Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Open accessIntegrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Dedicated defense methods against both data poisoning and model poisoning attacks have been investigated, such as norm clipping, geometric median based robust federated aggregation, and robust learning rate.
“Dedicated defense methods against both data poisoning and model poisoning attacks have been investigated, such as norm clipping [38], geometric median based Robust Federated Aggregation (RFA) [58] and robust learning rate [59].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [58]
Pillutla et al. proposed RFA by replacing the weighted arithmetic mean with an approximate geometric median to reduce the impact of contaminated updates.
“Pillutla et al. [58] proposed a robust aggregation approach called RFA by replacing the weighted arithmetic mean with an approximate geometric median, so as to reduce the impact of the contaminated updates.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [58]
Almost all well-designed Byzantine-robust aggregators still suffer from the curse of dimensionality.
“Almost all of the well-designed Byzantine-robust aggregators [22], [23], [58] still suffer from the curse of dimensionality.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [58]
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333 · see citing works
Image quality assessment: from error visibility to structural similarity
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004) · IEEE Transactions on Image Processing · doi:10.1109/tip.2003.819861 · Cited by 57,892 · see citing works
Densely Connected Convolutional Networks
Huang, G., Liu, Z., Van Der Maaten, L., & Weinberger, K. Q. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.243 · Cited by 48,566 · see citing works
Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.74 · Cited by 24,513 · see citing works
Sequence to Sequence Learning with Neural Networks
Sutskever, I., Vinyals, O., & Le, Q. V. (2014) · arXiv · doi:10.48550/arxiv.1409.3215 · Cited by 17,766 · see citing works
Speech recognition with deep recurrent neural networks
Graves, A., Mohamed, A.-R., & Hinton, G. (2013) · 2013 IEEE International Conference on Acoustics, Speech and Signal Processing · doi:10.1109/icassp.2013.6638947 · Cited by 8,893 · see citing works
Scope of validity of PSNR in image/video quality assessment
Huynh-Thu, Q., & Ghanbari, M. (2008) · Electronics Letters · doi:10.1049/el:20080522 · Cited by 2,959 · see citing works
Robust physical-world attacks on deep learning visual classification
Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., & Song, D. (2018) · 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2018.00175 · Cited by 2,173 · see citing works
The PASCAL visual object classes challenge 2006 (VOC2006) results
Everingham, M., Zisserman, A., Williams, C. K. I., & Gool, L. V. (2006) · Cited by 2,079 · see citing works
Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition
Sharif, M., Bhagavatula, S., Bauer, L., & Reiter, M. K. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978392 · Cited by 1,530 · see citing works
Understanding Black-box Predictions via Influence Functions
Koh, P. W., & Liang, P. (2017) · arXiv · doi:10.48550/arxiv.1703.04730 · Cited by 1,514 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Attribute and simile classifiers for face verification
Kumar, N., Berg, A. C., Belhumeur, P. N., & Nayar, S. K. (2009) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2009.5459250 · Cited by 1,383 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
Self-citationThe German Traffic Sign Recognition Benchmark: A multi-class classification competition
Stallkamp, J., Schlipsing, M., Salmen, J., & Igel, C. (2011) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2011.6033395 · Cited by 1,190 · see citing works
Buades, A., Coll, B., & Morel, J. (2011) · Image Processing On Line · doi:10.5201/ipol.2011.bcm_nlm · Cited by 1,116 · see citing works
Adversarial attacks on medical machine learning
Finlayson, S. G., Bowers, J. D., Ito, J., Zittrain, J. L., Beam, A. L., & Kohane, I. S. (2019) · Science · doi:10.1126/science.aaw4399 · Cited by 1,088 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural NetworksPreprint
Shafahi, A., Huang, W., Najibi, M., Suciu, O., Studer, C., Dumitraş, T., & Goldstein, T. (2018) · arXiv (Cornell University) · doi:10.3929/ethz-b-000460348 · Cited by 626 · see citing works
Understanding adversarial attacks on deep learning based medical image analysis systems
Ma, X., Niu, Y., Gu, L., Wang, Y., Zhao, Y., Bailey, J., & Lu, F. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2020.107332 · Cited by 553 · see citing works
Self-citationSpectral Signatures in Backdoor AttacksPreprint
Tran, B., Li, J. Z., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.00636 · Cited by 506 · see citing works
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018) · arXiv · doi:10.48550/arxiv.1811.03728 · Cited by 485 · see citing works
Certified Defenses for Data Poisoning Attacks
Steinhardt, J., Koh, P. W., & Liang, P. (2017) · arXiv · doi:10.48550/arxiv.1706.03691 · Cited by 479 · see citing works
DBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 468 · see citing works
Robust Physical-World Attacks on Deep Learning ModelsPreprint
Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., & Song, D. X. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1707.08945 · Cited by 443 · see citing works
Single Image Reflection Separation with Perceptual Losses
Zhang, X., Ng, R., & Chen, Q. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00503 · Cited by 396 · see citing works
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning
Barni, M., Kallas, K., & Tondi, B. (2019) · Proceedings - International Conference on Image Processing · doi:10.1109/icip.2019.8802997 · Cited by 360 · see citing works
Single Image Layer Separation Using Relative Smoothness
Li, Y., & Brown, M. S. (2014) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2014.346 · Cited by 356 · see citing works
Multi-view traffic sign detection, recognition, and 3D localisation
Timofte, R., Zimmermann, K., & Gool, L. V. (2011) · Machine Vision and Applications · doi:10.1007/s00138-011-0391-3 · Cited by 317 · see citing works
A Backdoor Attack Against LSTM-Based Text Classification Systems
Dai, J., Chen, C., & Li, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2941376 · Cited by 298 · see citing works
Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Clean-Label Backdoor Attacks on Video Recognition Models
Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., & Jiang, Y. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01445 · Cited by 247 · see citing works
Self-citationAdversarial Camouflage: Hiding Physical-World Attacks With Natural Styles
Duan, R., Ma, X., Wang, Y., Bailey, J., Qin, A. K., & Yang, Y. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00108 · Cited by 242 · see citing works
Self-citationBackdoor Attacks to Graph Neural Networks
Zhang, Z., Jia, J., Wang, B., & Gong, N. Z. (2021) · Proceedings of the 26th ACM Symposium on Access Control Models and Technologies · doi:10.1145/3450569.3463560 · Cited by 220 · see citing works
Benchmarking Single-Image Reflection Removal Algorithms
Wan, R., Shi, B., Duan, L., Tan, A., & Kot, A. C. (2017) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.423 · Cited by 180 · see citing works
Unsupervised Learning for Intrinsic Image Decomposition From a Single Image
Liu, Y., Li, Y., You, S., & Lu, F. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00331 · Cited by 122 · see citing works
Self-citationTurner, A., Tsipras, D., & Mądry, A. (2018) · Cited by 104 · see citing works
Combining PRNU and noiseprint for robust and efficient device source identification
Cozzolino, D., Marra, F., Gragnaniello, D., Poggi, G., & Verdoliva, L. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-0101-7 · Cited by 79 · see citing works
Pathological Evidence Exploration in Deep Retinal Image Diagnosis
Niu, Y., Gu, L., Lu, F., Lv, F., Wang, Z., Sato, I., Zhang, Z., Xiao, Y., Dai, X., & Cheng, T. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33011093 · Cited by 41 · see citing works
Self-citationUnsupervised Ensemble Strategy for Retinal Vessel Segmentation
Liu, B., Gu, L., & Lu, F. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-32239-7_13 · Cited by 34 · see citing works
Self-citationXiang, Z. J., Miller, D. J., & Kesidis, G. (2019) · Machine learning for signal processing ... · doi:10.1109/mlsp.2019.8918908 · Cited by 34 · see citing works
Luminance-based video backdoor attack against anti-spoofing rebroadcast detection
Bhalerao, A. H., Kallas, K., Tondi, B., & Barni, M. (2019) · IEEE International Workshop on Multimedia Signal Processing (MMSP) · doi:10.1109/mmsp.2019.8901711 · Cited by 17 · see citing works
Separate in Latent Space: Unsupervised Single Image Layer Separation
Liu, Y., & Feng, L. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6835 · Cited by 15 · see citing works
Self-citationTrembling triggers: exploring the sensitivity of backdoors in DNN-based face recognition
Pasquini, C., & Böhme, R. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-00104-z · Cited by 15 · see citing works
Backdoor Attacks in Neural Networks – A Systematic Evaluation on Multiple Traffic Sign Datasets
Rehman, H., Ekelhart, A., & Mayer, R. L. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-29726-8_18 · Cited by 12 · see citing works
Kwon, H., Yoon, H., & Park, K.-W. (2020) · International Conference on Software Engineering and Information Management (ICSIM) · doi:10.1145/3378936.3378938 · Cited by 5 · see citing works
Flagged first, then by citations
9 of the 59 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Unleashing the potential of prompt engineering for large language models
CHEN, B. ‐., Zhang, Z., Langrené, N., & Zhu, S. (2025) · Patterns · doi:10.1016/j.patter.2025.101260 · Cited by 764 · see citing works
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Self-citationAdvances in Adversarial Attacks and Defenses in Computer Vision: A Survey
Akhtar, N., Mian, A. S., Kardan, N., & Shah, M. (2021) · IEEE Access · doi:10.1109/access.2021.3127960 · Cited by 319 · see citing works
WaNet -- Imperceptible Warping-based Backdoor AttackPreprint
Nguyen, A., & Tran, A. N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.10369 · Cited by 296 · see citing works
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural NetworksPreprint
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., & Ma, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.05930 · Cited by 264 · see citing works
Self-citationFebruus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Dynamic Backdoor Attacks Against Machine Learning Models
Salem, A., Wen, R., Michael Backes, A., Ma, S., & Zhang, Y. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00049 · Cited by 227 · see citing works
ONION: A Simple and Effective Defense Against Textual Backdoor Attacks
Qi, F., Chen, Y., Li, M., Yao, Y., Liu, Z., & Sun, M. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.752 · Cited by 222 · see citing works
Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information
Zeng, Y., Pan, M., Just, H. A., Lyu, L., Meikang Qiu, A., & Jia, R. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3616617 · Cited by 212 · see citing works
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Doan, K., Lao, Y., Zhao, W., & Li, P. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01175 · Cited by 211 · see citing works
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive ReviewPreprint
Gao, Y., Doan, B. G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, ., & Kim, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.10760 · Cited by 207 · see citing works
Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., & Sun, M. (2021) · doi:10.18653/v1/2021.acl-long.37 · Cited by 190 · see citing works
BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning
Jia, J., Liu, Y., & Gong, N. Z. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833644 · Cited by 171 · see citing works
Self-citationAnti-Backdoor Learning: Training Clean Models on Poisoned DataPreprint
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., & Ma, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.11571 · Cited by 154 · see citing works
Self-citationWild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
Cinà, A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., & Roli, F. (2023) · ACM Computing Surveys · doi:10.1145/3585385 · Cited by 152 · see citing works
Poisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2024) · 2024 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp54263.2024.00179 · Cited by 138 · see citing works
Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification
Cheng, S., Liu, Y., Ma, S., & Zhang, X. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i2.16201 · Cited by 137 · see citing works
Self-citationPoisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2023) · arXiv · doi:10.48550/arxiv.2302.10149 · Cited by 138 · see citing works
“…[37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an adversary can modify a training dataset, and then asks (1) what impact this could have, (2) if…”
An Invisible Black-Box Backdoor Attack Through Frequency Domain
Wang, T., Yao, Y., Xu, F., An, S., Tong, H., & Wang, T. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19778-9_23 · Cited by 127 · see citing works
FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis
Feng, Y., Ma, B., Zhang, J., Zhao, S., Xia, Y., & Tao, D. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.02021 · Cited by 125 · see citing works
Adversarial Neuron Pruning Purifies Backdoored Deep ModelsPreprint
Wu, D., & Wang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14430 · Cited by 122 · see citing works
Poison Ink: Robust and Invisible Backdoor Attack
Zhang, J., Chen, D., Huang, Q., Liao, J., Zhang, W., Feng, H., Hua, G., & Yu, N. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3201472 · Cited by 121 · see citing works
Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution
Qi, F., Yao, Y., Xu, S., Liu, Z., & Sun, M. (2021) · doi:10.18653/v1/2021.acl-long.377 · Cited by 113 · see citing works
Wang, Z., Zhai, J., & Ma, S. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01465 · Cited by 111 · see citing works
Yang, W., Li, L., Zhang, Z., Ren, X., Sun, X., & He, B. (2021) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2021.naacl-main.165 · Cited by 107 · see citing works
Vassilev, A. (2025) · doi:10.6028/nist.ai.100-2e2025 · Cited by 106 · see citing works
Color Backdoor: A Robust Poisoning Attack in Color Space
Jiang, W., Li, H., Xu, G., & Zhang, T. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00786 · Cited by 97 · see citing works
Black-box Detection of Backdoor Attacks with Limited Information and Data
Dong, Y., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., & Zhu, J. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01617 · Cited by 92 · see citing works
An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences
Guo, W., Tondi, B., & Barni, M. (2022) · IEEE Open Journal of Signal Processing · doi:10.1109/ojsp.2022.3190213 · Cited by 91 · see citing works
Adversarial Unlearning of Backdoors via Implicit Hypergradient
Zeng, Y., Chen, S., Park, W., Mao, Z. M., Jin, M., & Jia, R. (2021) · VTechWorks (Virginia Tech) · doi:10.48550/arxiv.2110.03735 · Cited by 88 · see citing works
Data-Free Backdoor Removal Based on Channel Lipschitzness
Zheng, R., Tang, R., Li, J., & Liu, L. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20065-6_11 · Cited by 87 · see citing works
Subpopulation Data Poisoning Attacks
Jagielski, M., Severi, G., Pousette Harger, N., & Oprea, A. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3485368 · Cited by 86 · see citing works
Unlearnable Examples: Making Personal Data UnexploitablePreprint
Huang, H., Ma, X., Erfani, S., Bailey, J., & Wang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.04898 · Cited by 85 · see citing works
Self-citationZhao, Z., Chen, X., Xuan, Y., Dong, Y., Wang, D., & Liang, K. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01478 · Cited by 84 · see citing works
Rethinking Stealthiness of Backdoor Attack against NLP Models
Yang, W., Lin, Y., Li, P., Zhou, J., & Sun, X. (2021) · doi:10.18653/v1/2021.acl-long.431 · Cited by 82 · see citing works
A Systematic Review of Adversarial Machine Learning Attacks, Defensive Controls and Technologies
Malik, J., Muthalagu, R., & Pawar, P. M. (2024) · IEEE Access · doi:10.1109/access.2024.3423323 · Cited by 76 · see citing works
The "Beatrix" Resurrections: Robust Backdoor Detection via Gram Matrices
Ma, W., Wang, D., Sun, R., Xue, M., Wen, S., & Xiang, Y. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.23069 · Cited by 74 · see citing works
SPECTRE: Defending Against Backdoor Attacks Using Robust StatisticsPreprint
Hayase, J., Kong, W., Somani, R., & Oh, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.11315 · Cited by 74 · see citing works
RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models
Yang, W., Lin, Y., Li, P., Zhou, J., & Sun, X. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.659 · Cited by 72 · see citing works
BadDet: Backdoor Attacks on Object Detection
Chan, S.-H., Dong, Y., Zhu, J., Zhang, X., & Zhou, J. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-25056-9_26 · Cited by 68 · see citing works
TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targets
Chen, W., Song, D. X., & Li, B. H. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00393 · Cited by 67 · see citing works
Backdoor Defense via Adaptively Splitting Poisoned Dataset
Gao, K., Bai, Y., Gu, J., Yang, Y., & Xia, S. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00390 · Cited by 64 · see citing works
Better Trigger Inversion Optimization in Backdoor Scanning
Tao, G., Shen, G., Liu, Y., An, S., Xu, Q., Ma, S., Li, P., & Zhang, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01301 · Cited by 57 · see citing works
Self-citationPiccolo: Exposing Complex Backdoors in NLP Transformer Models
Liu, Y., Shen, G., Tao, G., An, S., Ma, S., & Zhang, X. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833579 · Cited by 54 · see citing works
Self-citationPhysical Backdoor Attacks to Lane Detection Systems in Autonomous Driving
Han, X., Xu, G., Zhou, Y. H., Yang, X., Li, J., & Zhang, T. (2022) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3503161.3548171 · Cited by 54 · see citing works
Wang, H., Xiang, Z. J., Miller, D. J., & Kesidis, G. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00015 · Cited by 53 · see citing works
A Study of the Attention Abnormality in Trojaned BERTs
Lyu, W., Zheng, S., Ma, T., & Chen, C. (2022) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2022.naacl-main.348 · Cited by 52 · see citing works
Moore, E., Imteaj, A., Rezapour, S., & Amini, M. H. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3313055 · Cited by 52 · see citing works
PointBA: Towards Backdoor Attacks in 3D Point Cloud
Li, X., Chen, Z., Zhao, Y., Tong, Z., Zhao, Y., Lim, A. E. B., & Zhou, J. T. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01618 · Cited by 52 · see citing works
Butt, M. A., Qayyum, A., Ali, H. M., Al‐Fuqaha, A., & Qadir, J. (2022) · Computers & Security · doi:10.1016/j.cose.2022.103058 · Cited by 51 · see citing works
Deep Model Intellectual Property Protection With Compression-Resistant Model Watermarking
Nie, H., Lu, S., Wu, J., & Jian-xin, Z. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3351116 · Cited by 51 · see citing works
Detecting Backdoors in Pre-trained Encoders
Feng, S., Tao, G., Cheng, S., Shen, G., Xu, X., Liu, Y., Zhang, K., Ma, S., & Zhang, X. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01569 · Cited by 49 · see citing works
Self-citationJin, R., & Li, X. (2023) · Medical Image Analysis · doi:10.1016/j.media.2023.102965 · Cited by 48 · see citing works
Backdoor Attacks and Defenses Targeting Multi-Domain AI Models: A Comprehensive Review
Zhang, S., Pan, Y., Liu, Q., Yan, Z., Choo, K. R., & Wang, G. (2024) · ACM Computing Surveys · doi:10.1145/3704725 · Cited by 47 · see citing works
Model Orthogonalization: Class Distance Hardening in Neural Networks for Better Security
Tao, G., Liu, Y., Shen, G., Xu, Q., An, S., Zhang, Z., & Zhang, X. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833688 · Cited by 46 · see citing works
Self-citationBackdoor Defense via Deconfounded Representation Learning
Zhang, Z., Liu, Q., Wang, Z., Lu, Z., & Hu, Q. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01177 · Cited by 46 · see citing works
Machine Learning with Confidential Computing: A Systematization of Knowledge
Mo, F., Tarkhani, Z., & Haddadi, H. (2024) · ACM Computing Surveys · doi:10.1145/3670007 · Cited by 46 · see citing works
Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooring
Yang, W., Shao, S., Yang, Y., Liu, X., Liu, X., Xia, Z., Schaefer, G., & Fang, H. (2023) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3630636 · Cited by 45 · see citing works
Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Trigger
Yu, Y., Wang, Y., Yang, W., Lu, S., Tan, Y., & Kot, A. C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01179 · Cited by 44 · see citing works
WaNet - Imperceptible Warping-based Backdoor Attack
Nguyen, T. A., & Tran, A. N. (2021) · International Conference on Learning Representations · Cited by 43 · see citing works
Membership Inference via Backdooring
Hu, H., Salcic, Z. A., Dobbie, G., Chen, J., Sun, L., & Zhang, X. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/532 · Cited by 41 · see citing works
You Are Catching My Attention: Are Vision Transformers Bad Learners under Backdoor Attacks?
Yuan, Z., Zhou, P., Zou, K., & Cheng, Y. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02357 · Cited by 40 · see citing works
Backdoor Attack Against Split Neural Network-Based Vertical Federated Learning
He, Y., Shen, Z., Hua, J., Dong, Q., Niu, J., Tong, W., Huang, X., Li, C., & Zhong, S. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3327853 · Cited by 39 · see citing works
BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Label
Hu, S., Zhou, Z., Zhang, Y., Zhang, L. Y., Zheng, Y., He, Y., & Jin, H. (2022) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3503161.3548272 · Cited by 39 · see citing works
AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value AnalysisPreprint
Guo, J., Li, A., & Liu, C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14880 · Cited by 39 · see citing works
Complex Backdoor Detection by Symmetric Feature Differencing
Liu, Y., Shen, G., Tao, G., Wang, Z., Ma, S., & Zhang, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01458 · Cited by 37 · see citing works
Self-citationBackdoor Attacks to Deep Learning Models and Countermeasures: A Survey
Li, Y., Zhang, S., Wang, W., & Song, H. T. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3267221 · Cited by 37 · see citing works
PTB: Robust physical backdoor attacks against deep neural networks in real world
Xue, M., He, C., Wu, Y., Sun, S., Zhang, Y., Wang, J., & Liu, W. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102726 · Cited by 37 · see citing works
Poisoning the Unlabeled Dataset of Semi-Supervised LearningPreprint
Carlini, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.01622 · Cited by 37 · see citing works
CrowdGuard: Federated Backdoor Detection in Federated Learning
Rieger, P., Krauß, T., Miettinen, M., Dmitrienko, A., & Sadeghi, A.-R. (2024) · Proceedings 2024 Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23233 · Cited by 36 · see citing works
FLTracer: Accurate Poisoning Attack Provenance in Federated Learning
Zhang, X., Liu, Q., Ba, Z., Hong, Y., Zheng, T., Lin, F., Lü, L., & Ren, K. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3410014 · Cited by 36 · see citing works
Revisiting Single Image Reflection Removal in the Wild
Zhu, Y., Fu, X., Jiang, P.-T., Zhang, H., Sun, Q., Chen, J., Zha, Z.-J., & Li, B. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02406 · Cited by 36 · see citing works
Backdoor Attack and Defense on Deep Learning: A Survey
Bai, Y., Xing, G., Wu, H., Rao, Z., Ma, C., Wang, S., Liu, X., Zhou, Y., Tang, J., Huang, K., et al. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3482723 · Cited by 36 · see citing works
Eliminating Backdoor Triggers for Deep Neural Networks Using Attention Relation Graph Distillation
Xia, J., Wang, T., Ding, J., Wei, X. H., & Chen, M. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/206 · Cited by 35 · see citing works
Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers
Li, Y., Chen, Z., Cortellazzi, J., Pendlebury, F., Tu, K., Pierazzi, F., Cavallaro, L., & Wang, G. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179347 · Cited by 34 · see citing works
Backdooring Multimodal Learning
Han, X., Wu, Y., Zhang, Q., Zhou, Y. H., Xu, Y., Qiu, H., Xu, G., & Zhang, T. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00031 · Cited by 33 · see citing works
TransMalDE: An Effective Transformer Based Hierarchical Framework for IoT Malware Detection
Deng, X., Wang, Z., Pei, X., & Xue, K. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3292855 · Cited by 32 · see citing works
Mengara, O., Avila, A. R., & Falk, T. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355816 · Cited by 32 · see citing works
Enhancing Backdoor Attacks With Multi-Level MMD Regularization
Xia, P., Niu, H., Li, Z., & Li, B. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3161477 · Cited by 32 · see citing works
TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoors
Pang, R., Zhang, Z., Gao, X., Xi, Z., Ji, S., Cheng, P., Luo, X., & Wang, T. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00048 · Cited by 31 · see citing works
Invisible Backdoor Attack With Dynamic Triggers Against Person Re-Identification
Sun, W., Jiang, X., Dou, S., Li, D., Miao, D., Deng, C. D., & Zhao, C. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3322659 · Cited by 30 · see citing works
Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspective
Zhang, Z., Lin, M., Dai, E., & Wang, S. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671910 · Cited by 30 · see citing works
Unleashing the Power of Continual Learning on Non-Centralized Devices: A Survey
Li, Y., Wang, H., Xu, W., Xiao, T., Liu, H., Tu, M., Wang, Y., Yang, X., Zhang, R., Yu, S., et al. (2025) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2025.3568279 · Cited by 30 · see citing works
Open-sourced Dataset Protection via Backdoor WatermarkingPreprint
Li, Y., Zhang, Z., Bai, J., Wu, B., Jiang, Y., & Xia, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.05821 · Cited by 30 · see citing works
TrojanFlow: A Neural Backdoor Attack to Deep Learning-based Network Traffic Classifiers
Ning, R., Xin, C., & Wu, H. (2022) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom48880.2022.9796878 · Cited by 29 · see citing works
Data-Efficient Backdoor Attacks
Xia, P., Li, Z., Zhang, W., & Li, B. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/554 · Cited by 29 · see citing works
Potential cyber threats of adversarial attacks on autonomous driving models
Boltachev, E. (2023) · Journal of Computer Virology and Hacking Techniques · doi:10.1007/s11416-023-00486-x · Cited by 29 · see citing works
Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial TrainingPreprint
Tao, L., Feng, L., Yi, J., Huang, S.-J., & Chen, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.04716 · Cited by 29 · see citing works
DriNet: Dynamic Backdoor Attack against Automatic Speech Recognization Models
Ye, J., Liu, X., You, Z., Li, G., & Liu, B. (2022) · Applied Sciences · doi:10.3390/app12125786 · Cited by 28 · see citing works
Backdoor Cleansing with Unlabeled Data
Pang, L., Sun, T., Ling, H., & Chen, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01176 · Cited by 28 · see citing works
Similarity-based integrity protection for deep learning systems
Hou, R., Ai, S., Chen, Q., Yan, H., Huang, T. H., & Chen, K. (2022) · Information Sciences · doi:10.1016/j.ins.2022.04.003 · Cited by 27 · see citing works
He, J., Lai, B., Kang, J., Du, H., Nie, J., Zhang, T., Yuan, Y., Zhang, W., Niyato, D. T., & Jamalipour, A. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3420696 · Cited by 27 · see citing works
Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition SystemsPreprint
Li, H., Wang, Y., Xie, X., Liu, Y., Wang, S., Wan, R., Chau, L., & Kot, A. C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.06996 · Cited by 27 · see citing works
Self-citationLinkBreaker: Breaking the Backdoor-Trigger Link in DNNs via Neurons Consistency Check
Chen, Z., Wang, S., Fu, A., Gao, Y., Yu, S., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3175616 · Cited by 26 · see citing works
PolicyCleanse: Backdoor Detection and Mitigation for Competitive Reinforcement Learning
Guo, J., Li, A., Wang, L., & Liu, C. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00433 · Cited by 26 · see citing works
Stealthy and Flexible Trojan in Deep Learning Framework
Wang, Y., Chen, K., Tan, Y., Huang, S., Ma, W., & Li, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3164073 · Cited by 25 · see citing works
Towards Attack-tolerant Federated Learning via Critical Parameter Analysis
Han, S., Park, S., Wu, F., Kim, S., Zhu, B., Xie, X., & Cha, M. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00461 · Cited by 25 · see citing works
Hidden Backdoor Attack against Semantic Segmentation ModelsPreprint
Li, Y., Li, Y., Lv, Y., Jiang, Y., & Xia, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.04038 · Cited by 25 · see citing works
CUDA: Convolution-Based Unlearnable Datasets
Sadasivan, V. S., Soltanolkotabi, M., & Feizi, S. (2023) · 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52729.2023.00376 · Cited by 24 · see citing works
- Authors
- Liu, Y., Ma, X., Bailey, J., & Lu, F.
- Affiliations
- State Key Laboratory of Virtual Reality Technology and Systems (CN)
- Deakin University (AU)
- The University of Melbourne (AU)
- Peng Cheng Laboratory (CN)
- Corresponding author
- Lu, Feng
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2020
- Pages
- 182-199
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W3107337211
- Cited by
- 531
- References
- 59
- Citations by year
- 2026: 56 · 2025: 116 · 2024: 128 · 2023: 102 · 2022: 74 · 2021: 47 · 2020: 8
- FWCI
- 22.06
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- Lecture notes in computer science (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Figshare (submittedVersion, cc-by)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China (61972012)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- backdoor attacks, deep neural network, stealthy attacks, backdoor defense, adversarial learning, computer vision
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
