CNN

    Convolutional Neural Network
d-SNE

    domain adaptation using Stochastic Neighborhood Embedding
GRL

    gradient reversal layer
RDM

    range-Doppler map
FADA

    Few-shot Adversarial Domain Adaptation
FMCW

    frequency-modulated continuous-wave
lse

    log-sum-exp
MDD

    Margin Disparity Discrepancy
ML

    machine learning
DA

    domain adaptation

# Unsupervised Domain Adaptation across FMCW Radar Configurations Using Margin
Disparity Discrepancy

Rodrigo Hernangómez1, Igor Bjelaković13, Lorenzo Servadei24, and Sławomir
Stańczak13  1 Fraunhofer Heinrich Hertz Institute, Berlin, Germany,
<EMAIL_ADDRESS>2Infineon Technologies AG, Munich,
Germany<EMAIL_ADDRESS>3Technical University of Berlin,
Berlin, Germany  4Technical University of Munich, Munich, Germany

###### Abstract

Commercial radar sensing is gaining relevance and machine learning algorithms
constitute one of the key components that are enabling the spread of this
radio technology into areas like surveillance or healthcare. However, radar
datasets are still scarce and generalization cannot be yet achieved for all
radar systems, environment conditions or design parameters. A certain degree
of fine tuning is, therefore, usually required to deploy machine-learning-
enabled radar applications. In this work, we consider the problem of
unsupervised domain adaptation across radar configurations in the context of
deep-learning human activity classification using frequency-modulated
continuous-wave. For that, we focus on the theory-inspired technique of Margin
Disparity Discrepancy, which has already been proved successful in the area of
computer vision. Our experiments extend this technique to radar data,
achieving a comparable accuracy to few-shot supervised approaches for the same
classification problem.

###### Index Terms:

radar, machine learning, deep learning, transfer learning, domain adaptation,
human activity classification

##  I Introduction

Radar, a well-established technology for several industrial areas, has
recently gained attention for other commercial applications like human
monitoring, presence detection or gesture sensing [1, 2, 3] due to the
production of small and compact radar sensors [4]. Here radar offers some
advantages in comparison with computer vision approaches, such as good
performance under poor-lighting conditions or privacy protection (due to the
difficulty to identify individuals from radar images).

Similarly as in the realm of computer vision, the use of radar often comes
hand in hand with machine learning (ML) techniques, including deep learning,
to overcome the burden of handcrafted feature engineering [5]. Due to the
variety of system design parameters at hand, such as modulation techniques or
bandwidth, these ML algorithms are required to generalize well under different
radar setups. This need for inter-domain generalization is common to several
ML problems and it has been studied in recent years under the paradigm of
domain adaptation (DA) [6, 7].

Considered a special case of transfer learning, DA involves modifying an ML
estimator that can be trained with enough data from a source domain, so that
its performance increases when evaluated with data originated from a different
target domain. Unlike other transfer learning approaches, here the mismatch
between source and target domain lies merely in a distinct probability measure
over data rather than in different input or output spaces [7].

The reasons for DA are usually related with insufficient or incomplete data in
the target domain, which can be overcome with the help of data from the source
domain. In ML classification, the missing information is often the labels;
this case is referred to as unsupervised DA. If target data are labeled, we
can apply supervised DA techniques instead [6].

Both supervised and unsupervised DA methods have already been investigated in
the Radar-ML community to overcome several problems, including individual
patient differences [8], aspect angle variations [9], synthetic-to-real
adaptation [10] or environmental differences [11]. In the case of cross-
configuration adaptation, Khodabakhshandeh et al. [12] use supervised
techniques such as Few-shot Adversarial Domain Adaptation (FADA) [13] or
domain adaptation using Stochastic Neighborhood Embedding (d-SNE) [14] to
adapt their trained human activity classifier to new frequency-modulated
continuous-wave (FMCW) radar setups using few data.

In this paper, we build on the work in [12] by applying Margin Disparity
Discrepancy (MDD) [15]. In that way, we confirm that this unsupervised
technique, which delivers state-of-the-art results for computer vision
datasets, also works for radar data and thus enables cross-configuration
radar-based human activity classification based on unlabeled data.

##  II Problem Statement

Radar-ML classification deals with the evaluation of a group of radar features
$\boldsymbol{x}\in\mathcal{X}$ obtained from a target to find the underlying
class $y\in\mathcal{Y}$ that best describes some property of the said target.
The input space $\mathcal{X}\subset\mathds{R}^{m}$ is characterized by a
dimension $m$ that depends on the radar technology and preprocessing steps,
while the label space is defined as $\mathcal{Y}=\left\\{1,\ldots,k\right\\}$,
with $k$ being the number of classes.

In order to achieve this classification, one has first to find a classifier
$h$ that maps $\boldsymbol{x}$ into $y$. The ML approach assumes a
sufficiently large amount of data available conveying information both about
the inputs and the class so that it can be used to train $h$ among a
restricted hypothesis class $\mathcal{H}$. This dataset consists of a sequence
of pairs of features and labels, i.e.
$\left\\{\left(\boldsymbol{x}_{i},y_{i}\right)\right\\}^{n}_{i=1}$, that have
been previously sampled from a certain domain $\mathcal{D}$, defined to be

$\mathcal{D}=\left(\mathcal{X},\mathcal{Y},p_{\mathcal{D}}\right),$ (1)

with an associated probability measure $p_{\mathcal{D}}$ over
$\mathcal{X}\times\mathcal{Y}$. Here and hereafter, we write $\mathbf{x}$ and
$\mathrm{y}$ in their upright form whenever we refer to the random variables
related to $p_{\mathcal{D}}$, and not to its realizations.

By choosing an objective loss function

$\ell:\;\mathcal{H}\times\mathcal{X}\times\mathcal{Y}\rightarrow\mathds{R}_{0+}$
(2)

and minimizing it over the hypothesis class $\mathcal{H}$ with a suitable
optimization method, we can train an $h$ that performs well for the available
data. The performance of $h$ can thus be measured by the risk associated with
the loss for a domain $\mathcal{D}$. This risk $\mathcal{L}_{\mathcal{D}}$
represents the expected value of the loss of $h$ for $p_{\mathcal{D}}$:

$\mathcal{L}_{\mathcal{D}}\left(h\right)=\mathds{E}_{\mathcal{D}}\ell\left(h,\left(\mathbf{x},\mathrm{y}\right)\right).$
(3)

By assuming the indicator function
$\mathds{1}_{h\left(\boldsymbol{x}\right)\neq y}$ to be the loss, we obtain
the 0-1 error
$\textrm{err}_{\mathcal{D}}\left(h\right)\triangleq\mathds{E}_{\mathcal{D}}\mathds{1}_{h\left(\mathbf{x}\right)\neq\mathrm{y}}$.
In practice, we do not have access to $p_{\mathcal{D}}$, so we resort to its
empirical approximation
$\mathcal{L}_{\widehat{\mathcal{D}}}\left(h\right)\triangleq\sum_{i=1}^{n}{\ell\left(h,\left(\boldsymbol{x}_{i},y_{i}\right)\right)}/n$
for a dataset $\widehat{\mathcal{D}}$ with $n$ samples drawn from
$\mathcal{D}$.

If generalization is achieved, $h$ will also behave well for unseen data as
long as it is drawn from the same domain. Unfortunately, this assumption
cannot always be guaranteed. It is often the case that training data have been
drawn from a source domain $\mathcal{S}$ but we would like to leverage the
trained classifier for a different target domain $\mathcal{T}$. Depending on
how dissimilar $\mathcal{S}$ and $\mathcal{T}$ are, the performance of the
trained classifier can degrade significantly. In our specific problem, this
domain shift is given by the choice of different FMCW settings and presents an
additional challenge in the lack of the labels for the training data from
$\mathcal{T}$. The absence of labeled target data makes it necessary to apply
unsupervised DA. In this paper, we explore this possibility by using Margin
Disparity Discrepancy (MDD) [15].

###  II-A Margin Disparity Discrepancy

In order to use MDD, we assume a hypothesis class induced by a space
$\mathcal{F}$ of scoring functions $f:\>\mathcal{X}\mapsto\mathds{R}^{k}$. We
also introduce the shorthand $f_{y}\left(\boldsymbol{x}\right)$ to refer to
the $y$-th component of $f\left(\boldsymbol{x}\right)$. The hypothesis class
is given by

$\mathcal{H}\triangleq\left\\{h_{f}:\>\boldsymbol{x}\mapsto\operatorname*{arg\,max}_{y\in\mathcal{Y}}{f_{y}\left(\boldsymbol{x}\right)}\mid
f\in\mathcal{F}\right\\}\,.$ (4)

MDD has been developed by Zhang et al. [15] as a practical algorithm based on
the concept of discrepancy distance by Mansour et al. [16]. For that, they
define the margin loss
$\textrm{err}^{\left(\rho\right)}_{{\mathcal{D}}}\left(f\right)$ as

$\textrm{err}^{\left(\rho\right)}_{{\mathcal{D}}}\left(f\right)\triangleq\mathds{E}_{\mathcal{D}}{\Phi^{\left(\rho\right)}\circ\phi_{f}\left(\mathbf{x},\mathrm{y}\right)}\,,$
(5)
$\phi_{f}\left(\boldsymbol{x},y\right)\triangleq\frac{1}{2}\left(f_{y}\left(\boldsymbol{x}\right)-\max_{y^{\prime}\neq
y}{f_{y^{\prime}}\left(\boldsymbol{x}\right)}\right)\,,$ (6)
$\Phi^{\left(\rho\right)}\left(x\right)\triangleq\begin{cases}0&\rho\leq x\\\
1-x/\rho&0\leq x\leq\rho\\\ 1&x\leq 0\end{cases}\,,$ (7)

and the true and empirical margin disparity between two scoring functions
$f^{\prime}$ and $f$ as

$\textrm{disp}^{\left(\rho\right)}_{{\mathcal{D}}}\left(f^{\prime},f\right)\triangleq\mathds{E}_{\mathcal{D}}{\Phi^{\left(\rho\right)}\circ\phi_{f^{\prime}}\left(\mathbf{x},h_{f}\left(\mathbf{x}\right)\right)}\,,$
(8)
$\textrm{disp}^{\left(\rho\right)}_{\widehat{\mathcal{D}}}\left(f^{\prime},f\right)\triangleq\frac{1}{n}\sum_{i=1}^{n}{\Phi^{\left(\rho\right)}\circ\phi_{f^{\prime}}\left(\boldsymbol{x}_{i},h_{f}\left(\boldsymbol{x}_{i}\right)\right)}\,,$
(9)

to finally formulate the following minimax optimization problem:

$\begin{gathered}\min_{f\in\mathcal{F}}{\textrm{err}^{\left(\rho\right)}_{\widehat{\mathcal{S}}}\left(f\right)+d^{\left(\rho\right)}_{f,\mathcal{F}}\left(\widehat{\mathcal{S}},\widehat{\mathcal{T}}\right)},\\\
d^{\left(\rho\right)}_{f,\mathcal{F}}\left({\mathcal{S}},{\mathcal{T}}\right)\triangleq\sup_{f^{\prime}\in\mathcal{F}}{\left(\textrm{disp}^{\left(\rho\right)}_{{\mathcal{T}}}\left(f^{\prime},f\right)-\textrm{disp}^{\left(\rho\right)}_{{\mathcal{S}}}\left(f^{\prime},f\right)\right)}\,.\end{gathered}$
(10)

Following the principles of unsupervised DA, the MDD term
$d^{\left(\rho\right)}_{f,\mathcal{F}}$ does not make use of any labels
$y_{i}$. Furthermore, the solution to (10) minimizes the 0-1 error of $h_{f}$
in the target domain, as the authors of [15] prove with the following
theoretical bound:

$\textrm{err}_{\mathcal{T}}\left(h_{f}\right)\leq\textrm{err}^{\left(\rho\right)}_{\mathcal{S}}\left(f\right)+d^{\left(\rho\right)}_{f,\mathcal{F}}\left({\mathcal{S}},{\mathcal{T}}\right)+\lambda\,,$
(11)

where $\lambda$ is the ideal combined margin loss:

$\lambda=\min_{f^{*}\in\mathcal{F}}{\left\\{\textrm{err}^{\left(\rho\right)}_{\mathcal{S}}\left(f^{*}\right)+\textrm{err}^{\left(\rho\right)}_{\mathcal{T}}\left(f^{*}\right)\right\\}}\,.$
(12)

The bound in (11) can also be expressed in terms of empirical measures rather
than true probability measures by the addition of Rademacher complexity terms
[17, Chapter 3].

Despite the interesting properties of MDD,
$\Phi^{\left(\rho\right)}\circ\phi_{f}$ is non-smooth, non-convex and its
training causes vanishing and exploding gradients, which leads Zhang et al.
[15] to work with the cross-entropy loss instead. For this, they map
$f\left(\boldsymbol{x}\right)$ to the $k$-simplex via the softmax function
$\sigma$, as it is customary in deep learning, where the elements of
$\sigma\left(\boldsymbol{z}\right)$ are given by

$\sigma_{j}\left(\boldsymbol{z}\right)\triangleq\frac{\exp{z_{j}}}{\sum_{i=1}^{k}{\exp{z_{i}}}},\;\;\text{for
}j=1,\ldots,k\,.$ (13)

The composition of the cross-entropy loss with the softmax yields the log-sum-
exp (lse) loss $\mathsterling_{f}$:

$\mathsterling_{f}\left(\boldsymbol{x},y\right)\triangleq
H\left(\mathds{1}_{j=y},\sigma\left(f\left(\boldsymbol{x}\right)\right)\right)=-\log{\sigma_{y}\left(f\left(\boldsymbol{x}\right)\right)}\\\
=\log{\sum_{y^{\prime}\in\mathcal{Y}}{\exp{\left(f_{y^{\prime}}\left(\boldsymbol{x}\right)-f_{y}\left(\boldsymbol{x}\right)\right)}}}\,.$
(14)

Zhang et al. [15] propose to use $\mathsterling_{f}$ instead of
$\Phi^{\left(\rho\right)}\circ\phi_{f}$ for
$\textrm{err}^{\left(\rho\right)}_{\widehat{\mathcal{S}}}$ and
$\textrm{disp}^{\left(\rho\right)}_{\widehat{\mathcal{S}}}$ in (10). As for
$\textrm{disp}^{\left(\rho\right)}_{\widehat{\mathcal{T}}}$, they use the
adversarial loss $\widetilde{\mathsterling}_{f}$ proposed by Goodfellow et al.
[18], i.e.

$\widetilde{\mathsterling}_{f}\left(\boldsymbol{x},y\right)\triangleq\log{\left(1-\sigma_{y}\left(f\left(\boldsymbol{x}\right)\right)\right)}\,,$
(15)

so that their MDD ultimately becomes

$\widetilde{d}^{\left(\gamma\right)}_{f,\psi,\mathcal{F}}\left({\widehat{\mathcal{S}}},{\widehat{\mathcal{T}}}\right)\triangleq\max_{f^{\prime}\in\mathcal{F}}\mathds{E}_{\boldsymbol{x}^{t}\sim\widehat{\mathcal{T}}}{\widetilde{\mathsterling}_{f^{\prime}}\left(\psi\left(\boldsymbol{x}^{t}\right),h_{f}\left(\psi\left(\boldsymbol{x}^{t}\right)\right)\right)}\\\
-\gamma\mathds{E}_{\boldsymbol{x}^{s}\sim\widehat{\mathcal{S}}}{\mathsterling_{f^{\prime}}\left(\psi\left(\boldsymbol{x}^{s}\right),h_{f}\left(\psi\left(\boldsymbol{x}^{s}\right)\right)\right)}$
(16)

for a margin factor $\gamma>0$ and a feature extractor $\psi$ that levels the
min-player to the max-player [15] (A concrete example of $\psi$ is given in
(27), Section III). The authors explain that this is equivalent to the use of
the margin loss with a margin $\rho=\log{\gamma}$ and that the problem is
still solved for $\mathcal{S}=\mathcal{T}$ [15].

In addition to the results in [15], we observe that the use of the recently
proposed soft-margin softmax [19] instead of $\sigma$ in (14) provides an
upper bound for $\textrm{err}^{\left(\rho\right)}_{\mathcal{S}}$. The entries
of the soft-margin softmax
$\sigma^{\left(\rho\right)}\left(\boldsymbol{z}\right)$ are defined as

$\sigma^{\left(\rho\right)}_{j}\left(\boldsymbol{z}\right)\triangleq\frac{\exp{\left(z_{j}-\rho\right)}}{\exp{\left(z_{j}-\rho\right)}+\sum_{i\neq
j}{\exp{z_{i}}}},\\\ \text{for }j=1,\ldots,k;\;\;\rho\in\mathds{R}_{+}$ (17)

and this induces the soft-margin cross-entropy loss
$\mathsterling_{f}^{\left(\rho\right)}$:

$\mathsterling_{f}^{\left(\rho\right)}\left(\boldsymbol{x},y\right)\triangleq-\log{\sigma^{\left(\rho\right)}_{y}\left(f\left(\boldsymbol{x}\right)\right)}\\\
=\log{\sum_{y^{\prime}\in\mathcal{Y}}{\exp{\left(f_{y^{\prime}}\left(\boldsymbol{x}\right)-f_{y}\left(\boldsymbol{x}\right)+\rho\cdot\mathds{1}_{y^{\prime}\neq
y}\right)}}}\,.$ (18)

Likewise, a soft-max adversarial loss can also be defined as

$\widetilde{\mathsterling}^{\left(\rho\right)}_{f}\left(\boldsymbol{x},y\right)\triangleq\log{\left(1-\sigma^{\left(\rho\right)}_{y}\left(f\left(\boldsymbol{x}\right)\right)\right)}\,.$
(19)

We prove this soft-margin-based bound with the help of the following Lemma,
which motivates us to investigate $\mathsterling^{\left(\rho\right)}_{f}$
further in Section III.

######  Lemma 1.

The soft-max cross entropy bounds the margin loss as

$\Phi^{\left(\rho\right)}\circ\phi_{f}\left(\boldsymbol{x},y\right)\leq\frac{1}{2\rho}\mathsterling^{\left(2\rho\right)}_{f}\left(\boldsymbol{x},y\right)\,.$
(20)

###### Proof.

First, let us recall the generalized hinge loss [20]:

$\hslash_{f}^{\left(\theta\right)}\left(\boldsymbol{x},y\right)\triangleq\max_{y^{\prime}\in\mathcal{Y}}{\left(f_{y^{\prime}}\left(\boldsymbol{x}\right)-f_{y}\left(\boldsymbol{x}\right)+\theta\cdot\mathds{1}_{y^{\prime}\neq
y}\right)}\,.$ (21)

Noting that the term within $\max_{y^{\prime}\in\mathcal{Y}}$ is null $\forall
y^{\prime}=y$, we have

$\hslash_{f}^{\left(2\rho\right)}\left(\boldsymbol{x},y\right)=\max\left\\{0,\max_{y^{\prime}\neq
y}{f_{y^{\prime}}\left(\boldsymbol{x}\right)-f_{y}\left(\boldsymbol{x}\right)+2\rho}\right\\}=\\\
\max\left\\{0,2\rho-2\phi_{f}\left(\boldsymbol{x},y\right)\right\\}=2\rho\max\left\\{0,1-\phi_{f}\left(\boldsymbol{x},y\right)/\rho\right\\}\,.$
(22)

The last expression in (22) can be derived from (7) if we set $1-x/\rho$
instead of 1 for $x\leq 0$, hence

$\Phi^{\left(\rho\right)}\circ\phi_{f}\left(\boldsymbol{x},y\right)\leq\frac{1}{2\rho}\hslash^{\left(2\rho\right)}_{f}\left(\boldsymbol{x},y\right)$
(23)

and the proof is concluded using the fact that

$\log{\sum_{a\in\mathcal{A}}{\exp{a}}}\geq\max_{a\in\mathcal{A}}{{a}}$ (24)

for any finite set $\mathcal{A}$. ∎

Taking the expectation w.r.t. $p_{\mathcal{S}}$ in (20), we finally obtain

$\textrm{err}^{\left(\rho\right)}_{\mathcal{S}}\left(f\right)\leq\frac{1}{2\rho}\mathds{E}_{\mathcal{S}}{\mathsterling^{\left(2\rho\right)}_{f}\left(\mathbf{x},\mathrm{y}\right)}\,.$
(25)

Despite the gap introduced by Eqs. 23 and 24, we note that Eq. 25 delivers
convincing bounds for a small
$\textrm{err}^{\left(\rho\right)}_{\mathcal{S}}\left(f\right)$, which can be
achieved by training $f$ under enough samples from $\mathcal{S}$.

##  III Experiments

###  III-A Setup

Similarly as in [12], we focus on human activity recognition using data that
have been measured simultaneously with 4 different 60-GHz FMCW radar sensors.
For these measurements, 2 male subjects were recorded separately while
performing 5 different activities: standing, waving, walking, boxing or boxing
while walking. Each one of the radar sensors was configured with a different
set of radar parameters, presented in Table I as I to IV. Here, the divergent
parameters of the different configurations (marked in bold) affect the
temporal and range resolution of the range-Doppler map (RDM) sequences, as
well as the maximum observable scope of the latter. From these configurations,
I has been taken over from [12].

TABLE I: Radar configuration parameters Configuration name | I | II | III | IV
---|---|---|---|---
Chirps per frame | $n_{c}$ | 64 | 64 | 64 | 64
Samples per chirp | $n_{s}$ | 256 | 256 | 128 | 256
Bandwidth | [$\mathrm{GHz}\text{/}$] | 2 | 1 | 2 | 2
Frame period | [$\mathrm{ms}\text{/}$] | 50 | 32 | 32 | 32
Chirp to chirp time | [$\mathrm{\SIUnitSymbolMicro s}\text{/}$] | 250 | 250 | 250 | 250
Range resolution | [$\mathrm{cm}\text{/}$] | 7.5 | 15 | 7.5 | 7.5
Max. range | [$\mathrm{m}\text{/}$] | 6.2 | 12.5 | 4.8 | 6.2
Max. speed | [$\mathrm{m}\text{/}\mathrm{s}$] | 5.0 | 5.0 | 5.0 | 5.0
Speed resolution | [$\mathrm{m}\text{/}\mathrm{s}$] | 0.15 | 0.15 | 0.15 | 0.15
00:10
---
00:11
---
0
---
2
---
4
---

Range [m]
---

00:10
---
00:11
---
time offset [min:sec]
---
-5
---
0
---
5
---

Doppler [m/s]
---

-40
---
-35
---
-30
---
-25
---
-20
---
-15
---
-10
---
-5
---
0
---

Amplitude [dB]
---

Figure 1: Range and Doppler spectrogram for boxing while walking.

The input features $\boldsymbol{x}$ in Fig. 1 comprise both range
($\boldsymbol{x}_{r}$) and Doppler ($\boldsymbol{x}_{d}$) information, i.e.:

$\boldsymbol{x}=\left(\boldsymbol{x}_{r},\boldsymbol{x}_{d}\right),\;\;\boldsymbol{x}_{r},\boldsymbol{x}_{d}\in\mathds{R}^{64\times
128}.$ (26)

The radar preprocessing to produce $\boldsymbol{x}$ is also based on [12],
with the notable addition of cropping and resampling of the spectrograms to
ensure the dimensions in (26) and the scopes of
$02\text{\,}\mathrm{s}\text{/}$, $0.04.8\text{\,}\mathrm{m}\text{/}$ and
$-55\text{\,}\mathrm{m}\text{/}\mathrm{s}$ for the time, range and Doppler
dimensions, respectively.

Despite all the preprocessing, the differences on resolution still yield a
domain shift across configurations that we try to tackle with MDD. For that,
we take both spectrograms as an input to our feature extractor $\psi$. Here we
choose the same topology as in [12]; that is, a pair of twin branches
$\psi_{r}$ and $\psi_{d}$, each one consisting of 3 convolutional layers for
which we concatenate the outputs:

$\psi\left(\boldsymbol{x}\right)\equiv\left(\psi_{r}\left(\boldsymbol{x}_{r}\right),\psi_{d}\left(\boldsymbol{x}_{d}\right)\right).$
(27)

Furthermore, we employ a bottleneck layer of 512 nodes and choose our
hypothesis space $\mathcal{F}$ to be consistent with the structure of the
fully connected layers from [12].

Motivated by Lemma 1, we replace the vanilla loss terms in (16) by the soft-
margin losses $\mathsterling^{\left(\rho\right)}$ and
$\widetilde{\mathsterling}^{\left(\rho\right)}$ with

$\rho=2\log{2}\simeq 1.386$ (28)

and we set the margin factor $\gamma=1$ since the margin $\rho$ is already
included in the loss, effectively rendering MDD as

$\widehat{d}^{\left(\rho\right)}_{f,\psi,\mathcal{F}}\left({\widehat{\mathcal{S}}},{\widehat{\mathcal{T}}}\right)\triangleq\max_{f^{\prime}\in\mathcal{F}}\mathds{E}_{\boldsymbol{x}^{t}\sim\widehat{\mathcal{T}}}{\widetilde{\mathsterling}^{\left(\rho\right)}_{f^{\prime}}\left(\psi\left(\boldsymbol{x}^{t}\right),h_{f}\left(\psi\left(\boldsymbol{x}^{t}\right)\right)\right)}\\\
-\mathds{E}_{\boldsymbol{x}^{s}\sim\widehat{\mathcal{S}}}{\mathsterling^{\left(\rho\right)}_{f^{\prime}}\left(\psi\left(\boldsymbol{x}^{s}\right),h_{f}\left(\psi\left(\boldsymbol{x}^{s}\right)\right)\right)}\,.$
(29)

Other than that, we leave all hyperparameters to the same values as in [15]
and adapt their implementation as in Fig. 2. This has been written in Pytorch
as an instance of adversarial training, where a gradient reversal layer (GRL)
is used to minimize the MDD loss term on $\psi$ while maximizing on
$f^{\prime}$ as the minimax formulation in (10) mandates.

$\psi_{d}$
---
Source
---
Risk
$f$
---
MDD
---

GRL
---

$\hat{y}$
---
$\hat{y}^{\prime}$
---

One-hot
---

$f^{\prime}$
---
Min
---
Max
---
Concatenate
---
$\psi_{r}$
---
Figure 2: MDD adversarial network, adapted from [15].

The number of samples per dataset lies over 1150 samples for the train sets
and over 350 samples for the test sets.

###  III-B Results

We have run unsupervised training experiments for all possible domain pairs
within configurations I-IV and summarized the resulting test accuracies on the
test sets in Table II.

The figures follow the same trend as the results of MDD in computer vision
datasets as reported by Zhang et al. [15]. and presented in Table III. Here
one can compare, for instance, the results using MDD for our FMCW data with
the minimum and maximum accuracies obtained for Office-31, a dataset
containing 4,652 images from three domains [21]. It is also noteworthy that
the highest accuracy for FMCW exceeds both that of the Office-Home dataset
(15,500 images from four domains) [22] and the VisDA dataset (280K real and
synthetic images) [23].

Our results are also comparable with the FADA method for FMCW-based human
activity recognition in [12], which increases the baseline accuracy of
$5060\text{\,}\mathrm{\char 37\relax}\text{/}$ without DA to
$8892\text{\,}\mathrm{\char 37\relax}\text{/}$. Here it is important to note
that MDD is, in contrast to FADA, an unsupervised technique and thus it
presents the advantage of working with unlabeled target data.

TABLE II: Test accuracy [$\mathrm{\char 37\relax}\text{/}$] of MDD for FMCW data | Target configuration
---|---
Source configuration |  | I | II | III | IV
I | - | 91.4 | 90.6 | 88.3
II | 90.9 | - | 89.8 | 89.4
III | 89.4 | 90.4 | - | 89.4
IV | 92.5 | 85.8 | 90.9 | -
TABLE III: Min. and max. accuracy [$\mathrm{\char 37\relax}\text{/}$] of MDD for different datasets Office-31 | Office-Home | VisDa | FMCW
---|---|---|---
72.2-100.0 | 53.6-82.3 | 74.6 (single value) | 85.8-92.5
TABLE IV: Average accuracy comparison [$\mathrm{\char 37\relax}\text{/}$] of the original MDD implementation and the soft-margin version | Office-31 | Office-Home | FMCW
---|---|---|---
Original MDD | 88.9 | 68.1 | 89.525
Soft-margin MDD | 88.3 | 67.6 | 89.9

We have also compared the average accuracy across domain combinations for the
original implementation of MDD in (16) with the average accuracy for our soft-
margin version in (29), taking the Office-31 and Office-Home datasets as well
as our FMCW radar data. The results, which can be seen in Table IV, show
little difference between both implementations.

##  IV Conclusion

In this work, we confirm that the MDD algorithm, which has already shown
promising results for unsupervised DA in the area of computer vision, is also
suitable for radar data across different FMCW parameters. The obtained
accuracy can become as high as for some supervised techniques [12] while using
a much more limited dataset, paving thus the way for a prompt deployment of
radar-based deep learning applications with custom configurations.

In our experiments, we observe that the use of the soft-margin cross entropy
loss provides similar results as the original implementation by Zhang et al.
[15]. Since the motivation of MDD is to bring the algorithms closer to the
analytical performance bounds of DA, we see potential in this alternative loss
function to bridge the gap between theory and practice.

## Acknowledgment

We gratefully acknowledge the support of NVIDIA Corporation with the donation
of the DGX-1 used for this research. We would also like to thank Avik Santra
from Infineon Technologies AG for his support throughout this work.

## References

  * Peng et al. [2017a] Z. Peng, C. Li, J.-M. Muñoz-Ferreras, and R. Gómez-García, “An FMCW radar sensor for human gesture recognition in the presence of multiple targets,” in _2017 First IEEE MTT-S International Microwave Bio Conference (IMBIOC)_ , May 2017, pp. 1–3.
  * Santra et al. [2018] A. Santra, R. V. Ulaganathan, and T. Finke, “Short-Range Millimetric-Wave Radar System for Occupancy Sensing Application,” _IEEE Sensors Letters_ , vol. 2, no. 3, pp. 1–4, Sep. 2018.
  * Lien et al. [2016] J. Lien, N. Gillian, M. E. Karagozler, P. Amihood, C. Schwesig, E. Olson, H. Raja, and I. Poupyrev, “Soli: Ubiquitous gesture sensing with millimeter wave radar,” _ACM Transactions on Graphics_ , vol. 35, no. 4, pp. 142:1–142:19, Jul. 2016.
  * Trotta et al. [2021] S. Trotta, D. Weber, R. W. Jungmaier, A. Baheti, J. Lien, D. Noppeney, M. Tabesh, C. Rumpler, M. Aichner, S. Albel, J. S. Bal, and I. Poupyrev, “2.3 SOLI: A Tiny Device for a New Human Machine Interface,” in _2021 IEEE International Solid- State Circuits Conference (ISSCC)_ , vol. 64, Feb. 2021, pp. 42–44.
  * Santra and Hazra [2020] A. Santra and S. Hazra, _Deep Learning Applications of Short-Range Radars_. Artech House, 2020.
  * Redko et al. [2019] I. Redko, E. Morvant, A. Habrard, M. Sebban, and Y. Bennani, _Advances in Domain Adaptation Theory_. Elsevier, 2019.
  * Kouw and Loog [2018] W. M. Kouw and M. Loog, “An introduction to domain adaptation and transfer learning,” _arXiv:1812.11806 [cs, stat]_ , Dec. 2018.
  * Yin et al. [2019] W. Yin, X. Yang, L. Li, L. Zhang, N. Kitsuwan, R. Shinkuma, and E. Oki, “Self-adjustable domain adaptation in personalized ECG monitoring integrated with IR-UWB radar,” _Biomedical Signal Processing and Control_ , vol. 47, pp. 75–87, Jan. 2019.
  * Chen et al. [2019] Q. Chen, Y. Liu, F. Fioranelli, M. Ritchie, and K. Chetty, “Eliminate Aspect Angle Variations for Human Activity Recognition using Unsupervised Deep Adaptation Network,” in _2019 IEEE Radar Conference (RadarConf)_ , Apr. 2019, pp. 1–6.
  * Li et al. [2020] X. Li, X. Jing, and Y. He, “Unsupervised Domain Adaptation for Human Activity Recognition in Radar,” in _2020 IEEE Radar Conference (RadarConf20)_ , Sep. 2020, pp. 1–5.
  * Stephan et al. [2021] M. Stephan, T. Stadelmayer, A. Santra, G. Fischer, R. Weigel, and F. Lurz, “Radar Image Reconstruction from Raw ADC Data using Parametric Variational Autoencoder with Domain Adaptation,” in _2020 25th International Conference on Pattern Recognition (ICPR)_ , Jan. 2021, pp. 9529–9536.
  * Khodabakhshandeh et al. [2021] H. Khodabakhshandeh, T. Visentin, R. Hernangómez, and M. Pütz, “Domain Adaptation Across Configurations of FMCW Radar for Deep Learning Based Human Activity Classification,” in _2021 21st International Radar Symposium (IRS)_ , Berlin, Germany, Jun. 2021, pp. 1–10.
  * Motiian et al. [2017] S. Motiian, Q. Jones, S. Iranmanesh, and G. Doretto, “Few-Shot Adversarial Domain Adaptation,” _Advances in Neural Information Processing Systems_ , vol. 30, Nov. 2017.
  * Xu et al. [2019] X. Xu, X. Zhou, R. Venkatesan, G. Swaminathan, and O. Majumder, “D-SNE: Domain Adaptation Using Stochastic Neighborhood Embedding,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 2019, pp. 2497–2506.
  * Zhang et al. [2019] Y. Zhang, T. Liu, M. Long, and M. Jordan, “Bridging Theory and Algorithm for Domain Adaptation,” in _International Conference on Machine Learning_. PMLR, May 2019, pp. 7404–7413.
  * Mansour et al. [2009] Y. Mansour, M. Mohri, and A. Rostamizadeh, “Domain Adaptation: Learning Bounds and Algorithms,” in _Proceedings of The 22nd Annual Conference on Learning Theory (COLT 2009)_ , Montréal, Canada, 2009\.
  * Mohri et al. [2018] M. Mohri, A. Rostamizadeh, and A. Talwalkar, _Foundations of Machine Learning_ , 2nd ed. Cambridge, Massachusetts; London, England: MIT Press, Dec. 2018.
  * Goodfellow et al. [2014] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative Adversarial Nets,” in _Advances in Neural Information Processing Systems_ , Z. Ghahramani, M. Welling, C. Cortes, N. Lawrence, and K. Q. Weinberger, Eds., vol. 27. Curran Associates, Inc., 2014, p. 9.
  * Liang et al. [2017] X. Liang, X. Wang, Z. Lei, S. Liao, and S. Z. Li, “Soft-Margin Softmax for Deep Classification,” in _Neural Information Processing_ , ser. Lecture Notes in Computer Science, D. Liu, S. Xie, Y. Li, D. Zhao, and E.-S. M. El-Alfy, Eds. Cham: Springer International Publishing, 2017, pp. 413–421.
  * Shalev-Shwartz and Ben-David [2014] S. Shalev-Shwartz and S. Ben-David, _Understanding Machine Learning: From Theory to Algorithms_. Cambridge university press, 2014.
  * Saenko et al. [2010] K. Saenko, B. Kulis, M. Fritz, and T. Darrell, “Adapting Visual Category Models to New Domains,” in _Computer Vision – ECCV 2010_ , ser. Lecture Notes in Computer Science, K. Daniilidis, P. Maragos, and N. Paragios, Eds. Berlin, Heidelberg: Springer, 2010, pp. 213–226.
  * Venkateswara et al. [2017] H. Venkateswara, J. Eusebio, S. Chakraborty, and S. Panchanathan, “Deep Hashing Network for Unsupervised Domain Adaptation,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 2017, pp. 5018–5027.
  * Peng et al. [2017b] X. Peng, B. Usman, N. Kaushik, J. Hoffman, D. Wang, and K. Saenko, “VisDA: The Visual Domain Adaptation Challenge,” _arXiv:1710.06924 [cs]_ , Nov. 2017.

  *[FMCW]: frequency-modulated continuous-wave
  *[ML]: machine learning
  *[DA]: domain adaptation
  *[FADA]: Few-shot Adversarial Domain Adaptation
  *[d-SNE]: domain adaptation using Stochastic
Neighborhood Embedding

  *[MDD]: Margin Disparity Discrepancy
  *[lse]: log-sum-exp
  *[RDM]: range-Doppler map
  *[GRL]: gradient reversal layer


# BackdoorBox: A Python Toolbox for
Backdoor Learning

Yiming Li , Mengxi Ya∗, Yang Bai, Yong Jiang, Shu-Tao Xia
Tsinghua Shenzhen International Graduate School, Tsinghua University, China
{li-ym18, yamx21<EMAIL_ADDRESS>{jiangy,
<EMAIL_ADDRESS>The first two authors contributed equally to this
toolbox.

###### Abstract

Third-party resources ($e.g.$, samples, backbones, and pre-trained models) are
usually involved in the training of deep neural networks (DNNs), which brings
backdoor attacks as a new training-phase threat. In general, backdoor
attackers intend to implant hidden backdoor in DNNs, so that the attacked DNNs
behave normally on benign samples whereas their predictions will be
maliciously changed to a pre-defined target label if hidden backdoors are
activated by attacker-specified trigger patterns. To facilitate the research
and development of more secure training schemes and defenses, we design an
open-sourced Python toolbox that implements representative and advanced
backdoor attacks and defenses under a unified and flexible framework. Our
toolbox has four important and promising characteristics, including
consistency, simplicity, flexibility, and co-development. It allows
researchers and developers to easily implement and compare different methods
on benchmark or their local datasets. This Python toolbox, namely BackdoorBox,
is available at https://github.com/THUYimingLi/BackdoorBox.

##  1 Introduction

Deep neural networks (DNNs) have demonstrated their superiority in computer
vision (LeCun et al., 2015; Li et al., 2015; Qiu et al., 2021a). In general,
training a well-performed model requires a large number of samples and
computational resources. Accordingly, researchers and developers often use
third-party resources ($e.g.$, samples and backbones) during the training
process or even directly adopt third-party pre-trained models for convenience.
However, the training opacity also introduces the backdoor threat (Gao et al.,
2020; Goldblum et al., 2022; Li et al., 2022b). Specifically, the backdoor
adversaries can implants hidden backdoor into DNNs by maliciously manipulating
the training process ($e.g.$, samples or loss). The attacked models behave
normally in predicting benign samples while having abnormal behaviors when the
backdoor is activated by poisoned samples.

Currently, there were many existing backdoor attacks and defenses (Lin et al.,
2020; Xiang et al., 2021; Zhai et al., 2021; Shen et al., 2021; Tao et al.,
2022; Xiang et al., 2022). Although most of them were open-sourced, there is
still no toolbox that can easily and flexibly implement and compare them
simultaneously. To fill this gap, we design and develop BackdoorBox — a
comprehensive open-sourced Python toolbox that implements representative and
advanced backdoor attacks and defenses under a _unified_ framework that can be
used in a _flexible_ manner.

Table 1: Implemented backdoor attacks in BackdoorBox.

Adversary’s Capacity | Attack Method | Key Properties
---|---|---
Poison-only | BadNets (Gu et al., 2019) | Visible
Blended (Chen et al., 2017) | Invisible
WaNet (Nguyen & Tran, 2021) | Invisible
ISSBA (Li et al., 2021d) |  | Invisible
---
Sample-specific
Physical
Label-consistent (Turner et al., 2019) |  | Invisible
---
Clean-label
TUAP (Zhao et al., 2020b) |  | Invisible
---
Clean-label
Refool (Liu et al., 2020) |  | Sample-specific
---
Clean-label
Sleeper Agent (Souri et al., 2022) |  | Invisible
---
Sample-specific
Clean-label
UBW-P (Li et al., 2022a) |  | Untargeted
---
Dispersable
Training-controlled | Blind (Bagdasaryan & Shmatikov, 2021) | Non-optimized
IAD (Nguyen & Tran, 2020) |  | Optimized
---
Sample-specific
PhysicalBA (Li et al., 2021c) | Physical
LIRA (Doan et al., 2021) |  | Invisible
---
Optimized
Sample-specific

Compared to existing backdoor-related libraries ($e.g.$, TrojanZoo (Pang et
al., 2022) and BackdoorBench (Wu et al., 2022)), BackdoorBox has four distinct
advantages: (1) It contains more than 20 representative backdoor attacks and
defenses covering both classical and advanced methods. (2) It develops all
methods under a unified framework with high consistency. (3) BackdoorBox
allows using user-specified samples and models for attacks and defenses. (4)
It allows using attack and defense modules jointly or separately. We hope that
our toolbox can facilitate the research and development of more secure
training schemes and defenses against backdoor threats.

##  2 Toolbox Characteristics and Dependencies

###  2.1 Toolbox Characteristics

Consistency. Instead of developing each method separately and organizing them
simply, we re-implement all methods in a unified manner. Specifically,
variables having the same function have a consistent name. Similar methods
inherit the same ‘base class’ for further development, have a unified
workflow, and have the same core sub-functions ($e.g.$, get_poisoned_dataset).

Simplicity. We provide code examples for each implemented backdoor attack and
defense to explain how to use them, the definitions and default settings of
all required attributes, and the necessary code comments. Users can easily
implement and develop our toolbox.

Flexibility. We allow users to easily obtain important intermediate outputs
and components of each method ($e.g.$, poisoned dataset and attacked/repaired
model), use their local samples and model structure for all implemented
attacks and defenses, and interact with their local codes. The attack and
defense modules can be used jointly or separately.

Co-development. All codes and developments of BackdoorBox are hosted on GitHub
to facilitate collaboration. At the time of this writing, there are more than
seven contributors have helped develop the code base and others have
contributed to the code test. The co-development mode facilitates rapid and
comprehensive developments and bug findings.

###  2.2 Toolbox Dependencies

Currently, our BackdoorBox is only compatible with Python 3 using PyTorch. It
also relies on numpy, scipy, opencv, pillow, matplotlib, requests, termcolor,
easydict, seaborn, imageio, and lpips. The full dependent package list is
included in the ‘requirements.txt’. People can easily download all required
packages by running:

pip install -r requirements.txt

##  3 The Module of Backdoor Attacks

###  3.1 General Information

We categorize existing backdoor attacks into three main types, including (1)
poison-only backdoor attacks, (2) training-controlled backdoor attacks, and
(3) model-modified backdoor attacks, based on the capacities of backdoor
adversaries. Specifically, under the poison-only setting, the adversaries can
only poison training samples while having no information and cannot control
the training schedule (Gu et al., 2019; Li et al., 2021d; Qi et al., 2023);
The training-controlled backdoor attacks (Zeng et al., 2021; Cheng et al.,
2021; Zhao et al., 2022) allow adversaries to fully control the whole training
process, such as training samples and the training schedule; Model-modified
attacks (Tang et al., 2020; Qi et al., 2022; Bai et al., 2022) enable
adversaries to directly modify the model by inserting malicious sub-modules or
flipping its critical bits (usually in the deployment stage).

Currently, our toolbox has implemented nine poison-only attacks and four
training-controlled attacks, as shown in Table 1. We have not implemented any
model-modified attack at this time because these methods are usually non-
poisoning-based, having limited threat scenarios and well-developed
approaches. We will keep updating this toolbox to include more representative
attacks.

###  3.2 Library Design and Implementation

Design. In our toolbox, since they enjoy a similar or even the same pipeline,
all implemented poison-only backdoor attacks inherit from a base class with
the same interface. Firstly, it first check whether the provided datasets are
supported by our toolbox. Currently, our toolbox supports official MINIST and
CIFAR10 datasets as well as arbitrary local datasets loaded by
torchvision.datasets.DatasetFolder. After that, it will generate poisoned
training and testing datasets that can be obtained by get_poisoned_dataset,
based on which to train and test with the given schedule. During the training
and testing process, it will calculate evaluation metrics, print running
statements, and save necessary materials after every given interval. Users can
also get the attacked model by get_model when the training is finished. In
particular, we implement the trigger appending process in the form of
torchvision.transforms. More importantly, our toolbox allows adding this
process to any particular place of the transformation sequence (instead of
only at the end of it, as done by most of existing methods) by assigning the
poisoned_transform_train_index and the poisoned_transform_test_index
attributes. Accordingly, our toolbox is flexible, allowing users to simulate
real backdoor scenarios. This is one of the advantages of our toolbox,
compared to existing backdoor-related code bases ($e.g.$, TrojanZoo (Pang et
al., 2022) and BackdoorBench (Wu et al., 2022)). For training-controlled
attacks, some of them did not inherit from the previous base class, since they
have different manners. However, we still unify the name of important
variables, attributes, and functions for the convenience of users. This is
also another distinctive advantage of our toolbox. In addition, we also
implement a bool-type attribute deterministic for reproducing the results when
it set to True.

Implementation. To execute an attack, users need to assign the hyper-
parameters of the (benign) training and testing datasets, the attack ($e.g.$,
poisoning rate and target label), the training schedule ($e.g.$, model
structure and learning rate), and the implementation ($e.g.$, adopted GPU and
saving directory). Specifically, users should (1) load necessary packages, (2)
load benign training and testing datasets, (3) define attack parameters, (4)
initialize the attack, (5) assign training schedule, and (6) train (and
obtain) the attacked model. The example of using BadNets is demonstrated in
Appendix A.1. For training-controlled attacks ($e.g.$, IAD and PhysicalBA), as
shown in Appendix A.2, users should adopt get_poisoned_dataset after the
Attack.train (instead of before it), since poisoned samples may most probably
be updated during the training process. In particular, we have provided the
example testing file for each attack in the tests directory for reference.

##  4 The Module of Backdoor Defenses

###  4.1 General Information

We categorize existing backdoor defenses into six main types, including (1)
pre-processing-based defenses, (2) model repairing, (3) poison suppression,
(4) model diagnosis, (5) sample diagnosis, and (6) certified defenses, based
on defense properties. Specifically, the first type of method alleviates
backdoor threats by pre-processing test images before feeding them into the
(deployed) model for prediction (Liu et al., 2017; Li et al., 2021c; Qiu et
al., 2021b), motivated by the observations that backdoor attacks may lose
effectiveness when the trigger used for attacking is different from the one
used for poisoning. These defenses are usually efficient and require minor
defender capacities; Model repairing (Zhao et al., 2020a; Wu & Wang, 2021;
Zeng et al., 2022) aims to erase potential hidden backdoor contained in given
suspicious models; Poison suppression (Du et al., 2020; Huang et al., 2022;
Wang et al., 2022) intends to depress the effects of poisoned samples during
the training process to prevent backdoor creation; Model diagnosis (Tao et
al., 2022; Guo et al., 2022; Xiang et al., 2022) and sample diagnosis (Tran et
al., 2018; Gao et al., 2021; Guo et al., 2023) try to detect whether a given
suspicious model and sample is malicious, respectively; Different from
previous types of defenses whose performances are empirical, certified
defenses (Weber et al., 2022; Jia et al., 2022; Zeng et al., 2023) adopt
randomized smoothing (Rosenfeld et al., 2020) or linear bound propagation (Xu
et al., 2020) to certify the backdoor robustness of a given model under some
conditions and assumptions. However, certified defenses usually suffer from
low effectiveness and efficiency in practice (Li et al., 2021c) since their
assumptions do not hold in real-world situations.

Currently, our toolbox has implemented ten classical and advanced defenses, as
shown in Table 2. We will keep updating this toolbox to include more
representative defenses.

Table 2: Implemented backdoor defenses in BackdoorBox.

Defense Type | Defense Method | Defender’s Capacity
---|---|---
Pre-processing-based | AutoEncoder (Liu et al., 2017) |  | Black-box Model Accessibility
---
Samples for Training Auto-Encoder
ShrinkPad (Li et al., 2021c) | Black-box Model Accessibility
Model Repairing | Fine-tuning (Liu et al., 2018) |  | White-box Model Accessibility
---
Local Benign Samples
Pruning (Liu et al., 2018) |  | White-box Model Accessibility
---
Local Benign Samples
MCR (Zhao et al., 2020a) |  | White-box Model Accessibility
---
Local Benign Samples
NAD (Li et al., 2021b) |  | White-box Model Accessibility
---
Local Benign Samples
Poison Suppression | ABL (Li et al., 2021a) | Training from Scratch
CutMix (Borgnia et al., 2021) | Training from Scratch
DBD (Huang et al., 2022) | Training from Scratch
Sample Diagnosis | SS (Tran et al., 2018) | Obtaining Suspicious Dataset

###  4.2 Library Design and Implementation

Design. Similar to the design of attack module, all defense methods of the
same type have the same core functions, consistent variable names, and the
interface. Specifically, for pre-processing-based defenses, users can (1)
adopt preprocess to obtain pre-processed data, (2) exploit predict to get
predictions of the given (suspicious) model of pre-processed samples, and (3)
test the performance of the defense on given datasets; For model repairing,
users can (1) repair the given (suspicious) model, (2) obtained repaired model
via get_model, and (3) test the performance of the defense on given datasets;
For poison suppression, users can (1) train a benign model based on suspicious
samples, (2) obtain the trained model via get_model, and (3) test its
performance; For sample diagnosis, users can filter malicious samples and test
the detection performance.

Implementation. Please refer to Appendix B for the demo examples for different
types of defenses and the tests directory for the test file of each method.

##  5 Conclusion

This paper presented BackdoorBox, a comprehensive and open-sourced Python
toolbox for backdoor attacks and defenses. The consistency, simplicity, and
flexibility of our toolbox make it an easy tool for researchers and developers
to implement and develop, while the co-development ensures continuous
updating. As avenues for future work, we plan to enhance our toolbox by
implementing more advanced methods, improving its computational efficiency,
supporting pip services, and developing methods towards other tasks and
paradigms ($e.g.$, NLP and federated learning).

## Acknowledgement

This work is supported in part by the National Natural Science Foundation of
China (62171248), the PCNL Key Project (PCL2021A07), the Shenzhen
Philosophical and Social Science Plan (SZ2020D009), the PCNL Key Project
(PCL2021A07), and the Tencent Rhino-Bird Research Program. We also sincerely
thank Guanhao Gan, Kuofeng Gao, Jia Xu, Tong Xu, Sheng Yang, Xin Yan, Haoxiang
Zhong, and Linghui Zhu, from Tsinghua Shenzhen International Graduate School
(SIGS), Tsinghua University, for their assistance in co-developing and testing
this toolbox.

## References

  * Bagdasaryan & Shmatikov (2021) Eugene Bagdasaryan and Vitaly Shmatikov.  Blind backdoors in deep learning models.  In _USENIX Security_ , 2021.
  * Bai et al. (2022) Jiawang Bai, Kuofeng Gao, Dihong Gong, Shu-Tao Xia, Zhifeng Li, and Wei Liu.  Hardly perceptible trojan attack against neural networks with bit flips.  In _ECCV_ , 2022.
  * Borgnia et al. (2021) Eitan Borgnia, Valeriia Cherepanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, and Arjun Gupta.  Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff.  In _ICASSP_ , 2021.
  * Chen et al. (2017) Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song.  Targeted backdoor attacks on deep learning systems using data poisoning.  _arXiv preprint arXiv:1712.05526_ , 2017.
  * Cheng et al. (2021) Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang.  Deep feature space trojan attack of neural networks by controlled detoxification.  In _AAAI_ , 2021.
  * Doan et al. (2021) Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li.  Lira: Learnable, imperceptible and robust backdoor attacks.  In _ICCV_ , 2021.
  * Du et al. (2020) Min Du, Ruoxi Jia, and Dawn Song.  Robust anomaly detection and backdoor attack detection via differential privacy.  In _ICLR_ , 2020.
  * Gao et al. (2020) Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim.  Backdoor attacks and countermeasures on deep learning: A comprehensive review.  _arXiv preprint arXiv:2007.10760_ , 2020.
  * Gao et al. (2021) Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith Ranasinghe, and Hyoungshick Kim.  Design and evaluation of a multi-domain trojan detection method on deep neural networks.  _IEEE Transactions on Dependable and Secure Computing_ , 2021.
  * Goldblum et al. (2022) Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Goldstein.  Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2022.
  * Gu et al. (2019) Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg.  Badnets: Evaluating backdooring attacks on deep neural networks.  _IEEE Access_ , 7:47230–47244, 2019.
  * Guo et al. (2022) Junfeng Guo, Ang Li, and Cong Liu.  Aeva: Black-box backdoor detection using adversarial extreme value analysis.  In _ICLR_ , 2022.
  * Guo et al. (2023) Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu.  Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency.  In _ICLR_ , 2023.
  * Huang et al. (2022) Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren.  Backdoor defense via decoupling the training process.  In _ICLR_ , 2022.
  * Jia et al. (2022) Jinyuan Jia, Yupei Liu, Xiaoyu Cao, and Neil Zhenqiang Gong.  Certified robustness of nearest neighbors against data poisoning and backdoor attacks.  In _AAAI_ , 2022.
  * LeCun et al. (2015) Yann LeCun, Yoshua Bengio, and Geoffrey Hinton.  Deep learning.  _Nature_ , 521(7553):436–444, 2015.
  * Li et al. (2021a) Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma.  Anti-backdoor learning: Training clean models on poisoned data.  In _NeurIPS_ , 2021a.
  * Li et al. (2021b) Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma.  Neural attention distillation: Erasing backdoor triggers from deep neural networks.  In _ICLR_ , 2021b.
  * Li et al. (2021c) Yiming Li, Tongqing Zhai, Yong Jiang, Zhifeng Li, and Shu-Tao Xia.  Backdoor attack in the physical world.  In _ICLR Workshop_ , 2021c.
  * Li et al. (2022a) Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li.  Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection.  In _NeurIPS_ , 2022a.
  * Li et al. (2022b) Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia.  Backdoor learning: A survey.  _IEEE Transactions on Neural Networks and Learning Systems_ , 2022b.
  * Li et al. (2021d) Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu.  Invisible backdoor attack with sample-specific triggers.  In _ICCV_ , 2021d.
  * Li et al. (2015) Zhifeng Li, Dihong Gong, Xuelong Li, and Dacheng Tao.  Learning compact feature descriptor and adaptive matching framework for face recognition.  _IEEE Transactions on Image Processing_ , 24(9):2736–2745, 2015.
  * Lin et al. (2020) Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang.  Composite backdoor attack for deep neural network by mixing existing benign features.  In _CCS_ , 2020.
  * Liu et al. (2018) Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg.  Fine-pruning: Defending against backdooring attacks on deep neural networks.  In _RAID_ , 2018.
  * Liu et al. (2020) Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu.  Reflection backdoor: A natural backdoor attack on deep neural networks.  In _ECCV_ , 2020.
  * Liu et al. (2017) Yuntao Liu, Yang Xie, and Ankur Srivastava.  Neural trojans.  In _ICCD_ , 2017.
  * Nguyen & Tran (2020) Anh Nguyen and Anh Tran.  Input-aware dynamic backdoor attack.  In _NeurIPS_ , 2020.
  * Nguyen & Tran (2021) Tuan Anh Nguyen and Anh Tuan Tran.  Wanet-imperceptible warping-based backdoor attack.  In _ICLR_ , 2021.
  * Pang et al. (2022) Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, Xiapu Luo, and Ting Wang.  Trojanzoo: Towards unified, holistic, and practical evaluation of neural backdoors.  In _EuroS &P_, 2022.
  * Qi et al. (2022) Xiangyu Qi, Tinghao Xie, Ruizhe Pan, Jifeng Zhu, Yong Yang, and Kai Bu.  Towards practical deployment-stage backdoor attack on deep neural networks.  In _CVPR_ , 2022.
  * Qi et al. (2023) Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal.  Revisiting the assumption of latent separability for backdoor defenses.  In _ICLR_ , 2023.
  * Qiu et al. (2021a) Haibo Qiu, Dihong Gong, Zhifeng Li, Wei Liu, and Dacheng Tao.  End2end occluded face recognition by masking corrupted features.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2021a.
  * Qiu et al. (2021b) Han Qiu, Yi Zeng, Shangwei Guo, Tianwei Zhang, Meikang Qiu, and Bhavani Thuraisingham.  Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation.  In _AsiaCCS_ , 2021b.
  * Rosenfeld et al. (2020) Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and J. Zico Kolter.  Certified robustness to label-flipping attacks via randomized smoothing.  In _ICML_ , 2020.
  * Shen et al. (2021) Guangyu Shen, Yingqi Liu, Guanhong Tao, Shengwei An, Qiuling Xu, Siyuan Cheng, Shiqing Ma, and Xiangyu Zhang.  Backdoor scanning for deep neural networks through k-arm optimization.  In _ICML_ , 2021.
  * Souri et al. (2022) Hossein Souri, Micah Goldblum, Liam Fowl, Rama Chellappa, and Tom Goldstein.  Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch.  In _NeurIPS_ , 2022.
  * Tang et al. (2020) Ruixiang Tang, Mengnan Du, Ninghao Liu, Fan Yang, and Xia Hu.  An embarrassingly simple approach for trojan attack in deep neural networks.  In _KDD_ , 2020.
  * Tao et al. (2022) Guanhong Tao, Guangyu Shen, Yingqi Liu, Shengwei An, Qiuling Xu, Shiqing Ma, Pan Li, and Xiangyu Zhang.  Better trigger inversion optimization in backdoor scanning.  In _CVPR_ , 2022.
  * Tran et al. (2018) Brandon Tran, Jerry Li, and Aleksander Madry.  Spectral signatures in backdoor attacks.  In _NeurIPS_ , 2018.
  * Turner et al. (2019) Alexander Turner, Dimitris Tsipras, and Aleksander Madry.  Label-consistent backdoor attacks.  _arXiv preprint arXiv:1912.02771_ , 2019.
  * Wang et al. (2022) Zhenting Wang, Hailun Ding, Juan Zhai, and Shiqing Ma.  Training with more confidence: Mitigating injected and natural backdoors during training.  In _NeurIPS_ , 2022.
  * Weber et al. (2022) Maurice Weber, Xiaojun Xu, Bojan Karlaš, Ce Zhang, and Bo Li.  Rab: Provable robustness against backdoor attacks.  _(IEEE S &P_, 2022.
  * Wu et al. (2022) Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen.  Backdoorbench: A comprehensive benchmark of backdoor learning.  In _NeurIPS (Datasets and Benchmarks Track)_ , 2022.
  * Wu & Wang (2021) Dongxian Wu and Yisen Wang.  Adversarial neuron pruning purifies backdoored deep models.  In _NeurIPS_ , 2021.
  * Xiang et al. (2021) Zhen Xiang, David J Miller, Siheng Chen, Xi Li, and George Kesidis.  A backdoor attack against 3d point cloud classifiers.  In _ICCV_ , 2021.
  * Xiang et al. (2022) Zhen Xiang, David J Miller, and George Kesidis.  Post-training detection of backdoor attacks for two-class and multi-attack scenarios.  In _ICLR_ , 2022.
  * Xu et al. (2020) Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai-Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsieh.  Automatic perturbation analysis for scalable certified robustness and beyond.  In _NeurIPS_ , 2020.
  * Zeng et al. (2021) Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia.  Rethinking the backdoor attacks’ triggers: A frequency perspective.  In _ICCV_ , 2021.
  * Zeng et al. (2022) Yi Zeng, Si Chen, Won Park Z. Morley Mao, Ming Jin, and Ruoxi Jia.  Adversarial unlearning of backdoors via implicit hypergradient.  In _ICLR_ , 2022.
  * Zeng et al. (2023) Yi Zeng, Zhouxing Shi, Ming Jin, Feiyang Kang, Lingjuan Lyu, Cho-Jui Hsieh, and Ruoxi Jia.  Towards robustness certification against universal perturbations.  In _ICLR_ , 2023.
  * Zhai et al. (2021) Tongqing Zhai, Yiming Li, Ziqi Zhang, Baoyuan Wu, Yong Jiang, and Shu-Tao Xia.  Backdoor attack against speaker verification.  In _ICASSP_ , 2021.
  * Zhao et al. (2020a) Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin.  Bridging mode connectivity in loss landscapes and adversarial robustness.  In _ICLR_ , 2020a.
  * Zhao et al. (2020b) Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang.  Clean-label backdoor attacks on video recognition models.  In _CVPR_ , 2020b.
  * Zhao et al. (2022) Zhendong Zhao, Xiaojun Chen, Yuexin Xuan, Ye Dong, Dakui Wang, and Kaitai Liang.  Defeat: Deep hidden feature backdoor attacks by imperceptible perturbation and latent representation constraints.  In _CVPR_ , 2022.

##  Appendix A The Demo Examples for Attacks

In this section, we provide the code examples of using both poison-only
attacks and training-controlled attacks in our BackdoorBox.

###  A.1 The Example of Using BadNets as the Poison-only Attack

Demo 1: The code example of using BadNets.

⬇

import torch

import torch.nn as nn

import core

# Assign the trigger pattern and its weight

pattern = torch.zeros((32, 32), dtype=torch.uint8)

pattern[-3:, -3:] = 255

weight = torch.zeros((32, 32), dtype=torch.float32)

weight[-3:, -3:] = 1.0

# Initialize BadNets with adversary-specified hyper-parameters

badnets = core.BadNets(

train_dataset=trainset, # Users should adopt their training dataset.

test_dataset=testset, # Users should adopt their testing dataset.

model=core.models.ResNet(18), # Users can adopt their model.

loss=nn.CrossEntropyLoss(),

y_target=1,

poisoned_rate=0.05,

pattern=pattern,

weight=weight,

deterministic=True

)

# Obtain the poisoned training and testing datasets

poisoned_train, poisoned_test = badnets.get_poisoned_dataset()

# Train and obtain the attacked model

schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’benign_training’: False,

’batch_size’: 128,

’num_workers’: 2,

’lr’: 0.1,

’momentum’: 0.9,

’weight_decay’: 5e-4,

’gamma’: 0.1,

’schedule’: [150, 180],

’epochs’: 200,

’log_iteration_interval’: 100,

’test_epoch_interval’: 10,

’save_epoch_interval’: 20,

’save_dir’: ’experiments’,

’experiment_name’: ’ResNet-18_BadNets’

}

badnets.train(schedule) # Attack via given training schedule.

attacked_model = badnets.get_model() # Get the attacked model.

###  A.2 The Example of Using PhysicalBA as the Training-controlled Attack

Demo 2: The code example of using physical backdoor attack (PhysicalBA).

⬇

import torch

import torch.nn as nn

import core

from torchvision.transforms import Compose, ToTensor, PILToTensor,
RandomHorizontalFlip, ColorJitter, RandomAffine

# Assign the trigger pattern and its weight

pattern = torch.zeros((32, 32), dtype=torch.uint8)

pattern[-3:, -3:] = 255

weight = torch.zeros((32, 32), dtype=torch.float32)

weight[-3:, -3:] = 1.0

# Initialize PhysicalBA with adversary-specified hyper-parameters

PhysicalBA = core.PhysicalBA(

train_dataset=trainset, # Users should adopt their training dataset.

test_dataset=testset, # Users should adopt their testing dataset.

model=core.models.ResNet(18), # Users can adopt their model.

loss=nn.CrossEntropyLoss(),

y_target=1,

poisoned_rate=0.05,

pattern=pattern,

weight=weight,

deterministic=True,

physical_transformations = Compose([

ColorJitter(brightness=0.2,contrast=0.2),

RandomAffine(degrees=10, translate=(0.1, 0.1), scale=(0.8, 0.9))

])

)

# Train and obtain the attacked model

schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’benign_training’: False,

’batch_size’: 128,

’num_workers’: 2,

’lr’: 0.1,

’momentum’: 0.9,

’weight_decay’: 5e-4,

’gamma’: 0.1,

’schedule’: [150, 180],

’epochs’: 200,

’log_iteration_interval’: 100,

’test_epoch_interval’: 10,

’save_epoch_interval’: 20,

’save_dir’: ’experiments’,

’experiment_name’: ’ResNet-18_PhysicalBA’

}

PhysicalBA.train(schedule) # Attack via given training schedule.

attacked_model = PhysicalBA.get_model() # Get the attacked model.

# Obtain the poisoned training and testing datasets

poisoned_train, poisoned_test = PhysicalBA.get_poisoned_dataset()

##  Appendix B The Demo Examples for Defenses

In this section, we provide the code examples of using pre-processing-based
defenses, model repairing, poison suppression, and sample diagnosis in our
BackdoorBox.

###  B.1 The Example of Using ShrinkPad as the Pre-processing-based Defense

Demo 3: The code example of using ShrinkPad.

⬇

import torch

import torch.nn as nn

import core

# Initialize ShrinkPad with defender-specified hyper-parameters

ShrinkPad = core.ShrinkPad(

size_map=32, # Users should assign it based on their samples.

pad=4, # Key hyper-parameter of ShrinkPad.

deterministic=True

)

# Get the pre-processed images

pre_img = ShrinkPad.preprocess(img) # Users should use their images.

# Get the predictions of pre-processed images by the given model

predicts = ShrinkPad.predict(model, img)

# Define the test schedule

schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’batch_size’: 128,

’num_workers’: 2,

’metric’: ’ASR_NoTarget’,

’y_target’: y_target,

’save_dir’: ’experiments’,

’experiment_name’: ’ShrinkPad-4_ASR_NoTarget’

}

# Evaluate the performance of ShrinkPad on a given dataset

ShrinkPad.test(model, dataset, schedule)

###  B.2 The Example of Using Fine-tuning as the Model Repairing

Demo 4: The code example of using fine-tuning.

⬇

import torch

import torch.nn as nn

import core

# Initialize fine-tuning with defender-specified hyper-parameters

finetuning = core.FineTuning(

train_dataset=dataset, # Users should adopt their benign samples.

test_dataset=dataset_test # Users can use both benign and poisoned datasets
for evaluation.

model=model, # Users should adopt their suspicious model.

layer=["full layers"], # Users should assign their tuning position.

loss=nn.CrossEntropyLoss(),

)

# Define the repairing schedule

schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’batch_size’: 128,

’num_workers’: 4,

’lr’: 0.001,

’momentum’: 0.9,

’weight_decay’: 5e-4,

’gamma’: 0.1,

’epochs’: 10,

’log_iteration_interval’: 100,

’save_epoch_interval’: 2,

’save_dir’: ’experiments’,

’experiment_name’: ’finetuning’

}

# Repair the suspicious model

finetuning.repair(schedule)

# Obtain the repaired model

repaired_model = finetuning.get_model()

# Evaluate the performance of repaired model with given testing schedule

test_schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’batch_size’: 128,

’num_workers’: 4,

’metric’: ’BA’,

’save_dir’: ’experiments’,

’experiment_name’: ’finetuning_BA’

}

finetuning.test(benign_dataset, test_schedule)

###  B.3 The Example of Using CutMix as the Poison Suppression

Demo 5: The code example of using CutMix.

⬇

import torch

import torch.nn as nn

import core

# Initialize CutMix with defender-specified hyper-parameters

CutMix = core.CutMix(

model=model, # Users should adopt their model

loss=nn.CrossEntropyLoss(),

beta=1.0,

cutmix_prob=1.0,

deterministic=True

)

# Train the model with a given schedule

schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’batch_size’: 128,

’num_workers’: 4,

’lr’: 0.1,

’momentum’: 0.9,

’weight_decay’: 5e-4,

’gamma’: 0.1,

’schedule’: [150, 180],

’epochs’: 200,

’log_iteration_interval’: 100,

’test_epoch_interval’: 20,

’save_epoch_interval’: 20,

’save_dir’: ’experiments’,

’experiment_name’: ’CutMix’,

}

CutMix.train(trainset=trainset, schedule=schedule) # Users should adopt their
local suspicious training dataset.

# Obtain the trained model

model = CutMix.get_model()

# Evaluate the performance of trained model with given testing schedule

test_schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’batch_size’: 128,

’num_workers’: 4,

’metric’: ’BA’,

’save_dir’: ’experiments’,

’experiment_name’: ’CutMix_BA’

}

CutMix.test(benign_dataset, test_schedule)

###  B.4 The Example of Using SS as the Sample Diagnosis

Demo 6: The code example of using spectral signature (SS).

⬇

import torch

import torch.nn as nn

import core

# Initialize SS with defender-specified hyper-parameters

Spectral = core.SS(

model=model, # Users should adopt the model trained on suspicious dataset.

dataset=suspicious_dataset,

percentile=80, # Key hyper-parameter of SS.

deterministic=True

)

# Filter out poisoned samples

poisoned_idx, _ = Spectral.filter()

# Evaluate the performance of SS with given testing schedule

test_schedule = {

’device’: ’GPU’,

’CUDA_VISIBLE_DEVICES’: ’0’,

’GPU_num’: 1,

’batch_size’: 128,

’num_workers’: 4,

’metric’: ’Precision’,

’save_dir’: ’experiments’,

’experiment_name’: ’SS_Precision’

}

Spectral.test(poisoned_idx_true, test_schedule)

##  Appendix C The Toolbox Structure

As shown in Figure 1, our toolbox consists of five main parts, including (1)
attack module, (2) defense module, (3) model module, (4) utility module, and
(5) testing files. The first four parts are the core functional components of
our toolbox, while the last one is provided for users as code examples.
Specifically, the attack and defense modules contain all implemented attacks
and defenses where each method is in a separate Python file; The model module
contains classical model architectures. Users can freely adopt these provided
models or their local models; The utility module provides supportive
functionalities, such as the calculation of evaluation metrics; The code
example of each implemented method is included in testing files.

Currently, our toolbox has only implemented part of both attack and defense
modules (as suggested in Section 3-4). We will keep updating this toolbox and
developing representative methods and necessary supportive components that
have not been included.

Figure 1: The framework of our BackdoorBox.