This is official code of our NDSS 23 paper Backdoor Attacks Against Dataset Distillation. Currently, we apply two distillation techniques, namely Dataset Distillation (DD) and Dataset Condensation with Gradient Matching (DC). In the project, we propose three different backdoor attacks, NAIVEATTACK, DOORPING, and INVISIBLE. NAIVEATTACK inserts a pre-defined trigger into the original training dataset before the distillation. DOORPING is an advanced method, which optimizes the trigger during the distillation process. Required by the reviewers, we need to add another backdoor method. So, we choose Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization.
Limited by the DD code, PyTorch 2.0 are not supported.
A suitable conda environment named baadd can be created and activated with:
conda env create -f environment.yaml
conda activate baadd
We support five different dataset: Fashion-MNIST (FMNIST), CIFAR10, CIFAR100, STL10, and SVHN. And two attack architectures: AlexNet and ConvNet
Due to the different arguments between DD and DC code, we list the arguments in the following:
| Dataset Name | Fashion-MNIST | CIFAR10 | CIFAR100 | STL10 | SVHN |
| Arguments | FashionMNIST | Cifar10 | Cifar100 | STL10 | SVHN |
| Model Architecture | AlexNet | ConvNet |
| Arguments | AlexCifarNet | ConvNet |
For NAIVEATTACK, run this mode via
python DD/main.py --mode distill_basic --dataset Cifar10 --arch AlexCifarNet --distill_lr 0.001 --naive --dataset_root /path/to/data --results_dir /path/to/results
For DOORPING, run this mode via
python DD/main.py --mode distill_basic --dataset Cifar10 --arch AlexCifarNet --distill_lr 0.001 --doorping --dataset_root /path/to/data --results_dir /path/to/results
For INVISIBLE, run this mode via
python DD/main.py --mode distill_basic --dataset Cifar10 --arch AlexCifarNet --distill_lr 0.001 --invisible --dataset_root /path/to/data --results_dir /path/to/results
| Dataset Name | Fashion-MNIST | CIFAR10 | CIFAR100 | STL10 | SVHN |
| Arguments | FashionMNIST | CIFAR10 | CIFAR100 | STL10 | SVHN |
| Model Architecture | AlexNet | ConvNet |
| Arguments | AlexNet | ConvNet |
For NAIVEATTACK, run this mode via
python DC/main.py --dataset CIFAR10 --model AlexNet --naive --data_path /path/to/data --save_path /path/to/results
For DOORPING, run this mode via
python DC/main.py --dataset CIFAR10 --model AlexNet --doorping --data_path /path/to/data --save_path /path/to/results
For INVISIBLE, run this mode via
python DC/main.py --dataset CIFAR10 --model AlexNet --invisible --data_path /path/to/data --save_path /path/to/results
Please cite this paper in your publications if it helps your research:
@inproceedings{LLBSZ23,
author = {Yugeng Liu and Zheng Li and Michael Backes and Yun Shen and Yang Zhang},
title = {{Backdoor Attacks Against Dataset Distillation}},
booktitle = {{NDSS}},
year = {2023}
}