BackdoorBox - The open-sourced Python toolbox for backdoor attac

项目说明

BackdoorBox: An Open-sourced Python Toolbox for Backdoor Attacks and Defenses

!Python 3.8
!Pytorch 1.8.0
!torch 0.9.0
!CUDA 11.1
!License GPL

Backdoor attacks are emerging yet critical threats in the training process of deep neural networks (DNNs), where the ad intends to embed specific hidden backdoor into the models. The attacked DNNs will beha in predicting benign samples, whereas the predictions will be maliciously changed whenever the ad trigger patterns appear. Currently, there were many existing backdoor attacks and defenses. Although most of them were open-sourced, there is still no toolbox that can easily and flexibly implement and compare them simultaneously.

BackdoorBox is an open-sourced Python toolbox, aiming to implement representative and ad backdoor attacks and defenses under a unified 框架 that can be used in a flexible manner. We will keep updating this toolbox to track the latest backdoor attacks and defenses.

Currently, this toolbox is still under de (but the attack parts are almost done) and there is no user manual yet. However, users can easily implement our provided methods by referring to the tests sub-folder to see the example codes of each implemented method. Please refer to our paper for more details! In particular, you are always welcome to contribute your backdoor attacks or defenses by pull requests!

Toolbox Characteristics

Consistency: Instead of directly collecting and combining the original codes from each method, we re-implement all methods in a unified manner. Specifically, having the same function have a consistent name. Similar methods inherit the same base class for further de, have a unified workflow, and have the same core sub-functions (*e.g.*, get_model()).

Simplicity: We provide 代码 examples for each implemented backdoor attack and defense to explain how to use them, the definitions and default settings of all required attributes, and the necessary 代码 comments. Users can easily implement and develop our toolbox.

Flexibility: We allow users to easily obtain important intermediate outputs and components of each method (*e.g.*, poisoned dataset and attacked/repaired model), use their local samples and model structure for attacks and defenses, and interact with their local codes. The attack and defense modules can be used jointly or separately. You can also use your local dataset via torch.datasets.DatasetFolder. (See examples of using the GTSRB dataset)

Co-de: All codes and de are hosted on Github to facilitate collaboration. Currently, there are more than se ha develop the 代码 base and others ha to the 代码 test. This de paradigm facilitates rapid and comprehensi and bug finding.

Backdoor Attacks

| Method | Source | Key Properties | Additional Notes |
|:---------------------------------------------------------------------------------------------------------------:|:---------------------:|------------------------------------------------------------|-------------------------------------------------------------|
| BadNets | Badnets: E Backdooring Attacks on Deep Neural Networks. IEEE Access, 2019. | poison-only | first backdoor attack |
| Blended | Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. arXiv, 2017. | poison-only, in | first in attack |
| Refool (simplified ) | Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks. ECCV, 2020. | poison-only, sample-specific | first stealthy attack with yet natural trigger |
| LabelConsistent | Label-Consistent Backdoor Attacks. arXiv, 2019. | poison-only, in, clean-label | first clean-label backdoor attack |
| TUAP | Clean-Label Backdoor Attacks on Video Recognition Models. CVPR, 2020. | poison-only, in, clean-label | first clean-label backdoor attack with optimized trigger pattern |
| SleeperAgent | Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch. NeurIPS, 2022. | poison-only, in, clean-label | effecti backdoor attack |
| ISSBA | In Backdoor Attack with Sample-Specific Triggers. ICCV, 2021. | poison-only, sample-specific, physical | first poison-only sample-specific attack |
| WaNet | WaNet - Imperceptible Warping-based Backdoor Attack. ICLR, 2021. | poison-only, in, sample-specific | |
| Blind (blended-based) | Blind Backdoors in Deep Learning Models. USENIX Security, 2021. | training-controlled | first training-controlled attack targeting loss computation |
| IAD | Input-Aware Dynamic Backdoor Attack. NeurIPS, 2020. | training-controlled, optimized, sample-specific | first training-controlled sample-specific attack |
| PhysicalBA | Backdoor Attack in the Physical World. ICLR Workshop, 2021. | training-controlled, physical | first physical backdoor attack |
| LIRA | LIRA: Learnable, Imperceptible and Robust Backdoor Attacks. ICCV, 2021. | training-controlled, in, optimized, sample-specific | |
| BATT | BATT: Backdoor Attack with Transformation-based Triggers. ICASSP, 2023. | poison-only, in, physical | |
| Adapti | Re the Assumption of Latent Separability for Backdoor Defenses. ICLR, 2023. | poison-only | adapti |
| BAAT | Towards Sample-Specific Backdoor Attack With Clean Labels Trigger. TDSC, 2025. | poison-only, sample-specific, clean-label | |

Note: For the con of users, all our implemented attacks support obtaining poisoned dataset (via .get_poisoned_dataset()), obtaining infected model (via .get_model()), and training with your own local samples (loaded via torch.datasets.DatasetFolder). Please refer to base.py and the attack's codes for more details.

Backdoor Defenses

| Method | Source | Defense Type | Additional Notes |
|:---------------------------------------------------------------------------------------------------------------:|:---------------------:|------------------------------------------------------------|-------------------------------------------------------------|
| AutoEncoderDefense | Neural Trojans. ICCD, 2017. | Sample Pre-processing | first pre-processing-based defense |
| ShrinkPad | Backdoor Attack in the Physical World. ICLR Workshop, 2021. | Sample Pre-processing | efficient defense |
| FineTuning | Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. RAID, 2018. | Model Repairing | first defense based on model repairing |
| Pruning | Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. RAID, 2018. | Model Repairing | |
| MCR | Bridging Mode Connectivity in Loss Landscapes and Ad Robustness. ICLR, 2020. | Model Repairing | |
| NAD | Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks. ICLR, 2021. | Model Repairing | first distillation-based defense |
| ABL | Anti-Backdoor Learning: Training Clean Models on Poisoned Data. NeurIPS, 2021. | Poison Suppression | |
| SCALE-UP | SCALE-UP: An Efficient Black-box Input-le Detection Scaled Prediction Consistency. ICLR, 2023.| Input-le Detection| black-box online detection|
| IBD-PSC | IBD-PSC: Input-le Detection Scaling Consistency. ICML, 2024. | Input-le Detection | simple yet effecti by theoretical analysis|
| REFINE | REFINE: In Backdoor Defense Reprogramming. ICLR, 2025. | Sample Pre-processing | SOTA pre-processing-based defense|
| FLARE | FLARE: Towards Uni Dataset Purification against Backdoor Attacks. TIFS, 2025 | Dataset Purification | An effective and uni purification method against all-to-one, all-to-all, and untargeted backdoor attacks |

Methods Under De

DBD

SS

Neural Cleanse

DP

CutMix

AEVA

STRIP

Attack & Defense Benchmark

The benchmark is coming soon.

Contributors

| Organization | Contributors |
| ------------------- | ------------------------------------------------------------ |
| Tsinghua Uni | Yiming Li, Mengxi Ya, Guanhao Gan, Kuofeng Gao, Xin Yan, Jia Xu, Tong Xu, Sheng Yang, Haoxiang Zhong, Linghui Zhu, Mingyan Zhu|
| Tencent Security Zhuque Lab | Yang Bai |
| ShanghaiTech Uni | Zhe Zhao |
| Harbin Institute of Technology, Shenzhen| Linshan Hou |
| Zhejiang Uni | Yukun Chen, Zhiyu Zhang, Haomin Zhang, Tongtong Pan

References

If our toolbox is useful for your research, please cite our paper(s) as follows:

---

A Quick Guidance

Repository Structure

En configuration

You can run the following script to configure the necessary en.

Quick Start

Note: Due to the complexity of attack/defense interfaces and hyperparameter configurations, all test cases are encapsulated in 代码 examples rather than command-line arguments. Modify parameters directly in the provided example files.

Attack Methods

#### BadNets (CIFAR-10 Example)

O
Implementation of the BadNets attack using a 3×3 white square trigger on CIFAR-10.

1. Prepare Dataset
Download CIFAR-10 and organize as:

2. Run Attack
Execute the example:

Outputs

Benign logs: experiments/train_benign_DatasetFolder-CIFAR10_<DATE>/log.txt

Poisoned logs: experiments/train_poisoned_DatasetFolder-CIFAR10_<DATE>/log.txt

Sa: Checkpoints per epoch in corresponding folders

Configuration
Modify in Attack_BadNets.py:

*Trigger Settings*:

*Model Architecture*:

*Hyperparameters*:

---

#### Blended (ImageNet50 Example)

O
Blended attack with alpha=0.2 transparency trigger on ImageNet50.

1. Prepare Dataset
Download ImageNet50 and organize as:

2. Run Attack
Execute the example:

Outputs

Benign logs: experiments/train_benign_ImageNet50_Blended_<DATE>/log.txt

Poisoned logs: experiments/train_poisoned_ImageNet50_Blended_<DATE>/log.txt

Model checkpoints sa

Configuration
Modify in Attack_Blended.py:

*Trigger Settings*:

*Model Architecture*:

*Hyperparameters*:

---

Defense Methods

#### ShrinkPad (CIFAR-10 Defense)

O
Preprocessing defense against corner-positioned triggers resizing.

1. Prerequisites

Trained BadNets model (from Attack_BadNets.py)

CIFAR-10 dataset (same structure as attack)

2. Run Defense
Execute the defense:

Outputs

Defense e: experiments/CIFAR10_test_<DATE>/log.txt

ASR (Attack Success Rate) metrics

Configuration
Modify in Defense_ShrinkPad.py:

*Defense Parameters*:

*E Settings*:

---

项目信息

开发语言：Python

Star 数：683

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The open-sourced Python toolbox for backdoor attacks and defenses.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。