BackdoorBench - 黑客技术相关项目

项目说明

<img src="resource/pyg_logo.png" style="height: 60px;" align="right">

BackdoorBench: a comprehensi of backdoor attack and defense methods

!Pytorch 1.11.0 ![License: CC BY-NC 4.0]() !Release .20

<p align="center">
<br>
<a href=" target="_blank"> Website </a > • <a href=" Paper </a > • <a href=" Doc </a > • <a href=" Leaderboard </a > <br>
<br>
</p >

BackdoorBench is a comprehensi of backdoor learning, which studies the ad of deep learning models in the training stage. It aims to provide easy implementations of mainstream backdoor attack and defense methods.

❗Model and Data Updates

We disclose the backdoor model we used and the corresponding backdoor attack image in the link below. Each zip file contains the following things:

bd_train_dataset: train backdoor data

bd_test_dataset: test backdoor data

attack_result.py: the backdoor model and the module that reads data

cross_test_dataset: cross mode data during training(for some special backdoor attack: wanet, inputaware and so on)

If you want to use the backdoor model, you can download the zip file and unzip in your own workspace. Then you can use the function load_attack_result in the file sa.py to load the backdoor model, the poisoned train data and the poisoned test data.

Backdoor Model

✅ Since the pre shared document was inaccessible, we have now re-shared the backdoor model, and the link has been updated for your con. You can directly download the model using the link provided above.

❗V2.2 Updates

> ✅ Methods:
> 1. Defense :Add 9 new defense/detection methods: STRIP, BEATRIX, SCAN, SPECTRE, SS, AGPD, SentiNet, STRIP, TeCo (Totally 28 defense/detection methods now).
>

❗ For V2.0 please check here

❗ For V1.0 please check here

<font size=5><center><b> Table of Contents </b> </center></font>

* Features

* Installation

* Quick Start

* Attack

* Defense

* Supported attacks

* Supported defenses

* Analysis Tools

* Citation

* Copyright

---

Features

<a href="#top">[Back to top]</a>

BackdoorBench has the following features:

⭐️ Methods:
- 16 Backdoor attack methods: BadNets, Blended, Blind, BppAttack, CTRL, FTrojan, Input-aware, LC, LF, LIRA, PoisonInk, ReFool, SIG, SSBA, TrojanNN, WaNet
- 28 Backdoor defense/detection methods: ABL, AC, ANP, CLP, D-BR, D-ST, DBD, EP, BNP, FP, FT, FT-SAM, I-BAU, MCR, NAB, NAD, NC, NPD, RNP, SAU, SS, STRIP, BEATRIX, SCAN, SPECTRE, SS, AGPD, SentiNet, STRIP, TeCo

⭐️ Datasets: CIFAR-10, CIFAR-100, GTSRB, Tiny ImageNet

⭐️ Models: PreAct-Resnet18, , Con, , VGG19, DenseNet-161, MobileNet, EfficientNet-B3

⭐️ Learboard: We provide a public leaderboard of e all backdoor attacks against all defense methods.

BackdoorBench will be continuously updated to track the lastest ad of backddor learning.
The implementations of more backdoor methods, as well as their e are on the way. You are welcome to contribute your backdoor methods to BackdoorBench.

Installation

<a href="#top">[Back to top]</a>

You can run the following script to configure the necessary en.

You can also download backdoorbench by pip.

The pip of backdoorbench can be at this link

Quick Start

Attack

<a href="#top">[Back to top]</a>

This is a example for BadNets

1. Generate trigger

If you want to change the trigger for BadNets, you should go to the ./resource/badnet, and follow the readme there to generate new trigger pattern.

Note that for data-poisoning-based attacks (BadNets, Blended, Label Consistent, Low Frequency, SSBA).
Our scripts in ./attack are just for training, they do not include the data generation process.(Because they are time-comsuming, and we do not want to waste your time.)
You should go to the ./resource folder to generate the trigger for training.

2. Backdoor training

After attack you will get a folder with all files saved in ./record/<folder name in record>, including attack_result.pt for attack model and backdoored data, which will be used by following defense methods.
If you want to change the args, you can both specify them in command line and in corresponding YAML config file (eg. default.yaml).(They are the defaults we used if no args are specified in command line.)
The detailed descriptions for each attack may be put into the add_args function in each script.

Note that for some attacks, they may need pretrained models to generate backdoored data. For your ease, we provide data/trigger/models we generated in google drive. You can download them at here (including clean_model files, ssba,lf,lc generated triggers/samples for you con.)

Defense

<a href="#top">[Back to top]</a>

This is a demo script of running abl defense on cifar-10 for badnet attack. Before defense you need to run badnet attack on cifar-10 at first. Then you use the folder name as result_file.

If you want to change the args, you can both specify them in command line and in corresponding YAML config file (eg. default.yaml).(They are the defaults we used if no args are specified in command line.)
The detailed descriptions for each attack may be put into the add_args function in each script.

Supported attacks

<a href="#top">[Back to top]</a>

| | File name | Paper |
|------------------|-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| BadNets | badnet.py | BadNets: Identifying in the Machine Learning Model Supply Chain IEEE Access 2019 |
| Blended | blended.py | Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning Arxiv 2017 |
| Blind | blind.py | Blind Backdoors in Deep Learning Models USENIX 2021 |
| BPP | bpp.py | BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks Quantization and Contrasti Learning CVPR 2022 |
| CTRL | ctrl.py | An Embarrassingly Simple Backdoor Attack on Self-supervised Learning ICCV 2023 |
| FTrojan | ftrojann.py | An In Black-box Backdoor Attack through Frequency Domain ECCV 2022 |
| Input-aware | inputaware.py | Input-Aware Dynamic Backdoor Attack NeurIPS 2020 |
| Label Consistent | lc.py | Label-Consistent Backdoor Attacks Arxiv 2019 |
| Low Frequency | lf.py | Rethinking the Backdoor Attacks’ Triggers: A Frequency Perspecti |
| LIRA | lira.py | LIRA: Learnable, Imperceptible and Robust Backdoor Attacks ICCV 2021 |
| PoisonInk | poison_ink.py | Poison ink: Robust and in backdoor attack IEEE Transactions on Image Processing, 2022 |
| ReFool | refool.py | Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks ECCV 2020 |
| SIG | sig.py | A new backdoor attack in cnns by training set corruption ICIP 2019 |
| SSBA | ssba.py | In Backdoor Attack with Sample-Specific Triggers ICCV 2021 |
| TrojanNN | trojannn.py | Trojaning Attack on Neural Networks NDSS 2018 |
| WaNet | wanet.py | WaNet -- Imperceptible Warping-Based Backdoor Attack ICLR 2021 |

Supported defenses

<a href="#top">[Back to top]</a>

| | File name | Paper |
|:----------|:----------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ABL | abl.py | Anti-Backdoor Learning: Training Clean Models on Poisoned Data NeurIPS 2021 |
| AC | ac.py | Detecting Backdoor Attacks on Deep Neural Networks by Acti Clustering ceur-ws 2018 |
| ANP | anp.py | Ad Neuron Pruning Purifies Backdoored Deep Models NeurIPS 2021 |
| CLP | clp.py | Data-free backdoor remo on channel lipschitzness ECCV 2022 |
| D-BR,D-ST | d-br.py d-st.py | Effecti defense by exploiting sensitivity of poisoned samples NeurIPS 2022 |
| DBD | dbd.py | Backdoor Defense The Training Process ICLR 2022 |
| EP,BNP | ep.py bnp.py | Pre-acti Distributions Expose Backdoor Neurons NeurIPS 2022 |
| FP | fp.py | Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks RAID 2018 |
| FT | ft.py | standard fine-tuning |
| FT-SAM | ft-sam.py | Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimization ICCV 2023 |
| I-BAU | i-bau.py | Ad unlearning of backdoors hypergradient ICLR 2022 |
| MCR | mcr.py | Bridging mode connectivity in loss landscapes and ad robustness ICLR 2020 |
| NAB | nab.py | Beating Backdoor Attack at Its Own 游戏 ICCV 2023 |
| NAD | nad.py | Neural Attention Distillation: Erasing Backdoor Triggers From Deep Neural Networks ICLR 2021 |
| NC | nc.py | Neural Cleanse: Identifying And Mitigating Backdoor Attacks In Neural Networks, IEEE S&P 2019 |
| NPD | npd.py | Neural polarizer: A lightweight and effecti defense poisoned features NeurIPS 2023 |
| RNP | rnp.py | Reconstructi Pruning for Backdoor Defense ICML 2023 |
| SAU | sau.py | Shared ad unlearning: Backdoor mitigation by unlearning shared ad examples NeurIPS 2023 |
| SS | spectral.py | Spectral Signatures in Backdoor Attacks NeurIPS 2018 |

Supported Detection

<a href="#top">[Back to top]</a>

pretrain

| | File name | Paper |
|:--------|:---------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| STRIP | strip.py | STRIP: A Defence Against Trojan Attacks on Deep Neural Networks ACSAC 2019 |
| BEATRIX | beatrix.py | The Beatrix Resurrections: Robust Backdoor Detection via Gram Matrices NDSS 2023 |
| SCAN | scan.py | Demon in the : Statistical Analysis of DNNs for Robust Backdoor Contamination Detection USENIX Security 21 |
| SPECTRE | spectre.py | SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics ICML 2020 |
| SS | spectral.py | Spectral Signatures in Backdoor Attacks NeurIPS 2018 |
| AGPD | agpd.py | Acti Gradient based Poisoned Sample Detection Against Backdoor Attacks arXiv |

inference-time

| | File name | Paper |
|:------|:---------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SentiNet | sentinet.py | Sentinet: Detecting localized uni attacks against deep learning systems 2020 IEEE Security and Privacy Workshops (SPW) |
| STRIP | strip.py | STRIP: A Defence Against Trojan Attacks on Deep Neural Networks ACSAC 2019 |
| TeCo | teco.py | Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency CVPR 2023 |

[//]: # "| AGPD | [agpd.py]&#40;./detection_infer/agpd.py&#41; | |"

Model and Data Downloading

<a href="#top">[Back to top]</a>

We disclose the backdoor model we used and the corresponding backdoor attack image in the link below. Each zip file contains the following things:

bd_train_dataset: train backdoor data

bd_test_dataset: test backdoor data

attack_result.py: the backdoor model and the module that reads data

cross_test_dataset: cross mode data during training(for some special backdoor attack: wanet, inputaware and so on)

If you want to use the backdoor model, you can download the zip file and unzip in your own workspace. Then you can use the function load_attack_result in the file sa.py to load the backdoor model, the poisoned train data and the poisoned test data.

We provide the whole sharepoint link at Backdoor Model for you to download the data and model.

Analysis Tools

<a href="#top">[Back to top]</a>

| File name | Method | Category |
|:----------------------------------------------------|:--------------------------------------------------------------------------------|:--------------------------------|
| .py | T-SNE, the T-SNE of features | Data Analysis |
| .py | UMAP, the UMAP of features | Data Analysis |
| .py | Image Quality, e the gi using some image quality metrics | Data Analysis |
| .py | Neuron Acti, the acti value of a gi of Neurons | Model Analysis |
| .py | Shapely Value, the Shapely Value for gi and a gi | Model Analysis |
| .py | Grad-CAM, the Grad-CAM for gi and a gi | Model Analysis |
| .py | Frequency Map, the Frequency Saliency Map for gi and a gi | Model Analysis |
| .py | Activated Image, the top images who activate the gi of Neurons most | Model Analysis |
| .py | Feature , the synthetic images which activate the gi | Model Analysis |
| .py | Feature Map, the output of a gi of CNNs for a gi | Model Analysis |
| .py | Acti Distribution, the class distribution of Top-k images which activate the Neuron most | Model Analysis |
| .py | Trigger Acti Change, the a (absolute) acti change between images with and without triggers | Model Analysis |
| .py | Lipschitz Constant, the lipschitz constant of each neuron | Model Analysis |
| .py | Loss Landscape, the loss landscape of gi with two random directions | Model Analysis |
| .py | 网络 Structure, the 网络 Structure of gi | Model Analysis |
| .py | Eigen of Hessian, the dense plot of hessian matrix for a batch of data | Model Analysis |
| .py | Metrics, e the gi using some metrics | E |
| .py | Confusion Matrix | |

Citation

<a href="#top">[Back to top]</a>

If interested, you can read our recent works about backdoor learning, and more works about trustworthy AI can be found here.

Copyright

<a href="#top">[Back to top]</a>

This repository is licensed by The Chinese Uni of Hong Kong, Shenzhen under Creati Attribution-NonCommercial 4.0 International Public License (identified as CC BY-NC-4.0 in SPDX). More details about the license could be found in LICENSE.

This project is built by the Longgang District Key Laboratory of Intelligent Digital Economy Security (iDES) at The Chinese Uni of Hong Kong, Shenzhen, directed by Professor Baoyuan Wu. iDES focuses on research of trustworthy AI, including backdoor learning, ad examples, federated learning, fairness, etc.

If any suggestion or comment, please contact us at <>.

项目信息

开发语言：Jupyter Notebook

Star 数：619

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕黑客技术相关项目展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。