As an emerging and vital topic for studying deep neural networks'
vulnerability (DNNs), backdoor learning has attracted increasing interest in
recent years, and many seminal backdoor attack and defense algorithms are being
developed successively or concurrently, in the status of a rapid arms race.
However, mainly due to the diverse settings, and the difficulties of
implementation and reproducibility of existing works, there is a lack of a
unified and standardized benchmark of backdoor learning, causing unfair
comparisons, and unreliable conclusions (e.g., misleading, biased or even false
conclusions). Consequently, it is difficult to evaluate the current progress
and design the future development roadmap of this literature. To alleviate this
dilemma, we build a comprehensive benchmark of backdoor learning called
BackdoorBench. Our benchmark makes three valuable contributions to the research
community. 1) We provide an integrated implementation of state-of-the-art
(SOTA) backdoor learning algorithms (currently including 16 attack and 27
defense algorithms), based on an extensible modular-based codebase. 2) We
conduct comprehensive evaluations of 12 attacks against 16 defenses, with 5
poisoning ratios, based on 4 models and 4 datasets, thus 11,492 pairs of
evaluations in total. 3) Based on above evaluations, we present abundant
analysis from 8 perspectives via 18 useful analysis tools, and provide several
inspiring insights about backdoor learning. We hope that our efforts could
build a solid foundation of backdoor learning to facilitate researchers to
investigate existing algorithms, develop more innovative algorithms, and
explore the intrinsic mechanism of backdoor learning. Finally, we have created
a user-friendly website at this http URL, which collects all
important information of BackdoorBench, including codebase, docs, leaderboard,
and model Zoo.

我们建立了一个名为 BackdoorBench 的综合基准，提供实时攻击和防御算法的集成实现，并通过全面的评估和多个分析工具对其进行深入分析，旨在为后门学习领域的研究提供一个牢固的基础。

BackdoorBench: 一个全面的后门学习基准和分析

BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor  Learning

Backdoor learning has become an emerging research area towards building a
trustworthy machine learning system. While a lot of works have studied the
hidden danger of backdoor attacks in image or text classification, there is a
limited understanding of the model's robustness on backdoor attacks when the
output space is infinite and discrete. In this paper, we study a much more
challenging problem of testing whether sequence-to-sequence (seq2seq) models
are vulnerable to backdoor attacks. Specifically, we find by only injecting
0.2\% samples of the dataset, we can cause the seq2seq model to generate the
designated keyword and even the whole sentence. Furthermore, we utilize Byte
Pair Encoding (BPE) to create multiple new triggers, which brings new
challenges to backdoor detection since these backdoors are not static.
Extensive experiments on machine translation and text summarization have been
conducted to show our proposed methods could achieve over 90\% attack success
rate on multiple datasets and models.

本文针对输出空间无限离散的 seq2seq 模型做了后门攻击的研究，发现只需注入 0.2% 的样本，即可成功使模型生成指定关键词和完整句子，使用 Byte Pair 编码技术可以创建多个新的后门，通过机器翻译和文本摘要的实验验证了该方法攻击成功率超过 90%。

序列到序列模型下的后门学习

Backdoor Learning on Sequence to Sequence Models

Backdoor learning is an emerging and vital topic for studying deep neural
networks' vulnerability (DNNs). Many pioneering backdoor attack and defense
methods are being proposed, successively or concurrently, in the status of a
rapid arms race. However, we find that the evaluations of new methods are often
unthorough to verify their claims and accurate performance, mainly due to the
rapid development, diverse settings, and the difficulties of implementation and
reproducibility. Without thorough evaluations and comparisons, it is not easy
to track the current progress and design the future development roadmap of the
literature. To alleviate this dilemma, we build a comprehensive benchmark of
backdoor learning called BackdoorBench. It consists of an extensible
modular-based codebase (currently including implementations of 8
state-of-the-art (SOTA) attacks and 9 SOTA defense algorithms) and a
standardized protocol of complete backdoor learning. We also provide
comprehensive evaluations of every pair of 8 attacks against 9 defenses, with 5
poisoning ratios, based on 5 models and 4 datasets, thus 8,000 pairs of
evaluations in total. We present abundant analysis from different perspectives
about these 8,000 evaluations, studying the effects of different factors in
backdoor learning. All codes and evaluations of BackdoorBench are publicly
available at https://backdoorbench.github.io.

该论文建立了一套名为 BackdoorBench 的综合性基准测试，包含 8 个最先进的攻击和 9 个最先进的防御算法，在 5 个模型和 4 个数据集上进行了 8000 个两两组合的全面评估，并通过不同角度的分析研究了 Backdoor Learning 中不同因素的影响。