{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/data-free-backdoor-attacks","title":"Data Free Backdoor Attacks","arxiv_id":"2412.06219","date":"2024-12-09","proceeding":null,"authors":["Bochuan Cao","Jinyuan Jia","Chuxuan Hu","Wenbo Guo","Zhen Xiang","Jinghui Chen","Bo Li","Dawn Song"],"abstract":"Backdoor attacks aim to inject a backdoor into a classifier such that it predicts any input with an attacker-chosen backdoor trigger as an attacker-chosen target class. Existing backdoor attacks require either retraining the classifier with some clean data or modifying the model's architecture. As a result, they are 1) not applicable when clean data is unavailable, 2) less efficient when the model is large, and 3) less stealthy due to architecture changes. In this work, we propose DFBA, a novel retraining-free and data-free backdoor attack without changing the model architecture. Technically, our proposed method modifies a few parameters of a classifier to inject a backdoor. Through theoretical analysis, we verify that our injected backdoor is provably undetectable and unremovable by various state-of-the-art defenses under mild assumptions. Our evaluation on multiple datasets further demonstrates that our injected backdoor: 1) incurs negligible classification loss, 2) achieves 100% attack success rates, and 3) bypasses six existing state-of-the-art defenses. Moreover, our comparison with a state-of-the-art non-data-free backdoor attack shows our attack is more stealthy and effective against various defenses while achieving less classification accuracy loss.","url_abs":"https://arxiv.org/abs/2412.06219v1","url_pdf":"https://arxiv.org/pdf/2412.06219v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"data-free-backdoor-attacks","repo_url":"https://github.com/aaaaaasuka/datafree_backdoor_attacks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2412.06219","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2412.06219"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/aaaaaasuka/datafree_backdoor_attacks","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_fixture":2,"unverified":11},"by_repo_kind":{"official":{"samples":13,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"14ecdc1bdbf62ce1","entry":"channel_random_select","repo":"aaaaaasuka/datafree_backdoor_attacks","repo_kind":"official","path":"inject_backdoor.py","file_url":"https://github.com/aaaaaasuka/datafree_backdoor_attacks/blob/HEAD/inject_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"14ecdc1bdbf62ce1"}},{"code_sha256_prefix":"9f02cb10d3b78f7f","entry":"generate_trigger_fix_weight_rgb","repo":"aaaaaasuka/datafree_backdoor_attacks","repo_kind":"official","path":"inject_backdoor.py","file_url":"https://github.com/aaaaaasuka/datafree_backdoor_attacks/blob/HEAD/inject_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9f02cb10d3b78f7f"}},{"code_sha256_prefix":"d870dafe0d1eea2e","entry":"InjectBackdoor_VGG","repo":"aaaaaasuka/datafree_backdoor_attacks","repo_kind":"official","path":"inject_backdoor.py","file_url":"https://github.com/aaaaaasuka/datafree_backdoor_attacks/blob/HEAD/inject_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d870dafe0d1eea2e"}},{"code_sha256_prefix":"c47aa7fdcc2f4011","entry":"accuracy","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"handcrafted_backdoor.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/handcrafted_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c47aa7fdcc2f4011"}},{"code_sha256_prefix":"05d5635890d407c4","entry":"add_trigger_handcrafted","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"handcrafted_backdoor.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/handcrafted_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"05d5635890d407c4"}},{"code_sha256_prefix":"3348cf5f81b0f343","entry":"atk_first_filter","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"inject_backdoor.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/inject_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3348cf5f81b0f343"}},{"code_sha256_prefix":"a1773d2413d1906c","entry":"compute_lam","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"utils.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a1773d2413d1906c"}},{"code_sha256_prefix":"be49f068eb9963c2","entry":"generate_trigger","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"inject_backdoor.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/inject_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"be49f068eb9963c2"}},{"code_sha256_prefix":"07ed1f92894f4360","entry":"get_data","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"utils.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"07ed1f92894f4360"}},{"code_sha256_prefix":"d39599094668333d","entry":"loss_inner","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"defends/ibau/IBAU.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/defends/ibau/IBAU.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d39599094668333d"}},{"code_sha256_prefix":"c477bfb68df6fef4","entry":"loss_outer","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"defends/ibau/IBAU.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/defends/ibau/IBAU.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c477bfb68df6fef4"}},{"code_sha256_prefix":"7879e76c2a733e4a","entry":"test","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"handcrafted_backdoor.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/handcrafted_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7879e76c2a733e4a"}},{"code_sha256_prefix":"f3f1a40575d9367c","entry":"time_calc","repo":"AAAAAAsuka/DataFree_Backdoor_Attacks","repo_kind":"official","path":"utils.py","file_url":"https://github.com/AAAAAAsuka/DataFree_Backdoor_Attacks/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f3f1a40575d9367c"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}