Text Backdoor Detection Using an Interpretable RNN Abstract Model
Open accessAbstract
Deep neural networks (DNNs) are known to be inherently vulnerable to malicious attacks such as the adversarial attack and the backdoor attack. The former is crafted by adding small perturbations to benign inputs so as to fool a DNN. The latter generally embeds a hidden pattern in a DNN by poisoning the dataset during the training process, which causes the infected model to misbehave on predefined inputs with a specific trigger and normally perform for others. Much work has been conducted on defending against the adversarial samples, while the backdoor attack received much less attention, especially in recurrent neural networks (RNNs), which play an important role in the text processing field. Two main limitations make it hard to directly apply existing image backdoor detection approaches to RNN-based text classification systems. First, a layer in an RNN does not preserve the same feature latent space function for different inputs, making it impossible to map the inserted specific pattern with the neural activations. Second, the text data is inherently discrete, making it hard to optimize the text like image pixels. In this work, we propose a novel backdoor detection approach named InterRNN for RNN-based text classification systems from the interpretation perspective. Specifically, we first propose a novel RNN interpretation technique by constructing a nondeterministic finite automaton (NFA) based abstract model, which can effectively reduce the analysis complexity of an RNN while preserving its original logic rules. Then, based on the abstract model, we can obtain interpretation results that explain the fundamental reason behind the decision for each input. We then detect trigger words by leveraging the differences between the behaviors in the backdoor sentences and those in the normal sentences. The extensive experiment results on four benchmark datasets demonstrate that our approach can generate better interpretation results compared to state-of-the-art approaches and effectively detect backdoors in RNNs.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The primary objective of a backdoor attack is to generate a converged global model with high accuracy of the main task and the backdoor-injected sub-task.
“The primary objective of the backdoor attack is to generate a converged global model with high accuracy of the main task and the backdoor-injected sub-task [107].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [107]
By training the neural network with new backdoor attack data sets, the self-supervised defense mechanism can defend it properly.
“By training the neural network with new backdoor attack data sets, the self-supervised defense mechanism can defend it properly [107].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [107]
Cites
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333 · see citing works
A Unified Approach to Interpreting Model Predictions
Lundberg, S., & Lee, S.-I. (2017) · arXiv · doi:10.48550/arxiv.1705.07874 · Cited by 23,707 · see citing works
"Why Should I Trust You?": Explaining the Predictions of Any Classifier
Ribeiro, M. T., Singh, S., & Guestrin, C. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939778 · Cited by 17,555 · see citing works
Gauriat, C.-M., Pencolé, Y., Ribot, P., et al. (2024) · HAL · doi:10.4230/oasics.dx.2024.27 · Cited by 12,623 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
An efficient k-means clustering algorithm: analysis and implementation
Kanungo, T., Mount, D. M., Netanyahu, N. S., Piatko, C. D., Silverman, R., & Wu, A. Y. (2002) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2002.1017616 · Cited by 5,660 · see citing works
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.282 · Cited by 5,317 · see citing works
Hierarchical Attention Networks for Document Classification
Yang, Z., Yang, D., Dyer, C., He, X., Smola, A. J., & Hovy, E. H. (2016) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/n16-1174 · Cited by 4,874 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
Learning Word Vectors for Sentiment Analysis
Maas, A. L., Daly, R. E., Pham, P. T., Huang, D., Ng, A. Y., & Potts, C. (2011) · Cited by 3,710 · see citing works
Pang, B., & Lee, L. (2005) · Annual Meeting of the Association for Computational Linguistics · doi:10.3115/1219840.1219855 · Cited by 3,260 · see citing works
Anchors: High-Precision Model-Agnostic Explanations
Ribeiro, M. T., Singh, S., & Guestrin, C. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11491 · Cited by 2,162 · cited 3× · see citing works
“Local approximation based approaches [32], [35], [45]–[47] are based on the assumption that the machine learning predictions around the neighborhood of a given input can be approximated by an interpretable white-box model.”
BackgroundMethodLearning regular sets from queries and counterexamples
Angluin, D. (1987) · Information and Computation · doi:10.1016/0890-5401(87)90052-6 · Cited by 2,099 · see citing works
Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
Xu, W., Evans, D., & Qi, Y. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23198 · Cited by 1,859 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
SmoothGrad: removing noise by adding noise
Smilkov, D., Thorat, N., Kim, B., Viégas, F., & Wattenberg, M. (2017) · arXiv · doi:10.48550/arxiv.1706.03825 · Cited by 1,467 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
Self-citationBadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
Interpretable Explanations of Black Boxes by Meaningful Perturbation
Fong, R. C., & Vedaldi, A. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.371 · Cited by 1,097 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review
Xu, H., Ma, Y., Liu, H., Deb, D., Liu, H., Tang, J., & Jain, A. K. (2020) · Machine Intelligence Research · doi:10.1007/s11633-019-1211-x · Cited by 716 · see citing works
Not Just a Black Box: Learning Important Features Through Propagating Activation DifferencesPreprint
Shrikumar, A., Greenside, P., Shcherbina, A., & Kundaje, A. B. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1605.01713 · Cited by 704 · see citing works
(2007) · The MIT Press eBooks · doi:10.7551/mitpress/7443.001.0001 · Cited by 528 · see citing works
Understanding Neural Networks through Representation ErasurePreprint
Li, J., Monroe, W., & Jurafsky, D. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1612.08220 · Cited by 493 · see citing works
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018) · arXiv · doi:10.48550/arxiv.1811.03728 · Cited by 485 · see citing works
Local Rule-Based Explanations of Black Box Decision SystemsPreprint
Guidotti, R., Monreale, A., Ruggieri, S., Pedreschi, D., Turini, F., & Giannotti, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.10820 · Cited by 323 · see citing works
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/647 · Cited by 314 · see citing works
Guo, W., Mu, D., Xu, J., Su, P., Wang, G., & Xing, X. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243792 · Cited by 286 · see citing works
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
Chou, E., Tramer, F., & Pellegrino, G. (2020) · 2020 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00025 · Cited by 281 · see citing works
NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
Ma, S., Liu, Y., Tao, G., Lee, W., & Zhang, X. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23415 · Cited by 247 · see citing works
Self-citationLiu, Y., Xie, Y., & Srivastava, A. (2017) · 2017 IEEE International Conference on Computer Design (ICCD) · doi:10.1109/iccd.2017.16 · Cited by 241 · see citing works
Self-citationONION: A Simple and Effective Defense Against Textual Backdoor Attacks
Qi, F., Chen, Y., Li, M., Yao, Y., Liu, Z., & Sun, M. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.752 · Cited by 222 · see citing works
Extracting Automata from Recurrent Neural Networks Using Queries and CounterexamplesPreprint
Weiss, G., Goldberg, Y., & Yahav, E. (2017) · International Conference on Machine Learning · doi:10.48550/arxiv.1711.09576 · Cited by 216 · see citing works
DeepStellar: model-based quantitative analysis of stateful deep learning systems
Du, X., Xie, X., Li, Y., Ma, L., Liu, Y., & Zhao, J. (2019) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3338906.3338954 · Cited by 169 · see citing works
Self-citationTABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI SystemsPreprint
Guo, W., Wang, L., Xing, X., Du, M., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.01763 · Cited by 154 · see citing works
NeuronInspect: Detecting Backdoors in Neural Networks via Output ExplanationsPreprint
Huang, X., Alzantot, M., & Srivastava, M. B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07399 · Cited by 85 · see citing works
Liu, Y., Xie, Y., & Srivastava, A. (2017) · IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD) · Cited by 81 · see citing works
Self-citationLearning With Interpretable Structure From Gated RNN
Hou, B., & Zhou, Z. (2020) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2020.2967051 · Cited by 81 · see citing works
Towards characterizing adversarial defects of deep learning software from the lens of uncertainty
Zhang, X., Xie, X., Ma, L., Du, X., Hu, Q., Liu, Y., Zhao, J., & Sun, M. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380368 · Cited by 79 · see citing works
Self-citationDiffChaser: Detecting Disagreements for Deep Neural Networks
Xie, X., Ma, L., Wang, H., Li, Y., Liu, Y., & Li, X. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/800 · Cited by 75 · see citing works
Self-citationCan We Trust Your Explanations? Sanity Checks for Interpreters in Android Malware Analysis
Fan, M. Y., Wei, W., Xie, X., Liu, Y., Guan, X., & Liu, T. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3021924 · Cited by 66 · see citing works
Self-citationOn Attribution of Recurrent Neural Network Predictions via Additive Decomposition
Du, M., Liu, N., Yang, F., Ji, S., & Hu, X. (2019) · International World Wide Web Conference (WWW) · doi:10.1145/3308558.3313545 · Cited by 57 · see citing works
Learning Probabilistic Automata for Model Checking
Mao, H., Chen, Y., Jaeger, M., Nielsen, T. D., Larsen, K. G., & Nielsen, B. (2011) · International Conference on the Quantitative Evaluation of Systems (QEST) · doi:10.1109/qest.2011.21 · Cited by 55 · see citing works
Learning Deterministic Weighted Automata with Queries and CounterexamplesPreprint
Weiss, G., Goldberg, Y., & Yahav, E. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.13895 · Cited by 23 · see citing works
Towards interpreting recurrent neural networks through probabilistic abstraction
Dong, G., Wang, J., Sun, J., Zhang, Y., Wang, X., Dai, T., Dong, J. S., & Wang, X. (2020) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3324884.3416592 · Cited by 19 · see citing works
Learning with Interpretable Structure from Gated RNNPreprint
Hou, B., & Zhou, Z. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.10708 · Cited by 6 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“By training the neural network with new backdoor attack data sets, the self-supervised defense mechanism can defend it properly [107].”
BackgroundPiccolo: Exposing Complex Backdoors in NLP Transformer Models
Liu, Y., Shen, G., Tao, G., An, S., Ma, S., & Zhang, X. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833579 · Cited by 54 · see citing works
“The last type defends at post-deployment stage by detecting trigger inputs [20], [23]–[35], [46], [47], [92], [93].”
BackgroundMethodSelf-citationRickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis
Struppek, L., Hintersdorf, D., & Kersting, K. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00423 · Cited by 57 · see citing works
“It remains an open question if existing backdoor defenses for language models, including backdoor sample detection [9, 15, 37, 38] and backdoor inversion [2, 56], could be adjusted to our text-to-image synthesis setting, which is different from text classification tasks.”
BackgroundBackdoor Attacks and Defenses Targeting Multi-Domain AI Models: A Comprehensive Review
Zhang, S., Pan, Y., Liu, Q., Yan, Z., Choo, K. R., & Wang, G. (2024) · ACM Computing Surveys · doi:10.1145/3704725 · Cited by 47 · see citing works
“In the text classification scenario, Fan et al. [35] designed a recurrent neural network (RNN) interpretability technique using a nondeterministic finite automaton (NFA) to compute the differences in behavior between backdoored sentences and normal sentences, thereby enabling online defense against…”
Security for Machine Learning-based Software Systems: A Survey of Threats, Practices, and Challenges
Chen, H., & Babar, M. A. (2023) · ACM Computing Surveys · doi:10.1145/3638531 · Cited by 50 · see citing works
Cheng, P., Wu, Z., Du, W., Zhao, H., Lu, W., & Liu, G. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3540303 · Cited by 46 · see citing works
“Fan et al. [82] propose an interpretable backdoor defense.”
Backdoor Attack and Defense on Deep Learning: A Survey
Bai, Y., Xing, G., Wu, H., Rao, Z., Ma, C., Wang, S., Liu, X., Zhou, Y., Tang, J., Huang, K., et al. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3482723 · Cited by 36 · see citing works
“Fan et al. [135] first proposed a novel RNN explanation technique by constructing an abstract model based on nondeterministic fi-nite automaton (NFA).”
InfluentialMengara, O., Avila, A. R., & Falk, T. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355816 · Cited by 32 · see citing works
“Examples include [62], [63], [145], [174], [291], [292], [293], [294], [295], [296], [297], [298], [299], [299], [300], [301], [302], [303], [304], [305], [306], [307], [308].”
A Survey on Backdoor Attack and Defense in Natural Language Processing
Sheng, X., Han, Z., Li, P., & Chang, X. (2022) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs57517.2022.00086 · Cited by 28 · see citing works
“The method in work [46] defends against attack methods that target RNNs.”
Stealthy and Flexible Trojan in Deep Learning Framework
Wang, Y., Chen, K., Tan, Y., Huang, S., Ma, W., & Li, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3164073 · Cited by 25 · see citing works
“Trojan attacks against various DNN models have attracted wide-spread attention [9], [10], [11], [12], [13], [14] and have become a serious threat to the security of the DNN supply chain.”
BackgroundLUNA: A Model-Based Universal Analysis Framework for Large Language Models
Song, D., Xie, X., Song, J., Zhu, D., Huang, Y., Juefei-Xu, F., & Ma, L. (2024) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2024.3411928 · Cited by 25 · see citing works
“To enable an effective quality analysis, we bind semantics , which reflects LLM’s performance regarding specific trustwor-thiness perspectives, to the abstract model.”
BackgroundSelf-citationMBA: Backdoor Attacks Against 3D Mesh Classifier
Fan, L., He, F., Si, T., Fan, R., Ye, C., & Li, B. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3346644 · Cited by 20 · see citing works
“Such a threat has motivated numerous efforts to investigate backdoor attacks and their defenses in the 2D image domain, such as those in [9], [13], [14], [15], [16], [17], [18], [19], and [20].”
BackgroundMartino, V. D., & Palomba, F. (2025) · Information and Software Technology · doi:10.1016/j.infsof.2025.107678 · Cited by 18 · see citing works
A smart collaborative framework for dynamic multi-task offloading in IIoT-MEC networks
Ai, Z., Zhang, W., Li, M., Li, P., & Shi, L. (2023) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-022-01441-1 · Cited by 16 · see citing works
“RNN: it has internal memory, to solve temporal-feature problems of data [35, 36].”
BackgroundWord-Level and Pinyin-Level Based Chinese Short Text Classification
Sun, X., & Huo, X. (2022) · IEEE Access · doi:10.1109/access.2022.3225659 · Cited by 12 · see citing works
“[17] M. Fan, Z. Si, X. Xie, Y. Liu, and T. Liu, ‘‘Text backdoor detection using an interpretable RNN abstract model,’’ IEEE Trans.”
MethodInfluentialOne step further: evaluating interpreters using metamorphic testing
Fan, M. Y., Wei, J., Jin, W., Zhou, X., Wei, W., & Liu, T. (2022) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3533767.3534225 · Cited by 10 · see citing works
“There have been many kinds of research on improving the interpretability of DNN models from two main perspectives, i.e., the ad-hoc interpretation methods [8, 34, 53] and the post-hoc interpretation methods [15, 17].”
BackgroundSelf-citationJia, J., Ma, S., Liu, Y., Wang, L., & Deng, R. H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3318936 · Cited by 9 · see citing works
“The spurious correlation problems in GNNs have two remarkable characteristics compared with the shortcut bias problems in other DNNs [9], [10], [11], [12].”
BackgroundSelf-citationAn Improved Generating Energy Prediction Method Based on Bi-LSTM and Attention Mechanism
He, B., Ma, R., Zhang, W., Zhu, J., & Zhang, X. (2022) · Electronics · doi:10.3390/electronics11121885 · Cited by 9 · see citing works
Object-free backdoor attack and defense on semantic segmentation
Mao, J., Qian, Y., Huang, J., Lian, Z., Tao, R., Wang, B., Wang, W., & Yao, T. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103365 · Cited by 8 · see citing works
TIJO: Trigger Inversion with Joint Optimization for Defending Multimodal Backdoored Models
Sur, I., Sikka, K., Walmer, M., Koneripalli, K., Roy, A., Lin, X., Divakaran, A., & Jha, S. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00022 · Cited by 8 · see citing works
“Other works rely on ideas such as model diagnosis [14, 19], prepossessing-based [2], and trigger synthesis [36, 46].”
Precise Defense Approach Against Small-Scale Backdoor Attacks in Industrial Internet of Things
Ran, Z., Yao, Y. K., Li, W., Yang, W., Li, W., & Wu, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3490579 · Cited by 6 · see citing works
“Current methods primarily include distribution differences [14], [15], reinforcement learning [16], [17], [18], and gradient optimization [19], [20], [21] to identify anomalous patterns indicative of backdoor manipulation.”
Lee, T., Lee, S., & Kwon, H. (2025) · IEEE Access · doi:10.1109/access.2024.3474088 · Cited by 5 · see citing works
“Fan et al. [35] proposed a method that can detect textual backdoors using an interpretable RNN abstract model.”
BadDGA: Backdoor Attack on LSTM-Based Domain Generation Algorithm Detector
Zhai, Y., Yang, L., Yang, J., He, L., & Li, Z. (2023) · Electronics · doi:10.3390/electronics12030736 · Cited by 3 · see citing works
AI-Powered Detection and Mitigation of Backdoor Attacks on Databases Server
Khan, A., & Sharma, I. (2024) · International Conference on Intelligent Data Communication Technologies and Internet of Things (IDCIoT) · doi:10.1109/idciot59759.2024.10467487 · Cited by 3 · see citing works
Nonlinear sliding mode control of flying wing aircraft under wind disturbance
Song, Y., Zhao, W., Liu, Z., Han, J., & Dang, Q. (2024) · Measurement Science and Technology · doi:10.1088/1361-6501/ad9e1a · Cited by 3 · see citing works
“With these advantages, the network has been used in many applications, such as text backdoor detection [29], video captioning [30], sequence recognition [31], medical uses [31], and electronic control [32].”
LLMBD: Backdoor defense via large language model paraphrasing and data voting in NLP
Ouyang, F., Zhang, D., Xie, C., Wang, H., & Xiang, T. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.113737 · Cited by 3 · see citing works
Runtime Backdoor Detection for Federated Learning via Representational Dissimilarity Analysis
Zhang, X., Xue, X., Du, X., Xie, X., Liu, Y., & Sun, M. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3550330 · Cited by 2 · see citing works
“As with the Square pattern, we investigate the effectiveness of our method against these practical backdoors, comparing it to other detection and defense techniques discussed in previous sections.”
Self-citationCert-SSBD: Certified Backdoor Defense With Sample-Specific Smoothing Noises
Qiao, T., Wang, Y. Q., Liu, X., Wu, S., Li, J., & Li, Y. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3667460 · Cited by 2 · see citing works
“Arguably, this reliance introduces security risks, with backdoor attacks [4], [5], [6], [7] being among the most severe threats.”
Backdoor threats in large language models—a survey
Liu, S., Pan, Y. F., Hong, K., Fei, R., Lin, C., Li, Q., & Shen, C. (2025) · Science China Information Sciences · doi:10.1007/s11432-024-4351-3 · Cited by 1 · see citing works
“In the field of NLP, InterRNN [220] targets RNN-based text classification systems to detect trigger words from an interpretation perspective.”
An LSTM-based Online Fault Diagnosis Method for Capacitor Voltage Transformer
Chen, W., Zhou, J., Yuan, Z., & Chen, J. (2021) · International Conference on Mechanical, Aerospace and Automotive Engineering (CMAAE) · doi:10.1145/3518781.3519179 · Cited by 1 · see citing works
“RNN has been widely applied and acquired many achievements in the fields of translation [7], recognition [8], text generation [9], etc.”
BackgroundYu, S., Song, C., Gao, P., & Zheng, H. (2022) · International Conference on Electronic Information Engineering and Computer Technology (EIECT) · doi:10.1109/eiect58010.2022.00068 · Cited by 1 · see citing works
Liu, Y., Wang, H., & Ma, Y. (2024) · Algorithms · doi:10.3390/a17050210 · Cited by 1 · see citing works
Self-citationA map-based model-driven testing framework for automated driving systems
Tang, Y. (2022) · doi:10.32657/10356/164257 · Cited by 1 · see citing works
Khan, A., Gupta, D., & Dutta, M. (2025) · International Conference on Intelligent and Innovative Technologies in Computing, Electrical and Electronics (IITCEE) · doi:10.1109/iitcee64140.2025.10915358
“Extended investigations on four benchmark datasets revealed that the author's method could identify RNN backdoors and exceed state-of-the-art interpretation methods [6].”
Phoneme Segmentation Based Backdoor Attack Against Speech Recognition as a Service
Cheng, L., Ji, S., Cai, H., Shi, Y., & Zhang, M. (2025) · Communications in computer and information science · doi:10.1007/978-981-95-1581-3_24
Stealthy Backdoor Carriers: The Threat of Visual Prompts to CLIP
Zhang, M., Zhao, M., Wang, W., & Wang, B. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3650599
Data‐driven symbolic model predictive control of unknown nonlinear system via abstract model
Fu, A., Fan, F., An, T., & Qiao, J. (2026) · Asian Journal of Control · doi:10.1002/asjc.70082
TSTN: Multi-Scale Video Summarization via a Transformer based Spatial-Temporal Network
Chen, K. (2026) · International Conference on Computer, Artificial Intelligence and Control Engineering (CAICE) · doi:10.1145/3804601.3804747
“Nevertheless, they generally necessitate specialized computational infrastructure and domain-expert annotations, suffer from training instability, and exhibit opaque decision-making processes that hinder diagnostic analysis and optimization [24] [25].”
- Authors
- Fan, M., Si, Z., Xie, X., Liu, Y., & Liu, T.
- Affiliations
- Xi'an Jiaotong University (CN)
- Nanyang Technological University (SG)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2021
- Volume
- 16
- Pages
- 4117-4132
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W3190075653
- Cited by
- 38
- References
- 46
- Citations by year
- 2026: 4 · 2025: 8 · 2024: 9 · 2023: 8 · 2022: 8 · 2021: 1
- FWCI
- 2.30
- Type
- journal article
- Language
- en
- Open access
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- Singapore Management University Institutional Knowledge (InK) (Singapore Management University) (submittedVersion, other-oa)
- DR-NTU (Nanyang Technological University) (submittedVersion)
- Funders
- National Natural Science Foundation of China (61902306, 61632015, 61602369, U1766215, 61772408, 61702414, 61833015)
- China Postdoctoral Science Foundation (2019TQ0251, 2020M673439)
- Innovative Research Group of the National Natural Science Foundation of China (61721002)
- Ministry of Education Innovation Research Team (IRT_17R86)
- Youth Talent Support Plan of Xi’an Association for Science and Technology (095920201303)
- National Research Foundation, Prime Minister’s Office, Singapore, under its National Cybersecurity Research and Development Program (NRF2018NCR-NCR005-0001)
- NRF Investigatorship (NRFI06-2020-0022)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Explainable Artificial Intelligence (XAI)
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- backdoor attack detection, recurrent neural networks, text classification, nondeterministic finite automata, abstract models, adversarial attacks, data poisoning, explainable AI
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
