SSL-Backdoor

A unified PyTorch library for backdoor attacks & defenses in self-supervised learning

MIT License · Python 3.10 · PyTorch 2.2–2.4 · CUDA 12.1

---

SSL-Backdoor is an academic research library for backdoor attacks in self-supervised learning (SSL). Our goal is to provide a comprehensive and unified platform for researchers to implement, evaluate, and compare various attacks and defenses in the context of SSL.

📢 News

• 2026-07-07 🎉 BadCLIP attack is now available! Dual-embedding guided backdoor attack on multimodal contrastive learning (CVPR 2024).
• 2026-07-07 🎉 CLIP-Backdoor attack is now available! Poisoning-based backdoor attacks on CLIP, based on Carlini et al. (ICLR 2022).

Previous updates

• 2026-02-02 Decomp defense is now available! (ICML 2025)
• 2025-12-02 SSL-Cleanse defense is now available! (ECCV 2024)
• 2025-08-11 DRUPE attack is now available! (S&P 2024)
• 2025-05-19 DEDE defense is now available!
• 2025-04-18 PatchSearch defense and BadEncoder attack are now available!

Supported Attacks

This library currently supports the following poisoning attack algorithms against SSL models:

Method	Paper	Venue	Configs
SSL-Backdoor	Backdoor attacks on self-supervised learning	CVPR 2022	train · test
BadEncoder	BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning	S&P 2022	config · train · test
CTRL	An Embarrassingly Simple Backdoor Attack on Self-supervised Learning	ICCV 2023	–
CorruptEncoder	Data poisoning based backdoor attacks to contrastive learning	CVPR 2024	train
BLTO (inference)	Backdoor Contrastive Learning via Bi-level Trigger Optimization	ICLR 2024	–
DRUPE	Distribution Preserving Backdoor Attack in Self-supervised Learning	S&P 2024	config · train · test
BadCLIP 🆕	BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning	CVPR 2024	trigger · poison · train · eval
CLIP-Backdoor 🆕	Poisoning and Backdooring Contrastive Learning	ICLR 2022	poison · train · eval

Supported Defenses

We are actively developing and integrating defense mechanisms. Currently, the following defenses are implemented:

Method	Paper	Venue	Configs
PatchSearch	Defending Against Patch-Based Backdoor Attacks on Self-Supervised Learning	CVPR 2023	doc · config
SSL-Cleanse	SSL-Cleanse: Trojan detection and mitigation in self-supervised learning	ECCV 2024	config
DEDE	DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders	CVPR 2025	–
Decomp	A Closer Look at Backdoor Attacks on CLIP	ICML 2025	config

Setup

Get started with SSL-Backdoor quickly:

1. Clone the repository:

  git clone https://github.com/jsrdcht/SSL-Backdoor.git
  cd SSL-Backdoor

2. Environment (Pixi CUDA only):

  # resolve/create the CUDA environment defined in pixi.toml
  pixi install -e cuda
  # quick check of core deps and CUDA availability
  pixi run -e cuda check
  # open an interactive shell in the CUDA env (optional)
  pixi shell -e cuda

Usage

Training an SSL Model on a Poisoned Dataset

To train an SSL model (e.g., using MoCo v2) with a chosen poisoning attack, you can use the provided scripts. Example for Distributed Data Parallel (DDP) training:

# Configure your desired attack, SSL method, dataset, etc. in the relevant config file
# (e.g., configs/ssl/moco_config.yaml, configs/poisoning/...)

bash tools/train.sh <path_to_your_config.yaml>

Please refer to the configs directory and specific training scripts for detailed usage and parameter options.

Citation

@misc{jsrdcht_ssl_backdoor_2025,
  title        = {SSL-Backdoor: A PyTorch library for SSL backdoor research},
  author       = {jsrdcht},
  year         = {2025},
  howpublished = {\url{https://github.com/jsrdcht/SSL-Backdoor/}},
  note         = {MIT License, accessed 2025-08-11}
}