  Backdoor attack intends to embed hidden backdoor into deep neural networks
(DNNs), so that the attacked models perform well on benign samples, whereas
their predictions will be maliciously changed if the hidden backdoor is
activated by attacker-specified triggers. This threat could happen when the
training process is not fully controlled, such as training on third-party
datasets or adopting third-party models, which poses a new and realistic
threat. Although backdoor learning is an emerging and rapidly growing research
area, its systematic review, however, remains blank. In this paper, we present
the first comprehensive survey of this realm. We summarize and categorize
existing backdoor attacks and defenses based on their characteristics, and
provide a unified framework for analyzing poisoning-based backdoor attacks.
Besides, we also analyze the relation between backdoor attacks and relevant
fields ($i.e.,$ adversarial attacks and data poisoning), and summarize widely
adopted benchmark datasets. Finally, we briefly outline certain future research
directions relying upon reviewed works. A curated list of backdoor-related
resources is also available at
\url{https://github.com/THUYimingLi/backdoor-learning-resources}.
