abka03/flashbn_rebn-models

FlashBN / ReBN: attacked models

The 17 backdoored PreActResNet-18 models used in the NeurIPS 2026 paper Backdoor Attacks Rerouted: BatchNorm as a Sink for Adversarial Signals (OpenReview).

• Code: https://github.com/Mak-Ta-Reque/flashbn_rebn
• Use: the code runs the FlashBN and ReBN defenses on these models and reproduces the paper's results.

Files

File	Size	SHA-256
attacked_models.zip	1.7 GB	2f81bddb7ecc79e2f0cfa2e70c147ea87606cacf56f8e5968d725433ebb5db1d

The archive contains one folder per model, with two files each:

• model.pt: the backdoored weights, with the architecture, dataset and number of classes.
• poisoned_test.npz: every non-target test image with the trigger applied (images, uint8), the attack target (target) and the true label (label).

Dataset	Attacks (folder <dataset>_preactresnet18_<attack>...)
CIFAR-10 (8)	ReAttack (BadNets → NAD), CTRL, FTrojan, BPP, Poison Ink, Diffusion backdoor, Adaptive-Blend, COMBAT; 10% poisoning, all-to-one, target class 0
Tiny ImageNet (9)	BadNets, Blended, LF, SSBA, WaNet, InputAware, BPP, TrojanNN (10% poisoning), SIG (0.5%); target class 0. These are the models of the BackdoorBench model zoo, converted to the format above

Usage

git clone https://github.com/Mak-Ta-Reque/flashbn_rebn.git && cd flashbn_rebn
wget https://huggingface.co/abka03/flashbn_rebn-models/resolve/main/attacked_models.zip
sha256sum attacked_models.zip      # 2f81bddb7ecc79e2f0cfa2e70c147ea87606cacf56f8e5968d725433ebb5db1d
unzip attacked_models.zip -d .     # creates attacked_models/<17 model folders>

Then follow the repository's README, e.g. python -m bn_defense.run flashbn attacked_models/<model folder>, or run notebooks/paper_results.ipynb for all results.

These models contain backdoors on purpose. They are meant for research on backdoor defenses; don't deploy them.

License

CC BY-NC 4.0. The Tiny ImageNet models come from BackdoorBench, which is also licensed under CC BY-NC 4.0.

Citation

@inproceedings{anonymous2026backdoor,
  title={Backdoor Attacks Rerouted: BatchNorm as a Sink for Adversarial Signals},
  author={Anonymous},
  booktitle={The Fortieth Annual Conference on Neural Information Processing Systems},
  year={2026},
  url={https://openreview.net/forum?id=1YqAFIeJti}
}

@inproceedings{backdoorbench,
  title={BackdoorBench: A Comprehensive Benchmark of Backdoor Learning},
  author={Wu, Baoyuan and Chen, Hongrui and Zhang, Mingda and Zhu, Zihao and Wei, Shaokui and Yuan, Danni and Shen, Chao},
  booktitle={Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track},
  year={2022}
}