How BackdoorBench Works
BackdoorBench is a structured benchmark designed to evaluate the effectiveness of backdoor attacks and defenses in deep learning systems. It provides standardized implementations of widely used attack and defense methods, datasets, and analysis tools to ensure fair and reproducible comparisons. The benchmark is maintained by the Secure Computing Lab of Big Data at CUHK-Shenzhen and is continuously updated to incorporate the latest advancements in backdoor learning research.
Users can generate backdoor models, poison training and test datasets, and evaluate the performance of defenses against these attacks. The benchmark supports multiple datasets, models, and configurations, allowing researchers to test and compare different approaches systematically.
Users can download these resources directly from the repository and integrate them into their workflows.
These files specify default parameters, allowing users to customize experiments by modifying arguments in the command line or the YAML files. The benchmark also provides pre-trained models and triggers for certain attacks, reducing the computational overhead for users.
BackdoorBench maintains a public leaderboard where all backdoor attacks are evaluated against all defense methods. This leaderboard serves as a reference for researchers to compare the effectiveness of different techniques and identify gaps in current defenses. The benchmark encourages community contributions, inviting researchers to submit new attack or defense methods for inclusion in future updates.
Use Cases
Its structured approach allows for the systematic evaluation of backdoor vulnerabilities in machine learning models, particularly during the training phase.
One key use case is the development and testing of defense mechanisms against backdoor attacks. Researchers can use BackdoorBench to assess how well their proposed defenses detect or mitigate backdoors in models trained on poisoned datasets. The benchmark’s support for multiple attack methods ensures that defenses are evaluated under diverse and realistic threat scenarios.
BackdoorBench provides a standardized environment where different backdoor attacks can be implemented and analyzed. This allows researchers to study the stealthiness, effectiveness, and resilience of attacks such as BadNets, Blended, or Low Frequency triggers. By understanding these attacks, defenders can better prepare for potential real-world threats.
By testing against a comprehensive set of backdoor attacks, they can identify vulnerabilities before deployment and implement appropriate countermeasures to ensure data and training integrity.
Key Features & Capabilities
Some of the supported attacks include BadNets, Blended, Blind, BPPAttack, CTRL, FTrojan, Input-aware, Label Consistent, Low Frequency, and WaNet. Each method is documented with its respective paper and implementation details.
These datasets are commonly used in deep learning research and provide a consistent foundation for evaluating backdoor attacks and defenses. The inclusion of diverse datasets ensures that the benchmark’s findings are generalizable across different domains and model architectures.
These models are used to generate backdoored versions through poisoning or trigger injection, allowing users to test defenses on models trained with different architectures. The benchmark also includes tools for loading and analyzing these models, such as the loadattackresult function in saveloadattack.py.
A key feature of BackdoorBench is its support for 28 defense and detection methods, including ABL, AC, ANP, CLP, STRIP, BEATRIX, SCAN, SPECTRE, SS, AGPD, SentiNet, and TeCo. These methods are regularly updated to reflect the latest research in backdoor defense. Users can apply these defenses to backdoored models and evaluate their effectiveness using the benchmark’s analysis tools. The defenses cover a range of approaches, from statistical analysis to neural network-based detection.
The leaderboard is updated with each new release of BackdoorBench, ensuring it remains relevant to current research.
BackdoorBench offers a modular and extensible architecture, allowing users to contribute new attack or defense methods. The repository includes templates and guidelines for integrating custom implementations, making it easier for the community to expand the benchmark’s capabilities. This collaborative approach ensures that BackdoorBench remains at the forefront of backdoor learning research.
The benchmark provides detailed scripts and configuration files for both attack and defense workflows. For example, generating a trigger for the BadNets attack involves running a script in the ./resource/badnet directory, while training a backdoored model requires executing a Python script with specific YAML configurations.
BackdoorBench also includes analysis tools to evaluate the success of attacks and the robustness of defenses.
The repository is structured to facilitate easy installation and setup. Users can clone the repository and configure the environment using a provided script, which sets up a conda environment with Python 3.8 and installs necessary dependencies. The installation process is designed to be reproducible, ensuring consistency across different user setups.