{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/privacy-backdoors-stealing-data-with","title":"Privacy Backdoors: Stealing Data with Corrupted Pretrained Models","arxiv_id":"2404.00473","date":"2024-03-30","proceeding":null,"authors":["Shanglun Feng","Florian Tramèr"],"abstract":"Practitioners commonly download pretrained machine learning models from open repositories and finetune them to fit specific applications. We show that this practice introduces a new risk of privacy backdoors. By tampering with a pretrained model's weights, an attacker can fully compromise the privacy of the finetuning data. We show how to build privacy backdoors for a variety of models, including transformers, which enable an attacker to reconstruct individual finetuning samples, with a guaranteed success! We further show that backdoored models allow for tight privacy attacks on models trained with differential privacy (DP). The common optimistic practice of training DP models with loose privacy guarantees is thus insecure if the model is not trusted. Overall, our work highlights a crucial and overlooked supply chain attack on machine learning privacy.","url_abs":"https://arxiv.org/abs/2404.00473v1","url_pdf":"https://arxiv.org/pdf/2404.00473v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"privacy-backdoors-stealing-data-with","repo_url":"https://github.com/shanglunfengatethz/privacybackdoor","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2404.00473","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2404.00473"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shanglunfengatethz/privacybackdoor","reach":{"status":"ok"}}],"summary":{"ran":14,"unverified":3},"by_repo_kind":{"official":{"samples":17,"ran":14,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":17,"samples":[{"code_sha256_prefix":"1717f80105daf98d","entry":"bait_mirror_position_generator","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/edit_bert.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/edit_bert.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1717f80105daf98d"}},{"code_sha256_prefix":"bef40d0b20840625","entry":"channel_extraction","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/edit_vit.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/edit_vit.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bef40d0b20840625"}},{"code_sha256_prefix":"838890aad132e55b","entry":"cope_with_sentences","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/data.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/data.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"838890aad132e55b"}},{"code_sha256_prefix":"cc619f559e789221","entry":"find_available_bait_and_target","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/run_dpprv.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/run_dpprv.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cc619f559e789221"}},{"code_sha256_prefix":"19f5cb07d7444756","entry":"find_self_consist","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/run_dpprv.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/run_dpprv.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"19f5cb07d7444756"}},{"code_sha256_prefix":"b6d4c90a68249f9d","entry":"get_sentences_labels_from_dicts","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/data.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/data.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b6d4c90a68249f9d"}},{"code_sha256_prefix":"393c698d71708c54","entry":"make_conv_pixel_extractor","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/edit_vit.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/edit_vit.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"393c698d71708c54"}},{"code_sha256_prefix":"159e78c46dc65a23","entry":"make_extract_pixels","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/edit_vit.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/edit_vit.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"159e78c46dc65a23"}},{"code_sha256_prefix":"471665f6887b5809","entry":"native_bait_selector","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/model_mlp.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/model_mlp.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"471665f6887b5809"}},{"code_sha256_prefix":"6dad85fe4118d5e9","entry":"native_preprocess","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/model_mlp.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/model_mlp.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6dad85fe4118d5e9"}},{"code_sha256_prefix":"e31fd1853842c0e9","entry":"select_position_embedding","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/edit_bert.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/edit_bert.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e31fd1853842c0e9"}},{"code_sha256_prefix":"7ead6cdb16fa1610","entry":"setdiff1d","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/tools.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/tools.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7ead6cdb16fa1610"}},{"code_sha256_prefix":"bb8089c8172faa52","entry":"stringify","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/tools.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/tools.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bb8089c8172faa52"}},{"code_sha256_prefix":"7096542a80cb5cf0","entry":"weights_generator","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/tools.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/tools.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7096542a80cb5cf0"}},{"code_sha256_prefix":"5f45cff9a3473ad2","entry":"load_dataset","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/data.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/data.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5f45cff9a3473ad2"}},{"code_sha256_prefix":"239d973184003e1a","entry":"record_step_info","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/model_mlp.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/model_mlp.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"239d973184003e1a"}},{"code_sha256_prefix":"1834c18d8b000103","entry":"seq_signal_passing","repo":"shanglunfengatethz/privacybackdoor","repo_kind":"official","path":"src/edit_bert.py","file_url":"https://github.com/shanglunfengatethz/privacybackdoor/blob/HEAD/src/edit_bert.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1834c18d8b000103"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}