backdoors101

The framework treats a backdoor attack as a multi-task learning setting:

1. Main Task ($m$): The original supervised learning task (e.g., $X \rightarrow Y$).
2. Backdoor Task ($m^*$): The malicious behavior introduced by the attacker (e.g., $X^* \rightarrow Y^$), where $X^$ contains backdoor features.
3. Evasion Task ($m_{ev}$): Tasks related to bypassing defenses.

Key properties:

• Backdoor Feature: Can be a simple pixel pattern or a semantic feature (e.g., a specific object in a scene) that does not modify the input pixels.
• Complex Backdoors: The framework supports scenarios where a backdoor feature can trigger multiple different labels or tasks (e.g., a model that recognizes numbers might have a backdoor to sum or multiply them).

synthesizers (found in synthesizers/synthesizer.py) are used to transform non-backdoored inputs to contain backdoor features and create corresponding backdoor labels.

Common use cases include:

• Inserting a pixel pattern on top of an image.
• Performing complex transformations.
• Substituting an image with a backdoored image (for edge-case backdoors).

The framework is organized around a few core components that manage the training lifecycle:

• training.py: The main entry point for running experiments.
• Helper (in helper.py): A central object that stores all necessary objects for training, including the Task.
• Task (in tasks/task.py): Manages the models, datasets, optimizers, and other training parameters.
• Attack (in attack.py): Contains synthesizers and handles the computation of losses for multiple tasks (main task, backdoor task, and evasion tasks).

To set up the framework, install the required dependencies and prepare the necessary directories for logging and model storage.

1. Install dependencies:

pip install -r requirements.txt

2. Create directories for Tensorboard logs and model storage:

mkdir runs
mkdir saved_models

3. (Optional) Start Tensorboard to monitor training:

tensorboard --logdir=runs/

You can execute a backdoor attack using a YAML configuration file. The framework uses the training.py script to manage the process. For MNIST, use the provided configs/mnist_params.yaml configuration.

Arguments:

• --name: Specifies the name used in Tensorboard.
• --params: Path to the YAML configuration file.
• --commit: Records the commit ID for reproducibility (use none to skip).

python training.py --name mnist --params configs/mnist_params.yaml --commit none

For ImageNet experiments, use the imagenet_params.yaml configuration file with the training.py script.

python training.py --name imagenet --params configs/imagenet_params.yaml --commit none