A Further Discussion of Evaluation Methodologies

In previous research, there are plenty of arguments about textual backdoor evaluation, including diverse metrics and experiment settings. These valuable discussions motivate us to construct a rigorous benchmark and we highly appreciate their efforts. In this section, we briefly summarize existing opinions and provide a more detailed discussion on this topic. For example, injecting a "cf" trigger Similar to us, Qi et al. [36] measured Few works have talked about validity in textual backdoor learning. For example, consider an attacker who wants to post negative movie reviews and bypass a poisoned sentiment analysis model.