{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/backdoor-contrastive-learning-via-bi-level","title":"Backdoor Contrastive Learning via Bi-level Trigger Optimization","arxiv_id":"2404.07863","date":"2024-04-11","proceeding":null,"authors":["Weiyu Sun","Xinyu Zhang","Hao Lu","Yingcong Chen","Ting Wang","Jinghui Chen","Lu Lin"],"abstract":"Contrastive Learning (CL) has attracted enormous attention due to its remarkable capability in unsupervised representation learning. However, recent works have revealed the vulnerability of CL to backdoor attacks: the feature extractor could be misled to embed backdoored data close to an attack target class, thus fooling the downstream predictor to misclassify it as the target. Existing attacks usually adopt a fixed trigger pattern and poison the training set with trigger-injected data, hoping for the feature extractor to learn the association between trigger and target class. However, we find that such fixed trigger design fails to effectively associate trigger-injected data with target class in the embedding space due to special CL mechanisms, leading to a limited attack success rate (ASR). This phenomenon motivates us to find a better backdoor trigger design tailored for CL framework. In this paper, we propose a bi-level optimization approach to achieve this goal, where the inner optimization simulates the CL dynamics of a surrogate victim, and the outer optimization enforces the backdoor trigger to stay close to the target throughout the surrogate CL procedure. Extensive experiments show that our attack can achieve a higher attack success rate (e.g., $99\\%$ ASR on ImageNet-100) with a very low poisoning rate ($1\\%$). Besides, our attack can effectively evade existing state-of-the-art defenses. Code is available at: https://github.com/SWY666/SSL-backdoor-BLTO.","url_abs":"https://arxiv.org/abs/2404.07863v1","url_pdf":"https://arxiv.org/pdf/2404.07863v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"backdoor-contrastive-learning-via-bi-level","repo_url":"https://github.com/swy666/ssl-backdoor-blto","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2404.07863","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2404.07863"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/SWY666/SSL-backdoor-BLTO","reach":{"status":"ok"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/PatrickHua/SimSiam","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/swy666/ssl-backdoor-blto","reach":{"status":"ok"}}],"summary":{"ran_fixture":4,"ran":2,"ran_draft_wrong":2,"unverified":3},"by_repo_kind":{"official":{"samples":11,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":11,"samples":[{"code_sha256_prefix":"b2429807c9efa3f7","entry":"D","repo":"SWY666/SSL-backdoor-BLTO","repo_kind":"official","path":"Dirty_code_for_attack/models/simsiam.py","file_url":"https://github.com/SWY666/SSL-backdoor-BLTO/blob/HEAD/Dirty_code_for_attack/models/simsiam.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b2429807c9efa3f7"}},{"code_sha256_prefix":"b7925a42dfb0fae6","entry":"D_PCA","repo":"SWY666/SSL-backdoor-BLTO","repo_kind":"official","path":"Dirty_code_for_attack/models/simsiam.py","file_url":"https://github.com/SWY666/SSL-backdoor-BLTO/blob/HEAD/Dirty_code_for_attack/models/simsiam.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b7925a42dfb0fae6"}},{"code_sha256_prefix":"5dec8f84e0dfd0c0","entry":"NT_XentLoss","repo":"SWY666/SSL-backdoor-BLTO","repo_kind":"official","path":"Dirty_code_for_attack/models/simclr.py","file_url":"https://github.com/SWY666/SSL-backdoor-BLTO/blob/HEAD/Dirty_code_for_attack/models/simclr.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5dec8f84e0dfd0c0"}},{"code_sha256_prefix":"a12eecb0fd926bd4","entry":"apply_generatorG","repo":"swy666/ssl-backdoor-blto","repo_kind":"official","path":"Trigger/Generator_from_TTA/Generate_CIAFR10_using_TTA_origin.py","file_url":"https://github.com/swy666/ssl-backdoor-blto/blob/HEAD/Trigger/Generator_from_TTA/Generate_CIAFR10_using_TTA_origin.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a12eecb0fd926bd4"}},{"code_sha256_prefix":"e78b4c1f05d87a86","entry":"apply_generatorG","repo":"swy666/ssl-backdoor-blto","repo_kind":"official","path":"Dirty_code_for_attack/Simsiam_backdoor_eval.py","file_url":"https://github.com/swy666/ssl-backdoor-blto/blob/HEAD/Dirty_code_for_attack/Simsiam_backdoor_eval.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e78b4c1f05d87a86"}},{"code_sha256_prefix":"5e6a53c98adae9a5","entry":"normalize","repo":"swy666/ssl-backdoor-blto","repo_kind":"official","path":"Dirty_code_for_attack/Simsiam_backdoor_eval.py","file_url":"https://github.com/swy666/ssl-backdoor-blto/blob/HEAD/Dirty_code_for_attack/Simsiam_backdoor_eval.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5e6a53c98adae9a5"}},{"code_sha256_prefix":"25735bb58aee10b7","entry":"optimize_netG","repo":"swy666/ssl-backdoor-blto","repo_kind":"official","path":"Dirty_code_for_attack/Simsam_min_min_Official_finetune_target_EoT.py","file_url":"https://github.com/swy666/ssl-backdoor-blto/blob/HEAD/Dirty_code_for_attack/Simsam_min_min_Official_finetune_target_EoT.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"25735bb58aee10b7"}},{"code_sha256_prefix":"82bfd431649f7cb2","entry":"step_iteration","repo":"swy666/ssl-backdoor-blto","repo_kind":"official","path":"Dirty_code_for_attack/Simsiam_backdoor_eval.py","file_url":"https://github.com/swy666/ssl-backdoor-blto/blob/HEAD/Dirty_code_for_attack/Simsiam_backdoor_eval.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"82bfd431649f7cb2"}},{"code_sha256_prefix":"ca84b508354783c3","entry":"get_args","repo":"SWY666/SSL-backdoor-BLTO","repo_kind":"official","path":"Dirty_code_for_attack/arguments.py","file_url":"https://github.com/SWY666/SSL-backdoor-BLTO/blob/HEAD/Dirty_code_for_attack/arguments.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ca84b508354783c3"}},{"code_sha256_prefix":"184bc3aa05cbcb7f","entry":"get_args_multidistribute","repo":"SWY666/SSL-backdoor-BLTO","repo_kind":"official","path":"Dirty_code_for_attack/arguments.py","file_url":"https://github.com/SWY666/SSL-backdoor-BLTO/blob/HEAD/Dirty_code_for_attack/arguments.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"184bc3aa05cbcb7f"}},{"code_sha256_prefix":"baeed5164d5bb57f","entry":"get_ctrl_offline","repo":"SWY666/SSL-backdoor-BLTO","repo_kind":"official","path":"Dataset/CTRL_offline.py","file_url":"https://github.com/SWY666/SSL-backdoor-BLTO/blob/HEAD/Dataset/CTRL_offline.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"baeed5164d5bb57f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}