{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/badencoder-backdoor-attacks-to-pre-trained","title":"BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning","arxiv_id":"2108.00352","date":"2021-08-01","proceeding":null,"authors":["Jinyuan Jia","Yupei Liu","Neil Zhenqiang Gong"],"abstract":"Self-supervised learning in computer vision aims to pre-train an image encoder using a large amount of unlabeled images or (image, text) pairs. The pre-trained image encoder can then be used as a feature extractor to build downstream classifiers for many downstream tasks with a small amount of or no labeled training data. In this work, we propose BadEncoder, the first backdoor attack to self-supervised learning. In particular, our BadEncoder injects backdoors into a pre-trained image encoder such that the downstream classifiers built based on the backdoored image encoder for different downstream tasks simultaneously inherit the backdoor behavior. We formulate our BadEncoder as an optimization problem and we propose a gradient descent based method to solve it, which produces a backdoored image encoder from a clean one. Our extensive empirical evaluation results on multiple datasets show that our BadEncoder achieves high attack success rates while preserving the accuracy of the downstream classifiers. We also show the effectiveness of BadEncoder using two publicly available, real-world image encoders, i.e., Google's image encoder pre-trained on ImageNet and OpenAI's Contrastive Language-Image Pre-training (CLIP) image encoder pre-trained on 400 million (image, text) pairs collected from the Internet. Moreover, we consider defenses including Neural Cleanse and MNTD (empirical defenses) as well as PatchGuard (a provable defense). Our results show that these defenses are insufficient to defend against BadEncoder, highlighting the needs for new defenses against our BadEncoder. Our code is publicly available at: https://github.com/jjy1994/BadEncoder.","url_abs":"https://arxiv.org/abs/2108.00352v1","url_pdf":"https://arxiv.org/pdf/2108.00352v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"badencoder-backdoor-attacks-to-pre-trained","repo_url":"https://github.com/jjy1994/BadEncoder","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"badencoder-backdoor-attacks-to-pre-trained","repo_url":"https://github.com/giantseaweed/decree","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"badencoder-backdoor-attacks-to-pre-trained","repo_url":"https://github.com/jinyuan-jia/badencoder","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"badencoder-backdoor-attacks-to-pre-trained","repo_url":"https://github.com/liu00222/StolenEncoder","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"badencoder-backdoor-attacks-to-pre-trained","repo_url":"https://github.com/shuchiwu/eminspector","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"badencoder-backdoor-attacks-to-pre-trained","repo_url":"https://github.com/shuchiwu/rda","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"badencoder-backdoor-attacks-to-pre-trained","repo_url":"https://github.com/jsrdcht/SSL-Backdoor","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"self-supervised-learning","task_name":"Self-Supervised Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2108.00352","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2108.00352"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/liu00222/StolenEncoder","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shuchiwu/eminspector","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jinyuan-jia/badencoder","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jsrdcht/SSL-Backdoor","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shuchiwu/rda","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jjy1994/BadEncoder","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/giantseaweed/decree","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":2,"ran_fixture":2,"unverified":4},"by_repo_kind":{"listed":{"samples":8,"ran":4,"repositories":4}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":2,"samples":[{"code_sha256_prefix":"158bf4c3a5f11f04","entry":"conv1x1","repo":"liu00222/StolenEncoder","repo_kind":"listed","path":"CLIP/models/imagenet_model.py","file_url":"https://github.com/liu00222/StolenEncoder/blob/HEAD/CLIP/models/imagenet_model.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"158bf4c3a5f11f04"}},{"code_sha256_prefix":"29df79c9fdb0cee8","entry":"conv3x3","repo":"liu00222/StolenEncoder","repo_kind":"listed","path":"CLIP/models/imagenet_model.py","file_url":"https://github.com/liu00222/StolenEncoder/blob/HEAD/CLIP/models/imagenet_model.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"29df79c9fdb0cee8"}},{"code_sha256_prefix":"cf100d49bb98767a","entry":"create_torch_dataloader","repo":"jsrdcht/SSL-Backdoor","repo_kind":"listed","path":"ssl_backdoor/attacks/badencoder/badencoder.py","file_url":"https://github.com/jsrdcht/SSL-Backdoor/blob/HEAD/ssl_backdoor/attacks/badencoder/badencoder.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cf100d49bb98767a"}},{"code_sha256_prefix":"8c3820f76db73254","entry":"predict_feature","repo":"jsrdcht/SSL-Backdoor","repo_kind":"listed","path":"ssl_backdoor/attacks/badencoder/badencoder.py","file_url":"https://github.com/jsrdcht/SSL-Backdoor/blob/HEAD/ssl_backdoor/attacks/badencoder/badencoder.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8c3820f76db73254"}},{"code_sha256_prefix":"5d3d807d2cd79131","entry":"AverageSim","repo":"liu00222/StolenEncoder","repo_kind":"listed","path":"CLIP/evaluate_surrogate_encoder.py","file_url":"https://github.com/liu00222/StolenEncoder/blob/HEAD/CLIP/evaluate_surrogate_encoder.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5d3d807d2cd79131"}},{"code_sha256_prefix":"e8227b733fdf9db2","entry":"get_multi_backdoor_imagenet","repo":"liu00222/StolenEncoder","repo_kind":"listed","path":"CLIP/datasets/imagenet_dataset.py","file_url":"https://github.com/liu00222/StolenEncoder/blob/HEAD/CLIP/datasets/imagenet_dataset.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e8227b733fdf9db2"}},{"code_sha256_prefix":"f932268000bef667","entry":"train","repo":"jinyuan-jia/badencoder","repo_kind":"listed","path":"badencoder.py","file_url":"https://github.com/jinyuan-jia/badencoder/blob/HEAD/badencoder.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f932268000bef667"}},{"code_sha256_prefix":"7c0b8c4203703d28","entry":"train","repo":"giantseaweed/decree","repo_kind":"listed","path":"attack_encoder.py","file_url":"https://github.com/giantseaweed/decree/blob/HEAD/attack_encoder.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7c0b8c4203703d28"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}