Backdoor Learning: A Survey

TL;DR

This survey comprehensively reviews backdoor attacks on deep neural networks, categorizing existing methods, defenses, and datasets, and discusses their relation to adversarial attacks and data poisoning, highlighting future research directions.

Contribution

First systematic survey of backdoor learning, providing unified analysis, categorization, and resource compilation for this emerging research area.

Findings

Categorized backdoor attack and defense methods

Analyzed relation with adversarial attacks and data poisoning

Summarized benchmark datasets used in the field

Abstract

Backdoor attack intends to embed hidden backdoor into deep neural networks (DNNs), so that the attacked models perform well on benign samples, whereas their predictions will be maliciously changed if the hidden backdoor is activated by attacker-specified triggers. This threat could happen when the training process is not fully controlled, such as training on third-party datasets or adopting third-party models, which poses a new and realistic threat. Although backdoor learning is an emerging and rapidly growing research area, its systematic review, however, remains blank. In this paper, we present the first comprehensive survey of this realm. We summarize and categorize existing backdoor attacks and defenses based on their characteristics, and provide a unified framework for analyzing poisoning-based backdoor attacks. Besides, we also analyze the relation between backdoor attacks and relevant fields ($i.e.,$ adversarial attacks and data poisoning), and summarize widely adopted benchmark datasets. Finally, we briefly outline certain future research directions relying upon reviewed works. A curated list of backdoor-related resources is also available at \url{https://github.com/THUYimingLi/backdoor-learning-resources}.