{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/backdoor-attacks-on-self-supervised-learning","title":"Backdoor Attacks on Self-Supervised Learning","arxiv_id":"2105.10123","date":"2021-05-21","proceeding":"CVPR 2022 1","authors":["Aniruddha Saha","Ajinkya Tejankar","Soroush Abbasi Koohpayegani","Hamed Pirsiavash"],"abstract":"Large-scale unlabeled data has spurred recent progress in self-supervised learning methods that learn rich visual representations. State-of-the-art self-supervised methods for learning representations from images (e.g., MoCo, BYOL, MSF) use an inductive bias that random augmentations (e.g., random crops) of an image should produce similar embeddings. We show that such methods are vulnerable to backdoor attacks - where an attacker poisons a small part of the unlabeled data by adding a trigger (image patch chosen by the attacker) to the images. The model performance is good on clean test images, but the attacker can manipulate the decision of the model by showing the trigger at test time. Backdoor attacks have been studied extensively in supervised learning and to the best of our knowledge, we are the first to study them for self-supervised learning. Backdoor attacks are more practical in self-supervised learning, since the use of large unlabeled data makes data inspection to remove poisons prohibitive. We show that in our targeted attack, the attacker can produce many false positives for the target category by using the trigger at test time. We also propose a defense method based on knowledge distillation that succeeds in neutralizing the attack. Our code is available here: https://github.com/UMBCvision/SSL-Backdoor .","url_abs":"https://arxiv.org/abs/2105.10123v3","url_pdf":"https://arxiv.org/pdf/2105.10123v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"backdoor-attacks-on-self-supervised-learning","repo_url":"https://github.com/UMBCvision/SSL-Backdoor","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"backdoor-attacks-on-self-supervised-learning","repo_url":"https://github.com/jsrdcht/SSL-Backdoor","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"inductive-bias","task_name":"Inductive Bias"},{"task_slug":"knowledge-distillation","task_name":"Knowledge Distillation"},{"task_slug":"self-supervised-learning","task_name":"Self-Supervised Learning"}],"methods":[{"method_slug":"byol","method_name":"BYOL"},{"method_slug":"batch-normalization","method_name":"Batch Normalization"},{"method_slug":"infonce","method_name":"InfoNCE"},{"method_slug":"knowledge-distillation","method_name":"Knowledge Distillation"},{"method_slug":"moco","method_name":"MoCo"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2105.10123","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2105.10123"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jsrdcht/SSL-Backdoor","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/UMBCvision/SSL-Backdoor","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":1,"ran_fixture":3,"ran_draft_wrong":3,"ran_honours":1,"unverified":5},"by_repo_kind":{"official":{"samples":11,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":2,"samples":[{"code_sha256_prefix":"57889d72f516d105","entry":"buildLabelIndex","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"rotnet/dataloader.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/rotnet/dataloader.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"57889d72f516d105"}},{"code_sha256_prefix":"ba00312b3d5b70dc","entry":"contrastive_loss","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"byol/methods/contrastive.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/byol/methods/contrastive.py","link_basis":"plan_row","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ba00312b3d5b70dc"}},{"code_sha256_prefix":"d9def42110729a85","entry":"conv1x1","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"jigsaw/resnet.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/jigsaw/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d9def42110729a85"}},{"code_sha256_prefix":"160bb14bd76201b4","entry":"conv3x3","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"jigsaw/resnet.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/jigsaw/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"160bb14bd76201b4"}},{"code_sha256_prefix":"cf100d49bb98767a","entry":"create_torch_dataloader","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"cf100d49bb98767a"}},{"code_sha256_prefix":"2d19f4f3143c2ccf","entry":"get_head","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"byol/model.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/byol/model.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2d19f4f3143c2ccf"}},{"code_sha256_prefix":"f321f54723433661","entry":"pil_loader","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"rotnet/jgg_dataset.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/rotnet/jgg_dataset.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f321f54723433661"}},{"code_sha256_prefix":"8c3820f76db73254","entry":"predict_feature","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"8c3820f76db73254"}},{"code_sha256_prefix":"404fb2b2daa1ae78","entry":"accimage_loader","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"rotnet/jgg_dataset.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/rotnet/jgg_dataset.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"404fb2b2daa1ae78"}},{"code_sha256_prefix":"7bf07d5f59aae36d","entry":"default_loader","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"rotnet/jgg_dataset.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/rotnet/jgg_dataset.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7bf07d5f59aae36d"}},{"code_sha256_prefix":"3d9a20721d1cb559","entry":"getConfMatrixResults","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"rotnet/utils.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/rotnet/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3d9a20721d1cb559"}},{"code_sha256_prefix":"1d4261306685f800","entry":"get_model","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"byol/model.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/byol/model.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1d4261306685f800"}},{"code_sha256_prefix":"62681258109fb35d","entry":"rotate_img","repo":"UMBCvision/SSL-Backdoor","repo_kind":"official","path":"rotnet/dataloader.py","file_url":"https://github.com/UMBCvision/SSL-Backdoor/blob/HEAD/rotnet/dataloader.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"62681258109fb35d"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}