Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Open accessIntegrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
MobileNet v1 utilizes depth-wise separable convolutions proposed in Xception, which decomposes the standard convolution into depth-wise convolution and pointwise convolution (1×1 convolution).
“MobileNet v1 [44] utilizes depth-wise separable convolutions proposed in Xception [26], which decomposes the standard convolution into depth-wise convolution and pointwise convolution (1 × 1 convolution), as shown in Fig. 13.”
From A Survey of Convolutional Neural Networks: Analysis, Applications, and Prospects (2022) · cites this paper as [26]
The authors of ShuffleNet v1 reckon that Xception and ResNeXt are less efficient in extremely small networks since 1×1 convolution requires a lot of computing resources; therefore, pointwise group convolution is proposed to reduce the computation complexity of 1×1 convolutions.
“The authors of ShuffleNet v1 reckon that Xception [26] and ResNeXt [29] are less efficient in extremely small networks since 1 × 1 convolution requires a lot of computing resources.Therefore, pointwise group convolution is proposed to reduce the computation complexity of 1 × 1 convolutions.”
From A Survey of Convolutional Neural Networks: Analysis, Applications, and Prospects (2022) · cites this paper as [26]
Non-zero gradients of the embedding layer in a neural network trained on a natural-language task unveil which tokens emerge in benign clients' training batches during FL training.
“For example, the non-zero gradients of the embedding layer in a neural network trained on a natural-language task unveil which tokens emerge in the benign clients' training batches during FL training [77].”
From Vulnerabilities in federated learning (2021) · cites this paper as [77]
Cites
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
Ren, S., He, K., Girshick, R., & Sun, J. (2015) · arXiv · doi:10.48550/arxiv.1506.01497 · Cited by 70,812 · see citing works
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380 · see citing works
Neural Machine Translation by Jointly Learning to Align and Translate
Bahdanau, D., Cho, K., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1409.0473 · Cited by 16,213 · see citing works
Speech recognition with deep recurrent neural networks
Graves, A., Mohamed, A.-R., & Hinton, G. (2013) · 2013 IEEE International Conference on Acoustics, Speech and Signal Processing · doi:10.1109/icassp.2013.6638947 · Cited by 8,893 · see citing works
International Conference on Learning Representations (ICLR 2013)
松尾, 豊. (2013) · 人工知能学会誌 = Journal of Japanese Society for Artificial Intelligence · Cited by 6,286 · see citing works
Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
Xiao, H., Rasul, K., & Vollgraf, R. (2017) · arXiv · doi:10.48550/arxiv.1708.07747 · Cited by 6,108 · see citing works
Han, S., Mao, H., & Dally, W. J. (2015) · arXiv · doi:10.48550/arxiv.1510.00149 · Cited by 4,662 · see citing works
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,123 · see citing works
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., & Wagner, D. (2018) · arXiv · doi:10.48550/arxiv.1802.00420 · Cited by 2,172 · see citing works
Deep Learning Face Representation from Predicting 10,000 Classes
Sun, Y. J., Wang, X., & Tang, X. (2014) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2014.244 · Cited by 1,995 · see citing works
Pruning Convolutional Neural Networks for Resource Efficient InferencePreprint
Molchanov, P. A., Tyree, S., Karras, T., Aila, T., & Kautz, J. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.06440 · Cited by 1,487 · see citing works
Face recognition in unconstrained videos with matched background similarity
Wolf, L., Hassner, T., & Maoz, I. (2011) · doi:10.1109/cvpr.2011.5995566 · Cited by 1,426 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Self-citationTargeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1712.05526 · Cited by 1,039 · see citing works
13th USENIX Workshop on Offensive Technologies, WOOT 2019
Gantman, A., & Maurice, C. (2019) · HAL (Le Centre pour la Communication Scientifique Directe) · Cited by 934 · see citing works
Can machine learning be secure?
Barreno, M., Nelson, B. A., Sears, R., Joseph, A. D., & Tygar, J. D. (2006) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1128817.1128824 · Cited by 852 · see citing works
Lowd, D., & Meek, C. (2005) · Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining · doi:10.1145/1081870.1081950 · Cited by 755 · see citing works
Mimicry attacks on host-based intrusion detection systems
Wagner, D., & Soto, P. (2002) · Proceedings of the 9th ACM conference on Computer and communications security · doi:10.1145/586110.586145 · Cited by 714 · see citing works
Structured Pruning of Deep Convolutional Neural Networks
Anwar, S., Hwang, K., & Sung, W. (2017) · ACM Journal on Emerging Technologies in Computing Systems · doi:10.1145/3005348 · Cited by 709 · see citing works
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization
Muñoz-González, L., Biggio, B., Demontis, A., Paudice, A., Wongrassamee, V., Lupu, E. C., & Roli, F. (2017) · Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3128572.3140451 · Cited by 549 · see citing works
Stochastic Activation Pruning for Robust Adversarial DefensePreprint
Dhillon, G. S., Azizzadenesheli, K., Lipton, Z. C., Bernstein, J., Kossaifi, J., Khanna, A., & Anandkumar, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.01442 · Cited by 342 · see citing works
Exploiting machine learning to subvert your spam filter
Nelson, B. A., Barreno, M., Chi, F. J., Joseph, A. D., Rubinstein, B. I. P., Saini, U., Sutton, C. A., Tygar, J. D., & Xia, K. (2008) · Cited by 322 · see citing works
FireCaffe: Near-Linear Acceleration of Deep Neural Network Training on Compute Clusters
Iandola, F., Moskewicz, M. W., Ashraf, K. M., & Keutzer, K. (2016) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2016.284 · Cited by 285 · see citing works
Yu, J., Lukefahr, A., Palframan, D. J., Dasika, G. S., Das, R., & Mahlke, S. A. (2017) · Proceedings - International Symposium on Computer Architecture/Proceedings · doi:10.1145/3079856.3080215 · Cited by 269 · see citing works
Good Word Attacks on Statistical Spam Filters.
Lowd, D., & Meek, C. (2005) · Cited by 240 · see citing works
Defensive Distillation is Not Robust to Adversarial ExamplesPreprint
Carlini, N., & Wagner, D. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1607.04311 · Cited by 222 · see citing works
Adversarial Example Defense: Ensembles of Weak Defenses are not Strong
He, W., Wei, J., Chen, X., Carlini, N., & Song, D. X. (2017) · Cited by 221 · see citing works
Undermining an Anomaly-Based Intrusion Detection System Using Common Exploits
Tan, K. M. C., Killourhy, K. S., & Maxion, R. A. (2002) · Lecture notes in computer science · doi:10.1007/3-540-36084-0_4 · Cited by 215 · see citing works
Fogla, P., Sharif, M., Perdisci, R., et al. (2006) · Cited by 213 · see citing works
Paragraph: Thwarting Signature Learning by Training Maliciously
Newsome, J., Karp, B., & Song, D. X. (2006) · Lecture notes in computer science · doi:10.1007/11856214_5 · Cited by 200 · see citing works
On Attacking Statistical Spam Filters.
Wittel, G. L., & Wu, S. F. (2004) · Cited by 172 · see citing works
Evading network anomaly detection systems
Fogla, P., & Lee, W. (2006) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/1180405.1180414 · Cited by 159 · see citing works
Yu, J., Lukefahr, A., Palframan, D. J., Dasika, G. S., Das, R., & Mahlke, S. A. (2017) · ACM SIGARCH Computer Architecture News · doi:10.1145/3140659.3080215 · Cited by 152 · see citing works
When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning AttacksPreprint
Suciu, O., Mărginean, R., Kaya, Y., Daumé, H., & Dumitraş, T. (2018) · arXiv (Cornell University) · Cited by 150 · see citing works
Robust Linear Regression Against Training Data Poisoning
Liu, C., Li, B., Vorobeychik, Y., & Oprea, A. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140447 · Cited by 84 · see citing works
Allergy Attack Against Automatic Signature Generation
Chung, S. P. H., & Mok, A. K. (2006) · Lecture notes in computer science · doi:10.1007/11856214_4 · Cited by 58 · see citing works
Advanced Allergy Attacks: Does a Corpus Really Help?
Chung, S. P. H., & Mok, A. K. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-74320-0_13 · Cited by 42 · see citing works
Traffic sign detection for U.S. roads: Remaining challenges and a case for tracking
Møgelmose, A., Liu, D., & Trivedi, M. M. (2014) · IEEE International Conference on Intelligent Transportation Systems (ITSC) · doi:10.1109/itsc.2014.6957882 · Cited by 41 · see citing works
Tung, F., Muralidharan, S., & Mori, G. (2017) · British Machine Vision Conference (BMVC) · doi:10.5244/c.31.115 · Cited by 30 · see citing works
Exploiting redundancy in natural language to penetrate Bayesian spam filters
Karlberger, C., Bayler, G., Kruegel, C., et al. (2007) · Cited by 29 · see citing works
Neural TrojansPreprint
Liu, Y., Xie, Y., & Srivastava, A. (2017) · arXiv (Cornell University) · Cited by 25 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
A Survey of Convolutional Neural Networks: Analysis, Applications, and Prospects
Li, Z., Liu, F., Yang, W., Peng, S., & Zhou, J. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3084827 · Cited by 5,273 · see citing works
“[183] proposed a method of fine-tuning and pruning that can effectively defend against the threat of backdoor injection.”
MethodHow to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Weight Poisoning Attacks on Pretrained Models
Kurita, K., Michel, P., & Neubig, G. (2020) · Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/2020.acl-main.249 · Cited by 354 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Vulnerabilities in federated learning
Bouacida, N., & Mohapatra, P. (2021) · IEEE Access · doi:10.1109/access.2021.3075203 · Cited by 248 · see citing works
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Doan, K., Lao, Y., Zhao, W., & Li, P. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01175 · Cited by 211 · see citing works
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
Uniting cyber security and machine learning: Advantages, challenges and future research
Wazid, M., Das, A. K., Chamola, V., & Park, Y. (2022) · ICT Express · doi:10.1016/j.icte.2022.04.007 · Cited by 130 · see citing works
On the Robustness of Backdoor-based Watermarking in Deep Neural Networks
Shafieinejad, M., Lukas, N., Wang, J., Li, X., & Kerschbaum, F. (2021) · Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security · doi:10.1145/3437880.3460401 · Cited by 98 · see citing works
An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences
Guo, W., Tondi, B., & Barni, M. (2022) · IEEE Open Journal of Signal Processing · doi:10.1109/ojsp.2022.3190213 · Cited by 91 · see citing works
Black-box Detection of Backdoor Attacks with Limited Information and Data
Dong, Y., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., & Zhu, J. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01617 · Cited by 92 · see citing works
Subpopulation Data Poisoning Attacks
Jagielski, M., Severi, G., Pousette Harger, N., & Oprea, A. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3485368 · Cited by 86 · see citing works
DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injection
Li, Y., Hua, J., Wang, H., Chen, C., & Liu, Y. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) · doi:10.1109/icse43902.2021.00035 · Cited by 75 · see citing works
A Systematic Review of Adversarial Machine Learning Attacks, Defensive Controls and Technologies
Malik, J., Muthalagu, R., & Pawar, P. M. (2024) · IEEE Access · doi:10.1109/access.2024.3423323 · Cited by 76 · see citing works
Salem, M., Taheri, S., & Yuan, J.-S. (2018) · Computers · doi:10.3390/computers8010003 · Cited by 47 · see citing works
Athena: Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0072 · Cited by 51 · see citing works
Mitigating the Backdoor Attack by Federated Filters for Industrial IoT Applications
Hou, B., Gao, J., Guo, X., Baker, T., Zhang, Y., Wen, Y., & Liu, Z. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3112100 · Cited by 49 · see citing works
Removing Backdoor-Based Watermarks in Neural Networks with Limited Data
Liu, X., Li, F., Wen, B., & Li, Q. (2021) · 2020 25th International Conference on Pattern Recognition (ICPR) · doi:10.1109/icpr48806.2021.9412684 · Cited by 49 · see citing works
Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attacks
Cotroneo, D., Improta, C., Liguori, P., & Natella, R. (2024) · Proceedings of the 32nd IEEE/ACM International Conference on Program Comprehension · doi:10.1145/3643916.3644416 · Cited by 45 · see citing works
Text Backdoor Detection Using an Interpretable RNN Abstract Model
Fan, M., Si, Z., Xie, X., Liu, Y., & Liu, T. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3103064 · Cited by 38 · see citing works
Threats and Defenses in the Federated Learning Life Cycle: A Comprehensive Survey and Challenges
Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., & Ding, W. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3563537 · Cited by 38 · see citing works
Dispersed Pixel Perturbation-Based Imperceptible Backdoor Trigger for Image Classifier Models
Wang, Y., Zhao, M., Li, S., Yuan, X., & Ni, W. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3202687 · Cited by 26 · see citing works
Toward Cleansing Backdoored Neural Networks in Federated Learning
Wu, C., Yang, X., Zhu, S., & Mitra, P. (2022) · 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs54860.2022.00084 · Cited by 12 · see citing works
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13 · see citing works
Aramoon, O., Chen, P.-Y., Qu, G., & Tian, Y. (2024) · Federated Learning · doi:10.1016/b978-0-44-319037-7.00017-x · Cited by 12 · see citing works
Chen, C., Wei, L., Zhang, L., Peng, Y., & Ning, J. (2022) · Security and Communication Networks · doi:10.1155/2022/2985308 · Cited by 8 · see citing works
Detecting Scene-Plausible Perceptible Backdoors in Trained DNNs Without Access to the Training Set
Xiang, Z., Miller, D. J., Wang, H., & Kesidis, G. (2021) · Neural Computation · doi:10.1162/neco_a_01376 · Cited by 8 · see citing works
A lightweight backdoor defense framework based on image inpainting
Wei, Y., Gao, H., Wang, Y., Gao, Y., & Liu, H. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.03.052 · Cited by 6 · see citing works
- Authors
- Liu, K., Dolan-Gavitt, B., & Garg, S.
- Affiliations
- New York University (US)
- Corresponding author
- Liu, Kang
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2018
- Pages
- 273-294
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W2807363941
- Cited by
- 1,055
- References
- 43
- Citations by year
- 2026: 122 · 2025: 212 · 2024: 201 · 2023: 163 · 2022: 119 · 2021: 123 · 2020: 81 · 2019: 27 · 2018: 7
- FWCI
- 24.29
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Lecture notes in computer science (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- backdoor attacks, backdoor defense, deep neural network, model pruning, fine-tuning, adversarial triggers, attack success rate
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
