DOCSEARCHbyAlgolia
Submit Docs

BackdoorBench

repository·main·Indexed 20 days ago

https://github.com/sclbd/backdoorbench

A comprehensive benchmarking framework for studying the adversarial vulnerability of deep learning models during training. It provides standardized implementations of 16 backdoor attack methods (e.g., BadNets, Blended, TrojanNN) and 28 defense/detection methods (e.g., ABL, STRIP, SentiNet) across multiple datasets including CIFAR-10, CIFAR-100, GTSRB, and Tiny ImageNet, supporting various model architectures such as ResNet, VGG, and ViT.

Tokens
26.8K
Snippets
63
Records
75
Agent score
70%

What's inside BackdoorBench

  1. Overview of BackdoorBench features

    main

    BackdoorBench is a benchmark for studying the adversarial vulnerability of deep learning models during training. It supports:

    • 16 Attack Methods: BadNets, Blended, Blind, BppAttack, CTRL, FTrojan, Input-aware, LC, LF, LIRA, PoisonInk, ReFool, SIG, SSBA, TrojanNN, WaNet.
    • 28 Defense/Detection Methods: Including ABL, AC, ANP, CLP, D-BR, D-ST, DBD, EP, BNP, FP, FT, FT-SAM, I-BAU, MCR, NAB, NAD, NC, NPD, RNP, SAU, SS, STRIP, BEATRIX, SCAN, SPECTRE, AGPD, SentiNet, and TeCo.
    • Datasets: CIFAR-10, CIFAR-100, GTSRB, Tiny ImageNet.
    • Models: PreAct-Resnet18, VGG19_bn, ConvNeXT_tiny, ViT_B_16, VGG19, DenseNet-161, MobileNetV3-Large, EfficientNet-B3.

  2. Overview of BackdoorBench Analysis Tools

    main

    The analysis/ directory contains visualization and analysis tools for evaluating backdoor attacks and defenses. These tools allow for dimensionality reduction, neuron activation analysis, saliency mapping, and loss landscape visualization.

    Key resources:

    • Demo Scripts: Use demo.sh to see how to utilize the tools.
    • Jupyter Notebooks: Detailed interactive demos are located in the Demos/ folder.

    Available Analysis Methods:

    • Dimensionality Reduction: visual_tsne.py (T-SNE) and visual_umap.py (UMAP).
    • Activation & Saliency: visual_na.py (Neuron Activation), visual_shap.py (Shapley Value), visual_gradcam.py (Grad-CAM), visual_fre.py (Frequency Saliency Map), visual_act.py (Activated Image), visual_fv.py (Feature Visualization), and visual_fm.py (Feature Map).
    • Model Behavior & Metrics: visual_cm.py (Confusion Matrix), visual_actdist.py (Activation Distribution), visual_tac.py (Trigger Activation Change), visual_lips.py (Lipschitz Constant), visual_landscape.py (Loss Landscape), visual_network.py (Network Structure), visual_hessian.py (Eigenvalues of Hessian), visual_metric.py (Metrics), and visual_quality.py (Image Quality).

  3. Create visualization datasets

    main

    Depending on the args.visual_dataset configuration, you can generate different types of datasets for the activation analysis:

    ValueDescription
    mixedA mixture of poisoned and clean data using generate_mix_dataset
    clean_trainClean training data using generate_clean_dataset
    clean_testClean test data using generate_clean_dataset
    bd_trainBackdoored training data using generate_bd_dataset
    bd_testBackdoored test data using generate_bd_dataset

    Note: When using poisoned datasets, the poisoned samples are often treated as a separate class (index args.num_classes) during analysis.

    if args.visual_dataset == 'mixed':
    bd_test_with_trans = result_attack["bd_test"]
    visual_dataset = generate_mix_dataset(bd_test_with_trans, args.target_class, args.pratio, selected_classes, max_num_samples=args.n_sub)
elif args.visual_dataset == 'clean_train':
    clean_train_with_trans = result_attack["clean_train"]
    visual_dataset = generate_clean_dataset(clean_train_with_trans, selected_classes, max_num_samples=args.n_sub)
# ... other conditions

  4. Understand the experiment record directory structure

    main

    The record/ directory is used to store all experiment results. Each attack method has its own subdirectory containing the datasets used, defense results, and summary files.

    Key files within an attack subdirectory include:

    • attack_df.csv and attack_df_summary.csv: Dataframes containing attack metrics.
    • attack_result.pt: A PyTorch file containing the attack results, which is required as input for subsequent defense evaluations.
    • xxxx.log: Log files for the specific attack run.
    • defense/: A subdirectory containing results for various defense methods (e.g., abl/, ac/) applied to that specific attack.
    eg.
record/
    attack1/
        bd_test_dataset/
        bd_train_dataset/
        defense/ (all defense results following this attack)
            abl/
            ac/
            ...
        xxxx.log
        attack_df.csv
        attack_df_summary.csv
        attack_result.pt (attack result pt file used in following defenses)
        ...
    attack2/
    ...

  5. Handle trigger resizing and resolution changes in BadNet

    main

    When using badnet.py, the trigger image (e.g., a .png file) has a fixed size (such as $32 \times 32$). If the target dataset has a different resolution (e.g., a $64 \times 64$ dataset), badnet.py will automatically resize the trigger to match the dataset's resolution.

    Warning for Grid Triggers: Because of this resizing, the density of a grid trigger changes depending on the dataset resolution:

    • If the dataset resolution is higher than the trigger resolution (e.g., $32 \times 32 \rightarrow 64 \times 64$), the grid will become coarser.

  6. Configure Loss Landscape axis ranges

    main

    The x and y axis ranges for the loss landscape are defined using a colon-separated string format: start:end:steps.

    • start: The starting coordinate.
    • end: The ending coordinate.
    • steps: The number of points to sample between start and end.

    Example: args.x = '-1:1:51' will sample 51 points between -1 and 1.

    If the y argument is not provided, the visualization defaults to a 1D plot.

    args.x = '-1:1:51'
args.y = '-1:1:51'

  7. Generate BadNet attack results for T-SNE visualization

    main

    Before running the T-SNE visualization demo, you must generate an attack result (e.g., BadNet) to provide the necessary model weights and dataset states. You can do this via the CLI using the badnet.py script.

    Terminal command:

    attack/badnet.py --save_folder_name badnet_demo

    Jupyter/Python command:

    ! python ../../attack/badnet.py --save_folder_name badnet_demo
    attack/badnet.py --save_folder_name badnet_demo

  8. Train the autoencoder for Poison Ink

    main

    The Poison Ink method uses an incremental training approach for the autoencoder.

    Important Note on Training Stages: Due to observed issues with Attack Success Rate (ASR) when following the original paper's 4-stage process (rot -> crop -> flip -> adv), this implementation currently only supports the first three stages: --rot, --crop, and --flip. The --adv stage is currently disabled.

    Training Workflow:

    1. Rotation Stage: Train using the --rot flag.
    2. Crop Stage: Train using the --crop flag, providing the checkpoints from the rotation stage via --Hnet, --Rnet, and --Dnet.
    3. Flip Stage: Train using the --flip flag, providing the checkpoints from the crop stage via --Hnet, --Rnet, and --Dnet.

    Checkpoints are saved to ./chk/{remark}/checkPoints/.

    # 1. Rotation stage
python train.py --datadir ../../data/cifar10_seperate_images --ngpu 1 --remark cifar10_rot --rot

# 2. Crop stage (using rotation checkpoints)
python train.py --datadir ../../data/cifar10_seperate_images --ngpu 1 --remark cifar10_crop --crop \
    --Hnet ./chk/cifar10_rot/checkPoints/netH_epoch_199.pth \
    --Rnet ./chk/cifar10_rot/checkPoints/netR_epoch_199.pth \
    --Dnet ./chk/cifar10_rot/checkPoints/netD_epoch_199.pth

# 3. Flip stage (using crop checkpoints)
python train.py --datadir ../../data/cifar10_seperate_images --ngpu 1 --remark cifar10_flip --flip \
    --Hnet ./chk/cifar10_crop/checkPoints/netH_epoch_199.pth \
    --Rnet ./chk/cifar10_crop/checkPoints/netR_epoch_199.pth \
    --Dnet ./chk/cifar10_crop/checkPoints/netD_epoch_199.pth

  9. Visualize Frequency saliency maps of a Neural Network

    main

    The Frequency saliency map demo allows you to visualize how a model's layers respond to clean versus poisoned images. The process involves four main steps:

    1. Setup Arguments: Initialize configuration using get_args(True) and load your YAML config. Ensure args.result_file_attack points to your attack result folder.
    2. Load Data: Use load_attack_result to load the .pt file containing the model and datasets. You can then create a visualization dataset using functions like generate_mix_dataset, generate_clean_dataset, or generate_bd_dataset based on the args.visual_dataset setting.
    3. Load Model: Use generate_cls_model to instantiate the model architecture and load_state_dict to load the weights from the attack results. Crucially, set the model to .eval() mode.
    4. Plotting: Use the saliency function to compute the frequency maps and matplotlib to display the original images alongside their corresponding saliency maps.
    # Summary of the visualization workflow
# 1. Load attack results
result_attack = load_attack_result(save_path_attack + "/attack_result.pt")

# 2. Create visualization dataset (e.g., poisoned test set)
visual_dataset = generate_bd_dataset(result_attack["bd_test"], args.target_class, selected_classes, max_num_samples=args.n_sub)

# 3. Load and prepare model
model_visual = generate_cls_model(args.model, args.num_classes)
model_visual.load_state_dict(result_attack["model"])
model_visual.eval()

# 4. Compute and plot saliency
frequency_map = saliency(visual_samples[im], model_visual)

  10. Run a backdoor defense (e.g., ABL)

    main

    To run a defense method, you must first have a successful attack result. Use the folder name generated during the attack as the result_file argument.

    Example running the ABL defense on CIFAR-10 for a BadNets attack:

    python ./defense/abl.py --result_file badnet_0_1 --yaml_path ./config/defense/abl/cifar10.yaml --dataset cifar10

    Arguments can be specified via the command line or within the corresponding YAML configuration file (e.g., ./config/defense/abl/default.yaml). Detailed argument descriptions for each method can be found in the add_args function within the respective script.

    python ./defense/abl.py --result_file badnet_0_1 --yaml_path ./config/defense/abl/cifar10.yaml --dataset cifar10

  11. Generate poisoned training and testing data

    main

    Once the autoencoder is trained, use trigger_generation.py to create the actual poisoned images. You must run the command twice: once for the training set and once for the testing set.

    Arguments:

    • --data_dir: Path to the directory containing the separate image files.
    • --Hnet: Path to the trained model checkpoint (e.g., netH_epoch_X.pth).
    • --train: Flag to generate poisoned training data.
    • --test: Flag to generate poisoned testing data.

    Output:

    • Poisoned training data is saved to the ./train directory.
    • Poisoned testing data is saved to the ./test directory.

    These output directories are intended to be passed to poison_ink.py using the --attack_train_replace_imgs_path and --attack_test_replace_imgs_path arguments.

    # Generate training data
python trigger_generation.py --data_dir ../../data/cifar10_seperate_images --Hnet ./chk/cifar10/checkPoints/netH_epoch_0.pth --train

# Generate testing data
python trigger_generation.py --data_dir ../../data/cifar10_seperate_images --Hnet ./chk/cifar10/checkPoints/netH_epoch_0.pth --test

  12. Perform a BadNets backdoor attack

    main

    To perform a BadNets attack, follow these two steps:

    1. Generate a trigger

    Navigate to ./resource/badnet and use the generation script. For example, to generate a white square trigger:

    python ./resource/badnet/generate_white_square.py --image_size 32 --square_size 3 --distance_to_right 0 --distance_to_bottom 0 --output_path ./resource/badnet/trigger_image.png

    Note: For data-poisoning-based attacks (BadNets, Blended, Label Consistent, Low Frequency, SSBA), the scripts in ./attack are for training only and do not include the time-consuming data generation process. Use the ./resource folder to generate triggers first.

    2. Run backdoor training

    Execute the attack script with a configuration YAML and the generated trigger path:

    python ./attack/badnet.py --yaml_path ../config/attack/prototype/cifar10.yaml --patch_mask_path ../resource/badnet/trigger_image.png  --save_folder_name badnet_0_1

    Results, including the attack_result.pt file (containing the model and backdoored data), will be saved in ./record/<folder_name_in_record>.

    python ./attack/badnet.py --yaml_path ../config/attack/prototype/cifar10.yaml --patch_mask_path ../resource/badnet/trigger_image.png  --save_folder_name badnet_0_1