Black-box Detection of Backdoor Attacks with Limited Information and Data
Open accessAbstract
Although deep neural networks (DNNs) have made rapid progress in recent years, they are vulnerable in adversarial environments. A malicious backdoor could be embedded in a model by poisoning the training dataset, whose intention is to make the infected model give wrong predictions during inference when the specific trigger appears. To mitigate the potential threats of backdoor attacks, various backdoor detection and defense methods have been proposed. However, the existing techniques usually require the poisoned training data or access to the white-box model, which is commonly unavailable in practice. In this paper, we propose a black-box backdoor detection (B3D) method to identify backdoor attacks with only query access to the model. We introduce a gradient-free optimization algorithm to reverse-engineer the potential trigger for each class, which helps to reveal the existence of backdoor attacks. In addition to backdoor detection, we also propose a simple strategy for reliable predictions using the identified backdoored models. Extensive experiments on hundreds of DNN models trained on several datasets corroborate the effectiveness of our method under the black-box setting against various backdoor attacks.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Backdoor attacks can occur at any phase during the convergence of the global model, including data collection, local model training, and global model aggregation.
“As discussed above, backdoor attacks can occur at any phase during the convergence of the global model, including data collection, local model training, and global model aggregation [41], [42].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [42]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946 · see citing works
Very Deep Convolutional Networks for Large-Scale Image Recognition
Simonyan, K., & Zisserman, A. (2014) · arXiv · doi:10.48550/arxiv.1409.1556 · Cited by 74,248 · see citing works
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380 · see citing works
Self-citationLearning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
(2016) · Cited by 11,679 · see citing works
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Large Scale GAN Training for High Fidelity Natural Image Synthesis
Brock, A., Donahue, J., & Simonyan, K. (2018) · arXiv · doi:10.48550/arxiv.1809.11096 · Cited by 3,717 · see citing works
Boosting Adversarial Attacks with Momentum
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00957 · Cited by 3,168 · see citing works
Self-citationMan vs. computer: Benchmarking machine learning algorithms for traffic sign recognition
Stallkamp, J., Schlipsing, M., Salmen, J., & Igel, C. (2012) · Neural Networks · doi:10.1016/j.neunet.2012.02.016 · Cited by 1,567 · see citing works
Wild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,563 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1712.05526 · Cited by 1,039 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
Spectral Signatures in Backdoor AttacksPreprint
Tran, B., Li, J. Z., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.00636 · Cited by 506 · see citing works
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018) · arXiv · doi:10.48550/arxiv.1811.03728 · Cited by 485 · see citing works
Adversarial Attacks and Defences: A SurveyPreprint
Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., & Mukhopadhyay, D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.00069 · Cited by 479 · see citing works
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/647 · Cited by 314 · see citing works
Wierstra, D., Schaul, T., Peters, J., & Schmidhuber, J. (2008) · IEEE Congress on Evolutionary Computation (CEC) · doi:10.1109/cec.2008.4631255 · Cited by 282 · see citing works
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
Chou, E., Tramer, F., & Pellegrino, G. (2020) · 2020 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00025 · Cited by 281 · see citing works
Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Clean-Label Backdoor Attacks on Video Recognition Models
Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., & Jiang, Y. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01445 · Cited by 247 · see citing works
Liu, Y., Xie, Y., & Srivastava, A. (2017) · 2017 IEEE International Conference on Computer Design (ICCD) · doi:10.1109/iccd.2017.16 · Cited by 241 · see citing works
TBT: Targeted Neural Network Attack With Bit Trojan
Rakin, A. S., He, Z., & Fan, D. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01321 · Cited by 200 · see citing works
Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs
Kolouri, S., Saha, A., Pirsiavash, H., & Hoffmann, H. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00038 · Cited by 190 · see citing works
Label-Consistent Backdoor AttacksPreprint
Turner, A., Tsipras, D., & Mądry, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.02771 · Cited by 177 · see citing works
Li, Y., Li, L., Wang, L., Zhang, T., & Gong, B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.00441 · Cited by 175 · see citing works
TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI SystemsPreprint
Guo, W., Wang, L., Xing, X., Du, M., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.01763 · Cited by 154 · see citing works
Backdooring Convolutional Neural Networks via Targeted Weight Perturbations
Dumford, J., & Scheirer, W. J. (2020) · IEEE International Joint Conference on Biometrics (IJCB) · doi:10.1109/ijcb48548.2020.9304875 · Cited by 102 · see citing works
Robust Anomaly Detection and Backdoor Attack Detection Via Differential PrivacyPreprint
Du, M., Jia, R., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07116 · Cited by 101 · see citing works
Bridging Mode Connectivity in Loss Landscapes and Adversarial RobustnessPreprint
Zhao, P., Chen, P., Das, P., Ramamurthy, K. N., & Lin, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.00060 · Cited by 95 · see citing works
NeuronInspect: Detecting Backdoors in Neural Networks via Output ExplanationsPreprint
Huang, X., Alzantot, M., & Srivastava, M. B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07399 · Cited by 85 · see citing works
Adversarial Distributional Training for Robust Deep LearningPreprint
Dong, Y., Deng, Z., Pang, T., Su, H., & Zhu, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.05999 · Cited by 82 · see citing works
Self-citationLiu, Y., Xie, Y., & Srivastava, A. (2017) · IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD) · Cited by 81 · see citing works
Defending Neural Backdoors via Generative Distribution ModelingPreprint
Qiao, X., Yang, Y., & Li, H. H. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.04749 · Cited by 61 · see citing works
Adversarial Machine Learning -- Industry PerspectivesPreprint
Kumar, R. S. S., Nyström, M., Lambert, J., Marshall, A. D., Goertzel, M., Comissoneru, A., Swann, M., & Xia, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.05646 · Cited by 49 · see citing works
Xiang, Z. J., Miller, D. J., & Kesidis, G. (2019) · Machine learning for signal processing ... · doi:10.1109/mlsp.2019.8918908 · Cited by 34 · see citing works
Black-box optimization of mixed discrete-continuous optimization problems
Halstrup, M. (2016) · Technische Universität Dortmund Eldorado (Technische Universität Dortmund) · doi:10.17877/de290r-17800 · Cited by 26 · see citing works
Scalable Backdoor Detection in Neural Networks
Harikumar, H., Le, V., Rana, S., Bhattacharya, S., Gupta, S., & Venkatesh, S. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-67661-2_18 · Cited by 21 · see citing works
Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural NetworksPreprint
Chan, A., & Ong, Y.-S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.08040 · Cited by 17 · see citing works
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13 · see citing works
Flagged first, then by citations
7 of the 57 references couldn’t be matched to a known paper.
Research works printed but not linked: 5
- Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Pro- ceedings of the 35th Annual Computer Security Applications Conference (ACSAC), pages 113-125, 2019. 2, 8, 9
- Kaidi Jin, Tianwei Zhang, Chao Shen, Yufei Chen, Ming Fan, Chenhao Lin, and Ting Liu. A unified framework for analyzing and detecting malicious examples of dnn models. arXiv preprint arXiv:2006.14871, 2020. 8, 9 · arXiv
- Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Re- flection backdoor: A natural backdoor attack on deep neu- ral networks. In European Conference on Computer Vision (ECCV), 2020. 2
- Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural tro- jans. In IEEE International Conference on Computer Design (ICCD), pages 45-48. IEEE, 2017. 2
- Daan Wierstra, Tom Schaul, Tobias Glasmachers, Yi Sun, Jan Peters, and Jürgen Schmidhuber. Natural evolu- tion strategies. Journal of Machine Learning Research, 15(27):949-980, 2014. 4, 11
Cited by
Sorted by citations
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
“, [25], [61], [59]) for its complicated target shifting and therefore is more serious compared with the allto-one attacks.”
BackgroundInfluentialWild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
Cinà, A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., & Roli, F. (2023) · ACM Computing Surveys · doi:10.1145/3585385 · Cited by 152 · see citing works
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“As discussed above, backdoor attacks can occur at any phase during the convergence of the global model, including data collection, local model training, and global model aggregation [41], [42].”
BackgroundBackdoor Defense via Adaptively Splitting Poisoned Dataset
Gao, K., Bai, Y., Gu, J., Yang, Y., & Xia, S. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00390 · Cited by 64 · see citing works
Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency
Liu, X., Li, M., Wang, H., Hu, S., Ye, D., Jin, H., Wu, L., & Xiao, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01570 · Cited by 37 · see citing works
“This kind of defense can work corporately with other backdoor defenses such as model diagnosis defense [9, 15, 46] or trigger reverse engineering [40, 43], and also provide prior knowledge of the trigger samples in a comprehensive defense pipeline, which can help the down-steam defenses to statistically analyze the ba…”
BackgroundCleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learning
Bansal, H., Yin, F., Singhi, N., Grover, A., Yu, Y., & Chang, K.-W. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00017 · Cited by 36 · see citing works
“Prior research such as [16, 7, 49, 42, 51] has aimed to detect backdoor anomalies in input data and determine whether a model has been backdoored.”
MethodBackdoor Attack and Defense on Deep Learning: A Survey
Bai, Y., Xing, G., Wu, H., Rao, Z., Ma, C., Wang, S., Liu, X., Zhou, Y., Tang, J., Huang, K., et al. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3482723 · Cited by 36 · see citing works
“Dong et al. [166] conducted defense in a more realistic black-box setting, where defenders can only access a pretrained model and use it as an oracle to obtain predictions.”
AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value AnalysisPreprint
Guo, J., Li, A., & Liu, C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14880 · Cited by 39 · see citing works
“, 2020), or the predicted confidence score of each class (Dong et al., 2021).”
BackgroundMethodResultInfluentialMengara, O., Avila, A. R., & Falk, T. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355816 · Cited by 32 · see citing works
“Representative examples include [84], [178], [183], [184], [185], [186], [187], [188], [189], [190], [191], [192], [193], [194].”
Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial TrainingPreprint
Tao, L., Feng, L., Yi, J., Huang, S.-J., & Chen, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.04716 · Cited by 29 · see citing works
“There were many defense strategies proposed for defending against targeted attacks and backdoor attacks, including detection-based defenses [111, 118, 16, 23, 38, 90, 48, 28], randomized smoothing [94, 127], differential privacy [73, 51], robust training [12, 66, 67, 40], and model repairing [19, 68, 130], while some…”
BackgroundMOVE: Effective and Harmless Ownership Verification via Embedded External Features
Li, Y., Zhu, L., Jia, X., Bai, Y., Jiang, Y., Xia, S., Cao, X., & Ren, K. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3546223 · Cited by 24 · see citing works
“4) Resistance to Trigger Synthesis-Based Detection: These methods [60], [61], [62] detect poisoned images by reversing potential triggers contained in given suspicious DNNs.”
JailGuard: A Universal Detection Framework for Prompt-based Attacks on LLM Systems
Zhang, X.-Y., Zhang, C., Li, T.-L., Huang, Y.-H., Jia, X.-J., Hu, M., Zhang, J., Liu, Y., Ma, S., & Shen, C. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3724393 · Cited by 64 · see citing works
“Conducting a detector to identify the attack inputs of the given model is one of the most popular defense strategies [35, 78, 88, 117].”
PolicyCleanse: Backdoor Detection and Mitigation for Competitive Reinforcement Learning
Guo, J., Li, A., Wang, L., & Liu, C. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00433 · Cited by 26 · see citing works
“4826 with the assumption that Rsum fits Gaussian distribution [46, 12, 5].”
BackgroundMethodInfluentialPointCRT: Detecting Backdoor in 3D Point Cloud via Corruption Robustness
Hu, S., Liu, W., Li, M., Zhang, Y., Liu, X., Wang, X., Zhang, L. Y., & Hou, J. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612456 · Cited by 17 · see citing works
“Hence, it poses a formidable obstacle for users to discern the surreptitious insertion of a backdoor trigger within the model [4, 12, 18, 42].”
BackgroundZhu, R., Tang, D., Tang, S., Wang, X., & Tang, H. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10351028 · Cited by 18 · see citing works
“Many proposed back-door defense techniques [2], [13], [20], [53], [72] are in this category, based upon different searching algorithms.”
BackgroundAbad, G., Ersoy, O., Picek, S., & Urbieta, A. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24334 · Cited by 18 · see citing works
Security threats to agricultural artificial intelligence: Position and perspective
Gao, Y., Camtepe, S. A., Sultan, N. H., Bui, H. T., Mahboubi, A., Aboutorab, H., Bewong, M., Islam, R., Islam, M. Z., Chauhan, A., et al. (2024) · Computers and Electronics in Agriculture · doi:10.1016/j.compag.2024.109557 · Cited by 17 · see citing works
Watch Out! Simple Horizontal Class Backdoor Can Trivially Evade Defense
Ma, H., Wang, S., Gao, Y., Zhang, Z., Qiu, H., Xue, M., Abuadbba, A., Fu, A., Nepal, ., & Abbott, D. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670361 · Cited by 14 · see citing works
“A representative one is the Neural Cleanse [83] with which few others [15, 24] share a similar concept (i.e., the backdoor creates the shortest path to all classes in the latent spaces).”
Zhang, H., Hua, G., Wang, X., Jiang, H., & Yang, W. T. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3244107 · Cited by 13 · see citing works
“However, countermeasures can be implemented to recover the original outputs [27] or detect the backdoors [51], [52], [53], which can help to reconstruct a set of relatively clean surrogate data. ii) Reverse engineering.”
BackgroundDifferential Analysis of Triggers and Benign Features for Black-Box DNN Backdoor Detection
Fu, H., Krishnamurthy, P., Garg, S., & Khorrami, F. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3297056 · Cited by 13 · see citing works
Single Image Backdoor Inversion via Robust Smoothed Classifiers
Sun, M.-J., & Kolter, J. Z. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00784 · Cited by 14 · see citing works
“cial in many backdoor defense [15, 32] and detection methods [12,17,18,20,21,24,31,38,43,44].”
BackgroundToward a Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasures
Qiu, H., Ma, H., Zhang, Z., Abuadbba, A., Kang, W., Fu, A., & Gao, Y. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3324318 · Cited by 13 · see citing works
“In addition to Neural Cleanse, there are other defenses such as Trojan signature [22], SCAn [8], B3D [34] also requiring iterating each class to identify backdoor behavior.”
BackgroundMethodContrastive Neuron Pruning for Backdoor Defense
Feng, Y., Ma, B., Liu, D., Zhang, Y., Cai, W., & Xia, Y. (2025) · IEEE Transactions on Image Processing · doi:10.1109/tip.2025.3539466 · Cited by 12 · see citing works
“Post-processing defenses [44] focus on eliminating hidden backdoors from a suspicious model after it has been identified.”
A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks
Li, Z., Sun, H., Xia, P., Xia, B., Rui, X., Zhang, W., Guo, Q., Fu, Z., & Li, B. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3472510 · Cited by 12 · see citing works
“Backdoor detection aims to identify the presence of poisoning either in input data or within the employed DNN models themselves [8], [11], [18], [53].”
MethodBAFFLE: A Baseline of Backpropagation-Free Federated Learning
Feng, H., Pang, T., Du, C., Chen, W., Yan, S., & Lin, M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73226-3_6 · Cited by 12 · see citing works
“To alleviate the vulnerability in FL, several defense strategies have been proposed via selecting reliable clients [43], data augmentation [13], update clipping [83], robust training [52], model perturbation [99], detection methods [20,78], and methods based on differential privacy [95].”
MethodSelf-citationNullius in Explanans: an ethical risk assessment for explainable AI
Nannini, L., Huyskes, D., Panai, E., Pistilli, G., & Tartaro, A. (2024) · Ethics and Information Technology · doi:10.1007/s10676-024-09800-7 · Cited by 14 · see citing works
“This is enabled by poisoning attacks or constituted with query-based access only (Dong et al., 2021; Gu et al., 2019; Jagielski et al., 2018; Liu et al., 2018; Severi et al., 2021; Shafahi et al., 2018).”
Defenses in Adversarial Machine Learning: A Systematic Survey From the Lifecycle Perspective
Wu, B., Zhu, M., Zheng, M., Zhu, Z., Wei, S., Zhang, M., Chen, H., Yuan, D., Liu, L., & Liu, Q. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3611340 · Cited by 11 · see citing works
“[42]proposeablack-boxbackdoordetection(B3D) methodwhichdesignsagradient-freeoptimizationalgorithmto reversethetriggerforeachclassanddetecttargetclassesbased onthesmalltriggernorms.”
Cyberspace's endogenous safety and security problem and the countermeasures
邬, 江. (2022) · Scientia Sinica Informationis · doi:10.1360/ssi-2022-0242 · Cited by 11 · see citing works
Accumulative Poisoning Attacks on Real-time DataPreprint
Pang, T., Yang, X. H., Dong, Y., Su, H., & Zhu, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.09993 · Cited by 11 · see citing works
Self-citationTest-Time Detection of Backdoor Triggers for Poisoned Deep Neural Networks
Li, X., Xiang, Z., Miller, D. J., & Kesidis, G. (2022) · ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) · doi:10.1109/icassp43922.2022.9746573 · Cited by 11 · see citing works
“[5] proposes a black-box backdoor detection (B3D), which captures backdoor triggers based on the difference in model outputs for a test image with and without the reverse-engineered backdoor pattern embedded.”
BackgroundMethodInfluentialA Survey of Security Protection Methods for Deep Learning Model
Peng, H., Bao, S., & Li, L. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3314398 · Cited by 10 · see citing works
“Moreover, Dong et al. [62] also proposed a black-box backdoor detection method, which uses a gradient-free optimization algorithm to perform model .”
MethodAvoid attacks: A Federated Data Sanitization Defense in IoMT Systems
Chen, C., Gao, Y., Huang, S., & Yan, X. (2023) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps57453.2023.10225791 · Cited by 10 · see citing works
“1 in which P is the transfer function to apply the trigger on x, m ∈ {0, 1} is a binary mask of trigger positions, p ∈ {0, 1} is the backdoor pattern [18].”
BackgroundLook, Listen, and Attack: Backdoor Attacks Against Video Action Recognition
Hammoud, H. A. A. K., Liu, S., Alkhrashi, M., AlBalawi, F., & Ghanem, B. (2024) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw63382.2024.00348 · Cited by 15 · see citing works
“Backdoor defenses are generally of five types: preprocessing-based [12, 47, 55], model reconstruction-based [38, 42, 74, 83, 89], trigger synthesis-based [23,24,29,43,54,58,62,68], model diagonsis-based [15, 34, 46, 76, 90], and sample-filtering based [8, 20, 26, 30, 61, 63].”
BackgroundDetecting Backdoor Attacks against Point Cloud Classifiers
Xiang, Z. J., Miller, D. J., Chen, S., Li, X., & Kesidis, G. (2022) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp43922.2022.9747194 · Cited by 10 · see citing works
“cess to its training set and without reference to any clean classifiers trained for the same domain [10, 11, 12, 13, 14, 15].”
BackgroundBlack-Box Graph Backdoor Defense
Yang, X. Y., Li, G., Tao, X., Zhang, C., & Li, J. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-0808-6_10 · Cited by 9 · see citing works
Self-citationModel-Contrastive Learning for Backdoor Elimination
Yue, Z., Xia, J., Ling, Z., Hu, M., Wang, T., Wei, X. H., & Chen, M. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612415 · Cited by 11 · see citing works
“The former can be used to i) identify backdoors of DNNs during the training [6, 11, 51, 59]; or ii) check whether the data are poisoned [10, 14, 41, 55], thus the poisoned data can be safely filtered during the training.”
BackgroundMethodTowards Effective and Robust Neural Trojan Defenses via Input Filtering
Do, K., Harikumar, H., Lê, H., Nguyen, D. H., Tran, T., Rana, S., Nguyen, D. K., Susilo, W., & Venkatesh, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20065-6_17 · Cited by 8 · see citing works
“1, 2, 5, 8 [5] Yinpeng Dong, Xiao Yang, Zhijie Deng, Tianyu Pang, Zihao Xiao, Hang Su, and Jun Zhu.”
BackgroundWang, X., Liu, C., Hu, X., Wang, Z., Yin, J., & Cui, X. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3564661 · Cited by 8 · see citing works
“[13] proposed a black-box backdoor detection method with only query access to the model.”
MethodYang, X., Li, G., Zhou, K., Li, J., Lin, X., & Liu, Y. (2025) · IEEE Open Journal of Vehicular Technology · doi:10.1109/ojvt.2025.3550411 · Cited by 7 · see citing works
“Consequently, the development of black-box detection methodology that does not rely on available samples and model parameters has become essential [119], [120].”
Self-citationXGBD: Explanation-Guided Graph Backdoor Detection
Guan, Z., Du, M., & Liu, N. (2023) · Frontiers in artificial intelligence and applications · doi:10.3233/faia230363 · Cited by 7 · see citing works
Arshad, I., Alsamhi, S. H., Qiao, Y., Lee, B., & Ye, Y. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3384938 · Cited by 7 · see citing works
“Despite this sparsity, ongoing research focuses on defense against backdoor attacks with limited data information and access [15], [16].”
BackgroundPrecise Defense Approach Against Small-Scale Backdoor Attacks in Industrial Internet of Things
Ran, Z., Yao, Y. K., Li, W., Yang, W., Li, W., & Wu, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3490579 · Cited by 6 · see citing works
“Current methods primarily include distribution differences [14], [15], reinforcement learning [16], [17], [18], and gradient optimization [19], [20], [21] to identify anomalous patterns indicative of backdoor manipulation.”
Attacking Neural Networks with Neural Networks: Towards Deep Synchronization for Backdoor Attacks
Guan, Z., Sun, L., Du, M., & Liu, N. (2023) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3583780.3614784 · Cited by 6 · see citing works
“First, detection-based defenses [7, 8, 10, 12, 13, 16, 50] aim to detect whether the backdoor exists in the model.”
BackgroundBoundary augment: A data augment method to defend poison attack
Chen, X., Ma, Y., Lu, S., & Yu, Y. (2021) · IET Image Processing · doi:10.1049/ipr2.12325 · Cited by 6 · see citing works
LaserGuider: A Laser Based Physical Backdoor Attack Against Deep Neural Networks
Xu, Y., Chen, G., Song, F., & Chen, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95767-3_13 · Cited by 5 · see citing works
Stealthy Backdoor Attacks On Deep Point Cloud Recognization Networks
Feng, L., Qian, Z., Zhang, X., & Li, S. (2023) · The Computer Journal · doi:10.1093/comjnl/bxad109 · Cited by 5 · see citing works
UMA: Facilitating Backdoor Scanning via Unlearning-Based Model Ablation
Zhao, Y., Li, C., & Chen, K. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30183 · Cited by 5 · see citing works
“Firstly, reverse engineering is the most widely adopted strategy in many detection methods (Liu et al. 2022; Dong et al. 2021; Qiao, Yang, and Li 2019).”
MethodReward Certification for Policy Smoothed Reinforcement Learning
Mu, R., Marcolino, L. S., Zhang, Y., Zhang, T., Huang, X., & Ruan, W. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30139 · Cited by 5 · see citing works
Detection and Defense of Unlearnable Examples
Zhu, Y., Yu, L., & Gao, X.-S. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i15.29667 · Cited by 5 · see citing works
REStore: Exploring a Black-Box Defense against DNN Backdoors using Rare Event Simulation
Roux, Q. L., Kallas, K., & Furon, T. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00021 · Cited by 5 · see citing works
“This leads to a black-box scenario for defenders, thus making black-box defenses a pertinent area of research [6], [10]–[12].”
BackgroundMethodTowards Sample-Specific Backdoor Attack With Clean Labels via Attribute Trigger
Zhu, M., Li, Y., Guo, J., Wei, T., Xia, S., & Qin, Z. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3552234 · Cited by 6 · see citing works
“Specifically, [43], [44], [45] reversed the trigger based on targeted universal adversarial attacks, inspired by the similarities between backdoor attacks and adversarial attacks in the inference process; [46], [47] exploited the Grad-CAM [48] to extract critical regions from input images towards…”
Transpose Attack: Stealing Datasets with Bidirectional Training
Amit, G., Levy, M. Y., & Mirsky, Y. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23325 · Cited by 4 · see citing works
Analyzing Threat Level of the Backdoor Attack Method for an Organization’s Operation
Nasharuddin, M. Z. S. M., & Ibrahim, A. A. (2024) · International Journal on Perceptive and Cognitive Computing · doi:10.31436/ijpcc.v10i2.484 · Cited by 4 · see citing works
“Dong et al. [14] work introduces a technique for identifying backdoor attack using a black-box approach, even when there is a scarcity of information and data available.”
Mitigating Backdoor Threats to Large Language Models: Advancement and Challenges
Liu, Q., Mo, W., Tong, T., Xu, J., Wang, F., Xiao, C., & Chen, M. (2024) · Allerton Conference on Communication, Control, and Computing · doi:10.1109/allerton63246.2024.10735305 · Cited by 6 · see citing works
“Against this challenge, it is important to investigate practical ways to detect and neutralize backdoors that have already been injected in deployed LLM services without white-box accessibility [121].”
BackgroundSATBA: An Invisible Backdoor Attack Based on Spatial Attention
Zhou, H., Xu, X., Wang, X., & Bullock, L. B. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00133 · Cited by 4 · see citing works
“In addition, Dong et al. [31] attempted to identify backdoor attacks by utilizing their proposed gradient-free optimization algorithm to reverse potential triggers for each class.”
BackgroundDefending against backdoor attack on deep neural networks based on multi-scale inactivation
Zhang, A., Chen, H., Wang, X., Li, J., Gao, Y., & Wang, X. (2024) · Information Sciences · doi:10.1016/j.ins.2024.121562 · Cited by 4 · see citing works
Enhancing AI safety of machine unlearning for ensembled models
Ye, H., Guo, J., Liu, Z., Jiang, Y., & Lam, K. (2025) · Applied Soft Computing · doi:10.1016/j.asoc.2025.113011 · Cited by 3 · see citing works
Zhu, Y., Cao, H., Ren, Y., Wang, W., Wang, B., Hu, M., Cai, B., & Wang, W. (2023) · Security and Communication Networks · doi:10.1155/2023/9597905 · Cited by 3 · see citing works
RetractedA Novel Backdoor Detection Approach Using Entropy-Based Measures
Surendrababu, H. K., & Nagaraj, N. (2024) · IEEE Access · doi:10.1109/access.2024.3444273 · Cited by 3 · see citing works
“In a third category of the defense techniques [7], while no access to the training dataset or white box access to the poisoned model is assumed, a black box or query access to the poisoned model is assumed for detecting backdoor triggers.”
BackgroundUnlabeled backdoor poisoning on trained-from-scratch semi-supervised learning
Feng, L., Qian, Z., Zhang, X., & Li, S. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119453 · Cited by 3 · see citing works
Detecting All-to-One Backdoor Attacks in Black-Box DNNs via Differential Robustness to Noise
Fu, H., Krishnamurthy, P., Garg, S., & Khorrami, F. (2025) · IEEE Access · doi:10.1109/access.2025.3543333 · Cited by 2 · see citing works
“(3) The user’s lack of resources or expertise requires hiring a third party for backdoor detection, however, limiting the third party’s access to input and output of the model due to privacy concerns [16].”
Selective Forgetting in Task-Progressive Learning Through Machine Unlearning
Karn, R. R., Knechtel, J., & Sinanoglu, O. (2024) · International Conference on Machine Learning and Cybernetics · doi:10.1109/icmlc63072.2024.10935063 · Cited by 2 · see citing works
“Backdoor Attack: This refers to a setting where attackers subtly alter the training data D µ during training to introduce a hidden pattern or trigger [15].”
Enhanced Coalescence Backdoor Attack Against DNN Based on Pixel Gradient
Yin, J., Chen, H., Li, J., & Gao, Y. (2024) · Neural Processing Letters · doi:10.1007/s11063-024-11469-4 · Cited by 2 · see citing works
“Fine-pruning [15], NC [20], and B3D [32] can detect any backdoor using a simple trigger pattern, but fail to detect backdoors using a sophisticated trigger pattern.”
Detecting Backdoor Attacks in Black-Box Neural Networks through Hardware Performance Counters
Alam, M., Wang, Y., & Maniatakos, M. (2024) · Design, Automation, and Test in Europe · doi:10.23919/date58400.2024.10546739 · Cited by 2 · see citing works
“Dong et al. proposed a method utilizing clean validation images and a gradient-free optimization strategy that uses prediction confidence to reverse engineer triggers and detect backdoor inputs [9].”
BackgroundMethodInfluentialModel X-ray : Detecting Backdoored Models via Decision Boundary
Su, Y., Zhang, J., Xu, T., Zhang, T., Zhang, W., & Yu, N. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3681075 · Cited by 2 · see citing works
“Differently, detection work in black-box scenarios is extremely challenging [9, 14, 20, 48], e.g .”
BackgroundTRIGS: Trojan Identification from Gradient-Based Signatures
Hussein, M. E., Janakiraman, S. S., & AbdAlmageed, W. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-78122-3_23 · Cited by 2 · see citing works
Universal Soldier: Using Universal Adversarial Perturbations for Detecting Backdoor Attacks
Xu, X., Ersoy, O., Tajalli, B., & Picek, S. (2024) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w60302.2024.00024 · Cited by 2 · see citing works
Das, D., Kaytal, Y., Ganesh, R., Bhattacharya, R., & Ranjan, R. K. (2021) · ACM International Conference on AI in Finance (ICAIF) · doi:10.1145/3490354.3494417 · Cited by 1 · see citing works
“We establish this claim by using synthetic simulations which are explained in detail in the evaluation section of our paper [8].”
MethodCorrecting the distribution of batch normalization signals for Trojan mitigation
Li, X., Xiang, Z. J., Miller, D. J., & Kesidis, G. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.128752 · Cited by 1 · see citing works
Bensaoud, A., & Kalita, J. K. (2025) · Systems and Soft Computing · doi:10.1016/j.sasc.2025.200335 · Cited by 1 · see citing works
Backdoor threats in large language models—a survey
Liu, S., Pan, Y. F., Hong, K., Fei, R., Lin, C., Li, Q., & Shen, C. (2025) · Science China Information Sciences · doi:10.1007/s11432-024-4351-3 · Cited by 1 · see citing works
ArcGen: Generalizing Neural Backdoor Detection Across Diverse Architectures
Yang, Z., Luo, C., He, D., Li, Y., & Li, Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3610254 · Cited by 1 · see citing works
“Model-based detection can be classified into white-box [8], [9], [10], [11], [15], [16], [35] and black-box methods [12], [13], [14], [34], [36], [37].”
FUBA: Backdoor Federated Learning via Federated Unlearning
Sheng, X., Bao, W., Guo, Y., & Fu, S. (2025) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2025.3630110 · Cited by 1 · see citing works
“First, we evaluate two centralized black-box detection-based defenses: B3D [39] and MNTD [40].”
Rethinking Lipschitzness Data-free Backdoor Defense
Wang, X., Zhu, Z., Jin, Z., Chen, H., & Lim, T. J. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3761026 · Cited by 1 · see citing works
“To counter these evolving threats, detection mechanisms like Black-box Backdoor Detection (B3D) [6] offer a strategy that works under black-box conditions, requiring neither internal model access nor tainted data.”
DeBUGCN - Detecting Backdoors in CNNs Using Graph Convolutional Networks
Vartak, A., Hossain, K. M., & Oates, T. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11227981 · Cited by 1 · see citing works
“3, similar to the one used by used by Wang et al. [8], Hong et al. [29], Dong et al. [30], and Xue et al. [31].”
Chen, C., Huang, S., Shi, L., Li, Y., & Gao, Y. (2025) · Cybersecurity · doi:10.1186/s42400-025-00444-8 · Cited by 1 · see citing works
“′ The generic form of a poisoned image x with a hidden trigger as in Eq.1 in which P is the transfer function to apply the trigger in x , m ∈ { 0, 1 } d is a binary mask of trigger positions, p ∈ { 0, 1 } d is the backdoor pattern (Dong et al. 2021).”
Backdoor Training Paradigm in Generative Adversarial Networks
Wang, H., & Cheng, F. (2025) · Entropy · doi:10.3390/e27030283 · Cited by 1 · see citing works
“This makes it challenging to detect such attacks based solely on the model’s performance on clean test sets [35–38].”
Backdoor Mitigation in Deep Neural Networks via Strategic Retraining
Dhonthi, A., Hahn, E. M., & Hashemi, V. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-27481-7_37 · Cited by 1 · see citing works
“The detection technique needs to be able to treat the data as a black box, because we usually do not have any information on how the data is poisoned [7,13].”
BackgroundDetecting and Mitigating Backdoor Attacks with Dynamic and Invisible Triggers
Zheng, Z., Hua, Z., & Zhang, L. Y. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-30111-7_19
Jones, A. J. (2024) · Advances in medical technologies and clinical practice book series · doi:10.4018/979-8-3693-1906-2.ch008
Distributed Data Sanitization Against Data Poisoning Attacks Via Federated ClusteringPreprint
Chen, C., Huang, S., Shi, L., Li, Y., & Gao, Y. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4855260
OCGEC: One-class Graph Embedding Classification for DNN Backdoor Detection
Jiang, H., Yu, H., Li, N., & Yi, P. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10650468
“First, inspired by the computation graph, we create a composition approach that converts all of the target model’s weights and structural information into graph data.”
MethodLearning from Distinction: Mitigating Backdoors Using a Low-Capacity Model
Sun, H., Li, Y., Lv, X., & Ma, J. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3680968
“Some removal methods reconstruct the trigger and employ fine-tuning to repair the model[5, 8, 14, 32, 48, 53].”
MethodBackdoor Attack Against Dataset Distillation in Natural Language Processing
Chen, Y., Xu, W., Zhang, S., & Xu, Y. (2024) · Applied Sciences · doi:10.3390/app142311425
Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Models
Huang, Z., Chen, J., Zhang, Z., & Yu, C.-M. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00058
“The growing prevalence of AI systems in critical applications has led to increasing demands for security certification.”
Wang, S., Zhao, C., Lin, C., Zhao, Z., Yang, Z., Wang, Q., Shen, C. Q., & Guan, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3632218
“Black-box defense methods operate without access to model internals, relying solely on output logits or labels for detection [88], [89], [90].”
A Unified Framework for Backdoor Trigger Segmentation
Xue, D., Qian, S., & Xu, C. (2026) · IEEE Transactions on Image Processing · doi:10.1109/tip.2026.3666796
“Black-Box Backdoor Detection (B3D) [48] utilizes a gradient-free optimization algorithm to reverse-engineer the potential trigger for each class, which helps to reveal the existence of backdoor attack.”
Filter, Obstruct, and Dilute: Defending Against Backdoor Attacks on Semi-Supervised Learning
Wang, X., Wan, W., Li, X., Geng, C., Li, S.-Y., & Chen, S. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3677662
“The primary reason is that these defense methods heavily rely on labeled data or some characteristics of learned features under full supervision to detect poisoned samples or neutralize implanted backdoors [39], [40], [41].”
Neuron-level defense against backdoor attacks in federated learning
Luo, J., Zhang, X., Bai, F., Zeng, K., & Shen, T. (2026) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-026-03114-4
Purified Distillation Slimming (PDS) for Robust Backdoor Defense
Shan, L., Han, K., Tu, Y., Lee, I., & Hei, X. (2026) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3779208.3785283
“Detection mechanisms scrutinize either the input data for triggers indicative of manipulation (data-based detection) [4, 12, 28, 46, 56, 58, 60] or the model itself for structural aberrations (model-based detection) [4, 5, 17, 25, 63].”
Tracing the Use of Open-Source Training Datasets for Neural Radiance Field Models
Huang, Z., Zhang, Y., Xiao, X., Hua, Z., & Fang, Y. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3709129
“Although this method is widely used in practice, with the development of backdoor detection technology [33], [34], watermarking methods based on label tampering are becoming easier to identify and remove.”
SemBugger: Toward Multi-target Backdoor Attacks on Semantic Communication
Yang, X., Zhang, C., Li, G., Chen, C., & Li, J. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-39125-4_7
Self-citation
- Authors
- Dong, Y., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., & Zhu, J.
- Affiliations
- Tsinghua University (CN)
- Pazhou Lab,Guangzhou,China,510330
- Hohai University (CN)
- Venue
- 2021 IEEE/CVF International Conference on Computer Vision (ICCV)
- Publisher
- IEEE
- Published
- 2021-10
- Pages
- 16462-16471
- OpenAlex
- W3138646989
- Cited by
- 92
- References
- 57
- Citations by year
- 2026: 6 · 2025: 19 · 2024: 34 · 2023: 22 · 2022: 6 · 2021: 5
- FWCI
- 7.74
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE/CVF International Conference on Computer Vision (ICCV) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by-nc-sa)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Key Research and Development Program of China
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- backdoor attacks, backdoor detection, black-box attacks, data poisoning, derivative-free optimization, adversarial robustness, deep neural network
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
