{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/rethinking-backdoor-attacks","title":"Rethinking Backdoor Attacks","arxiv_id":"2307.10163","date":"2023-07-19","proceeding":null,"authors":["Alaa Khaddaj","Guillaume Leclerc","Aleksandar Makelov","Kristian Georgiev","Hadi Salman","Andrew Ilyas","Aleksander Madry"],"abstract":"In a backdoor attack, an adversary inserts maliciously constructed backdoor examples into a training set to make the resulting model vulnerable to manipulation. Defending against such attacks typically involves viewing these inserted examples as outliers in the training set and using techniques from robust statistics to detect and remove them. In this work, we present a different approach to the backdoor attack problem. Specifically, we show that without structural information about the training data distribution, backdoor attacks are indistinguishable from naturally-occurring features in the data--and thus impossible to \"detect\" in a general sense. Then, guided by this observation, we revisit existing defenses against backdoor attacks and characterize the (often latent) assumptions they make and on which they depend. Finally, we explore an alternative perspective on backdoor attacks: one that assumes these attacks correspond to the strongest feature in the training data. Under this assumption (which we make formal) we develop a new primitive for detecting backdoor attacks. Our primitive naturally gives rise to a detection algorithm that comes with theoretical guarantees and is effective in practice.","url_abs":"https://arxiv.org/abs/2307.10163v1","url_pdf":"https://arxiv.org/pdf/2307.10163v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2307.10163","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2307.10163"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/SewoongLab/spectre-defense","reach":null}],"summary":{"ran":4,"ran_fixture":1,"ran_draft_wrong":1,"unverified":3},"by_repo_kind":{"found_in_text":{"samples":9,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"75013a384e86bd0d","entry":"LabelSortedDataset","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"75013a384e86bd0d"}},{"code_sha256_prefix":"9ba46cc13ff798af","entry":"custom_svd","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"DEP_MISSING","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9ba46cc13ff798af"}},{"code_sha256_prefix":"dfef8b13029dfa18","entry":"either_dataloader_dataset_to_both","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dfef8b13029dfa18"}},{"code_sha256_prefix":"d2a1873f0e924783","entry":"get_module_device","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d2a1873f0e924783"}},{"code_sha256_prefix":"9761766b17f984f8","entry":"in_notebook","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9761766b17f984f8"}},{"code_sha256_prefix":"63c8b7f7ecc37a2e","entry":"make_dataloader","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"63c8b7f7ecc37a2e"}},{"code_sha256_prefix":"83096e81b6d61f9f","entry":"compute_all_reps","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"83096e81b6d61f9f"}},{"code_sha256_prefix":"77845e534f26e2ba","entry":"compute_spectral_df","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"77845e534f26e2ba"}},{"code_sha256_prefix":"be4321ae96632441","entry":"make_pbar","repo":"SewoongLab/spectre-defense","repo_kind":"found_in_text","path":"util.py","file_url":"https://github.com/SewoongLab/spectre-defense/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"be4321ae96632441"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}