LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Abstract
Recently, machine learning models have demonstrated to be vulnerable to backdoor attacks, primarily due to the lack of transparency in black-box models such as deep neural networks. A third-party model can be poisoned such that it works adequately in normal conditions but behaves maliciously on samples with specific trigger patterns. However, the trigger injection function is manually defined in most existing backdoor attack methods, e.g., placing a small patch of pixels on an image or slightly deforming the image before poisoning the model. This results in a two-stage approach with a sub-optimal attack success rate and a lack of complete stealthiness under human inspection.In this paper, we propose a novel and stealthy backdoor attack framework, LIRA, which jointly learns the optimal, stealthy trigger injection function and poisons the model. We formulate such an objective as a non-convex, constrained optimization problem. Under this optimization framework, the trigger generator function will learn to manipulate the input with imperceptible noise to preserve the model performance on the clean data and maximize the attack success rate on the poisoned data. Then, we solve this challenging optimization problem with an efficient, two-stage stochastic optimization procedure. Finally, the proposed attack framework achieves 100% success rates in several benchmark datasets, including MNIST, CIFAR10, GTSRB, and T-ImageNet, while simultaneously bypassing existing backdoor defense methods and human inspection.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
A high BAR is equivalent to a high ASR and BTA.
“Generally, a high BAR is equivalent to a high ASR and BTA.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [143]
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
U-Net: Convolutional Networks for Biomedical Image Segmentation
Ronneberger, O., Fischer, P., & Brox, T. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-24574-4_28 · Cited by 99,404 · see citing works
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 48,293 · see citing works
Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.74 · Cited by 24,513 · see citing works
Mastering the game of Go without human knowledge
Silver, D., Schrittwieser, J., Simonyan, K., Antonoglou, I., Huang, A., Guez, A., Hubert, T., Baker, L., Lai, M., Bolton, A., et al. (2017) · Nature · doi:10.1038/nature24270 · Cited by 9,084 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
(2017) · International Conference on Machine Learning · Cited by 6,382 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
Adversarial Examples Are Not Easily Detected
Carlini, N., & Wagner, D. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140444 · Cited by 1,626 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
Dota 2 with Large Scale Deep Reinforcement Learning
OpenAI, :, Berner, C., Brockman, G., Chan, B., Cheung, V., Dębiak, P., Dennison, C., Farhi, D., Fischer, Q., et al. (2019) · arXiv · doi:10.48550/arxiv.1912.06680 · Cited by 1,065 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1712.05526 · Cited by 1,039 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural NetworksPreprint
Shafahi, A., Huang, W., Najibi, M., Suciu, O., Studer, C., Dumitraş, T., & Goldstein, T. (2018) · arXiv (Cornell University) · doi:10.3929/ethz-b-000460348 · Cited by 626 · see citing works
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization
Muñoz-González, L., Biggio, B., Demontis, A., Paudice, A., Wongrassamee, V., Lupu, E. C., & Roli, F. (2017) · Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3128572.3140451 · Cited by 549 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
Spectral Signatures in Backdoor AttacksPreprint
Tran, B., Li, J. Z., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.00636 · Cited by 506 · see citing works
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018) · arXiv · doi:10.48550/arxiv.1811.03728 · Cited by 485 · see citing works
DBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 468 · see citing works
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View
Liu, Q., Li, P., Zhao, W., Cai, W., Yu, S., & Leung, V. C. M. (2018) · IEEE Access · doi:10.1109/access.2018.2805680 · Cited by 421 · see citing works
Self-citationLatent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning
Barni, M., Kallas, K., & Tondi, B. (2019) · Proceedings - International Conference on Image Processing · doi:10.1109/icip.2019.8802997 · Cited by 360 · see citing works
Weight Poisoning Attacks on Pretrained Models
Kurita, K., Michel, P., & Neubig, G. (2020) · Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/2020.acl-main.249 · Cited by 354 · see citing works
Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
Li, S., Xue, M., Zhao, B. Z. H., Zhu, H., & Zhang, X. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3021407 · Cited by 325 · see citing works
AlQuraishi, M. (2019) · Bioinformatics · doi:10.1093/bioinformatics/btz422 · Cited by 315 · see citing works
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/647 · Cited by 314 · see citing works
WaNet -- Imperceptible Warping-based Backdoor AttackPreprint
Nguyen, A., & Tran, A. N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.10369 · Cited by 296 · see citing works
Liu, Y., Xie, Y., & Srivastava, A. (2017) · 2017 IEEE International Conference on Computer Design (ICCD) · doi:10.1109/iccd.2017.16 · Cited by 241 · see citing works
Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
Zhu, C., Huang, W., Shafahi, A., Li, H., Taylor, G., Studer, C., & Goldstein, T. (2019) · Repository for Publications and Research Data (ETH Zurich) · doi:10.3929/ethz-b-000459774 · Cited by 190 · see citing works
Label-Consistent Backdoor AttacksPreprint
Turner, A., Tsipras, D., & Mądry, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.02771 · Cited by 177 · see citing works
Blind Backdoors in Deep Learning ModelsPreprint
Bagdasaryan, E., & Shmatikov, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.03823 · Cited by 175 · see citing works
Wasserstein Adversarial Examples via Projected Sinkhorn Iterations
Wong, E., Schmidt, F. R., & Kolter, J. Z. (2019) · arXiv · doi:10.48550/arxiv.1902.07906 · Cited by 145 · see citing works
Rethinking the Trigger of Backdoor AttackPreprint
Li, Y., Zhai, T., Wu, B., Jiang, Y., Li, Z., & Xia, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.04692 · Cited by 132 · see citing works
Towards Imperceptible and Robust Adversarial Example Attacks Against Neural Networks
Luo, B., Liu, Y., Wei, L., & Xu, Q. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11499 · Cited by 130 · see citing works
Bypassing Backdoor Detection Algorithms in Deep Learning
Tan, T. J. L., & Shokri, R. (2020) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp48549.2020.00019 · Cited by 123 · see citing works
Geometric Robustness of Deep Networks: Analysis and Improvement
Kanbak, C., Moosavi-Dezfooli, S.-M., & Pascal Frossard, B. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00467 · Cited by 120 · see citing works
Backdooring Convolutional Neural Networks via Targeted Weight Perturbations
Dumford, J., & Scheirer, W. J. (2020) · IEEE International Joint Conference on Biometrics (IJCB) · doi:10.1109/ijcb48548.2020.9304875 · Cited by 102 · see citing works
Distributed Hierarchical GPU Parameter Server for Massive Scale Deep Learning Ads SystemsPreprint
Zhao, W., Xie, D., Jia, R., Qian, Y., Ding, R., Sun, M., & Li, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.05622 · Cited by 98 · see citing works
Self-citationHardware Trojan Design on Neural Networks
Clements, J., & Lao, Y. (2019) · IEEE International Symposium on Circuits and Systems proceedings · doi:10.1109/iscas.2019.8702493 · Cited by 83 · see citing works
Self-citationLiu, Y., Xie, Y., & Srivastava, A. (2017) · IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD) · Cited by 81 · see citing works
Robust Watermarking for Deep Neural Networks via Bi-level Optimization
Yang, P., Lao, Y., & Li, P. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01457 · Cited by 63 · see citing works
Self-citationDefending Neural Backdoors via Generative Distribution ModelingPreprint
Qiao, X., Yang, Y., & Li, H. H. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.04749 · Cited by 61 · see citing works
Agile and Accurate CTR Prediction Model Training for Massive-Scale Online Advertising Systems
Xu, Z., Li, D., Zhao, W., Shen, X., Huang, T., Li, X., & Li, P. (2021) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/3448016.3457236 · Cited by 38 · see citing works
Self-citationDefending against Backdoor Attack on Deep Neural NetworksPreprint
Cheng, H., Xu, K., Liu, S., Chen, P., Zhao, P., & Lin, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.12162 · Cited by 37 · see citing works
Interpretable Graph Similarity Computation via Differentiable Optimal Alignment of Node Embeddings
Doan, K. D., Manchanda, S., Mahapatra, S., & Reddy, C. K. A. (2021) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/3404835.3462960 · Cited by 28 · see citing works
Self-citationBackdoor Attacks on Facial Recognition in the Physical WorldPreprint
Wenger, E., Passananti, J., Yao, Y., Zheng, H.-T., & Zhao, B. Y. (2020) · arXiv (Cornell University) · Cited by 23 · see citing works
Exposing Backdoors in Robust Machine Learning Models.Preprint
Soremekun, E., Udeshi, S., Chattopadhyay, S., & Zeller, A. (2020) · arXiv (Cornell University) · Cited by 18 · see citing works
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13 · see citing works
Efficient Implicit Unsupervised Text Hashing using Adversarial Autoencoder
Doan, K. D., & Reddy, C. K. A. (2020) · doi:10.1145/3366423.3380150 · Cited by 11 · see citing works
Self-citation
Flagged first, then by citations
3 of the 59 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
Cinà, A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., & Roli, F. (2023) · ACM Computing Surveys · doi:10.1145/3585385 · Cited by 152 · see citing works
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“In other studies, similar terms, such as ASR [143], [144] and backdoor task accuracy (BTA) [32], are used.”
BackgroundMethodNguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130 · see citing works
Self-citationFIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis
Feng, Y., Ma, B., Zhang, J., Zhao, S., Xia, Y., & Tao, D. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.02021 · Cited by 125 · see citing works
Physical Adversarial Attack Meets Computer Vision: A Decade Survey
Wei, H., Tang, H., Jia, X., Wang, Z., Yu, H., Li, Z., Satoh, S., Gool, L. V., & Wang, Z. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3430860 · Cited by 115 · see citing works
Wang, Z., Zhai, J., & Ma, S. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01465 · Cited by 111 · see citing works
An Invisible Black-Box Backdoor Attack Through Frequency Domain
Wang, T., Yao, Y., Xu, F., An, S., Tong, H., & Wang, T. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19778-9_23 · Cited by 127 · see citing works
Zhao, Z., Chen, X., Xuan, Y., Dong, Y., Wang, D., & Liang, K. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01478 · Cited by 84 · see citing works
Stealthy Backdoor Attack for Code Models
Yang, Z., Xu, B., Zhang, J. M., Kang, H. J., Shi, J., He, J., & Lo, D. (2024) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2024.3361661 · Cited by 78 · see citing works
Robust Watermarking for Deep Neural Networks via Bi-level Optimization
Yang, P., Lao, Y., & Li, P. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01457 · Cited by 63 · see citing works
Self-citationChen, Y., Zhu, X., Gong, X., Yi, X., & Li, S. X. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3198481 · Cited by 48 · see citing works
Machine Learning Security Against Data Poisoning: Are We There Yet?
Ciná, A. E., Grosse, K., Demontis, A., Biggio, B., Roli, F., & Pelillo, M. (2024) · Computer · doi:10.1109/mc.2023.3299572 · Cited by 47 · see citing works
Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Trigger
Yu, Y., Wang, Y., Yang, W., Lu, S., Tan, Y., & Kot, A. C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01179 · Cited by 44 · see citing works
BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Label
Hu, S., Zhou, Z., Zhang, Y., Zhang, L. Y., Zheng, Y., He, Y., & Jin, H. (2022) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3503161.3548272 · Cited by 39 · see citing works
Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency
Liu, X., Li, M., Wang, H., Hu, S., Ye, D., Jin, H., Wu, L., & Xiao, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01570 · Cited by 37 · see citing works
Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey
Li, Y., Zhang, S., Wang, W., & Song, H. T. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3267221 · Cited by 37 · see citing works
PTB: Robust physical backdoor attacks against deep neural networks in real world
Xue, M., He, C., Wu, Y., Sun, S., Zhang, Y., Wang, J., & Liu, W. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102726 · Cited by 37 · see citing works
DeepAuth: A DNN Authentication Framework by Model-Unique and Fragile Signature Embedding
Lao, Y., Zhao, W., Yang, P., & Li, P. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i9.21193 · Cited by 33 · see citing works
Self-citationBackdoor Attack and Defense on Deep Learning: A Survey
Bai, Y., Xing, G., Wu, H., Rao, Z., Ma, C., Wang, S., Liu, X., Zhou, Y., Tang, J., Huang, K., et al. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3482723 · Cited by 36 · see citing works
Mengara, O., Avila, A. R., & Falk, T. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355816 · Cited by 32 · see citing works
Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers
Li, Y., Chen, Z., Cortellazzi, J., Pendlebury, F., Tu, K., Pierazzi, F., Cavallaro, L., & Wang, G. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179347 · Cited by 34 · see citing works
A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives
Gao, Y., Chen, H., Sun, P., Li, J., Zhang, A., Wang, Z., & Liu, W. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i3.27954 · Cited by 30 · see citing works
Hardly Perceptible Trojan Attack Against Neural Networks with Bit Flips
Bai, J., Gao, K., Gong, D., Xia, S., Li, Z., & Liu, W. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20065-6_7 · Cited by 29 · see citing works
Backdoor Attacks Against Dataset Distillation
Liu, Y., Li, Z., Michael Backes, A., Shen, Y., & Zhang, Y. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24287 · Cited by 31 · see citing works
TAT: Targeted backdoor attacks against visual object tracking
Cheng, Z., Wu, B., Zhang, Z., & Zhao, J. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109629 · Cited by 29 · see citing works
BadCM: Invisible Backdoor Attack Against Cross-Modal Learning
Zhang, Z., Xu, Y., Zhu, L., Song, J., & Nie, L. (2024) · IEEE Transactions on Image Processing · doi:10.1109/tip.2024.3378918 · Cited by 29 · see citing works
Backdoor Cleansing with Unlabeled Data
Pang, L., Sun, T., Ling, H., & Chen, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01176 · Cited by 28 · see citing works
Kaleidoscope: Physical Backdoor Attacks Against Deep Neural Networks With RGB Filters
Gong, X., Wang, Z., Chen, Y., Xue, M., Wang, Q., & Shen, C. Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3239225 · Cited by 27 · see citing works
COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks
Huynh, T., Nguyen, D., Pham, T., & Tran, A. T. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i3.28019 · Cited by 22 · see citing works
Backdoor Attacks on Time Series: A Generative Approach
Jiang, Y., Ma, X., Erfani, S., & Bailey, J. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00034 · Cited by 24 · see citing works
CLPA: Clean-Label Poisoning Availability Attacks Using Generative Adversarial Nets
Zhao, B., & Lao, Y. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i8.20902 · Cited by 22 · see citing works
Self-citationDefending Backdoor Attacks on Vision Transformer via Patch Processing
Doan, K. D., Lao, Y., Yang, P., & Li, P. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i1.25125 · Cited by 23 · see citing works
Self-citationBackdoor Attacks for Remote Sensing Data With Wavelet Transform
Dräger, N., Xu, Y., & Ghamisi, P. (2023) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2023.3289307 · Cited by 20 · see citing works
MBA: Backdoor Attacks Against 3D Mesh Classifier
Fan, L., He, F., Si, T., Fan, R., Ye, C., & Li, B. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3346644 · Cited by 20 · see citing works
Backdoor attacks and defense mechanisms in federated learning: A survey
Li, Z., Lan, J., Yan, Z., & Erol Gelenbe, A. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103248 · Cited by 19 · see citing works
Identification for Deep Neural Network: Simply Adjusting Few Weights!
Lao, Y., Yang, P., Zhao, W., & Li, P. (2022) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde53745.2022.00104 · Cited by 19 · see citing works
Self-citationThe Dark Side of Dynamic Routing Neural Networks: Towards Efficiency Backdoor Injection
Chen, S., Chen, H., Haque, M., Liu, C., & Yang, W. H. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02355 · Cited by 19 · see citing works
DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models
Zhou, J., Lv, P., Lan, Y., Meng, G., Chen, K., & Ma, H. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30186 · Cited by 19 · see citing works
Zhu, R., Tang, D., Tang, S., Wang, X., & Tang, H. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10351028 · Cited by 18 · see citing works
Abad, G., Ersoy, O., Picek, S., & Urbieta, A. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24334 · Cited by 18 · see citing works
BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defense
Cheng, S., Tao, G., Liu, Y., An, S., Xu, X., Feng, S., Shen, G., Zhang, K., Xu, Q., Ma, S., et al. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24944 · Cited by 16 · see citing works
CASSOCK: Viable Backdoor Attacks against DNN in the Wall of Source-Specific Backdoor Defenses
Wang, S., Gao, Y., Fu, A., Zhang, Z., Zhang, Y., Susilo, W., & Liu, D. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3582829 · Cited by 16 · see citing works
Progressive Poisoned Data Isolation for Training-Time Backdoor Defense
Chen, Y., Wu, H., & Zhou, J. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i10.29023 · Cited by 16 · see citing works
Threat Modeling AI/ML With the Attack Tree
Hoseini, S. V., Suutala, J., Partala, J., & Halunen, K. (2024) · IEEE Access · doi:10.1109/access.2024.3497011 · Cited by 17 · see citing works
PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification
Yuan, Y., Kong, R., Xie, S., Li, Y., & Liu, Y. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612032 · Cited by 14 · see citing works
NeuralSanitizer: Detecting Backdoors in Neural Networks
Zhu, H., Zhao, Y., Zhang, S., & Chen, K. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3390599 · Cited by 14 · see citing works
iBA: Backdoor Attack on 3D Point Cloud via Reconstructing Itself
Bian, Y., Tian, S., & Liu, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3452630 · Cited by 15 · see citing works
Single Image Backdoor Inversion via Robust Smoothed Classifiers
Sun, M.-J., & Kolter, J. Z. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00784 · Cited by 14 · see citing works
Invisible Backdoor Attack against 3D Point Cloud Classifier in Graph Spectral Domain
Fan, L., He, F., Si, T., Tang, W., & Li, B. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30099 · Cited by 13 · see citing works
T2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models
Wang, Z., Zhang, J., Shan, S., & Chen, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73013-9_7 · Cited by 13 · see citing works
Zukaib, U., & Cui, X. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.113167 · Cited by 13 · see citing works
Imperceptible and multi-channel backdoor attack
Xue, M., Ni, S., Wu, Y., Zhang, Y., & Liu, W. (2023) · Applied Intelligence · doi:10.1007/s10489-023-05228-6 · Cited by 13 · see citing works
DeepHardMark: Towards Watermarking Neural Network Hardware
Clements, J., & Lao, Y. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i4.20367 · Cited by 13 · see citing works
Self-citationContrastive Neuron Pruning for Backdoor Defense
Feng, Y., Ma, B., Liu, D., Zhang, Y., Cai, W., & Xia, Y. (2025) · IEEE Transactions on Image Processing · doi:10.1109/tip.2025.3539466 · Cited by 12 · see citing works
Untargeted Backdoor Attack Against Deep Neural Networks With Imperceptible Trigger
Xue, M., Wu, Y., Ni, S., Zhang, L. Y., Zhang, Y., & Liu, W. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3329641 · Cited by 12 · see citing works
BadMerging: Backdoor Attacks Against Model Merging
Zhang, J., Chi, J., Li, Z., Cai, K., Zhang, Y., & Tian, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690284 · Cited by 13 · see citing works
Lotus: Evasive and Resilient Backdoor Attacks through Sub-Partitioning
Cheng, S., Tao, G., Liu, Y., Shen, G., An, S., Feng, S., Xu, X., Zhang, K., Ma, S., & Zhang, X. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02342 · Cited by 11 · see citing works
BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning
Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., Zhu, M., Wang, R., Liu, L., & Shen, C. (2025) · International Journal of Computer Vision · doi:10.1007/s11263-025-02447-x · Cited by 12 · see citing works
Hanif, M. A., Chattopadhyay, N., Ouni, B., & Shafique, M. (2025) · IEEE Access · doi:10.1109/access.2025.3571995 · Cited by 11 · see citing works
Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoning
Wang, Z., Huang, S., Huang, Y., & Cui, H. (2023) · doi:10.1145/3591197.3591307 · Cited by 10 · see citing works
Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognition
Hammoud, H. A. A. K., Liu, S., Alkhrashi, M., AlBalawi, F., & Ghanem, B. (2024) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw63382.2024.00348 · Cited by 15 · see citing works
NL2GDPR: Automatically Develop GDPR Compliant Android Application Features from Natural Language
Shezan, F. H., Lao, Y., Peng, M., Wang, X., Sun, M., & Li, P. (2022) · IEEE Conference on Communications and Network Security · doi:10.1109/cns56114.2022.10273858 · Cited by 9 · see citing works
Self-citationA novel robust black-box fingerprinting scheme for deep classification neural networks
Mo, M., Wang, C., Guo, Q., Bian, S., Huang, Q., & Zhang, X. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124201 · Cited by 9 · see citing works
Yu, Y., Wang, Y., Yang, W., Guo, L., Lu, S., Duan, L., Tan, Y., & Kot, A. C. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3507873 · Cited by 8 · see citing works
Delta-DAGMM: A Free Rider Attack Detection Model in Horizontal Federated Learning
Huang, H., Zhang, B., Sun, Y., Ma, C., & Qu, J. (2022) · Security and Communication Networks · doi:10.1155/2022/8928790 · Cited by 9 · see citing works
Inaudible Backdoor Attack via Stealthy Frequency Trigger Injection in Audio Spectrogram
Zhang, T., Phan, H., Tang, Z., Shi, C., Wang, Y., Yuan, B., & Chen, Y. J. (2024) · ACM Annual International Conference on Mobile Computing and Networking (MobiCom) · doi:10.1145/3636534.3649345 · Cited by 9 · see citing works
Imperceptible Backdoor Attacks on Text-Guided 3D Scene Grounding
Liu, D., & Hu, W. (2025) · IEEE Transactions on Multimedia · doi:10.1109/tmm.2025.3543050 · Cited by 8 · see citing works
Membership Inference Attacks Against Semantic Segmentation Models
Chobola, T., Usynin, D., & Kaissis, G. A. (2023) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3605764.3623906 · Cited by 8 · see citing works
Minimalism is King! High-Frequency Energy-Based Screening for Data-Efficient Backdoor Attacks
Xun, Y., Jia, X., Gu, J., Liu, X., Guo, Q., & Cao, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3380821 · Cited by 7 · see citing works
Yang, X., Li, G., Zhou, K., Li, J., Lin, X., & Liu, Y. (2025) · IEEE Open Journal of Vehicular Technology · doi:10.1109/ojvt.2025.3550411 · Cited by 7 · see citing works
Qiu, H., Sun, J., Zhang, M., Pan, X., & Yang, M. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00226 · Cited by 7 · see citing works
Model-Manipulation Attacks Against Black-Box Explanations
Hegde, A., Noppel, M., & Wressnegger, C. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00081 · Cited by 7 · see citing works
RIBAC: Towards Robust and Imperceptible Backdoor Attack against Compact DNN
Phan, H., Shi, C., Xie, Y., Zhang, T., Li, Z., Zhao, T., Liu, J., Wang, Y., Chen, Y. J., & Yuan, B. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19772-7_41 · Cited by 7 · see citing works
Moiré Backdoor Attack (MBA): A Novel Trigger for Pedestrian Detectors in the Physical World
Wei, H., Yu, H., Zhang, K., Wang, Z., Zhu, J., & Wang, Z. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3611910 · Cited by 7 · see citing works
Arshad, I., Alsamhi, S. H., Qiao, Y., Lee, B., & Ye, Y. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3384938 · Cited by 7 · see citing works
UNIT: Backdoor Mitigation via Automated Neural Distribution Tightening
Cheng, S., Shen, G., Zhang, K., Tao, G., An, S., Guo, H., Ma, S., & Zhang, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73033-7_15 · Cited by 6 · see citing works
Attacking Neural Networks with Neural Networks: Towards Deep Synchronization for Backdoor Attacks
Guan, Z., Sun, L., Du, M., & Liu, N. (2023) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3583780.3614784 · Cited by 6 · see citing works
Exploring the Orthogonality and Linearity of Backdoor Attacks
Zhang, K., Cheng, S., Shen, G., Tao, G., An, S., Makur, A., Ma, S., & Zhang, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00225 · Cited by 7 · see citing works
Evading backdoor defenses: Concealing genuine backdoors through scapegoat strategy
Qian, Y., Lian, Z., Li, Y., Wang, W., Gu, Z., Wang, B., & Zhang, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104225 · Cited by 6 · see citing works
Fisher Information guided Purification against Backdoor Attacks
Karim, N., Arafat, A. A., Rakin, A. S., Guo, Z., & Rahnavard, N. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690250 · Cited by 6 · see citing works
KerbNet: A QoE-Aware Kernel-Based Backdoor Attack Framework
Gong, X., Chen, Y., Huang, H., Kong, W., Wang, Z., Shen, C. Q., & Wang, Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3286842 · Cited by 6 · see citing works
Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering
Zhu, R., Tang, D., Tang, S., Wang, Z., Tao, G., Ma, S., Wang, X., & Tang, H. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24450 · Cited by 7 · see citing works
Poisoning Attack on Federated Knowledge Graph Embedding
Zhou, E., Guo, S., Ma, Z., Hong, Z., Guo, T., & Dong, P. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645422 · Cited by 6 · see citing works
LaserGuider: A Laser Based Physical Backdoor Attack Against Deep Neural Networks
Xu, Y., Chen, G., Song, F., & Chen, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95767-3_13 · Cited by 5 · see citing works
Unified Neural Backdoor Removal With Only Few Clean Samples Through Unlearning and Relearning
Min, N. M., Pham, L. H., & Sun, J. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3586499 · Cited by 5 · see citing works
Stealthy Backdoor Attacks On Deep Point Cloud Recognization Networks
Feng, L., Qian, Z., Zhang, X., & Li, S. (2023) · The Computer Journal · doi:10.1093/comjnl/bxad109 · Cited by 5 · see citing works
Stealthy Backdoor Attacks on Semantic Symbols in Semantic Communications
Zhou, Y., Hu, R. Q., & Qian, Y. (2024) · Globecom · doi:10.1109/globecom52923.2024.10901411 · Cited by 5 · see citing works
Don’t FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNs
Hammoud, H. A. A. K., Bibi, A., Torr, P. H. S., & Ghanem, B. (2023) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw59228.2023.00230 · Cited by 6 · see citing works
Adaptive Robust Learning Against Backdoor Attacks in Smart Homes
Zhang, J., Wang, Z., Ma, Z., & Ma, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3392772 · Cited by 5 · see citing works
Backdoor Attacks with Input-Unique Triggers in NLP
Zhou, X., Li, J., Zhang, T., Lyu, L., Yang, M., & He, J. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70341-6_18 · Cited by 5 · see citing works
A Triple Stealthy Backdoor: Hidden in Spatial, Frequency, and Feature Domains
Gao, Y., Chen, H., Sun, P., Li, J., Yin, Y., Wang, Z., & Liu, W. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3600427 · Cited by 4 · see citing works
Unlearning Backdoor Attacks Through Gradient-Based Model Pruning
Dunnett, K., Arablouei, R., Miller, D., Dedeoglu, V., & Jurdak, R. (2024) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w60302.2024.00021 · Cited by 4 · see citing works
A steganographic backdoor attack scheme on encrypted traffic
Rao, B., Zhu, G., Ding, Q., Chen, D., Cao, M., Cao, Y. H., & Wang, F. (2025) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-024-01893-7 · Cited by 4 · see citing works
Low-Frequency Black-Box Backdoor Attack via Evolutionary Algorithm
Qiao, Y., Liu, D., Wang, R., & Liang, K. (2025) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61041.2025.00737 · Cited by 4 · see citing works
Misactivation-Aware Stealthy Backdoor Attacks on Neural Code Understanding Models
Sun, X., Xiao, Y., Bo, L., Sun, W., Liu, X., Li, B., & Zhang, J. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3614128 · Cited by 4 · see citing works
Tong, H., Ma, H., Shen, H., Li, Z., & Chang, L. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2024.108966 · Cited by 4 · see citing works
Mask-Based Invisible Backdoor Attacks on Object Detection
Shin, J. (2024) · Proceedings - International Conference on Image Processing · doi:10.1109/icip51287.2024.10647450 · Cited by 4 · see citing works
Clean and Compact: Efficient Data-Free Backdoor Defense with Model Compactness
Phan, H., Xiao, J., Sui, Y., Zhang, T., Tang, Z., Shi, C., Wang, Y., Chen, Y. J., & Yuan, B. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73027-6_16 · Cited by 4 · see citing works
Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelines
Bagdasarian, E., & Shmatikov, V. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690337 · Cited by 5 · see citing works
- Authors
- Doan, K., Lao, Y., Zhao, W., & Li, P.
- Affiliations
- Virginia Tech (US)
- Clemson University (US)
- Baidu (China) (CN)
- Venue
- 2021 IEEE/CVF International Conference on Computer Vision (ICCV)
- Publisher
- IEEE
- Published
- 2021-10
- Pages
- 11946-11956
- OpenAlex
- W3201941857
- Cited by
- 211
- References
- 59
- Citations by year
- 2026: 29 · 2025: 48 · 2024: 73 · 2023: 39 · 2022: 20 · 2021: 2
- FWCI
- 15.48
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE/CVF International Conference on Computer Vision (ICCV) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- backdoor attacks, backdoor defense evasion, stealthy attacks, data poisoning, deep neural network, adversarial robustness, nonconvex constrained optimization, two-stage stochastic programming, image classification security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
