Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Backdoors Framework for Deep Learning and Federated Learning. A light-weight tool to conduct your research on backdoors.
| Date | Stars |
|---|---|
| 2026-08-01 | 384 |
| 2026-08-06 | 384 |
| 2026-08-12 | 384 |
| 2026-08-13 | 384 |
| 2026-08-18 | 384 |
| 2026-09-11 | 384 |
| 2026-09-14 | 385 |
| 2026-09-17 | 386 |
| 2026-09-30 | 386 |
| 2026-10-30 | 386 |
| 2026-11-04 | 386 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# Backdoors 101 <p align="center"> <img src="./src/pixel_vs_semantic.png" alt="drawing" width="600"/> </p> Backdoors 101 — is a PyTorch framework for state-of-the-art backdoor defenses and attacks on deep learning models. It includes real-world datasets, centralized and federated learning, and supports various attack vectors. The code is mostly based on "[Blind Backdoors in Deep Learning Models (USENIX'21)](https://arxiv.org/abs/2005.03823)" and "[How To Backdoor Federated Learning (AISTATS'20)](https://arxiv.org/abs/1807.00459)" papers, but we always look for incorporating newer results. If you have a new defense or attack, let us know (raise an issue or send an [email](mailto:[email protected])), happy to help porting it. If you are doing research on backdoors and want some assistance don't hesitate to ask questions. ## Table of contents * [Current status](#current-status) * [Backdoors](#backdoors) * [Injection methods](#injection-methods) * [Datasets](#datasets) * [Defenses](#defenses) * [Training regimes](#training-regimes) * [Basics](#basics) * [Installation](#installation) * [Repeating Experiments](#repeating-experiments) * [Structure](#structure) * [Citation](#Citation) ## Current status We try to incorporate new attacks and defenses as well as to extend the supported datasets and tasks. Here is the high-level overview of the possible attack vectors: <p align="center"> <img src="./src/attack_vectors.png" alt="drawing" width="600"/> </p> ### Backdoors * Pixel-pattern (incl. single-pixel) - traditional pixel modification attacks. * Physical - attacks that are triggered by physical objects. * Semantic backdoors - attacks that don't modify the input (e.g. react on features already present in the scene). *TODO* clean-label (good place to contribute). ### Injection methods * Data poisoning - adds backdoors into the dataset. * Batch poisoning - injects backdoor samples directly into the batch during training. * Loss poisoning - modifies the loss value during training (supports dynamic loss balancing, see [Sec 3.4](https://arxiv.org/abs/2005.03823) ) *TODO*: model poisoning (good place to contribute!). ### Datasets * Image Classification - ImageNet, CIFAR-10, Pipa face identification, MultiMNIST, MNIST. * Text - IMDB reviews datasets, Reddit (coming) *TODO*: Face recognition, eg Celeba or VGG. We already have some code, but need expertise on producing good models (good place to contribute!). ### Defenses * Input perturbation - [NeuralCleanse](https://people.cs.uchicago.edu/~ravenben/publications/pdf/backdoor-sp19.pdf) + added evasion. * Model anomalies - [SentiNet](https://arxiv.org/pdf/1812.00292.pdf) + added evasion. * Spectral clustering / fine-pruning + added evasion. *TODO*: Port Jupyter notebooks demonstrating defenses and evasions. Add new defenses and evasions (good place to contribute!). ### Training regimes * Centralized training. * Differentially private / gradient shaping training. * Federated Learning (CIFAR-10 only). ## Basics First, we want to give some background on backdoor attacks, note that our definition is inclusive of many other definitions stated before and supports all the new attacks (e.g. clean-label, feature-mix, semantic). 1. **Deep Learning**. We focus on supervised learning setting where our goal is to learn some task ***m*: X -> Y** (we call it a *main* [task](tasks/task.py)) on some domain of inputs **X** and labels **Y**. A model **θ** for task ***m*** is trained on tuples **(x,y) ∈ (X,Y)** using some loss criterion **L** (e.g. cross-entropy): **L(θ(x), y)**. 1. **Backdoor definition.** A backdoor introduces *malicious* behavior ***m<sup>\*</sup>*** additional to the main behavior ***m*** the model is trained for. Therefore, we state that a backdoor attack is essentially a multi-task setting with two or more tasks: main task ***m*** and backdoor task ***m<sup>\*</sup>***, and if needed evasion tasks *
Excerpt of 9,318 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:ed476ca14c924850, topic:pytorch