{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/blind-backdoors-in-deep-learning-models","title":"Blind Backdoors in Deep Learning Models","arxiv_id":"2005.03823","date":"2020-05-08","proceeding":null,"authors":["Eugene Bagdasaryan","Vitaly Shmatikov"],"abstract":"We investigate a new method for injecting backdoors into machine learning models, based on compromising the loss-value computation in the model-training code. We use it to demonstrate new classes of backdoors strictly more powerful than those in the prior literature: single-pixel and physical backdoors in ImageNet models, backdoors that switch the model to a covert, privacy-violating task, and backdoors that do not require inference-time input modifications. Our attack is blind: the attacker cannot modify the training data, nor observe the execution of his code, nor access the resulting model. The attack code creates poisoned training inputs \"on the fly,\" as the model is training, and uses multi-objective optimization to achieve high accuracy on both the main and backdoor tasks. We show how a blind attack can evade any known defense and propose new ones.","url_abs":"https://arxiv.org/abs/2005.03823v4","url_pdf":"https://arxiv.org/pdf/2005.03823v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"blind-backdoors-in-deep-learning-models","repo_url":"https://github.com/ebagdasa/backdoors101","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"deep-learning","task_name":"Deep Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2005.03823","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2005.03823"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ebagdasa/backdoors101","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_draft_wrong":3,"unverified":5},"by_repo_kind":{"official":{"samples":8,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d9def42110729a85","entry":"conv1x1","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d9def42110729a85"}},{"code_sha256_prefix":"160bb14bd76201b4","entry":"conv3x3","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"160bb14bd76201b4"}},{"code_sha256_prefix":"eba3f5bcc6a06d36","entry":"make_layers","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/vgg.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/vgg.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"eba3f5bcc6a06d36"}},{"code_sha256_prefix":"81584367d81cd5ad","entry":"resnet18","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/resnet_cifar.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"81584367d81cd5ad"}},{"code_sha256_prefix":"45b534bafe4d4090","entry":"resnet34","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/resnet_cifar.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"45b534bafe4d4090"}},{"code_sha256_prefix":"f0d760bc8ee50095","entry":"resnet50","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/resnet_cifar.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f0d760bc8ee50095"}},{"code_sha256_prefix":"1d6a9b32fa100d3a","entry":"vgg11","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/vgg.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/vgg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1d6a9b32fa100d3a"}},{"code_sha256_prefix":"5c9b2e9b83552cf6","entry":"vgg11_bn","repo":"ebagdasa/backdoors101","repo_kind":"official","path":"models/vgg.py","file_url":"https://github.com/ebagdasa/backdoors101/blob/HEAD/models/vgg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5c9b2e9b83552cf6"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}