The DOI matches its Crossref record; 57 of the 59 references it cites were found in a registry or an index.
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Abstract
Recently, machine learning models have demonstrated to be vulnerable to backdoor attacks, primarily due to the lack of transparency in black-box models such as deep neural networks. A third-party model can be poisoned such that it works adequately in normal conditions but behaves maliciously on samples with specific trigger patterns. However, the trigger injection function is manually defined in most existing backdoor attack methods, e.g., placing a small patch of pixels on an image or slightly deforming the image before poisoning the model. This results in a two-stage approach with a sub-optimal attack success rate and a lack of complete stealthiness under human inspection.In this paper, we propose a novel and stealthy backdoor attack framework, LIRA, which jointly learns the optimal, stealthy trigger injection function and poisons the model. We formulate such an objective as a non-convex, constrained optimization problem. Under this optimization framework, the trigger generator function will learn to manipulate the input with imperceptible noise to preserve the model performance on the clean data and maximize the attack success rate on the poisoned data. Then, we solve this challenging optimization problem with an efficient, two-stage stochastic optimization procedure. Finally, the proposed attack framework achieves 100% success rates in several benchmark datasets, including MNIST, CIFAR10, GTSRB, and T-ImageNet, while simultaneously bypassing existing backdoor defense methods and human inspection.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Generally, a high BAR is equivalent to a high ASR and BTA.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [143]
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
U-Net: Convolutional Networks for Biomedical Image Segmentation
Ronneberger, O., Fischer, P., & Brox, T. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-24574-4_28 · Cited by 99,404
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805 · Cited by 73,173
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 54,325
Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.74 · Cited by 24,513
Mastering the game of Go without human knowledge
Silver, D., Schrittwieser, J., Simonyan, K., Antonoglou, I., Huang, A., Guez, A., Hubert, T., Baker, L., Lai, M., Bolton, A., et al. (2017) · Nature · doi:10.1038/nature24270 · Cited by 9,084
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602
(2017) · International Conference on Machine Learning · Cited by 6,382
Research works printed but not linked: 3
- doan, 2020, Image generation via minimizing fr\’echet distance in discriminator feature space, arXiv preprint arXiv 2003 11055
- goodfellow, 2014, Generative adversarial nets, Advances in Neural Information Processing Systems (NIPS), 2672
- salem, 2020, Dynamic backdoor attacks against machine learning models, arXiv preprint arXiv 2003 07516
Cited by
Sorted by citations
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682
Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
Cinà, A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., & Roli, F. (2023) · ACM Computing Surveys · doi:10.1145/3585385 · Cited by 152
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152
“In other studies, similar terms, such as ASR [143], [144] and backdoor task accuracy (BTA) [32], are used.”
BackgroundMethodNguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130
Self-citationFIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis
Feng, Y., Ma, B., Zhang, J., Zhao, S., Xia, Y., & Tao, D. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.02021 · Cited by 125
Physical Adversarial Attack Meets Computer Vision: A Decade Survey
Wei, H., Tang, H., Jia, X., Wang, Z., Yu, H., Li, Z., Satoh, S., Gool, L. V., & Wang, Z. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3430860 · Cited by 152
Wang, Z., Zhai, J., & Ma, S. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01465 · Cited by 124
An Invisible Black-Box Backdoor Attack Through Frequency Domain
Wang, T., Yao, Y., Xu, F., An, S., Tong, H., & Wang, T. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19778-9_23 · Cited by 139
Zhao, Z., Chen, X., Xuan, Y., Dong, Y., Wang, D., & Liang, K. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01478 · Cited by 88
Stealthy Backdoor Attack for Code Models
Yang, Z., Xu, B., Zhang, J. M., Kang, H. J., Shi, J., He, J., & Lo, D. (2024) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2024.3361661 · Cited by 100
Robust Watermarking for Deep Neural Networks via Bi-level Optimization
Yang, P., Lao, Y., & Li, P. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01457 · Cited by 65
Self-citationChen, Y., Zhu, X., Gong, X., Yi, X., & Li, S. X. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3198481 · Cited by 51
Machine Learning Security Against Data Poisoning: Are We There Yet?
Ciná, A. E., Grosse, K., Demontis, A., Biggio, B., Roli, F., & Pelillo, M. (2024) · Computer · doi:10.1109/mc.2023.3299572 · Cited by 47
Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Trigger
Yu, Y., Wang, Y., Yang, W., Lu, S., Tan, Y., & Kot, A. C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01179 · Cited by 46
BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Label
Hu, S., Zhou, Z., Zhang, Y., Zhang, L. Y., Zheng, Y., He, Y., & Jin, H. (2022) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3503161.3548272 · Cited by 39
Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency
Liu, X., Li, M., Wang, H., Hu, S., Ye, D., Jin, H., Wu, L., & Xiao, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01570 · Cited by 43
Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey
Li, Y., Zhang, S., Wang, W., & Song, H. T. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3267221 · Cited by 41
PTB: Robust physical backdoor attacks against deep neural networks in real world
Xue, M., He, C., Wu, Y., Sun, S., Zhang, Y., Wang, J., & Liu, W. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102726 · Cited by 41
DeepAuth: A DNN Authentication Framework by Model-Unique and Fragile Signature Embedding
Lao, Y., Zhao, W., Yang, P., & Li, P. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i9.21193 · Cited by 35
Self-citationBackdoor Attack and Defense on Deep Learning: A Survey
Bai, Y., Xing, G., Wu, H., Rao, Z., Ma, C., Wang, S., Liu, X., Zhou, Y., Tang, J., Huang, K., et al. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3482723 · Cited by 42
Mengara, O., Avila, A. R., & Falk, T. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355816 · Cited by 35
Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers
Li, Y., Chen, Z., Cortellazzi, J., Pendlebury, F., Tu, K., Pierazzi, F., Cavallaro, L., & Wang, G. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179347 · Cited by 42
A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives
Gao, Y., Chen, H., Sun, P., Li, J., Zhang, A., Wang, Z., & Liu, W. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i3.27954 · Cited by 31
Hardly Perceptible Trojan Attack Against Neural Networks with Bit Flips
Bai, J., Gao, K., Gong, D., Xia, S., Li, Z., & Liu, W. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20065-6_7 · Cited by 31
Backdoor Attacks Against Dataset Distillation
Liu, Y., Li, Z., Michael Backes, A., Shen, Y., & Zhang, Y. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24287 · Cited by 39
TAT: Targeted backdoor attacks against visual object tracking
Cheng, Z., Wu, B., Zhang, Z., & Zhao, J. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109629 · Cited by 29
BadCM: Invisible Backdoor Attack Against Cross-Modal Learning
Zhang, Z., Xu, Y., Zhu, L., Song, J., & Nie, L. (2024) · IEEE Transactions on Image Processing · doi:10.1109/tip.2024.3378918 · Cited by 32
Backdoor Cleansing with Unlabeled Data
Pang, L., Sun, T., Ling, H., & Chen, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01176 · Cited by 33
Kaleidoscope: Physical Backdoor Attacks Against Deep Neural Networks With RGB Filters
Gong, X., Wang, Z., Chen, Y., Xue, M., Wang, Q., & Shen, C. Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3239225 · Cited by 29
COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks
Huynh, T., Nguyen, D., Pham, T., & Tran, A. T. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i3.28019 · Cited by 24
Backdoor Attacks on Time Series: A Generative Approach
Jiang, Y., Ma, X., Erfani, S., & Bailey, J. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00034 · Cited by 24
CLPA: Clean-Label Poisoning Availability Attacks Using Generative Adversarial Nets
Zhao, B., & Lao, Y. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i8.20902 · Cited by 28
Self-citationDefending Backdoor Attacks on Vision Transformer via Patch Processing
Doan, K. D., Lao, Y., Yang, P., & Li, P. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i1.25125 · Cited by 30
Self-citationBackdoor Attacks for Remote Sensing Data With Wavelet Transform
Dräger, N., Xu, Y., & Ghamisi, P. (2023) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2023.3289307 · Cited by 20
MBA: Backdoor Attacks Against 3D Mesh Classifier
Fan, L., He, F., Si, T., Fan, R., Ye, C., & Li, B. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3346644 · Cited by 20
Backdoor attacks and defense mechanisms in federated learning: A survey
Li, Z., Lan, J., Yan, Z., & Erol Gelenbe, A. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103248 · Cited by 20
Identification for Deep Neural Network: Simply Adjusting Few Weights!
Lao, Y., Yang, P., Zhao, W., & Li, P. (2022) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde53745.2022.00104 · Cited by 20
Self-citationThe Dark Side of Dynamic Routing Neural Networks: Towards Efficiency Backdoor Injection
Chen, S., Chen, H., Haque, M., Liu, C., & Yang, W. H. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02355 · Cited by 19
DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models
Zhou, J., Lv, P., Lan, Y., Meng, G., Chen, K., & Ma, H. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30186 · Cited by 21
Zhu, R., Tang, D., Tang, S., Wang, X., & Tang, H. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10351028 · Cited by 20
Abad, G., Ersoy, O., Picek, S., & Urbieta, A. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24334 · Cited by 23
BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defense
Cheng, S., Tao, G., Liu, Y., An, S., Xu, X., Feng, S., Shen, G., Zhang, K., Xu, Q., Ma, S., et al. (2023) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2023.24944 · Cited by 23
CASSOCK: Viable Backdoor Attacks against DNN in the Wall of Source-Specific Backdoor Defenses
Wang, S., Gao, Y., Fu, A., Zhang, Z., Zhang, Y., Susilo, W., & Liu, D. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3582829 · Cited by 18
Progressive Poisoned Data Isolation for Training-Time Backdoor Defense
Chen, Y., Wu, H., & Zhou, J. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i10.29023 · Cited by 18
Threat Modeling AI/ML With the Attack Tree
Hoseini, S. V., Suutala, J., Partala, J., & Halunen, K. (2024) · IEEE Access · doi:10.1109/access.2024.3497011 · Cited by 22
PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification
Yuan, Y., Kong, R., Xie, S., Li, Y., & Liu, Y. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612032 · Cited by 15
NeuralSanitizer: Detecting Backdoors in Neural Networks
Zhu, H., Zhao, Y., Zhang, S., & Chen, K. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3390599 · Cited by 14
iBA: Backdoor Attack on 3D Point Cloud via Reconstructing Itself
Bian, Y., Tian, S., & Liu, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3452630 · Cited by 16
Single Image Backdoor Inversion via Robust Smoothed Classifiers
Sun, M.-J., & Kolter, J. Z. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00784 · Cited by 14
Invisible Backdoor Attack against 3D Point Cloud Classifier in Graph Spectral Domain
Fan, L., He, F., Si, T., Tang, W., & Li, B. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30099 · Cited by 13
T2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models
Wang, Z., Zhang, J., Shan, S., & Chen, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73013-9_7 · Cited by 19
Zukaib, U., & Cui, X. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.113167 · Cited by 13
Imperceptible and multi-channel backdoor attack
Xue, M., Ni, S., Wu, Y., Zhang, Y., & Liu, W. (2023) · Applied Intelligence · doi:10.1007/s10489-023-05228-6 · Cited by 18
DeepHardMark: Towards Watermarking Neural Network Hardware
Clements, J., & Lao, Y. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i4.20367 · Cited by 13
Self-citationContrastive Neuron Pruning for Backdoor Defense
Feng, Y., Ma, B., Liu, D., Zhang, Y., Cai, W., & Xia, Y. (2025) · IEEE Transactions on Image Processing · doi:10.1109/tip.2025.3539466 · Cited by 12
Untargeted Backdoor Attack Against Deep Neural Networks With Imperceptible Trigger
Xue, M., Wu, Y., Ni, S., Zhang, L. Y., Zhang, Y., & Liu, W. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3329641 · Cited by 13
BadMerging: Backdoor Attacks Against Model Merging
Zhang, J., Chi, J., Li, Z., Cai, K., Zhang, Y., & Tian, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690284 · Cited by 26
Lotus: Evasive and Resilient Backdoor Attacks through Sub-Partitioning
Cheng, S., Tao, G., Liu, Y., Shen, G., An, S., Feng, S., Xu, X., Zhang, K., Ma, S., & Zhang, X. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02342 · Cited by 12
BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning
Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., Zhu, M., Wang, R., Liu, L., & Shen, C. (2025) · International Journal of Computer Vision · doi:10.1007/s11263-025-02447-x · Cited by 16
Hanif, M. A., Chattopadhyay, N., Ouni, B., & Shafique, M. (2025) · IEEE Access · doi:10.1109/access.2025.3571995 · Cited by 12
Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoning
Wang, Z., Huang, S., Huang, Y., & Cui, H. (2023) · doi:10.1145/3591197.3591307 · Cited by 10
Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognition
Hammoud, H. A. A. K., Liu, S., Alkhrashi, M., AlBalawi, F., & Ghanem, B. (2024) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw63382.2024.00348 · Cited by 15
NL2GDPR: Automatically Develop GDPR Compliant Android Application Features from Natural Language
Shezan, F. H., Lao, Y., Peng, M., Wang, X., Sun, M., & Li, P. (2022) · IEEE Conference on Communications and Network Security · doi:10.1109/cns56114.2022.10273858 · Cited by 9
Self-citationA novel robust black-box fingerprinting scheme for deep classification neural networks
Mo, M., Wang, C., Guo, Q., Bian, S., Huang, Q., & Zhang, X. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124201 · Cited by 10
Yu, Y., Wang, Y., Yang, W., Guo, L., Lu, S., Duan, L., Tan, Y., & Kot, A. C. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3507873 · Cited by 8
Delta-DAGMM: A Free Rider Attack Detection Model in Horizontal Federated Learning
Huang, H., Zhang, B., Sun, Y., Ma, C., & Qu, J. (2022) · Security and Communication Networks · doi:10.1155/2022/8928790 · Cited by 10
Inaudible Backdoor Attack via Stealthy Frequency Trigger Injection in Audio Spectrogram
Zhang, T., Phan, H., Tang, Z., Shi, C., Wang, Y., Yuan, B., & Chen, Y. J. (2024) · ACM Annual International Conference on Mobile Computing and Networking (MobiCom) · doi:10.1145/3636534.3649345 · Cited by 9
Imperceptible Backdoor Attacks on Text-Guided 3D Scene Grounding
Liu, D., & Hu, W. (2025) · IEEE Transactions on Multimedia · doi:10.1109/tmm.2025.3543050 · Cited by 8
Membership Inference Attacks Against Semantic Segmentation Models
Chobola, T., Usynin, D., & Kaissis, G. A. (2023) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3605764.3623906 · Cited by 12
Minimalism is King! High-Frequency Energy-Based Screening for Data-Efficient Backdoor Attacks
Xun, Y., Jia, X., Gu, J., Liu, X., Guo, Q., & Cao, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3380821 · Cited by 7
Yang, X., Li, G., Zhou, K., Li, J., Lin, X., & Liu, Y. (2025) · IEEE Open Journal of Vehicular Technology · doi:10.1109/ojvt.2025.3550411 · Cited by 7
Qiu, H., Sun, J., Zhang, M., Pan, X., & Yang, M. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00226 · Cited by 7
Model-Manipulation Attacks Against Black-Box Explanations
Hegde, A., Noppel, M., & Wressnegger, C. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00081 · Cited by 7
RIBAC: Towards Robust and Imperceptible Backdoor Attack against Compact DNN
Phan, H., Shi, C., Xie, Y., Zhang, T., Li, Z., Zhao, T., Liu, J., Wang, Y., Chen, Y. J., & Yuan, B. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19772-7_41 · Cited by 8
Moiré Backdoor Attack (MBA): A Novel Trigger for Pedestrian Detectors in the Physical World
Wei, H., Yu, H., Zhang, K., Wang, Z., Zhu, J., & Wang, Z. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3611910 · Cited by 7
Arshad, I., Alsamhi, S. H., Qiao, Y., Lee, B., & Ye, Y. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3384938 · Cited by 7
UNIT: Backdoor Mitigation via Automated Neural Distribution Tightening
Cheng, S., Shen, G., Zhang, K., Tao, G., An, S., Guo, H., Ma, S., & Zhang, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73033-7_15 · Cited by 8
Attacking Neural Networks with Neural Networks: Towards Deep Synchronization for Backdoor Attacks
Guan, Z., Sun, L., Du, M., & Liu, N. (2023) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3583780.3614784 · Cited by 6
Exploring the Orthogonality and Linearity of Backdoor Attacks
Zhang, K., Cheng, S., Shen, G., Tao, G., An, S., Makur, A., Ma, S., & Zhang, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00225 · Cited by 10
Evading backdoor defenses: Concealing genuine backdoors through scapegoat strategy
Qian, Y., Lian, Z., Li, Y., Wang, W., Gu, Z., Wang, B., & Zhang, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104225 · Cited by 7
Fisher Information guided Purification against Backdoor Attacks
Karim, N., Arafat, A. A., Rakin, A. S., Guo, Z., & Rahnavard, N. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690250 · Cited by 6
KerbNet: A QoE-Aware Kernel-Based Backdoor Attack Framework
Gong, X., Chen, Y., Huang, H., Kong, W., Wang, Z., Shen, C. Q., & Wang, Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3286842 · Cited by 6
Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering
Zhu, R., Tang, D., Tang, S., Wang, Z., Tao, G., Ma, S., Wang, X., & Tang, H. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24450 · Cited by 11
Poisoning Attack on Federated Knowledge Graph Embedding
Zhou, E., Guo, S., Ma, Z., Hong, Z., Guo, T., & Dong, P. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645422 · Cited by 6
LaserGuider: A Laser Based Physical Backdoor Attack Against Deep Neural Networks
Xu, Y., Chen, G., Song, F., & Chen, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95767-3_13 · Cited by 5
Unified Neural Backdoor Removal With Only Few Clean Samples Through Unlearning and Relearning
Min, N. M., Pham, L. H., & Sun, J. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3586499 · Cited by 8
Stealthy Backdoor Attacks On Deep Point Cloud Recognization Networks
Feng, L., Qian, Z., Zhang, X., & Li, S. (2023) · The Computer Journal · doi:10.1093/comjnl/bxad109 · Cited by 5
Stealthy Backdoor Attacks on Semantic Symbols in Semantic Communications
Zhou, Y., Hu, R. Q., & Qian, Y. (2024) · Globecom · doi:10.1109/globecom52923.2024.10901411 · Cited by 5
Don’t FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNs
Hammoud, H. A. A. K., Bibi, A., Torr, P. H. S., & Ghanem, B. (2023) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw59228.2023.00230 · Cited by 7
Adaptive Robust Learning Against Backdoor Attacks in Smart Homes
Zhang, J., Wang, Z., Ma, Z., & Ma, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3392772 · Cited by 5
Backdoor Attacks with Input-Unique Triggers in NLP
Zhou, X., Li, J., Zhang, T., Lyu, L., Yang, M., & He, J. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70341-6_18 · Cited by 12
A Triple Stealthy Backdoor: Hidden in Spatial, Frequency, and Feature Domains
Gao, Y., Chen, H., Sun, P., Li, J., Yin, Y., Wang, Z., & Liu, W. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3600427 · Cited by 6
Unlearning Backdoor Attacks Through Gradient-Based Model Pruning
Dunnett, K., Arablouei, R., Miller, D., Dedeoglu, V., & Jurdak, R. (2024) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w60302.2024.00021 · Cited by 6
A steganographic backdoor attack scheme on encrypted traffic
Rao, B., Zhu, G., Ding, Q., Chen, D., Cao, M., Cao, Y. H., & Wang, F. (2025) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-024-01893-7 · Cited by 4
Low-Frequency Black-Box Backdoor Attack via Evolutionary Algorithm
Qiao, Y., Liu, D., Wang, R., & Liang, K. (2025) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61041.2025.00737 · Cited by 5
Misactivation-Aware Stealthy Backdoor Attacks on Neural Code Understanding Models
Sun, X., Xiao, Y., Bo, L., Sun, W., Liu, X., Li, B., & Zhang, J. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3614128 · Cited by 4
Tong, H., Ma, H., Shen, H., Li, Z., & Chang, L. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2024.108966 · Cited by 4
Mask-Based Invisible Backdoor Attacks on Object Detection
Shin, J. (2024) · Proceedings - International Conference on Image Processing · doi:10.1109/icip51287.2024.10647450 · Cited by 4
Clean and Compact: Efficient Data-Free Backdoor Defense with Model Compactness
Phan, H., Xiao, J., Sui, Y., Zhang, T., Tang, Z., Shi, C., Wang, Y., Chen, Y. J., & Yuan, B. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73027-6_16 · Cited by 4
Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelines
Bagdasarian, E., & Shmatikov, V. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690337 · Cited by 7
Metadata
- Authors
- Doan, K., Lao, Y., Zhao, W., & Li, P.
- Affiliations
- Virginia Tech (US)
- Clemson University (US)
- Baidu (China) (CN)
- Venue
- 2021 IEEE/CVF International Conference on Computer Vision (ICCV)
- Publisher
- IEEE
- Published
- 2021-10
- Pages
- 11946-11956
- OpenAlex
- W3201941857
- Cited by
- 211
- References
- 59
- Citations by year
- 2026: 29 · 2025: 48 · 2024: 73 · 2023: 39 · 2022: 20 · 2021: 2
- FWCI
- 15.48
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE/CVF International Conference on Computer Vision (ICCV) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- backdoor attacks, backdoor defense evasion, stealthy attacks, data poisoning, deep neural network, adversarial robustness, nonconvex constrained optimization, two-stage stochastic programming, image classification security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
