Venue: NeurIPS 2022 Track Datasets and Benchmarks

Reviews:

final_score: rating: 9: Top 15% of accepted papers, strong accept
review_content: summary and contributions: The paper presents a backdoor benchmarking framework. It includes several basic and current attacks and defenses that target a model's integrity during the training phase of a model. The paper includes evaluating these methods and further analyzing the effect of different poison ratios and the effect of attacks and defenses. To facilitate interpretation of benchmark results, several explanatory methods are included in the framework.
strengths: The work is an excellent contribution toward trustworthy machine learning for the underrepresented backdoor attack vector. It provides a reasonable set of attacks and defenses and gives a clear presentation of the categorization of these attacks and defenses. In addition, it goes further by providing a set of explainability methods.
weaknesses: During the evaluation it is not always clear how the hyperparameters are chosen. For example, whether a separate hyperparameter search is performed for each attack and defense to find the optimal case.
In section 4.3, I am not sure that the explanation for decreasing poisoning success with increasing number of poisons is sufficient. It could also be a matter of different training settings/conditions.
correctness: It is not always clear how hyperparameters are chosen.
clarity: The paper has some spelling and grammatical mistakes that should be revised, but overall is clear. For example:

- However, we find that the evaluations of new methods are often insufficient, with comparisons with limited previous methods, based on limited models and datasets.
- stat-of-the-art
- evluate
relation to prior work: Prior related work is sufficiently described.
additional feedback: More trials per run in Figure 3 would make potential trends clearer.
review_title: Solid benchmarking paper with promising code base

final_score: rating: 4: Ok but not good enough - rejection
review_content: summary and contributions: The paper presents a benchmark and software system to evaluate poison attacks and defenses. The authors include a large number of popular defenses and attacks. The authors further make it easy to implement additional attacks and defenses. 

strengths: - Large number of defenses and attacks evaluated
- Code base that enables easy implementation of defenses and attacks
- Public benchmark on the defense performance

The proposed code base is well-documented and comprehensive in terms of including existing backdoor attacks and defenses. I appreciate authors' effort in running 8000 experiments on defense and attack pairs. 
weaknesses: - There exists many code bases on backdoor attacks. 
- Lacks diversity on complex attack parameters 

The main weakness of this paper is the existence of many prior works on backdoor frameworks, specifically TrojanZoo. The difference between the proposed system and TrojanZoo appears to be minor. More comments on this "Relation to Prior Work." 

Another concern is that the BackdoorBench only offers parameter change on several attack parameters (poison ratio). However, backdoor attacks have many additional parameters depending on the attack specifics, e.g. trigger size, physical triggers, perturbation size. There are other attack setups such as label-specific backdoors, where attacker only backdoors data from one label. I would appreciate if the authors can add these parameters in the benchmark, so that the defenses do not only optimize for a biased set of attack parameters. 

correctness: The implementation is correct and designs are appropriate. 

clarity: The paper has some language issue making it hard to understand. I recommend that the authors proofread the paper multiple times to fix language/presentation issues. 

relation to prior work: TrojanZoo is a popular framework used in prior work, and many research groups are already familiar with the setup. It is unclear to me whether this paper adds additional benefits over TrojanZoo, as the only difference focuses on the number of defenses/attacks. While I appreciate the authors running 8,000 pairs of evaluations, it is unclear whether those tests produce significant findings that we did not already know. Finally, given how people are familiar with TrojanZoo codebase already, the benefit for researchers to switch to BackdoorBench appears to be low. 

additional feedback: None.
review_title: Nice benchmark effort, but challenges in distinguishing itself from prior work

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: summary and contributions: This paper proposes a comprehensive backdoor benchmark of backdoor learning. It consists of 8 state-of-the-art backdoor attacks and 9 backdoor defenses. Based on the open-sourced framework, the authors conducted large-scale experiments on 4 datasets and provided some preliminary analysis and findings on these attacks/defenses. Overall, this paper offers a very easy-to-use backdoor benchmark, which would be highly beneficial for researchers in the backdoor learning area.
additional feedback: Please answer the reviewer's questions in [Weakness].
review_title: A good benchmark on backdoor attacks/defenses

final_score: rating: 7: Good paper, accept
review_content: summary and contributions: This paper provides a Benchmark on Computer Vision Backdoor Learning, with an easy implementations of mainstream CV backdoor attack and defense methods. it contains 8 attack methods, 9 defense methods with 4 datasets, as well as the detailed results.
strengths: 1. This paper provides different backdoor attack and defense methods in Computer Vision domain, this is good. 
2. clear and runnable codes for individual attack/defense methods, the results table is very persuasive.
weaknesses: 1. The frameworks are not well compatible. A very good point is: For individual attack/defense method, the framework provides seperate and individual script to make sure the code can run. However, there are many redundant codes, such the data loader part. If further work can reduce the redundance of the codes, and make the framework more light-weighted, it would be better.
2. What's the difference between your work and other benchmarks, such as 'backdoor101' and 'trojanzoo'. The paper mensioned in 'related benchmarks' part, claiming they contain recent models. But this is not very persuasive. However, compared to 'trojanzoo', your codebase seems easier to extend to other datasets.
3. In the future, if the benchmark can extend to NLP domain, it would be a huge jump and wonderful improvement.
correctness: The benchmark has appropriate experiment design.
clarity: This paper is well written.
relation to prior work: yes. 
additional feedback: Nope
review_title: A computer vision backdoor learning benchmark

final_score: rating: 7: Good paper, accept
review_content: summary and contributions: The main contribution of the paper is a codebase that implements the latest attack, defense, and evaluation methods related to backdoor attacks on deep learning models; in total, the authors implemented 8 state-of-the-art (SOTA) attack algorithms and 9 SOTA defense algorithms.

The second and third contributions are an evaluation and analysis of the 8 attacks against the 9 defenses using 5 poisoning ratios (0.1%, 0.5%, 1%, 5%, 10%) based on 5 model architectures trained on 4 image classification datasets; a total of 8,000 evaluations were performed ("no defense" was added as an additional defense strategy in the evaluation).

Overall, the authors find that most defense methods can mitigate many of the backdoor attacks while not significantly harming accuracy on the set of clean examples. They also find defenses have a more difficult time recovering the correct prediction for poisoned examples when the dataset has a relatively large number of classes. Additionally, the authors find some defenses achieve a lower attack success rate when the poison ratio is higher, since a higher poison ratio may be easier for that defense method to detect. Finally, their analysis suggests that attack/defense performance can vary considerably depending on the model architecture, prompting further investigation into the relationship between model architecture and backdoor performance.
strengths: The paper tackles a relatively new and important subfield of research, attacking/defending backdoor attacks in deep neural networks.

The authors provide implementations of the latest backdoor attack and defense algorithms.

The evaluation is relatively comprehensive and provides some insights on the behavior of the attack and defense methods under different conditions.

The paper is well structured and easy to read and follow.

The authors provide a nice overview and general taxonomy of the different attack and defense methods.

The codebase is extensible to more attacks/defenses/models.
weaknesses: My main concern is the similarity of BackdoorBench to TrojanZoo. TrojanZoo also provides a codebase of 8 attacks and 14 defenses; however, the authors note some of these methods are older and out of date. Can't TrojanZoo be updated with the latest attacks/defenses? What is the main benefit of adding an additional backdoor benchmark? Is BackdoorBench more easily extensible than TrojanZoo? If BackdoorBench is not easily extensible, then a new backdoor benchmark codebase may be created again in 1-2 years, possibly hindering the comparison of new attacks/defenses to older methods.

The authors note the predictive performance of some of the models are relatively low due to differences in training. Analyzing backdoor attack/defense performance seems less useful when evaluating based on poor predictive models. How did the authors choose these 5 model architectures to evaluate? And are many of the attacks the authors implemented model agnostic?

Backdoor attack/defense performance is only evaluated on image classification datasets; however, I think including text or audio datasets could significantly improve this paper.

How robust are the results in Figure 3, where are the error bars?


MINOR WEAKNESSES

line 102: "class" repeated.

Text on Figures 2,3,4,5 is small and hard to read.
correctness: Yes.
clarity: The paper is well structured, but contains numerous grammatical errors. I recommend using a service like Grammarly to fix these issues.
relation to prior work: Yes.
additional feedback: Perhaps provide some results of the evaluation analysis in the abstract or introduction.
review_title: Review

Meta-review: metareview: This is a valuable benchmark on backdoors. Most reviewers argue for acceptance, some strongly so (with scores 7,7,8,9), while only one reviewer gave a rejecting score. That reviewer mostly questioned the relationship to TrojanZoo, and the authors discussed this comprehensively now. That reviewer, RPfC, also was inactive during the rebuttal and decision process, and thus I do not weigh their (apparently answered) concerns highly. I thus recommend acceptance.
confidence: 4: The area chair is confident but not absolutely certain
Decision: Accept