The DOI matches its Crossref record; 57 of the 59 references it cites were found in a registry or an index.
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Abstract
Recently, machine learning models have demonstrated to be vulnerable to backdoor attacks, primarily due to the lack of transparency in black-box models such as deep neural networks. A third-party model can be poisoned such that it works adequately in normal conditions but behaves maliciously on samples with specific trigger patterns. However, the trigger injection function is manually defined in most existing backdoor attack methods, e.g., placing a small patch of pixels on an image or slightly deforming the image before poisoning the model. This results in a two-stage approach with a sub-optimal attack success rate and a lack of complete stealthiness under human inspection.In this paper, we propose a novel and stealthy backdoor attack framework, LIRA, which jointly learns the optimal, stealthy trigger injection function and poisons the model. We formulate such an objective as a non-convex, constrained optimization problem. Under this optimization framework, the trigger generator function will learn to manipulate the input with imperceptible noise to preserve the model performance on the clean data and maximize the attack success rate on the poisoned data. Then, we solve this challenging optimization problem with an efficient, two-stage stochastic optimization procedure. Finally, the proposed attack framework achieves 100% success rates in several benchmark datasets, including MNIST, CIFAR10, GTSRB, and T-ImageNet, while simultaneously bypassing existing backdoor defense methods and human inspection.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Generally, a high BAR is equivalent to a high ASR and BTA.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [143]
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
U-Net: Convolutional Networks for Biomedical Image Segmentation
Ronneberger, O., Fischer, P., & Brox, T. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-24574-4_28 · Cited by 99,404
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805 · Cited by 73,173
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 54,325
Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.74 · Cited by 24,513
Mastering the game of Go without human knowledge
Silver, D., Schrittwieser, J., Simonyan, K., Antonoglou, I., Huang, A., Guez, A., Hubert, T., Baker, L., Lai, M., Bolton, A., et al. (2017) · Nature · doi:10.1038/nature24270 · Cited by 9,084
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602
(2017) · International Conference on Machine Learning · Cited by 6,382
Research works printed but not linked: 3
- doan, 2020, Image generation via minimizing fr\’echet distance in discriminator feature space, arXiv preprint arXiv 2003 11055
- goodfellow, 2014, Generative adversarial nets, Advances in Neural Information Processing Systems (NIPS), 2672
- salem, 2020, Dynamic backdoor attacks against machine learning models, arXiv preprint arXiv 2003 07516
Cited by
Sorted by citations
Items 201–211 of 211
Model Pirating and Backdoor Injection Attacks in Data-Free Setting
Hu, A., Lei, X., Chen, X., & Zhou, X. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582391
Xie, J., Liu, Y., Zhang, F., Li, D. C., Fu, X., & Zha, Z.-J. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3712043
Fairness in vision-language text-to-image retrieval: Natural biases and adversarial threats
Lazzaro, D., Ciná, A. E., Roli, F., Anguita, D., Biggio, B., Laurita, G., & Oneto, L. (2026) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2026.111385
Boost-BAAT: Hardness-Aware Sample Selection for Clean-Label Backdoor Attacks
Jiang, S., & Xia, Z. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-3423-3_14
Zeng, G., Wei, H.-N., Lu, K., & Geng, G. (2026) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2025.125888
IRIS: Invisible Laser Injection for Stealthy Backdoor Attacks
Soga, Y., Kosuge, D., MANABE, T., Yanai, N., Yamamoto, H., Takayama, Y., & Ohigashi, T. (2026) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw72509.2026.00050
Analysis of Backdoor Attack Methods for CLIP Models Based on Prompt Learning
Su, J. (2026) · International Symposium on Advances in Electrical, Electronics and Computer Engineering (ISAEECE) · doi:10.1109/isaeece70502.2026.11635665
Indelible Backdoors: On the Limits of Post-training Defenses
Guo, J., Nguyen, T. D., Johnson, T. T., & Leach, K. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-37098-3_2
Exploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A Survey
Holland, R., Pal, S., & Pan, L. (2026) · ACM Computing Surveys · doi:10.1145/3847107
Akkaya, A. E. (2026) · International Artificial Intelligence and Data Processing Symposium (IDAP) · doi:10.1109/idap71869.2026.11728194
UDPU: Unlabeled Data Purification and Unlearning for Backdoor Defense
Shan, L., Tu, Y., Han, K., Chen, S., Fu, C., & Hei, X. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-42939-1_17
Metadata
- Authors
- Doan, K., Lao, Y., Zhao, W., & Li, P.
- Affiliations
- Virginia Tech (US)
- Clemson University (US)
- Baidu (China) (CN)
- Venue
- 2021 IEEE/CVF International Conference on Computer Vision (ICCV)
- Publisher
- IEEE
- Published
- 2021-10
- Pages
- 11946-11956
- OpenAlex
- W3201941857
- Cited by
- 211
- References
- 59
- Citations by year
- 2026: 29 · 2025: 48 · 2024: 73 · 2023: 39 · 2022: 20 · 2021: 2
- FWCI
- 15.48
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE/CVF International Conference on Computer Vision (ICCV) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- backdoor attacks, backdoor defense evasion, stealthy attacks, data poisoning, deep neural network, adversarial robustness, nonconvex constrained optimization, two-stage stochastic programming, image classification security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
