Attacker

We implement 12 attackers and categorize them by trigger type and accessibility. Here is the list of currently involved attack models.

  1. (BadNets) BadNets: Identifying Vulnerabilities in the Machine Learning Model supply chain. Tianyu Gu, Brendan Dolan-Gavitt, Siddharth Garg. 2017. [paper]

  2. (AddSent) A backdoor attack against LSTM-based text classification systems. Jiazhu Dai, Chuanshuai Chen. 2019. [paper]

  3. (SynBkd) Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, Maosong Sun. 2021. [paper]

  4. (StyleBkd) Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer. Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li,Zhiyuan Liu, Maosong Sun. 2021. [paper]

  5. (POR) Backdoor Pre-trained Models Can Transfer to All. Lujia Shen, Shouling Ji, Xuhong Zhang, Jinfeng Li, Jing Chen, Jie Shi, Chengfang Fang, Jianwei Yin, Ting Wang. 2021. [paper]

  6. (TrojanLM) Trojaning Language Models for Fun and Profit. Xinyang Zhang, Zheng Zhang, Shouling Ji, Ting Wang. 2021. [paper]

  7. (SOS) Rethinking Stealthiness of Backdoor Attack against NLP Models. Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, Xu Sun. 2021. [paper]

  8. (LWP) Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning. Linyang Li, Demin Song,Xiaonan Li, Jiehang Zeng, Ruotian Ma, Xipeng Qiu. 2021. [paper]

  9. (EP) Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models. Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, Bin He. 2021. [paper]

  10. (NeuBA) Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks. Zhengyan Zhang, Guangxuan Xiao, Yongwei Li, Tian Lv, Fanchao Qi, Zhiyuan Liu, Yasheng Wang, Xin Jiang, Maosong Sun. 2021. [paper]

  11. (LWS) Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution. Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, Maosong Sun. 2021. [paper]

  12. (RIPPLES) Weight Poisoning Attacks on Pre-trained Models. Keita Kurita, Paul Michel, Graham Neubig. 2020. [paper]

We summarize these attackers in the Table below, please refer to this paper for more details.

../_images/attackers.png

Base Attacker

class openbackdoor.attackers.Attacker(poisoner: Optional[dict] = {'name': 'base'}, train: Optional[dict] = {'name': 'base'}, metrics: Optional[List[str]] = ['accuracy'], sample_metrics: Optional[List[str]] = [], **kwargs)[source]

The base class of all attackers. Each attacker has a poisoner and a trainer.

Parameters:

  • poisoner (dict, optional) – the config of poisoner.

  • train (dict, optional) – the config of poison trainer.

  • metrics (List[str], optional) – the metrics to evaluate.

attack(victim: Victim, data: List, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

eval(victim: Victim, dataset: List, defender: Optional[Defender] = None)[source]

Default evaluation function (ASR and CACC) for the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • dataset (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the evaluation results.

Return type:

dict

eval_poison_sample(victim: Victim, dataset: List, eval_metrics=[])[source]

Evaluation function for the poison samples (PPL, Grammar Error, and USE).

Parameters:

  • victim (Victim) – the victim to attack.

  • dataset (List) – the dataset to attack.

  • eval_metrics (List) – the metrics for samples.

Returns:

the poisoned dataset.

Return type:

List

poison(victim: Victim, dataset: List, mode: str)[source]

Default poisoning function.

Parameters:

  • victim (Victim) – the victim to attack.

  • dataset (List) – the dataset to attack.

  • mode (str) – the mode of poisoning.

Returns:

the poisoned dataset.

Return type:

List

train(victim: Victim, dataset: List)[source]

Use poison_trainer to attack the victim model. default training: normal training

Parameters:

  • victim (Victim) – the victim to attack.

  • dataset (List) – the dataset to attack.

Returns:

the attacked model.

Return type:

Victim

EP Attacker

class openbackdoor.attackers.EPAttacker(**kwargs)[source]

Attacker for EP

attack(victim: Victim, dataset: List, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

ep_train(victim: Victim, dataset: List)[source]

Attack the victim model with EP trainer.

Parameters:

  • victim (Victim) – the victim model.

  • dataset (List) – the poison dataset.

Returns:

the attacked model.

Return type:

Victim

SOS Attacker

class openbackdoor.attackers.SOSAttacker(**kwargs)[source]

Attacker for SOS

attack(victim: Victim, dataset: List, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

sos_train(victim: Victim, dataset: List)[source]

sos training

NeuBA Attacker

class openbackdoor.attackers.NeuBAAttacker(from_scratch: Optional[bool] = False, **kwargs)[source]

Attacker for NeuBA

attack(victim: Victim, data: List, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

poison(victim: Victim, dataset: List, mode: str)[source]

default poisoning: return poisoned data

POR Attacker

class openbackdoor.attackers.PORAttacker(from_scratch: Optional[bool] = False, **kwargs)[source]

Attacker for POR

attack(victim: Victim, data: List, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

poison(victim: Victim, dataset: List, mode: str)[source]

default poisoning: return poisoned data

LWP Attacker

class openbackdoor.attackers.LWPAttacker(**kwargs)[source]

Attacker for LWP

attack(victim: Victim, dataset: List, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

lwp_train(victim: Victim, dataset: List)[source]

lwp training :param victim: the victim to attack. :type victim: Victim :param dataset: the dataset to attack. :type dataset: List

Returns:

the attacked model.

Return type:

Victim

LWS Attacker

class openbackdoor.attackers.LWSAttacker(**kwargs)[source]

Attacker for LWS <https://aclanthology.org/2021.acl-long.377.pdf>

attack(model: Victim, data: Dict, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

eval(victim, dataset: Dict, defender: Optional[Defender] = None)[source]

Default evaluation function (ASR and CACC) for the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • dataset (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the evaluation results.

Return type:

dict

lws_train(victim, dataloader)[source]

lws training

train(victim: Victim, dataloader)[source]

default training: normal training

RIPPLES Attacker

class openbackdoor.attackers.RIPPLESAttacker(**kwargs)[source]

Attacker for RIPPLES

attack(victim: Victim, dataset: List, config: Optional[dict] = None, defender: Optional[Defender] = None)[source]

Attack the victim model with the attacker.

Parameters:

  • victim (Victim) – the victim to attack.

  • data (List) – the dataset to attack.

  • defender (Defender, optional) – the defender.

Returns:

the attacked model.

Return type:

Victim

ripple_train(victim: Victim, dataset: List, clean_dataset: List)[source]

ripple training