#  How to Craft Backdoors with Unlabeled Data Alone?

Yifei Wang∗
MIT
&Wenhan Ma
Peking University
&Stefanie Jegelka
TU Munich and MIT
&Yisen Wang
Peking University
Equal contribution.

###### Abstract

Relying only on unlabeled data, Self-supervised learning (SSL) can learn rich
features in an economical and scalable way. As the drive-horse for building
foundation models, SSL has received a lot of attention recently with wide
applications, which also raises security concerns where backdoor attack is a
major type of threat: if the released dataset is maliciously poisoned,
backdoored SSL models can behave badly when triggers are injected to test
samples. The goal of this work is to investigate this potential risk. We
notice that existing backdoors all require a considerable amount of _labeled_
data that may not be available for SSL. To circumvent this limitation, we
explore a more restrictive setting called no-label backdoors, where we only
have access to the unlabeled data alone, where the key challenge is how to
select the proper poison set without using label information. We propose two
strategies for poison selection: clustering-based selection using
pseudolabels, and contrastive selection derived from the mutual information
principle. Experiments on CIFAR-10 and ImageNet-100 show that both no-label
backdoors are effective on many SSL methods and outperform random poisoning by
a large margin. Code will be available at https://github.com/PKU-ML/nlb.

##  1 Introduction

Deep learning’s success is largely attributed to large-scale labeled data
(like ImageNet (Deng et al., 2009)) which requires a lot of human annotation.
However, data collection is often very expensive or requires domain expertise.
Recently, Self-Supervised Learning (SSL) that only utilizes unlabeled data has
shown promising results, reaching or exceeding supervised learning in various
domains (Chen et al., 2020a; Devlin et al., 2019), and serving as foundation
models for many downstream applications (Brown et al., 2020). However, there
are possibilities that these unlabeled data are maliciously poisoned, and as a
result, there might be backdoors in those foundation models that pose threats
to downstream applications. Figure 1 outlines such a poisoning scenario, where
a malicious attacker injects backdoors to a public unlabeled dataset, e.g.,
Wiki-text (Merity et al., 2017) and CEM500K (Conrad & Narayan, 2021), and
released these poisoned datasets to the users.

Figure 1: A practical poisoning scenario when the attacker only has access to
unlabeled data alone.

To implement such an attack, there remains an important technical problem yet
unexplored: how to inject backdoors with unlabeled data alone? Up to our
knowledge, all existing backdoors require knowing the labels of the poisoned
samples (elaborated later). However, in cases like Figure 1, the attacker only
has access to unlabeled data alone when poisoning SSL. To circumvent this
obstacle, in this paper, we explored a new backdoor scenario called no-label
backdoor (NLB). Going beyond dirty-label backdoor (knowing and editing both
inputs and labels) (Gu et al., 2017) and clean-label backdoor (knowing labels,
editing only inputs) (Turner et al., 2019), no-label backdoor (knowing and
editing only inputs) is a further step towards using minimal information to
craft backdoor attacks.

Previous practice of label-aware backdoor reveals that the key to backdoor
attack is to induce a strong correlation between the backdoor trigger and a
specific target class. Thus, the main obstacle to no-label backdoors is how to
inject triggers into a subset of samples with consistent labels. A natural
idea is to annotate “pseudolabels” by clustering algorithms like K-means, and
use these pseudolabels for backdoor injection. Although effective to some
extent, we find that clustering algorithms are often unstable and lead to poor
performance under bad initialization. To circumvent this limitation, we
develop a new mutual information principle for poison selection, based on
which we derive a direct selection strategy called Contrastive Selection. In
particular, contrastive selection chooses a subset with maximal similarity
between samples within the group (i.e., positive samples), while having
minimal similarity to the other samples (i.e., negative samples). Empirically,
we find that contrastive selection can produce high class consistency between
chosen samples, and as a deterministic method, it is more stable than
clustering-based selection. Contributions are summarized below:

  * •

We explore a new scenario of backdoor attack, no-label backdoor (NLB), where
the attacker has access to unlabeled data alone. Unlike dirty-label and clean-
label backdoors, NLB represents a more restricted setting that no existing
backdoors can be directly applied to.

  * •

To craft effective no-label backdoors, we propose two effective strategies to
select the poison set from the unlabeled data: clustering-based NLB and
contrastive NLB. The former is based on K-means-induced pseudolabels while the
latter is directly derived from the proposed mutual information principle for
poison selection.

  * •

Experiments on CIFAR-10 and ImageNet-100 show both no-label backdoors are
effective for poisoning many SSL methods and outperform random selection
significantly by a large margin. Meanwhile, these no-label backdoors are also
resistant to finetuning-based backdoor defense to some extent.

Related Work. Recently, a few works explore backdoor attack on SSL.
Specifically, Saha et al. (2021) propose to poison SSL by injecting triggers
to images from the target class, while BadEncoder (Jia et al., 2021) backdoors
a SSL model by finetuing the model on triggered target class images. Li et al.
(2023) design a color space trigger for backdooring SSL models. However, _all
these methods_ require poisoning many samples from the target classes (e.g.,
50% in Saha et al. (2021)), which is hard to get for the attacker that only
has unlabeled data. In this paper, we explore the more restrictive setting
when no label information is available for the attacker at all. Besides,
Carlini & Terzis (2022) recently studied the backdoor attack on CLIP (Radford
et al., 2021), a multi-modal contrastive learning method aligning image-text
pairs. However, natural language supervision is also unavailable in many
unlabeled dataset, such as, CEM500K. To craft poisons under these
circumstances, we explore the most restrictive setting where we have no access
to any external supervision, and only the unlabeled data alone. As far as we
know, we are the first to explore this no-label backdoor setting.

##  2 Threat Model

We begin with the background of self-supervised learning (SSL) and then
introduce the threat model of no-label backdoors for SSL.

###  2.1 Background on Self-Supervised Learning

Data Collection. As a certain paradigm of unsupervised learning, SSL requires
only unlabeled samples for training (denoted as
${\mathcal{D}}=\\{({\bm{x}}_{i})\\}$), which allows it to cultivate massive-
scale unlabeled datasets. Rather than crawling unlabeled data by oneself, a
common practice (also adopted in GPT series) is to utilize a (more or less)
curated unlabeled dataset, such as 1) Common Crawl, a massive corpus (around
380TB) containing 3G web pages (Brown et al., 2020); 2) JFT-300M, an internal
Google dataset with 300M images with no human annotation (Sun et al., 2017);
3) CEM500K, a 25GB unlabeled dataset of 500k unique 2D cellular electron
microscopy images (Conrad & Narayan, 2021). The construction and curvation of
these massive-scale datasets is still a huge project. As valuable assets, some
of these datasets (like Google’s JFT-300M) are kept private and some require
certain permissions (like ImageNet). Meanwhile, as these datasets are very
large, official downloads could be very slow. To counter these limits, there
are unofficial mirrors and personal links sharing unauthorized data copies,
which could potentially contain malicious poisons as shown in Figure 1.

Training and Evaluation. The general methodology of self-supervised learning
is to learn meaningful data representations using self-generated surrogate
learning signals, a.k.a. self-supervision. Contrastive learning is a state-of-
the-art SSL paradigm with well-known examples like SimCLR (Chen et al.,
2020a), MoCo (He et al., 2020), and we take it as an example in our work.
Specifically, contrastive learning generates a pair of positive samples for
each original data ${\bm{x}}$ with random data augmentation, and applies the
InfoNCE loss Oord et al. (2018):

$\begin{gathered}\ell_{nce}({\bm{z}}_{i},{\bm{z}}_{j})=-\log\frac{\exp\left(\operatorname{sim}\left({\bm{z}}_{i},{\bm{z}}_{j}\right)/\tau\right)}{\sum_{k=1}^{2B}\mathbf{1}_{[k\neq
i]}\exp\left(\operatorname{sim}\left(\bm{z}_{i},\bm{z}_{k}\right)/\tau\right)},\end{gathered}$
(1)

where $({\bm{z}}_{i},{\bm{z}}_{j})$ denote the representations of the positive
pair that are pulled together, and the others in the minibatch are regarded as
negative samples and pushed away. Here, $\tau$ is a temperature parameter and
$\operatorname{sim}$ calculates the cosine similarity between two samples.
After pretraining, we usually train a linear classifier with labeled data on
top of _fixed_ representations, and use its classification accuracy (i.e.,
linear accuracy) to measure the representation quality.

###  2.2 Threat Model of No-label Backdoors

In this part, we outline the threat model of no-label backdoors (NLB) that
tries to inject backdoors to a given unlabeled dataset without label
information.

Attacker’s Knowledge. As illustrated in Figure 1, the attacker can be someone
who provides third-party download services of unauthorized copies of a common
unlabeled dataset ${\mathcal{D}}$. This dataset is constructed by others _a
priori_ , e.g., the medical dataset CEM500K. By holding a clean copy of the
unlabeled data ${\mathcal{D}}=\\{x\\}$, the attacker has access to all samples
in the dataset. However, since he is not the _creator_ of the dataset, he does
not have the knowledge of the data construction process nor has the domain
expertise to create labels for this dataset.

Attacker’s Capacity. By holding the unlabeled dataset, the attacker can select
a small proportion (not exceeding a given budget size $M$) from the unlabeled
data as the poison set, and inject stealthy trigger patterns to this subset,
keeping other data unchanged. Afterward, he could release the poisoned dataset
to the Internet and induce data users to train SSL models with it. The key
challenge of crafting no-label backdoors is to select the proper poison set
from the unlabeled dataset.

Attack’s Goal. Since the attacker has no label information, he or she cannot
craft backdoor attack to a target class as conventional setting. Instead, the
attacker can aim at “ _untargeted backdoor attack_ ”, where the goal is simply
paralyzing the SSL model such that it has poor performance (like untargeted
adversarial attack). In this case, the attacker hopes the poisoned model to
have high accuracy on clean test data (i.e., high clean accuracy), and low
accuracy when injecting triggers to test data (i.e., low poison accuracy). We
can also regard the class that most backdoored samples are classified as a
“pseudo target class”, and calculate attack success rate (ASR) w.r.t. this
class (higher the better).

##  3 Proposed No-label Backdoors

To select the proper poison set without label information, we propose two
methods: an indirect method based on clustering-based pseudolabeling (Section
3.1), and a direct method derived from the mutual information principle
(Section 3.2).

###  3.1 Clustering-based NLB with PseudoLabeling

(a) CCR v.s. cluster size

(b) CCR w/ 10 random runs

(c) backdoor performance

Figure 2: Analysis on clustering-based NLB on CIFAR-10. a) Cluster Consistency
Rate (CCR) of different clusters (obtained with multiple runs). b) CCR across
$10$ random runs. c) Backdoor performance with three no-label backdoors:
random selection, clustering with good CCR ($86.93\%$), clustering with bad
CCR ($45.48\%$).

Pseudo-labeling with SSL features. As label information is absent, a natural
way to craft no-label backdoors is to annotate unlabeled data with
“pseudolabels” obtained through a clustering algorithm. To obtain better
clustering performance, we first utilize a pretrained deep encoder (obtained
with a modern SSL algorithm, e.g., SimCLR (Chen et al., 2020a)) to extract
feature embeddings for each sample, and then apply the well-known K-means
algorithm (Hartigan & Wong, 1979) to clustering these embeddings to $K$
clusters. We treat each cluster as a pseudo-class, and correspondingly, we
annotate the unlabeled dataset with $K$ pseudo-labels,
$\tilde{{\mathcal{D}}}=\\{(x_{i},c_{i})\\}$, where
$c_{i}\in{\mathcal{C}}=\\{1,\dots,K\\}$ denotes the belonging cluster of
$x_{i}$. In practice, we find that choosing $K$ as the same number of ground-
truth labels (e.g., $K=10$ for CIFAR-10) often yields the best performance.

After pseudo labeling, following the practice of label-aware backdoors, the
next step is to select a subset of samples from the same pseudoclass as the
poisoning candidates. We measure the quality of each cluster by its class
consistency rate (CCR), the ratio of samples from the most frequent class in
each cluster. A higher CCR means that the cluster is almost from the same
class.

Poisoning Cluster Selection and Limitations. Figure 2 summarizes the influence
of clustering on CCR. Firstly, we observe that we often get very imbalanced
clusters with K-means, ranging from 2,000 to more than 10,000 samples (Figure
2(a)), and there is a consistent trend, that a larger cluster generally has a
smaller CCR. Based on this observation, we select the smallest cluster
${\mathcal{D}}_{c}$ whose size exceeds the poison budget $M$ to obtain a more
class-consistent poison set. Figure 2(b) shows that at most time, this
strategy yields a much higher CCR than random selection (10% CCR), and also
outperforms random selection at backdoor attacks (Figure 2(c)). Nevertheless,
from Figure 2(b), we also observe that K-means is unstable and sometimes
produce poison sets with very low CCR (about 20%), which is close to random
selection. As a result, the clustering approach occasionally produces poor
results at bad initialization, as shown in Figure 2(c). To resolve this
problem, in the next section, we explore a direct approach for poisoning
subset selection without using pseudolabels.

###  3.2 Contrastive NLB with Maximal Mutual Information

As discussed in Section 3.1, whether clustering-based NLB succeeds depends
crucially on the quality of pseudolabels that varies across different
initializations. Thus, we further devise a more principled strategy to
directly select the poison set ${\mathcal{P}}\subseteq{\mathcal{D}}$ via the
maximal mutual information principle.

The mutual information principle is a foundational guideline to self-
supervised learning: the learned representations $Z$ should contain the most
information of the original inputs; mathematically, the mutual information
between the input $X$ and the representation $Z$, i.e.,

$I(X;Z)=\mathbb{E}_{P(X,Z)}\log\frac{P(X,Z)}{P(X)P(Z)},$ (2)

should be maximized. Many state-of-the-art SSL algorithms, such as contrastive
learning and mask autoencoding, can be traced back to the mutual information
principle.

Backdoor as a New Feature. First, we note that by poisoning a subset of
training samples with backdoors and leaving others unchanged, we essentially
create a new feature in the dataset. Specifically, let $S$ denote a binary
variable that indicates poison selection: given a sample $x\sim X$, we assign

${\color[rgb]{0,0,0}P(S|X=x)}=\begin{cases}1,\text{ if
}x\in{\mathcal{P}}\text{ (embedded with backdoor pattern)};\\\ 0,\text{ if
}x\notin{\mathcal{P}}\text{ (no backdoor pattern)}.\end{cases}$ (3)

Thus, any choice of poison set ${\mathcal{P}}$ will induce a feature mapping
between the input trigger and the selection variable $S$, which we call a
_backdoor feature_. Although one can simply choose a random subset from
${\mathcal{D}}_{u}$, it is often not good enough for crafting effective
backdoors (see Figure 2(c)). This leads us to rethink the problem about what
criterion a good backdoor feature should satisfy, especially without access to
label information.

A Mutual Information Perspective on Backdoor Design. From the feature
perspective, the success of backdoor attacks lies in whether the poisoned data
can induce the model to learn the backdoor feature. Thus, to make a strong
poison effect, the backdoor features should be designed to be as easy to learn
as possible, which can be achieved by encouraging a strong dependence between
the backdoor feature and the learning objective, as measured by their mutual
information. Since SSL maximizes $I(X;Z)$ during training, denoting
$Z^{*}=\operatorname*{arg\,max}_{Z}I(X;Z)$, the backdoor feature should be
chosen to maximize their joint mutual information as follows,

$S^{*}=\operatorname*{arg\,max}_{S}I(X;Z^{*};S),\text{ where
}I(X;Z^{*};S)=I(X;Z^{*})-I(X;Z^{*}|S),$ (4)

and $I(X;Z|S)=\mathbb{E}_{P(X,Z|S)}\log\frac{P(X,Z|S)}{P(X|S)P(Z|S)}$ denotes
the conditional mutual information.

######  Remark 3.1.

This mutual information principle is general and not limited to no-label
backdoors. Notably, it can explain why we need to inject poisons to the same
class $Y$ in label-aware backdoors, since $Y$ and $S$ now have high mutual
information, which helps achieve a high $I(X;Y;S)$.

To solve Eq. (4) for no-label backdoors, we can first leverage a well-
pretrained SSL model and assume that it approximately maximizes the mutual
information, i.e., $I(X;Z)\approx I(X,X)=H(X)$, where
$H(X)=-\mathbb{E}_{P(X)}\log P(X)$ denotes the Shannon entropy111For the ease
of discussion, this is a common assumption adopted in SSL theory (Tsai et al.,
2021).. Then, we can simplify $I(X;Z;S)\approx H(X)-H(X|S)=I(X;S)$. As a
result, our ultimate guideline to unlabeled poison selection is to maximize
the mutual information between the input and the backdoor, i.e.,

$S^{*}=\operatorname*{arg\,max}_{S}I(X;S),\text{ where }I(X;S)=H(X)-H(X|S).$
(5)

Guided by this principle, the poison selection (indicated by $S$) should
create a data split with minimal input uncertainty within each group, i.e.,
$H(X|S)$. In fact, Eq. (5) is also known as the _Information Gain_ criterion
used in decision trees when choosing the most important input feature for
splitting the data at each node, e.g., in ID3 (Quinlan, 1986). Differently,
for backdoor attacks, we have a certain poisoning budget to _create a new
backdoor feature_ $S$ such that the information gain is maximized.

Tractable Variational Lower Bound. However, the mutual information
$I(X,S)=\mathbb{E}_{P(X,S)}\log\frac{P(X,S)}{P(X)P(S)}$ is computationally
intractable since we do not know $P(X)$. To deal with this issue, a common
practice is to maximize a tractable variational lower bound of the mutual
information (Oord et al., 2018; Hjelm et al., 2019; Poole et al., 2019). Among
them, InfoNCE (Oord et al., 2018) is a popular choice and is successfully
applied in contrastive learning. Generally speaking, a larger InfoNCE
indicates a larger similarity between positive samples (poisoned samples in
NLB), and a smaller similarity between negative samples (between poisoned and
non-poisoned samples). Following this principle, we design an InfoNCE-style
criterion for the poison set ${\mathcal{P}}$ of budget size $M$,

${\mathcal{L}}_{\rm
NCE}({\mathcal{P}})=\sum_{x\in{\mathcal{P}}}\sum_{x^{+}\in{\mathcal{P}}}f(x)^{\top}f(x^{+})-\sum_{x\in{\mathcal{P}}}\log\sum_{x^{\prime}\notin{\mathcal{P}}}\exp(f(x)^{\top}f(x^{\prime})),$
(6)

where $f(\cdot)$ is a variational encoder (we adopt a pretrained SSL model in
practice) and $\tau>0$ is a temperature hyperparameter. When the dataset is
large, the number of negative samples in $X\backslash{\mathcal{P}}$ could be
large. To reduce computation costs, inspired by the fact that
$\log\sum_{x^{\prime}\notin{\mathcal{P}}}\exp(f(x)^{\top}f(x^{\prime}))\geq\max_{x^{\prime}\notin{\mathcal{P}}}f(x)^{\top}f(x^{\prime})$,
we approximate this term with $M$ negative samples with the largest feature
similarities to $x$ (i.e., hard negatives), denoted as
${\mathcal{N}}_{x}\subseteq{\mathcal{X}}\backslash{\mathcal{P}}$. Thus, we
arrive at our poison selection criterion called Total Contrastive Similarity
(TCS),

${\mathcal{L}}_{\rm
TCS}({\mathcal{P}})=\sum_{x\in{\mathcal{P}}}\sum_{x^{+}\in{\mathcal{P}}}f(x)^{\top}f(x^{+})-\sum_{x\in{\mathcal{P}}}\sum_{x^{\prime}\in{\mathcal{N}}_{x}}f(x)^{\top}f(x^{\prime}).$
(7)

Both the positive terms and the negative terms are computed with $M\times M$
pairs of samples.

Efficient Implementation. Since directly finding a $M$-sized poison set
${\mathcal{P}}\subseteq{\mathcal{X}}$ that maximizes Eq. (7) is still NP-hard,
we further reduce it to a sample-wise selection problem for computational
efficiency. Specifically, for each sample $x\in{\mathcal{X}}$, we regard its
$M$ nearest samples as the poison set (denoted as ${\mathcal{P}}_{x}$), and we
choose the poison set ${\mathcal{P}}_{x}$ whose anchor sample $x$ has the
maximal _sample-wise_ contrastive similarity,

$\ell_{\rm
CS}(x)=\sum_{x^{+}\in{\mathcal{P}}_{x}}f(x)^{\top}f(x^{+})-\sum_{x^{\prime}\in{\mathcal{N}}_{x}}f(x)^{\top}f(x^{\prime}).$
(8)

In this way, following the mutual information principle, samples belonging to
the selected poison set have high similarity with each other and small
similarity to the other non-poisoned samples.

(a) Analysis of contrastive NLB

(b) Random selection samples

(c) Contrastive selection samples

Figure 3:  Analysis of contrastive NLB on CIFAR-10. a) backdoor performance of
different variants of contrastive selection; b) & c) t-SNE visualization of
random and contrastive selection.

To summarize, we call the proposed method as a contrastive no-label backdoor,
since it relies on both positive and negative samples to select the poison set
(Eq. 8). In Figure 3(a), we compare the performance of random, positive-only,
negative-only, and contrastive selection, where we can see that the
contrastive selection yields the lowest backdoor accuracy and the highest ASR
(more ablation results in Appendix B.2). Figures 3(b) & 3(c) plot the select
subset in the feature space. Compared to random selection, poisoned samples
with contrastive selection are indeed similar to each other while separating
from the rest, which aligns well with the mutual information principle. More
algorithm details can be found in Appendix A.

##  4 Experiments

In this section, we evaluated the performance of our proposed no-label
backdoor attack method on benchmark datasets and compared it with the baseline
method. See additional results in Appendix B.

Training. We consider two benchmark datasets: a commonly used small dataset
CIFAR-10 (Krizhevsky et al., 2009), and a large-scale dataset ImageNet100
adopted by Saha et al. (2021), which is a 1/10 subset of ImageNet-1k (Deng et
al., 2009) with 100 classes. For each dataset, we split the total training set
into a pre-training set and a downstream task set ($9:1$). For the former, we
discard the labels and use the unlabeled data for self-supervised pretaining,
use the latter split to learn a linear classifier on top of the learned
representation, and evaluate the classification performance on the test data.
For SSL pretraining, we include four well-known SSL methods: SimCLR (Chen et
al., 2020a), MoCo v2 (Chen et al., 2020b), BYOL (Grill et al., 2020), and
Barlow Twins (Zbontar et al., 2021), with default training hyperparameters,
all using ResNet-18 as backbones (He et al., 2016). For pretraining, we train
500 epochs on CIFAR-10 and 300 epochs on ImageNet-100. For linear probing, we
train 100 epochs on CIFAR-10 and 50 epochs on ImageNet-100.

Backdoor Poisoning. We inject poisons to the unlabeled pretraining set with
three no-label backdoors: random selection, K-means-based clustering (Section
3.1), and contrastive selection (Section 3.2). We adopt a simple BadNet (Gu et
al., 2017) trigger by default, and these methods only differ by the selection
of the poison set. By default, the poison rate is 6% for CIFAR-10 and 0.6% for
ImageNet-100.

Table 1: Performance of different SSL methods under different no-label
backdoors on CIFAR-10.

Pretraining | Backdoor | CCR | Clean ACC($\uparrow$) | Poison ACC($\downarrow$) | Poison ASR($\uparrow$)
---|---|---|---|---|---
SimCLR | Random (baseline) | 10.70 | 86.90 | 68.54 | 14.93
Clustering (ours) | 86.93 | 86.97 | 11.02 | 98.80
Contrastive (ours) | 90.41 | 86.43 | 19.59 | 88.21
MoCo v2 | Random (baseline) | 10.70 | 87.89 | 79.52 | 9.02
Clustering (ours) | 86.93 | 87.63 | 41.35 | 44.00
Contrastive (ours) | 90.41 | 87.65 | 41.03 | 62.07
BYOL | Random (baseline) | 10.70 | 90.47 | 85.56 | 6.12
Clustering (ours) | 86.93 | 89.93 | 47.71 | 47.87
Contrastive (ours) | 90.41 | 90.21 | 54.94 | 41.35
Barlow Twins | Random (baseline) | 10.70 | 85.38 | 75.33 | 12.22
Clustering (ours) | 86.93 | 86.10 | 40.26 | 19.66
Contrastive (ours) | 90.41 | 85.55 | 42.97 | 44.30

Table 2: Performance of different SSL methods under different no-label
backdoors on ImageNet-100.

Pretraining | Backdoor | CCR | Clean ACC($\uparrow$) | Poison ACC($\downarrow$) | Poison ASR($\uparrow$)
---|---|---|---|---|---
SimCLR | Random (baseline) | 1.71 | 61.96 | 58.54 | 1.17
Clustering (ours) | 94.30 | 62.16 | 34.74 | 40.30
Contrastive (ours) | 99.72 | 61.48 | 19.34 | 74.46
MoCo v2 | Random (baseline) | 1.71 | 70.74 | 67.90 | 0.91
Clustering (ours) | 94.30 | 71.24 | 59.38 | 12.26
Contrastive (ours) | 99.72 | 70.86 | 38.90 | 50.44
BYOL | Random (baseline) | 1.71 | 67.32 | 53.24 | 6.51
Clustering (ours) | 94.30 | 67.02 | 51.56 | 23.65
Contrastive (ours) | 99.72 | 67.22 | 22.90 | 72.38
Barlow Twins | Random (baseline) | 1.71 | 70.76 | 67.84 | 0.93
Clustering (ours) | 94.30 | 71.16 | 56.76 | 19.79
Contrastive (ours) | 99.72 | 70.10 | 23.18 | 73.85

###  4.1 Performance on Benchmark Datasets

We compare the three no-label backdoor methods (random, clustering,
contrastive) in Table 1 (CIFAR-10) and Table 2 (ImageNet-100).

Comparing with Random Baseline. First, we notice that the random selection
baseline can hardly craft effective no-label backdoors on both datasets: on
CIFAR-10, the ASR is around $10\%$ (random guess); on ImageNet-100, the ASR is
around $1\%$ in most cases. In comparison, the proposed clustering and
contrastive methods can attain nontrivial backdoor performance, degrading the
accuracy by at most 75.85% (86.97% $\to$ 11.02%), and attaining around 70% ASR
on ImageNet-100. Thus, the two selection strategies are both effective NLBs
compared to random selection.

Comparing Clustering and Contrastive Methods. Among the two proposed
backdoors, we notice that the direct contrastive selection outperforms the
clustering approach in most cases, and the advantage is more significant on
the large-scale ImageNet-100 dataset. For example, clustering-based NLB only
attains 19.66%/19.79% ASR for Barlow Twins on CIFAR-10/ImageNet-100, while
contrastive NLB attains 44.3%/73.85% ASR instead. This aligns well with our
analysis of the limitation of clustering-based poisoning (Section 3.1), and
shows that the proposed mutual information principle (Section 3.2) is an
effective guideline for designing NLB.

Comparing to Label-Aware Backdoor (Oracle). For completeness, we also evaluate
label-aware backdoors (LAB) as an oracle setting for no-label backdoors in
Table 3. For a fair comparison, we adopt the same poisoning trigger and
poisoning rate, and the only difference is that with label information, LAB
can select poisoning samples from exactly the same class. Comparing to SimCLR
results of no-label backdoors in Tables 2 & 1, we find that their performance
is pretty close. Notably, the gap between label-ware backdoor and contrastive
NLB is less than 1% in both poison accuracy and ASR when poisoning SimCLR.
Therefore, no-label backdoors can achieve comparable poisoning performance
even if we only have unlabeled data alone.

Table 3: Performance of label-aware backdoors (oracle) for poisoning SimCLR.

Dataset | Poison Class | CCR | Clean ACC($\uparrow$) | Poison ACC($\downarrow$) | Poison ASR($\uparrow$)
---|---|---|---|---|---
CIFAR-10 | Same as Clustering | 100 | 86.56 | 10.35 | 99.60
Same as Contrastive | 100 | 86.57 | 14.10 | 95.34
ImageNet-100 | Same as Clustering | 100 | 61.80 | 30.38 | 53.53
Same as Contrastive | 100 | 61.60 | 18.62 | 74.99

###  4.2 Empirical Understandings

In this part, we further provide some detailed analyses of no-label backdoors.

Poison Rate. We plot the performance of clustering and contrastive NLBs under
different poison rates in Figure 4. We can see that ranging from $0.02$ to
$0.10$, both NLBs maintain a relatively high level of CCR, and attains ASR
higher than $50\%$ in all cases. In particular, contrastive selection
maintains a high degree of class consistency with a high poisoning rate and
achieves nearly $100\%$ ASR, while clustering NLB degrades in this case.
Instead, clustering is more effective under a medium poisoning rate, and
achieves better performance with the range of $0.03$ to $0.06$.

(a) CCR v.s. poison rate

(b) ASR v.s. poison rate

Figure 4: No-label backdoor on SimCLR with different poisoning rates.

Trigger Type. We also evaluate the proposed no-label backdoors with the Blend
trigger (Chen et al., 2017), which mixes the poisoned samples with a fixed
“Hello Kitty” pattern with a default Blend ratio of $0.2$. Table 4 shows that
the two proposed methods are also effective with the Blend trigger.

Table 4: Backdoor Performance with the Blend trigger on CIFAR-10. Backdoor | Clean ACC ($\uparrow$) | Poison ACC ($\downarrow$) | Poison ASR ($\uparrow$)
---|---|---|---
Random (baseline) | 86.52 | 47.71 | 26.57
Clustering (ours) | 86.25 | 30.25 | 71.26
Contrastive (ours) | 85.91 | 30.19 | 73.81

(a) clean samples (without trigger)

(b) backdoored samples (with trigger)

Figure 5: t-SNE visualization on CIFAR-10 test features using a SimCLR encoder
attacked by contrastive backdoor. Different colors mark different classes.

Feature-level Interpretation. At last, we visualize the representations of
clean and backdoored data in Figure 5 using a backdoored SimCLR model to
understand how the backdoor trigger works in the feature level. We can see
that for clean data, the model could learn class-separated clusters (Figure
5(a)); while for backdoored data, the representations of different classes are
mixed together (Figure 5(b)). It shows that when triggered, the backdoored
model (with NLB) can be successfully misled and map all backdoored data to
nearly the same place.

Computation Time. With a pretrained SSL encoder that is often available online
for popular datasets, the poisoning process of no-label backdoors is easy to
implement and fast to compute. In practice, with a single GeForce RTX 3090
GPU, clustering and contrastive NLBs can be completed in 9.3 and 10.2 seconds,
respectively, showing that we can craft effective no-label backdoors very
efficiently.

###  4.3 Performance under Backdoor Defense

At last, we investigate whether the proposed no-label backdoors can be
mitigated by backdoor defense. Finetuning is one of the simplest backdoor
defense method, and it is often adopted for transferring pretrained SSL models
to downstream tasks. Remarkably, Sha et al. (2022) show that almost all
existing backdoors can be successfully removed by a proper configuration of
fine-tuning. Here, we explore whether it is also effective for no-label
backdoors. We adopt the labeled training split for fully fine-tuning of 30
epochs on CIFAR-10 and 15 epochs on ImageNet-100, respectively.

Comparing the fine-tuning results in Table 5 with the original results in
Tables 2 & 1, we find that 1) fine-tuning can indeed defend backdoors by
degrading the ASR and improving backdoor accuracy; but 2) meanwhile, the
backdoors are not easily removable, since there remains nontrivial ASRs (for
example, 83.15% on CIFAR-10 and 24.57% on ImageNet-100) after finetuning,
indicating that no-label backdoors are still resistant to finetuning-based
defense to some extent.

Table 5: Finetuning results of backdoored SimCLR models on CIFAR-10 and ImageNet-100. Dataset | Backdoor | Clean ACC($\uparrow$) | Poison ACC($\downarrow$) | Poison ASR($\uparrow$)
---|---|---|---|---
CIFAR-10 | Clustering (ours) | 88.21 | 24.58 | 83.15
Contrastive (ours) | 88.09 | 35.25 | 70.36
Label-aware (oracle) | 88.54 | 36.52 | 67.57
ImageNet-100 | Clustering (ours) | 64.14 | 57.98 | 4.18
Contrastive (ours) | 64.52 | 49.12 | 24.57
Label-aware (oracle) | 64.14 | 51.56 | 19.54

##  5 Conclusion

In this work, we have investigated a new backdoor scenario when the attacker
only has access to unlabeled data alone. We explored two new strategies to
craft no-label backdoors (NLBs). The first is the clustering-based
pseudolabeling method, which can find same-class clusters in most cases, but
may occasionally fail due to the unstableness of K-means. To circumvent this
limitation, we further propose a new direct selection approach based on the
mutual information principle, named contrastive selection. Experiments on
CIFAR-10 and ImageNet-100 show that both clustering-based and contrastive no-
label backdoors achieve effective backdoor performance, and are resistant to
finetuning-based defense to some extent. As further extensions of dirty-label
and clean-label backdoors, the proposed no-label backdoors show that backdoor
attacks are even possible without using any supervision signals, which poses a
meaningful threat to current foundation models relying on self-supervised
learning.

## Acknowledgements

This project was partially was supported by Office of Naval Research under
grant N00014-20-1-2023 (MURI ML-SCOPE), NSF AI Institute TILOS (NSF
CCF-2112665), and NSF award 2134108.

## References

  * Brown et al. (2020) Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al.  Language models are few-shot learners.  In _NeurIPS_ , 2020.
  * Carlini & Terzis (2022) Nicholas Carlini and Andreas Terzis.  Poisoning and backdooring contrastive learning.  _ICLR_ , 2022.
  * Caron et al. (2021) Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin.  Emerging properties in self-supervised vision transformers.  In _ICCV_ , 2021.
  * Chen et al. (2020a) Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton.  A simple framework for contrastive learning of visual representations.  In _ICML_ , 2020a.
  * Chen et al. (2020b) Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He.  Improved baselines with momentum contrastive learning.  _arXiv preprint arXiv:2003.04297_ , 2020b.
  * Chen et al. (2021) Xinlei Chen, Saining Xie, and Kaiming He.  An empirical study of training self-supervised vision transformers.  _arXiv preprint arXiv:2104.02057_ , 2021.
  * Chen et al. (2017) Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song.  Targeted backdoor attacks on deep learning systems using data poisoning.  _arXiv preprint arXiv:1712.05526_ , 2017.
  * Conrad & Narayan (2021) Ryan Conrad and Kedar Narayan.  Cem500k, a large-scale heterogeneous unlabeled cellular electron microscopy image dataset for deep learning.  _Elife_ , 10:e65894, 2021.
  * Deng et al. (2009) Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  _CVPR_ , 2009.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova.  Bert: Pre-training of deep bidirectional transformers for language understanding.  In _NAACL-HLT_ , 2019.
  * Grill et al. (2020) Jean-Bastien Grill, Florian Strub, Florent Altché, C. Tallec, Pierre H. Richemond, Elena Buchatskaya, C. Doersch, Bernardo Avila Pires, Zhaohan Daniel Guo, Mohammad Gheshlaghi Azar, B. Piot, K. Kavukcuoglu, Rémi Munos, and Michal Valko.  Bootstrap your own latent: a new approach to self-supervised learning.  In _NeurIPS_ , 2020.
  * Gu et al. (2017) Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg.  Badnets: Identifying vulnerabilities in the machine learning model supply chain.  _arXiv preprint arXiv:1708.06733_ , 2017.
  * Hartigan & Wong (1979) John A Hartigan and Manchek A Wong.  Algorithm as 136: A k-means clustering algorithm.  _Journal of the royal statistical society. series c (applied statistics)_ , 28(1):100–108, 1979.
  * He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In _CVPR_ , 2016.
  * He et al. (2020) Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick.  Momentum contrast for unsupervised visual representation learning.  In _CVPR_ , 2020.
  * Hjelm et al. (2019) R Devon Hjelm, Alex Fedorov, Samuel Lavoie-Marchildon, Karan Grewal, Phil Bachman, Adam Trischler, and Yoshua Bengio.  Learning deep representations by mutual information estimation and maximization.  In _ICLR_ , 2019.
  * Jia et al. (2021) Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong.  Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning.  _arXiv preprint arXiv:2108.00352_ , 2021.
  * Krizhevsky et al. (2009) Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * Li et al. (2023) Changjiang Li, Ren Pang, Zhaohan Xi, Tianyu Du, Shouling Ji, Yuan Yao, and Ting Wang.  An embarrassingly simple backdoor attack on self-supervised learning.  In _ICCV_ , 2023.
  * Merity et al. (2017) Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher.  Pointer sentinel mixture models.  In _ICLR_ , 2017.
  * Oord et al. (2018) Aaron van den Oord, Yazhe Li, and Oriol Vinyals.  Representation learning with contrastive predictive coding.  _arXiv preprint arXiv:1807.03748_ , 2018.
  * Poole et al. (2019) Ben Poole, Sherjil Ozair, Aaron Van Den Oord, Alex Alemi, and George Tucker.  On variational bounds of mutual information.  In _ICML_ , 2019.
  * Quinlan (1986) J. Ross Quinlan.  Induction of decision trees.  _Machine learning_ , 1:81–106, 1986.
  * Radford et al. (2021) Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al.  Learning transferable visual models from natural language supervision.  In _ICML_ , 2021.
  * Rousseeuw (1987) Peter J Rousseeuw.  Silhouettes: a graphical aid to the interpretation and validation of cluster analysis.  _Journal of computational and applied mathematics_ , 20:53–65, 1987.
  * Saha et al. (2021) Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, and Hamed Pirsiavash.  Backdoor attacks on self-supervised learning.  _arXiv preprint arXiv:2105.10123_ , 2021.
  * Sha et al. (2022) Zeyang Sha, Xinlei He, Pascal Berrang, Mathias Humbert, and Yang Zhang.  Fine-tuning is all you need to mitigate backdoor attacks.  _arXiv preprint arXiv: 2212.09067_ , 2022.
  * Sun et al. (2017) Chen Sun, Abhinav Shrivastava, Saurabh Singh, and Abhinav Gupta.  Revisiting unreasonable effectiveness of data in deep learning era.  In _ICCV_ , 2017.
  * Tejankar et al. (2023) Ajinkya Tejankar, Maziar Sanjabi, Qifan Wang, Sinong Wang, Hamed Firooz, Hamed Pirsiavash, and Liang Tan.  Defending against patch-based backdoor attacks on self-supervised learning.  In _CVPR_ , 2023.
  * Tsai et al. (2021) Yao-Hung Hubert Tsai, Yue Wu, Ruslan Salakhutdinov, and Louis-Philippe Morency.  Self-supervised learning from a multi-view perspective.  In _ICLR_ , 2021.
  * Turner et al. (2019) Alexander Turner, Dimitris Tsipras, and Aleksander Madry.  Clean-label backdoor attacks.  _OpenReview preprint_ , 2019.
  * Zbontar et al. (2021) Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stéphane Deny.  Barlow twins: Self-supervised learning via redundancy reduction.  In _ICML_ , 2021.

##  Appendix A Algorithm Details

In this section, we show the pseudocode of Clustering-based No-label Backdoor
and Contrastive No-label Backdoor. For clarity, the code is written in a
serial manner, but in actual implementation, both can be easily parallelized
using PyTorch on a GPU. Both algorithms have a very short execution time; on
CIFAR-10, excluding the pre-training and inference times, they require no more
than 3 seconds, significantly shorter than the time needed for pre-training
and inference.

Furthermore, if an existing pre-trained encoder is available, the pre-training
step can be omitted.

###  A.1 Pseudo Code of Clustering-based No-label Backdoor

input :

data : unlabeled data (N*H*W*C).

N : size of the unlabeled data.

M : size of poisoned data.

$K_{c}$ : number of clustering categories in the K-means algorithm.

output :

poison$\\_$idx : indices of the poisoned data.

encoder $\leftarrow$ Pretrain(data)

feature $\leftarrow$ Inference(encoder, data)

clusters $\leftarrow$ Kmeans(feature, K = $K_{c}$)

/* $clusters$ are $K_{c}$ lists, every list has the indices of a clustering
category */

min$\\_$cluster$\\_$size $\leftarrow$ +inf

selected$\\_$cluster $\leftarrow$ none

for  _i $\in$ {0, 1, $\cdots$ , $K_{c}$-1}_ do

2 if  _M $\leq$ len(clusters[i]) $<$ min$\\_$cluster$\\_$size_ then

3 min$\\_$cluster$\\_$size $\leftarrow$ len (clusters[i]) selected$\\_$cluster
$\leftarrow$ clusters[i]

4

poison$\\_$idx $\leftarrow$ random$\\_$sample(selected$\\_$cluster, M)  return
: poison$\\_$idx

Algorithm 1 Clustering-based No-label Backdoor

###  A.2 Pseudo Code of Contrastive No-label Backdoor

input :

data : unlabeled data (N*H*W*C).

N : size of the unlabeled data.

M : size of poisoned data.

output :

poison$\\_$idx : indices of the poisoned data.

encoder $\leftarrow$ Pretrain(data)

feature $\leftarrow$ Inference(encoder, data)

sim$\\_$mat $\leftarrow$ Matmul(feature, feature.T)

for  _idx $\in$ {0, 1,$\cdots$ , N-1}_ do

6 top2Msim $\leftarrow$ TopK$\\_$Value(sim$\\_$mat[idx,:], K=2M) score[idx]
$\leftarrow$ Sum(top2Msim[0:M]) - Sum(top2Msim[M:2M])

anchor$\\_$idx $\leftarrow$ Argmax(score) poison$\\_$idx $\leftarrow$
TopK$\\_$Index(sim$\\_$mat[anchor$\\_$idx], K=M)  return : poison$\\_$idx

Algorithm 2 Contrastive No-label Backdoor

##  Appendix B Additional Results

###  B.1 Performance of Different SSL Poison Encoder for Backdoor Attacks

In the main text, by default, the attacker adopts the SimCLR-trained model for
extracting features used for poison selection. Here, we further compare the
performance of different SSL encoders for poison selection. The poisoned data
are used for training a SimCLR following the default setting.

From Table 6, we can see that both the four SSL methods considered in this
work (SimCLR, MoCo v2, BYOL, Barlow Twins) are comparably effective when used
for crafting no-label backdoor.

Table 6: Results of our attack with different SSL threat models and poison
models on CIFAR-10.

Poison | Backdoor | CCR | Clean ACC($\uparrow$) | Poison ACC($\downarrow$) | Poison ASR($\uparrow$)
---|---|---|---|---|---
SimCLR | Random (baseline) | 10.70 | 86.90 | 68.54 | 14.93
Clustering (ours) | 86.93 | 86.97 | 11.02 | 98.80
Contrastive (ours) | 90.41 | 86.43 | 19.59 | 88.21
MoCo v2 | Random (baseline) | 10.70 | 86.90 | 68.54 | 14.93
Clustering (ours) | 94.63 | 86.85 | 14.74 | 94.44
Contrastive (ours) | 95.37 | 86.51 | 21.67 | 86.52
BYOL | Random (baseline) | 10.70 | 86.90 | 68.54 | 14.93
Clustering (ours) | 97.37 | 86.09 | 16.19 | 92.5
Contrastive (ours) | 88.15 | 86.17 | 12.36 | 97.24
Barlow Twins | Random (baseline) | 10.70 | 86.90 | 68.54 | 14.93
Clustering (ours) | 83.04 | 86.31 | 21.29 | 84.80
Contrastive (ours) | 65.44 | 86.33 | 39.15 | 59.16

###  B.2 Comparison of Random, Positive-only, Negative-only, and Contrastive
Selection

Here, we present a detailed ablation study of the proposed contrastive
selection method in Table 7. We can see that both positive and negative
examples contribute to the final backdoor performance. In particular, both
terms are necessary on ImageNet-100, since ablating any one of them renders
the backdoor ineffective.

Table 7: Results of Random, Positive-only, Negative-only, and Contrastive
Selection on CIFAR-10 and ImageNet-100 when poisoning SimCLR.

Dataset | Backdoor | CCR | Clean ACC($\uparrow$) | Poison ACC($\downarrow$) | Poison ASR($\uparrow$)
---|---|---|---|---|---
CIFAR-10 | Contrastive | 90.41 | 86.43 | 19.59 | 88.21
Positive only | 98.33 | 86.71 | 25.04 | 82.48
Negative only | 62.74 | 86.31 | 40.13 | 39.32
Random | 10.7 | 86.90 | 68.54 | 14.93
ImageNet-100 | Contrastive | 99.72 | 61.48 | 19.34 | 74.46
Positive only | 38.75 | 62.06 | 53.84 | 1.79
Negative only | 44.44 | 61.52 | 44.54 | 3.31
Random | 1.71 | 61.96 | 58.54 | 1.17

###  B.3 Visualization of Different Backdoors

We further visualize the features of model trained with different no-label
backdoors in Figure 6. For clean data, all models could learn class-separated
clusters. For poisoned data, models with no backdoor or random backdoor map
them to random classes, while the model with contrastive backdoor can map most
poisoned samples to the same class, resulting in consistent misclassification
and high ASR.

(a) no backdoor

(b) random backdoor

(c) contrastive backdoor

Figure 6: t-SNE feature visualization of all clean test samples and 100
poisoned test samples (with trigger injected) on CIFAR-10. Three models are
included: a) a clean model with no backdoor, b) a model with random backdoor,
and c) a model with contrastive backdoor.

###  B.4 Comparison of MI criteria

As for the mutual information, our TCS objective is derived following our
general MI principle. Like InfoNCE an InfoMax, its eventual formulation
consists of a positive pair term and a negative pair term, which are the
essential ingradients for estimating MI lower bounds. The other
simplifications that we used in TCS, such as, truncating the number of
negative samples to $M$, are mostly for reducing the overall complexity. The
comparison below shows that these different variants of MI-based selection
criteria (e.g., including InfoNCE) have similar performance for backdoor
poisoning., while TCS has better computation complexity.

Table 8: Comparison of InfoNCE and TCS for contrastive no-label backdoors on CIFAR-10. Selection | CCR | Clean Acc | Poison Acc | ASR
---|---|---|---|---
InfoNCE | 89.30 | 82.54 | 18.63 | 87.92
TCS | 90.41 | 86.43 | 19.59 | 88.21

###  B.5 Results on Modern SSL Methods

To further inverstigate the performance of no-label backdoors for modern SSL
methods, we additional evaluate them on DINO (Caron et al., 2021) and MoCo-v3
(Chen et al., 2021) on ImageNet-100.

As shown below in Table 9, our methods also perform well for poisoning DINO
and MoCo-v3. In comparison, the contrastive method attains much higher ASR
than the clustering method.

Table 9: Evaluation of the two proposed no-label backdoors on ImageNet-100 with DINO and MoCov3. Pretraining | Backdoor | CCR |  Clean ACC($\uparrow$) |  Poison ACC($\downarrow$) |  Poison ASR($\uparrow$)
---|---|---|---|---|---
DINO | clustering | 94.30 | 43.02 | 23.4 | 21.39
| contrastive | 99.72 | 44.24 | 15.24 | 55.03
MoCov3 | clustering | 94.30 | 71.5 | 46.9 | 36.78
| contrastive | 99.72 | 71.34 | 26.46 | 69.79

###  B.6 Transferability of Backdoors

In the main paper, we evaluate backdoors with on a downstream task with the
same label set, which is a common setting among SSL backdoors (Saha et al.,
2021). Following your advice, we also evaluate the performance of label-aware
and no-label backdoors when transferring from a ImageNet-100 pretrained model
to CIFAR-10. As the classes shift, now the task of backdoor attack becomes
degrading the poison accuracy as much as possible.

As shown below, label-aware and no-label backdoors are both effective when
transferred across datasets. Our contrastive no-label backdoors attain an even
lower poison accuracy.

Table 10: Transferability of backdoor attacks across datasets (ImageNet-100 to CIFAR-10). Backdoor | Clean ACC(↑) | Poison ACC(↓)
---|---|---
Ours (no-label) | 68.02 | 45.84
Saha et al. (2021) (label-aware) | 69.49 | 47.79

###  B.7 Additional Analysis on Selected Poison Set

To further investigate properties of the poison subset chosen by different
methods, we further calculate the label distribution of the poison set (Figure
7(a)) and the overlap ratio between different poison sets (Figure 7(b)). We
can see that some poison sets have high correlation (e.g., 74%), while some
have zero correlation. Upon our further investigation, we find that the high
correlation subsets have the same majority class, and vice versa. This
provides a useful insight into the poison sets selected by different methods.

(a) Poison data category distribution

(b) Overlap ratios

Figure 7: Statistics of the poison set selected with different pretraining and
poisoning methods.

###  B.8 Clustering without Knowledge of Cluster Size

We note that the number of ground-truth classes $K$ might be unknown in some
unlabeled datasets. Under such circumstances, one can utilize existing
strategies to automatically estimate $K$ from data. Here, we try the well-
known Silhouette Score (Rousseeuw, 1987). As shown in Table 11 below, $K=11$
delivers the highest Silhouette Score, which is very close to the ground truth
$K=10$ for CIFAR-10. Table 12 shows that $K=10$ and $K=11$ have pretty close
CCR, meaning that they are almost equally well for backdoor attack. Therefore,
we can indeed get good estimation of $K$ from unlabeled dataset even if it is
unknown.

Table 11: Silhouette Score computed with SimCLR representations on CIFAR-10.

$K$ | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14
---|---|---|---|---|---|---|---|---|---|---
Score | 0.066 | 0.071 | 0.0774 | 0.0784 | 0.0814 | 0.0821 | 0.0835 | 0.0825 | 0.0822 | 0.0796

Table 12: CCR with different $K$s on CIFAR-10. $K$ | 5 | 10 | 11 | 15 | 20
---|---|---|---|---|---
CCR |  0.74$\pm$0.22 |  0.82$\pm$0.19 | 0.83$\pm$0.15 |  0.70$\pm$0.24 |  0.70$\pm$0.25

###  B.9 Performance against PatchSearch Defense

Besides the general finetuning-based defense explored in Section 4.3, we
further evaluate no-label backdoors on a defense algorithm specified for SSL,
named PatchSearch (Tejankar et al., 2023). We also include label-aware
backdoors (Saha et al., 2021) as an oracle baseline.

As shown in Table 13, PatchSearch outperforms finetuning-based defense and is
effective for both label-aware and our no-label backdoors. More specifically,
our no-label backdoors are more resistant to PatchSearch defense than label-
aware methods since both methods attain higher ASRs.

Table 13: Performance of different SSL backdoors against PatchSearch defense on ImageNet-100. Method |  Clean ACC($\uparrow$) |  Poison ACC($\downarrow$) |  Poison ASR($\uparrow$)
---|---|---|---
Label-aware | 61.36 | 55.86 | 1.68
Contrastive NLB | 61.44 | 55.94 | 2.44
Clustering NLB | 61.28 | 55.96 | 2.38

##  Appendix C Experiment Details

Backdoor Injection. We inject BadNets/Blend trigger following the common
practice. For CIFAR-10, we add a small 3x3 trigger in the poisoned images for
BadNets, and add a “hello kitty” pattern for Blend with a blend ratio of 0.2.
For ImageNet-100, we randomly paste a fixed patch to a random position on the
image, and make its length and width equal to 1/6 of the image. We show
examples of the clean and poisoned images in Figure 8.

Evaluation Metrics. We define the evaluation metrics adopted in this work
below.

CCR. This metric is used to assess whether the selected category has
consistent labels. Assuming we have a sample size of $M$, and $C$ is the
number of classification categories. Denote a pair of examples as
$(x_{i},y_{i})$, where $x_{i}$ is the input and $y_{i}$ is the label. For the
$c$-th category, $\operatorname{CCR}_{c}$ is calculated by:

$\operatorname{CCR}_{c}=\sum_{i=0}^{M-1}\textbf{1}[\hat{y}(x_{i})=c]/M.$

And CCR is calculated by:

$\operatorname{CCR}=\max_{c\in[0,C-1]}\operatorname{CCR}_{c}.$

ASR. This metric is used to assess whether the targets of attacks are
concentrated. We apply triggers to the evaluation dataset to generate a poison
dataset. Let $N$ be the size of the dataset, $C$ be the number of
classification categories, and $f(x_{i})$ represent the predicted label of the
i-th sample. For the c-th category, $\operatorname{ASR}_{c}$ is calculated by:

$\operatorname{ASR}_{c}=(\sum_{i=0}^{N-1}\textbf{1}[(y_{i}\neq
c)\wedge(f(x_{i})=c)])/(\sum_{i=0}^{N-1}\textbf{1}[y_{i}\neq c]).$

And ASR is calculated by:

$\operatorname{ASR}=\max_{c\in[0,C-1]}\operatorname{ASR}_{c}.$

For all experiments in the paper (aside from random poison method), the value
of $c$ that maximizes $\operatorname{ASR}_{c}$ is the same as the value of c
that maximizes $\operatorname{CCR}_{c}$.

(a) CIFAR10
Clean

(b) CIFAR10
BadNets

(c) CIFAR10
Blend

(d) ImageNet100
Clean

(e) ImageNet100
BadNets

Figure 8: Clean samples and poisoned samples instances in CIFAR-10 and
ImageNet-100.


# CyNER: A Python Library for Cybersecurity Named Entity Recognition

Md Tanvirul Alam1, Dipkamal Bhusal1, Youngja Park2, Nidhi Rastogi1
1Rochester Institute of Technology, USA
<EMAIL_ADDRESS>
2IBM T. J. Watson Research Center, USA
<EMAIL_ADDRESS>

###### Abstract

Open Cyber threat intelligence (OpenCTI) information is available in an
unstructured format from heterogeneous sources on the Internet. We present
CyNER, an open-source python library for cybersecurity named entity
recognition (NER). CyNER combines transformer-based models for extracting
cybersecurity-related entities, heuristics for extracting different indicators
of compromise, and publicly available NER models for generic entity types. We
provide models trained on a diverse corpus that users can readily use. Events
are described as classes in previous research - MALOnt2.0 Christian et al.
(2021) and MALOnt Rastogi et al. (2020) and together extract a wide range of
malware attack details from a threat intelligence corpus. The user can combine
predictions from multiple different approaches to suit their needs. The
library is available in Github 111https://github.com/aiforsec/CyNER and a
video demonstrating the use case is available in
YouTube.222https://youtu.be/E4uKCrKKaP8

CyNER: A Python Library for Cybersecurity Named Entity Recognition

Md Tanvirul Alam1, Dipkamal Bhusal1, Youngja Park2, Nidhi Rastogi1 1Rochester
Institute of Technology, USA<EMAIL_ADDRESS>2IBM T. J. Watson
Research Center, USA<EMAIL_ADDRESS>

##  1 Introduction

A large amount of open cyber threat and attack information, also called cyber
threat intelligence (openCTI), is available on the Internet on platforms such
as security blogs, the dark web, software vendors bulletin boards, official
news and social networks Yi et al. (2020). Both structured and unstructured
forms of openCTI can benefit security operations center (SOC) analysts and
researchers in their increasingly complex jobs of triaging false alerts,
finding zero-day attacks, protecting intellectual property, and preventing
intrusions from adversaries. However, access to this information from openCTI
has remained relatively untapped due to limited research enabling aggregation
and structuring of threat intelligence incidents. Furthermore, there is a lack
of a gold standard dataset in cybersecurity, which is the first prerequisite
for the basic task of information extraction or train any modern natural
language processing (NLP) method.

Current methods rely on structured knowledge bases such as the cybersecurity
vulnerability enumeration (CVE)333https://cve.org database, mitre att&ck
framework(att&ck)444https://attack.mitre.org/ to extract named entities which
result in high accuracy but produce poor performance when similar entities are
extracted from unstructured, complex threat reports, which is more often the
case. Conditional random fields (CRF) Joshi et al. (2013), support vector
machine (SVM) Deliu et al. (2017), and many learning models have been
unsuccessful in yielding satisfactory results in extracting cybersecurity
events from openCTI. While transformer-based methods, such as BERT Devlin et
al. (2018), have been explored, the cybersecurity concepts extracted provided
a limited advantage over information extracted from structured sources such as
CVE Xie et al. (2021).

To address the challenges above, we propose CyNER, a generic python library
for extracting cybersecurity threat intelligence incidents. Specifically, we
make the following contributions:

  1. 1.

We provide a manually-labeled, benchmark dataset annotated on a wide range of
cybersecurity incidents. While the annotated corpus relates to Android malware
threat analysis, the concepts are generic enough to apply to other security
threats. We also provide a corpus of noise-free, high-quality openCTI reports
written on android malware analysis.

  2. 2.

We provide CyNER, an easy to use python library that allows access to
transformer-based NER models pre-trained on high-fidelity security events
(e.g., malware, vulnerability) and a heuristic model for threat indicators
(e.g., malware hashes, compromised IP addresses). In addition, we include
support for extracting generic entity types with popular NLP libraries.

  3. 3.

We provide a flexible and modular implementation of CyNER and user
documentation. The library provides the option to combine prediction from
multiple models with configurable priority settings.

Our proposed framework, CyNER allows cybersecurity information extraction
using NER models that deliver high accuracy. The malware-related threat
intelligence discovery combines malware data with general world concepts,
integrates "knowledge," correlation, and concept grouping, and therefore,
generates inference and insights for SOC analysts.

In this work, we instantiate existing malware ontologies Rastogi et al.
(2020); Christian et al. (2021) using a corpus comprising over 60 high quality
and large threat intelligence reports written between 2018-2021 and downloaded
from websites belonging to security and technology organizations (Kaspersky,
Symantec, McAfee). The annotated text contains entities manually generated by
graduate students trained by their advisor experienced in cybersecurity. We
build on the existing strengths of the security, semantic web, and natural
language domains. Security ontologies Rastogi et al. (2020) Swimmer (2008) are
extended to extract cyber security threat intelligence from online sources.
Other benefits include the interoperability of information across applications
and creating labeled features for machine learning models. Using ontologies
when labeled data allows queries over large datasets to identify trends and
predict future occurrences.

##  2 Related Work

Security ontologies (like malware) have attempted to provide a structure to
security concepts that capture event analysis Swimmer (2008) primarily to
collate data and distribute it across organizations and institutions Barnum
(2012); Connolly et al. (2014). Other models for extracting and structuring
threat intelligence focus on one of the following - identifying attack
patterns, software vulnerabilities, threats, or information dissemination.

CVE555https://cve.mitre.org/, NVD666https://nvd.nist.gov/ are vulnerability
tracking programs where the security community feeds information. For sharing
threat intelligence, there are industry standards like Structured Threat
Information eXpression (STIX)Barnum (2012), which provides a language-agnostic
framework to capture threat intelligence into a shareable package. In
contrast, a trusted automated exchange of indicator information (TAXII)
Connolly et al. (2014) is a platform that can send and receive the STIX
package.

##  3 System Overview

Figure 1: System diagram of the CyNER library

The primary goal of our library is to provide cybersecurity researchers with
models for extracting cybersecurity entities and provide the framework to
train new models on annotated datasets. We show a detailed system diagram of
our library in Figure 1. In this section, we discuss the three key components
of our framework - using pretrained models for prediction, training models on
new datasets, and augmenting prediction using a combination of different
models.

###  3.1 Pretrained Model for Prediction

We provide three different types of models that users can readily use to
extract cybersecurity entities-

####  3.1.1 Transformer models pretrained on cybersecurity corpus

We train transformer models on an annotated cybersecurity corpus and add the
pretrained models in our library. Our dataset consists of five classes-
malware, indicator, system, organization, and vulnerability. These models
allow users to extract named entities related to the cybersecurity domain. We
use the tner library Ushio and Camacho-Collados (2021) to train the models.

####  3.1.2 Heuristic for indicators of compromise

We provide a heuristic-based approach for categorizing different indicators of
compromise, e.g., URL, IP address, hash, etc. These entities do not require an
understanding of the context they appear in and can be usually extracted with
regular expression matching. We use regular expression templates proposed in
earlier work on cybersecurity NER Yi et al. (2020); Piplai et al. (2020). We
show some example regex patterns in Table 1.

####  3.1.3 Generic NER models

Sometimes entities that do not fall under cybersecurity concepts may be of
interest when analyzing threat reports. For example, extracting targeted
countries of a malware attack from threat reports can give important insight
regarding its behavior. Off-the-shelf NER models provided in popular NLP
libraries, which are trained on generic corpus like Ontonotes Hovy et al.
(2006) can achieve good accuracy on such classes of entities Kim et al.
(2020). We integrate Flair Akbik et al. (2019) and spaCy777https://spacy.io/
with our library, and users can readily use the pretrained NER models
available in those libraries.

###  3.2 Model Training

We provide modules for finetuning transformer language models on user-provided
datasets. We use Huggingface’s transformer library Wolf et al. (2019) for
finetuning. The user can use pretrained language models available in the
transformer library and set different hyperparameters during model finetuning.

###  3.3 Combining Prediction from Multiple Approaches

We provide a simple yet intuitive mechanism for combining predictions from
different methods. The user can use any combination of the available models
(transformers, heuristics, flair, spacy) for making a prediction. The user can
also define priority when merging outputs from multiple models using a keyword
argument priority. The default value of the priority is ’HTFS,’ which
indicates that the output from the heuristic approach will be given the
highest priority, followed by the prediction from the given transformer model,
followed by the Flair and Spacy models (if provided). If there is an overlap
between predicted entity positions from multiple approaches, we use the
prediction from the highest priority one.

Entity Types | Regular Expression
---|---
FilePath | r’[a-zA-Z]:\\\\([0-9a-zA-Z]+)’, r’(\/[^\s\n]+)+’
Email | r’[a-z][_a-z0-9-.]+@[a-z0-9-]+[a-z]+’
SHA256 | r’[a-f0-9]{64}|[A-F0-9]{64}’
SHA1 | r’[a-f0-9]{40}|[A-F0-9]{40}’
CVE | r’CVE—[0-9]{4}—[0-9]{4,6}’
IPv4 | r’^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\\.(?!$)|$)){4}$’

Table 1: Example regular expressions used in heuristics based detection

##  4 Datasets

Figure 2: Example annotation from BRAT

We collected approximately 60 threat intelligence reports referenced in the
MITRE att&ck website under the software
category.888https://attack.mitre.org/software/ Each threat report describes a
unique malware. Since cleaning unstructured CTI reports can be very
challenging Kim et al. (2020), we manually extract the clean text from each
report. We use the BRAT annotation tool Stenetorp et al. (2012) for annotating
the corpus. Example annotation is shown in Figure 2.

Our dataset consists of five classes of high importance for analyzing threat
reports - malware, indicators of compromise, system, organization, and
vulnerability. The malware class encapsulates viruses, trojans, ransomware,
etc. Operating system (e.g., Android, Windows), software (e.g., Adobe flash
player, Skype), and hardware. Indicators of compromise comprise domain name,
URL, IP address, filename, Hash, email, port number, etc. Vulnerability
includes both CVE ID (e.g., CVE-2012-2825) and mention of exploits (e.g.,
master key vulnerability). It is worth noting that other types of entities
like location and person are also important when analyzing threat reports.
However, these and other generic entities can be extracted well using
different off-the-shelf models Kim et al. (2020). As a result, we added the
support to extract such entities using other NLP libraries and did not include
them in our annotation.

We split the corpus into train, dev, and test split containing 40, 10, and 10
documents, respectively. Statistics of different types of entities in each
split are displayed in Table 2. We convert the annotation in BIO format for
training, B-prefix indicating the beginning of a tag and the I-prefix
indicating the inside of that tag. An outside (O) tag is used to indicate a
token that does not belong to any of the five categories. We have 106991 total
tokens in the complete corpus, with 4530 tagged entities.

Split | Malware | Indicator | System | Organization | Vulnerability
---|---|---|---|---|---
Train | 703 | 1021 | 837 | 284 | 48
Dev | 254 | 208 | 182 | 92 | 9
Test | 242 | 261 | 248 | 131 | 10

Table 2: Dataset statistics showing the number of instances of different
classes.

##  5 Evaluation

###  5.1 Experimental Settings

We finetune transformer models available in Huggingface’s transformers library
Wolf et al. (2019) for sequence tagging. We train both base and large variants
of BERT Devlin et al. (2018), RoBERTa Liu et al. (2019) and XLM-RoBERTa
Conneau et al. (2019) models. We add a linear layer to the hidden layer
representation obtained from the transformer model for the token
classification task. We train each model for 20 epochs with a sequence length
of 128. We use an initial learning rate of 1e-5 for the base models and 5e-6
for the large models. We use 32 samples for each mini-batch. All models are
trained using AdamW optimizer Loshchilov and Hutter (2017) on a single Nvidia
Tesla V100 GPU.

###  5.2 Results

We report the span micro-F1 score computed by the seqeval
999https://pypi.org/project/seqeval/ library. We report results for the six
different transformer models on Table 3. XLM models outperform both BERT and
RoBERTa models, despite being multilingual. XLM-RoBERTa-large model achieves
the best average F1 score of 76.66%. Class-specific precision, recall, and
F1-score are displayed in Table 4. The model performs relatively poorly on the
Organization class compared to others.

Model | Precision | Recall | F1-score
---|---|---|---
BERT-base-uncased | 69.67 | 69.88 | 69.77
BERT-large-uncased | 72.69 | 73.45 | 73.07
RoBERTa-base | 37.22 | 42.50 | 39.69
RoBERTa-large | 34.76 | 44.18 | 38.91
XLM-RoBERTa-base | 74.57 | 77.23 | 75.88
XLM-RoBERTa-large | 75.30 | 78.07 | 76.66

Table 3: Result on the test dataset for different Transformer models.

Class | Precision | Recall | F1-score
---|---|---|---
Malware | 79.82 | 75.11 | 77.39
Indicator | 78.34 | 86.62 | 82.27
System | 70.36 | 79.93 | 74.84
Organization | 70.64 | 60.16 | 64.98
Vulnerability | 100.0 | 80.0 | 88.89

Table 4: Result for different classes in test set for XLM-RoBERTa-large model.

⬇

import cyner

text=’Proofpoint report mentions that the German-language messages were turned
off once the UK messages were established, indicating a conscious effort to
spread FluBot 446833e3f8b04d4c3c2d2288e456328266524e396adbfeba3769d00727481e80
in Android phones.’

model = cyner.CyNER(’xlm-roberta-large’, use_heuristic=False,
flair_model=None)

entities = model.get_entities(text)

for e in entities:

print(e)

#output

Mention: Proofpoint, Class: Organization, Start: 0, End: 10, Confidence: 0.82

Mention: FluBot, Class: Malware, Start: 156, End: 162, Confidence: 0.92

Mention: 446833e3f8b04d4c3c2d2288e456328266524e396adbfeba3769d00727481e80,
Class: Indicator, Start: 163, End: 227, Confidence: 0.90

Mention: Android, Class: System, Start: 231, End: 238, Confidence: 1.00

Listing 1: Prediction with only pretrained transformer model (Mention: entity
extracted from the text, Class: entity label, Start: starting character
position in the given text, End: ending character position in the given text,
Confidence: confidence/probability of detection)

⬇

model = cyner.CyNER(transformer_model=’xlm-roberta-large’, use_heuristic=True,
flair_model=None, priority=’HTFS’)

entities = model.get_entities(text)

for e in entities:

print(e)

#output

Mention: 446833e3f8b04d4c3c2d2288e456328266524e396adbfeba3769d00727481e80,
Class: SHA256, Start: 163, End: 227, Confidence: 1.00

Mention: Proofpoint, Class: Organization, Start: 0, End: 10, Confidence: 0.82

Mention: FluBot, Class: Malware, Start: 156, End: 162, Confidence: 0.92

Mention: Android, Class: System, Start: 231, End: 238, Confidence: 1.00

Listing 2: Prediction with a pretrained transformer model and heuristic for
indicators

⬇

model = cyner.CyNER(transformer_model=’xlm-roberta-large’, use_heuristic=True,
flair_model=’ner’, priority=’HTFS’)

entities = model.get_entities(text)

for e in entities:

print(e)

#output

Mention: 446833e3f8b04d4c3c2d2288e456328266524e396adbfeba3769d00727481e80,
Class: SHA256, Start: 163, End: 227, Confidence: 1.00

Mention: Proofpoint, Class: Organization, Start: 0, End: 10, Confidence: 0.82

Mention: FluBot, Class: Malware, Start: 156, End: 162, Confidence: 0.92

Mention: Android, Class: System, Start: 231, End: 238, Confidence: 1.00

Mention: German-language, Class: MISC, Start: 36, End: 51, Confidence: 1.00

Mention: UK, Class: LOC, Start: 86, End: 88, Confidence: 1.00

Listing 3: Prediction using pretrained transformer model, heuristic for
indicators and Flair NER model

##  6 System Demonstration

###  6.1 Installation

CyNER is available as a python framework in Github. Users can run the
following command for installation:

⬇

pip install git+https://github.com/aiforsec/CyNER.git

###  6.2 Entity extraction with a pretrained model

CyNER allows users to use different combinations of models for extracting
entities. In Listing 1 we show a model initialized to use only pretrained XLM-
RoBERTa-large model. The model can successfully detect the four cybersecurity-
related entities in the text - ’Proofpoint’ as Organization, ’FluBot’ as
malware, ’Android’ as System, and the hash as Indicator.

In listing 2, we combine prediction from the same transformer model with the
heuristic-based approach. We use priority ’HTFS,’ which means prediction from
the heuristic-based detection will be prioritized. The only difference from
the previous output is that the hash is now detected as SHA256, a subcategory
of the Indicator obtained from regular expression matching. Since the output
from the transformer overlaps with the detection from the heuristic and has a
lower priority, it is omitted from the merged prediction.

In listing 3, we add the NER model from Flair on top of transformer and
heuristic approaches.101010This is the default parameter setting for
prediction Note that we do not use the Spacy model by default, so it is not
used for this prediction. Using the Flair NER model allows us to capture two
more generic entities - ’German-language’ as MISC (Miscellaneous) and ’UK’ as
LOC (Location).

###  6.3 Fine tuning Models

Users can fine-tune transformer language models on annotated NER datasets. The
dataset needs to be annotated in the CoNLL 2003 as shown below:

⬇

Proofpoint B-Organization

wrote O

about O

the O

DroidJack B-Malware

RAT I-Malware

side-loaded O

with O

Pokemon B-System

GO I-System

. O

⬇

cfg = {’checkpoint_dir’: ’.ckpt’,

’dataset’: ’dataset/mitre’,

’transformers_model’: ’xlm-roberta-large’,

’lr’: 5e-6,

’epochs’: 20,

’max_seq_length’: 128}

model = cyner.TransformersNER(cfg)

model.train()

Listing 4: Finetuning xlm-roberta-large model

Users can configure different parameters, including dataset path, pretrained
transformer model, learning rate, epochs, maximum sequence length, as shown in
Listing 4.

##  7 Conclusion

In this paper, we have presented a python library for extracting cybersecurity
named entities. We have provided pretrained transformer-based NER models
trained on annotated threat reports. In addition, we have added a heuristic-
based approach for extracting different indicators and incorporated popular
NLP libraries that will allow the user to extract more generic entity types.
We have added flexible options to enable the user to combine predictions from
multiple models with a defined priority order and support finetune language
models on annotated NER corpus. We believe this library will benefit
cybersecurity researchers and practitioners to analyze cybersecurity threat
reports and gather meaningful insights.

## References

  * Akbik et al. (2019) Alan Akbik, Tanja Bergmann, Duncan Blythe, Kashif Rasul, Stefan Schweter, and Roland Vollgraf. 2019.  Flair: An easy-to-use framework for state-of-the-art nlp.  In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics (Demonstrations)_ , pages 54–59.
  * Barnum (2012) Sean Barnum. 2012.  Standardizing cyber threat intelligence information with the structured threat information expression (stix).  _Mitre Corporation_ , 11:1–22.
  * Christian et al. (2021) Ryan Christian, Sharmishtha Dutta, Youngja Park, and Nidhi Rastogi. 2021.  An ontology-driven knowledge graph for android malware.  In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_ , pages 2435–2437.
  * Conneau et al. (2019) Alexis Conneau, Kartikay Khandelwal, Naman Goyal, Vishrav Chaudhary, Guillaume Wenzek, Francisco Guzmán, Edouard Grave, Myle Ott, Luke Zettlemoyer, and Veselin Stoyanov. 2019.  Unsupervised cross-lingual representation learning at scale.  _arXiv preprint arXiv:1911.02116_.
  * Connolly et al. (2014) Julie Connolly, Mark Davidson, and Charles Schmidt. 2014.  The trusted automated exchange of indicator information (taxii).  _The MITRE Corporation_ , pages 1–20.
  * Deliu et al. (2017) Isuf Deliu, Carl Leichter, and Katrin Franke. 2017.  Extracting cyber threat intelligence from hacker forums: Support vector machines versus convolutional neural networks.  In _2017 IEEE International Conference on Big Data (Big Data)_ , pages 3648–3656. IEEE.
  * Devlin et al. (2018) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018.  Bert: Pre-training of deep bidirectional transformers for language understanding.  _arXiv preprint arXiv:1810.04805_.
  * Hovy et al. (2006) Eduard Hovy, Mitch Marcus, Martha Palmer, Lance Ramshaw, and Ralph Weischedel. 2006\.  Ontonotes: the 90% solution.  In _Proceedings of the human language technology conference of the NAACL, Companion Volume: Short Papers_ , pages 57–60.
  * Joshi et al. (2013) Arnav Joshi, Ravendar Lal, Tim Finin, and Anupam Joshi. 2013.  Extracting cybersecurity related linked data from text.  In _2013 IEEE Seventh International Conference on Semantic Computing_ , pages 252–259. IEEE.
  * Kim et al. (2020) Gyeongmin Kim, Chanhee Lee, Jaechoon Jo, and Heuiseok Lim. 2020.  Automatic extraction of named entities of cyber threats using a deep bi-lstm-crf network.  _International journal of machine learning and cybernetics_ , 11(10):2341–2355.
  * Liu et al. (2019) Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019.  Roberta: A robustly optimized bert pretraining approach.  _arXiv preprint arXiv:1907.11692_.
  * Loshchilov and Hutter (2017) Ilya Loshchilov and Frank Hutter. 2017.  Decoupled weight decay regularization.  _arXiv preprint arXiv:1711.05101_.
  * Piplai et al. (2020) Aritran Piplai, Sudip Mittal, Anupam Joshi, Tim Finin, James Holt, and Richard Zak. 2020.  Creating cybersecurity knowledge graphs from malware after action reports.  _IEEE Access_ , 8:211691–211703.
  * Rastogi et al. (2020) Nidhi Rastogi, Sharmishtha Dutta, Mohammed J Zaki, Alex Gittens, and Charu Aggarwal. 2020.  Malont: An ontology for malware threat intelligence.  In _SIGKDD’20: International Workshop on Deployable Machine Learning for Security Defense_ , pages 28–44. Springer.
  * Stenetorp et al. (2012) Pontus Stenetorp, Sampo Pyysalo, Goran Topić, Tomoko Ohta, Sophia Ananiadou, and Jun’ichi Tsujii. 2012.  Brat: a web-based tool for nlp-assisted text annotation.  In _Proceedings of the Demonstrations at the 13th Conference of the European Chapter of the Association for Computational Linguistics_ , pages 102–107.
  * Swimmer (2008) Morton Swimmer. 2008.  Towards an ontology of malware classes.  _Online] January_ , 27.
  * Ushio and Camacho-Collados (2021) Asahi Ushio and Jose Camacho-Collados. 2021.  T-ner: An all-round python library for transformer-based named entity recognition.  In _Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: System Demonstrations_ , pages 53–62.
  * Wolf et al. (2019) Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al. 2019.  Huggingface’s transformers: State-of-the-art natural language processing.  _arXiv preprint arXiv:1910.03771_.
  * Xie et al. (2021) Bo Xie, Guowei Shen, Chun Guo, and Yunhe Cui. 2021.  The named entity recognition of chinese cybersecurity using an active learning strategy.  _Wireless Communications and Mobile Computing_ , 2021.
  * Yi et al. (2020) Feng Yi, Bo Jiang, Lu Wang, and Jianjun Wu. 2020.  Cybersecurity named entity recognition using multi-modal ensemble learning.  _IEEE Access_ , 8:63214–63224.