Backdoor Learning: A Survey
Open accessAbstract
Backdoor attack intends to embed hidden backdoors into deep neural networks (DNNs), so that the attacked models perform well on benign samples, whereas their predictions will be maliciously changed if the hidden backdoor is activated by attacker-specified triggers. This threat could happen when the training process is not fully controlled, such as training on third-party datasets or adopting third-party models, which poses a new and realistic threat. Although backdoor learning is an emerging and rapidly growing research area, there is still no comprehensive and timely review of it. In this article, we present the first comprehensive survey of this realm. We summarize and categorize existing backdoor attacks and defenses based on their characteristics, and provide a unified framework for analyzing poisoning-based backdoor attacks. Besides, we also analyze the relation between backdoor attacks and relevant fields (i.e., adversarial attacks and data poisoning), and summarize widely adopted benchmark datasets. Finally, we briefly outline certain future research directions relying upon reviewed works. A curated list of backdoor-related resources is also available at https://github.com/THUYimingLi/backdoor-learning-resources.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In some existing surveys, WFL was considered as one of the deep learning applications when discussing the impact of backdoor attacks, but no detailed analysis of vulnerabilities of backdoor attacks on WFL was provided.
“On the other hand, in [48], [49], [50], and [51], WFL was considered as one of the deep learning applications when discussing the impact of backdoor attacks, but no detailed analysis of vulnerabilities of backdoor attacks on WFL was provided.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [49]
Backdoor attacks during the local model training phase require attackers to have complete control over compromised clients.
“Backdoor attacks during the local model training phase require attackers to have complete control over compromised clients [39], [49], [242].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [49]
The current FL paradigm is vulnerable to free-riding participants.
“This makes the paradigm vulnerable to freeriding participants [167], [168], [185], [148], [186].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [168]
In FL systems, there may exist free-riders who aim to benefit from the global model but do not want to contribute any useful information, thus compromising collaborative fairness.
“In FL systems, there may exist free-riders, who aim to benefit from the global model, but do not want to contribute any useful information, thus compromising collaborative fairness [167], [168], [184].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [168]
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333 · see citing works
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805 · see citing works
Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.74 · Cited by 24,513 · see citing works
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
Breiman, L. (1996) · Machine Learning · doi:10.1007/bf00058655 · Cited by 16,325 · see citing works
Distilling the Knowledge in a Neural Network
Hinton, G., Vinyals, O., & Dean, J. (2015) · arXiv · doi:10.48550/arxiv.1503.02531 · Cited by 14,204 · see citing works
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Overcoming catastrophic forgetting in neural networks
Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., et al. (2017) · Proceedings of the National Academy of Sciences · doi:10.1073/pnas.1611835114 · Cited by 7,899 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
Xiao, H., Rasul, K., & Vollgraf, R. (2017) · arXiv · doi:10.48550/arxiv.1708.07747 · Cited by 6,108 · see citing works
Finite-time Analysis of the Multiarmed Bandit Problem
Auer, P., Cesa-Bianchi, N., & Fischer, P. (2002) · Machine Learning · doi:10.1023/a:1013689704352 · Cited by 6,033 · see citing works
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479 · see citing works
On Assessing ML Model Robustness: A Methodological Framework (Academic Track)
Awadid, A., & Robert, B. (2025) · OASIcs : OpenAccess Series in Informatics · doi:10.4230/oasics.saia.2024.1 · Cited by 4,723 · see citing works
Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445 · see citing works
Reading digits in natural images with unsupervised feature learning
Netzer, Y. (2024) · doi:10.57702/e7wwo0zk · Cited by 4,261 · see citing works
VGGFace2: A Dataset for Recognising Faces across Pose and Age
Cao, Q., Shen, L., Xie, W., Parkhi, O. M., & Zisserman, A. (2018) · 2018 13th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2018) · doi:10.1109/fg.2018.00020 · Cited by 3,032 · see citing works
Improved regularization of convolutional neural networks with cutout
DeVries, T., & Taylor, G. W. (2017) · arXiv · doi:10.48550/arxiv.1708.04552 · Cited by 2,776 · see citing works
Universal Adversarial Perturbations
Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.17 · Cited by 2,680 · see citing works
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
Akhtar, N., & Mian, A. (2018) · IEEE Access · doi:10.1109/access.2018.2807385 · Cited by 2,021 · see citing works
Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition
Stallkamp, J., Schlipsing, M., Salmen, J., & Igel, C. (2012) · Neural Networks · doi:10.1016/j.neunet.2012.02.016 · Cited by 1,567 · see citing works
Theoretically principled trade-off between robustness and accuracy
Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., & Jordan, M. I. (2019) · arXiv · doi:10.48550/arxiv.1901.08573 · Cited by 1,560 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Face recognition in unconstrained videos with matched background similarity
Wolf, L., Hassner, T., & Maoz, I. (2011) · doi:10.1109/cvpr.2011.5995566 · Cited by 1,426 · see citing works
Attribute and simile classifiers for face verification
Kumar, N., Berg, A. C., Belhumeur, P. N., & Nayar, S. K. (2009) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2009.5459250 · Cited by 1,383 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
Certified Adversarial Robustness via Randomized SmoothingPreprint
Cohen, J. M., Rosenfeld, E., & Kolter, J. Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.02918 · Cited by 1,172 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1712.05526 · Cited by 1,039 · see citing works
Fooling Automated Surveillance Cameras: Adversarial Patches to Attack Person Detection
Thys, S., Ranst, W. V., & Goedemé, T. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw.2019.00012 · Cited by 770 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Møgelmose, A., Trivedi, M. M., & Moeslund, T. B. (2012) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2012.2209421 · Cited by 694 · see citing works
Detecting Adversarial Samples from Artifacts
Feinman, R., Curtin, R. R., Shintre, S., & Gardner, A. B. (2017) · arXiv · doi:10.48550/arxiv.1703.00410 · Cited by 606 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
Characterizing Adversarial Subspaces Using Local Intrinsic DimensionalityPreprint
Ma, X., Li, B., Wang, Y., Erfani, S., Wijewickrema, S. N. R., Schoenebeck, G. R., Song, D. X., Houle, M. E., & Bailey, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.02613 · Cited by 508 · see citing works
Spectral Signatures in Backdoor AttacksPreprint
Tran, B., Li, J. Z., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.00636 · Cited by 506 · see citing works
On Adaptive Attacks to Adversarial Example Defenses
Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020) · arXiv · doi:10.48550/arxiv.2002.08347 · Cited by 486 · see citing works
Invisible Backdoor Attack with Sample-Specific Triggers
Li, Y., Li, Y., Wu, B., Li, L., He, R., & Lyu, S. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01615 · Cited by 472 · see citing works
Self-citationDBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 468 · see citing works
Efficient Decision-Based Black-Box Adversarial Attacks on Face Recognition
Dong, Y., Su, H., Wu, B., Li, Z., Liu, W., Zhang, T., & Zhu, J. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00790 · Cited by 433 · see citing works
Self-citationAttack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Adversarial Weight Perturbation Helps Robust GeneralizationPreprint
Wu, D., Xia, S., & Wang, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.05884 · Cited by 390 · see citing works
Self-citationLatent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Weight Poisoning Attacks on Pretrained Models
Kurita, K., Michel, P., & Neubig, G. (2020) · Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/2020.acl-main.249 · Cited by 354 · see citing works
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108434 · Cited by 351 · cited 1× · see citing works
“In contrast, some works [30], [101]–[103] also questioned whether federal learning is really easy to be attacked.”
ResultCan You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
Li, S., Xue, M., Zhao, B. Z. H., Zhu, H., & Zhang, X. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3021407 · Cited by 325 · see citing works
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/647 · Cited by 314 · see citing works
A Backdoor Attack Against LSTM-Based Text Classification Systems
Dai, J., Chen, C., & Li, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2941376 · Cited by 298 · see citing works
Self-citationSentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
Chou, E., Tramer, F., & Pellegrino, G. (2020) · 2020 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00025 · Cited by 281 · see citing works
Detecting AI Trojans Using Meta Neural Analysis
Xu, X., Wang, Q., Li, H., Borisov, N., Gunter, C. A., & Li, B. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00034 · Cited by 278 · see citing works
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural NetworksPreprint
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., & Ma, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.05930 · Cited by 264 · see citing works
Self-citationFebruus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Clean-Label Backdoor Attacks on Video Recognition Models
Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., & Jiang, Y. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01445 · Cited by 247 · see citing works
Self-citationLiu, Y., Xie, Y., & Srivastava, A. (2017) · 2017 IEEE International Conference on Computer Design (ICCD) · doi:10.1109/iccd.2017.16 · Cited by 241 · see citing works
Backdoor Attacks Against Deep Learning Systems in the Physical World
Wenger, E., Passananti, J., Bhagoji, A. N., Yao, Y., Zheng, H.-T., & Zhao, B. Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00614 · Cited by 233 · see citing works
Input-Aware Dynamic Backdoor AttackPreprint
Nguyen, A., & Tran, A. T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.08138 · Cited by 221 · see citing works
BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements
Chen, X., Salem, A., Chen, D., Michael Backes, A., Ma, S., Shen, Q., Wu, Z., & Zhang, Y. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485837 · Cited by 221 · see citing works
Backdoor Attacks to Graph Neural Networks
Zhang, Z., Jia, J., Wang, B., & Gong, N. Z. (2021) · Proceedings of the 26th ACM Symposium on Access Control Models and Technologies · doi:10.1145/3450569.3463560 · Cited by 220 · see citing works
Generalizable Data-Free Objective for Crafting Universal Adversarial Perturbations
Mopuri, K. R., Ganeshan, A., & Babu, R. V. (2018) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2018.2861800 · Cited by 219 · see citing works
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Doan, K., Lao, Y., Zhao, W., & Li, P. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01175 · Cited by 211 · see citing works
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive ReviewPreprint
Gao, Y., Doan, B. G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, ., & Kim, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.10760 · Cited by 207 · see citing works
Learning to Detect Malicious Clients for Robust Federated LearningPreprint
Li, S., Cheng, Y. J., Wang, W., Liu, Y., & Chen, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.00211 · Cited by 202 · see citing works
Composite Backdoor Attack for Deep Neural Network by Mixing Existing Benign Features
Lin, J., Xu, L., Liu, Y., & Zhang, X. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3423362 · Cited by 202 · see citing works
TBT: Targeted Neural Network Attack With Bit Trojan
Rakin, A. S., He, Z., & Fan, D. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01321 · Cited by 200 · see citing works
DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
Qiu, H., Zeng, Y., Guo, S., Zhang, T., Meikang Qiu, A., & Thuraisingham, B. M. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453108 · Cited by 196 · see citing works
Rethinking the Backdoor Attacks’ Triggers: A Frequency Perspective
Zeng, Y., Park, W., Mao, Z. M., & Jia, R. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01616 · Cited by 193 · see citing works
Flip Feng Shui: Hammering a Needle in the Software Stack
Razavi, K., Gras, B., Bosman, E., Bart Preneel, A., Giuffrida, C., & Bos, H. (2016) · VU Research Portal · Cited by 192 · see citing works
Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs
Kolouri, S., Saha, A., Pirsiavash, H., & Hoffmann, H. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00038 · Cited by 190 · see citing works
Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., & Sun, M. (2021) · doi:10.18653/v1/2021.acl-long.37 · Cited by 190 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. B. (2019) · International Conference on Machine Learning · Cited by 188 · see citing works
Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation
Zhong, H., Liao, C., Squicciarini, A., Zhu, S., & Miller, D. J. (2020) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3374664.3375751 · Cited by 186 · see citing works
Label-Consistent Backdoor AttacksPreprint
Turner, A., Tsipras, D., & Mądry, A. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.02771 · Cited by 177 · see citing works
Blind Backdoors in Deep Learning ModelsPreprint
Bagdasaryan, E., & Shmatikov, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.03823 · Cited by 175 · see citing works
An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks
Tang, R., Du, M., Liu, N., Yang, F., & Hu, X. (2020) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3394486.3403064 · Cited by 172 · see citing works
BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning
Jia, J., Liu, Y., & Gong, N. Z. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833644 · Cited by 171 · see citing works
Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
Wang, J., Dong, G., Sun, J., Wang, X., & Zhang, P. (2019) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse.2019.00126 · Cited by 168 · see citing works
Introduction to Statistical Machine Learning
杉山, 将. (2016) · Elsevier eBooks · doi:10.1016/c2014-0-01992-2 · Cited by 162 · see citing works
TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI SystemsPreprint
Guo, W., Wang, L., Xing, X., Du, M., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.01763 · Cited by 154 · see citing works
Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer
Qi, F., Chen, Y., Zhang, X., Li, M., Liu, Z., & Sun, M. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.374 · Cited by 143 · see citing works
Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification
Cheng, S., Liu, Y., Ma, S., & Zhang, X. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i2.16201 · Cited by 137 · see citing works
Rethinking the Trigger of Backdoor AttackPreprint
Li, Y., Zhai, T., Wu, B., Jiang, Y., Li, Z., & Xia, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.04692 · Cited by 132 · see citing works
Self-citationBypassing Backdoor Detection Algorithms in Deep Learning
Tan, T. J. L., & Shokri, R. (2020) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp48549.2020.00019 · Cited by 123 · see citing works
Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination DetectionPreprint
Tang, D., Wang, X., Tang, H., & Zhang, K. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.00686 · Cited by 121 · see citing works
Poison Ink: Robust and Invisible Backdoor Attack
Zhang, J., Chen, D., Huang, Q., Liao, J., Zhang, W., Feng, H., Hua, G., & Yu, N. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3201472 · Cited by 121 · see citing works
Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
Wang, R., Zhang, G., Liu, S., Chen, P., Xiong, J., & Wang, M. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58592-1_14 · Cited by 116 · see citing works
RAB: Provable Robustness Against Backdoor Attacks
Weber, M., Xu, X., Karlaš, B., Zhang, C., & Li, B. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179451 · Cited by 115 · see citing works
Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models
Wang, S., Nepal, S., Rudolph, C., Grobler, M. M., Chen, S., & Chen, T. (2020) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2020.3000900 · Cited by 114 · see citing works
Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution
Qi, F., Yao, Y., Xu, S., Liu, Z., & Sun, M. (2021) · doi:10.18653/v1/2021.acl-long.377 · Cited by 113 · see citing works
Yang, W., Li, L., Zhang, Z., Ren, X., Sun, X., & He, B. (2021) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2021.naacl-main.165 · Cited by 107 · see citing works
Backdooring Convolutional Neural Networks via Targeted Weight Perturbations
Dumford, J., & Scheirer, W. J. (2020) · IEEE International Joint Conference on Biometrics (IJCB) · doi:10.1109/ijcb48548.2020.9304875 · Cited by 102 · see citing works
Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning
Li, L., Song, D., Li, X., Zeng, J., Ma, R., & Qiu, X. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.241 · Cited by 102 · see citing works
Robust Anomaly Detection and Backdoor Attack Detection Via Differential PrivacyPreprint
Du, M., Jia, R., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07116 · Cited by 101 · see citing works
Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff
Borgnia, E., Cherepanova, V., Fowl, L., Ghiasi, A., Geiping, J., Goldblum, M., Goldstein, T., & Gupta, A. K. (2021) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp39728.2021.9414862 · Cited by 100 · see citing works
Adversarial sample detection for deep neural network through model mutation testingPreprint
Wang, J., DONG, G., Sun, J., Wang, X., & PEIXIN, Z. (2019) · Singapore Management University Institutional Knowledge (InK) (Singapore Management University) · Cited by 96 · see citing works
Bridging Mode Connectivity in Loss Landscapes and Adversarial RobustnessPreprint
Zhao, P., Chen, P., Das, P., Ramamurthy, K. N., & Lin, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.00060 · Cited by 95 · see citing works
Backdoor Attack Against Speaker Verification
Zhai, T., Li, Y., Zhang, Z., et al. (2021) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp39728.2021.9413468 · Cited by 94 · see citing works
Self-citationBlack-box Detection of Backdoor Attacks with Limited Information and Data
Dong, Y., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., & Zhu, J. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01617 · Cited by 92 · cited 7× · see citing works
“, [25], [61], [59]) for its complicated target shifting and therefore is more serious compared with the allto-one attacks.”
BackgroundInfluentialAn Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences
Guo, W., Tondi, B., & Barni, M. (2022) · IEEE Open Journal of Signal Processing · doi:10.1109/ojsp.2022.3190213 · Cited by 91 · see citing works
Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks
Jia, J., Cao, X., & Gong, N. Z. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.16971 · Cited by 89 · see citing works
BadNL: Backdoor Attacks Against NLP ModelsPreprint
Chen, X., Salem, A., Michael Backes, A., Ma, S., & Zhang, Y. (2020) · arXiv (Cornell University) · Cited by 87 · see citing works
On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient ShapingPreprint
Hong, S., Chandrasekaran, V., Kaya, Y., Dumitraş, T., & Papernot, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11497 · Cited by 86 · see citing works
Targeted Attack for Deep Hashing Based Retrieval
Bai, J., Chen, B., Li, Y., Wu, D., Guo, W., Xia, S., & Yang, E. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58452-8_36 · Cited by 86 · see citing works
Self-citationTrojan Attacks on Wireless Signal Classification with Adversarial Machine Learning
Davaslıoğlu, K., & Sagduyu, Y. E. (2019) · IEEE International Symposium on Dynamic Spectrum Access Networks · doi:10.1109/dyspan.2019.8935782 · Cited by 85 · see citing works
NeuronInspect: Detecting Backdoors in Neural Networks via Output ExplanationsPreprint
Huang, X., Alzantot, M., & Srivastava, M. B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07399 · Cited by 85 · see citing works
Model Agnostic Defence Against Backdoor Attacks in Machine Learning
Udeshi, S., Peng, S., Woo, G., Loh, L., Rawshan, L., & Chattopadhyay, S. (2022) · IEEE Transactions on Reliability · doi:10.1109/tr.2022.3159784 · Cited by 84 · see citing works
Sparse Adversarial Attack via Perturbation Factorization
Fan, Y., Wu, B., Li, T., Zhang, Y., Li, M., Li, Z., & Yang, Y. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58542-6_3 · Cited by 84 · see citing works
Self-citationCertified Robustness to Label-Flipping Attacks via Randomized SmoothingPreprint
Rosenfeld, E., Winston, E., Ravikumar, P., & Kolter, J. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.03018 · Cited by 83 · see citing works
Rethinking Stealthiness of Backdoor Attack against NLP Models
Yang, W., Lin, Y., Li, P., Zhou, J., & Sun, X. (2021) · doi:10.18653/v1/2021.acl-long.431 · Cited by 82 · see citing works
Liu, Y., Xie, Y., & Srivastava, A. (2017) · IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD) · Cited by 81 · see citing works
Neural network laundering: Removing black-box backdoor watermarks from deep neural networks
Aiken, W., Kim, H., Woo, S. S., & Ryoo, J. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102277 · Cited by 79 · see citing works
Attack-Resistant Federated Learning with Residual-based ReweightingPreprint
Fu, S., Xie, C., Li, B., & Chen, Q. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.11464 · Cited by 78 · see citing works
Gotta Catch'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
Shan, S., Wenger, E., Wang, B., Li, B., Zheng, H.-T., & Zhao, B. Y. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417231 · Cited by 75 · see citing works
DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injection
Li, Y., Hua, J., Wang, H., Chen, C., & Liu, Y. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) · doi:10.1109/icse43902.2021.00035 · Cited by 75 · see citing works
Self-citationBackdooring and Poisoning Neural Networks with Image-Scaling Attacks
Quiring, E., & Rieck, K. (2020) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00024 · Cited by 74 · see citing works
TrojDRL: Evaluation of Backdoor Attacks on Deep Reinforcement Learning
Kiourti, P., Wardega, K., Jha, S., & Li, W. (2020) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1109/dac18072.2020.9218663 · Cited by 73 · see citing works
Defending against Model Stealing via Verifying Embedded External Features
Li, Y., Zhu, L., Jia, X., Jiang, Y., Xia, S., & Cao, X. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i2.20036 · Cited by 73 · see citing works
Self-citationLiu, Y., Mondal, A., Chakraborty, A., Zuzak, M., Jacobsen, N., Xing, D., & Srivastava, A. (2020) · International Symposium on Quality Electronic Design (ISQED) · doi:10.1109/isqed48828.2020.9137011 · Cited by 70 · see citing works
ProFlip: Targeted Trojan Attack with Progressive Bit Flips
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00762 · Cited by 70 · see citing works
Backdoor Scanning for Deep Neural Networks through K-Arm OptimizationPreprint
Shen, G., Liu, Y., Tao, G., An, S., Xu, Q., Cheng, S., Ma, S., & Zhang, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.05123 · Cited by 69 · see citing works
Towards Inspecting and Eliminating Trojan Backdoors in Deep Neural Networks
Guo, W., Wang, L., Xu, Y. H., Xing, X., Du, M., & Song, D. X. (2020) · Proceedings · doi:10.1109/icdm50108.2020.00025 · Cited by 68 · see citing works
A Backdoor Attack against 3D Point Cloud Classifiers
Xiang, Z. J., Miller, D. J., Chen, S., Li, X., & Kesidis, G. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00750 · Cited by 66 · see citing works
On Certifying Robustness against Backdoor Attacks via Randomized SmoothingPreprint
Wang, B., Cao, X., jia, J., & Gong, N. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11750 · Cited by 63 · see citing works
Can Adversarial Weight Perturbations Inject Neural Backdoors
Garg, S., Kumar, A., Goel, V., & Liang, Y. (2020) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3340531.3412130 · Cited by 62 · see citing works
Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip
Chen, W., Zhang, Z., Hu, X., & Wu, B. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58555-6_17 · Cited by 62 · see citing works
One-Pixel Signature: Characterizing CNN Models for Backdoor Detection
Huang, S., Peng, W., Jia, Z., & Zhuowen Tu, A. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58583-9_20 · Cited by 62 · see citing works
Defending Neural Backdoors via Generative Distribution ModelingPreprint
Qiao, X., Yang, Y., & Li, H. H. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.04749 · Cited by 61 · see citing works
(2019) · USENIX Security Symposium · Cited by 60 · see citing works
Zhu, L., Ning, R., Wang, C., Xin, C., & Wu, H. (2020) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3394171.3413546 · Cited by 58 · see citing works
Backdoor Attack on Machine Learning Based Android Malware Detectors
Li, C., Chen, X., Wang, D., Wen, S., Ahmed, M. E., Camtepe, S. A., & Xiang, Y. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3094824 · Cited by 57 · see citing works
Naseri, M., Hayes, J., & Cristofaro, E. D. (2020) · arXiv (Cornell University) · Cited by 54 · see citing works
PointBA: Towards Backdoor Attacks in 3D Point Cloud
Li, X., Chen, Z., Zhao, Y., Tong, Z., Zhao, Y., Lim, A. E. B., & Zhou, J. T. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01618 · Cited by 52 · see citing works
Athena: Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0072 · Cited by 51 · see citing works
Detection of Backdoors in Trained Classifiers Without Access to the Training Set
Xiang, Z., Miller, D. J., & Kesidis, G. (2020) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2020.3041202 · Cited by 50 · see citing works
Weight Poisoning Attacks on Pre-trained ModelsPreprint
Kurita, K., Michel, P., & Neubig, G. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.06660 · Cited by 49 · see citing works
Removing Backdoor-Based Watermarks in Neural Networks with Limited Data
Liu, X., Li, F., Wen, B., & Li, Q. (2021) · 2020 25th International Conference on Pattern Recognition (ICPR) · doi:10.1109/icpr48806.2021.9412684 · Cited by 49 · see citing works
Yoshida, K., & Fujino, T. (2020) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3411508.3421375 · Cited by 47 · see citing works
BACKDOORL: Backdoor Attack against Competitive Reinforcement Learning
Wang, L., Javed, Z., Wu, X., Guo, W., Xing, X., & Song, D. X. (2021) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/509 · Cited by 47 · see citing works
RAB: Provable Robustness Against Backdoor AttacksPreprint
Weber, M., Xu, X., Karlaš, B., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.08904 · Cited by 46 · see citing works
Deep Neural Backdoor in Semi-Supervised Learning: Threats and Countermeasures
Yan, Z., Wu, J., Li, G., Li, S., & Guizani, M. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3116431 · Cited by 46 · see citing works
Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder
Chan, A., Tay, Y., Ong, Y.-S., & Zhang, A. (2020) · Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP) · doi:10.18653/v1/2020.findings-emnlp.373 · Cited by 42 · see citing works
Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attacks
Jia, J., Liu, Y., Cao, X., & Gong, N. Z. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i9.21191 · Cited by 42 · see citing works
Towards Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2020) · arXiv · doi:10.48550/arxiv.2003.04247 · Cited by 38 · see citing works
Backdoor attacks and defenses in feature-partitioned collaborative learning
Liu, Y., Yi, Z., & Chen, T. (2020) · arXiv · doi:10.48550/arxiv.2007.03608 · Cited by 38 · see citing works
Defending against Backdoor Attack on Deep Neural NetworksPreprint
Cheng, H., Xu, K., Liu, S., Chen, P., Zhao, P., & Lin, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.12162 · Cited by 37 · see citing works
Defense against neural trojan attacks: A survey
Kaviani, S., & Sohn, I. (2020) · Neurocomputing · doi:10.1016/j.neucom.2020.07.133 · Cited by 37 · see citing works
Semi-supervised robust training with generalized perturbed neighborhood
Li, Y., Wu, B., Feng, Y., Fan, Y., Jiang, Y., Li, Z., & Xia, S. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2021.108472 · Cited by 36 · see citing works
Self-citationJavaheripi, M., Samragh, M., Fields, G., Javidi, T., & Koushanfar, F. (2020) · doi:10.1145/3400302.3415671 · Cited by 34 · see citing works
Anti-Distillation Backdoor Attacks: Backdoors Can Really Survive in Knowledge Distillation
Ge, Y., Wang, Q., Zheng, B., Zhuang, X., Li, Q., Shen, C. Q., & Wang, C. (2021) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3474085.3475254 · Cited by 34 · see citing works
Mimic and Fool: A Task-Agnostic Adversarial Attack
Chaturvedi, A., & Garain, U. (2020) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2020.2984972 · Cited by 33 · see citing works
Lin, Y., Lee, W., & Celik, Z. B. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.10639 · Cited by 33 · see citing works
Defending against Backdoors in Federated Learning with Robust Learning Rate
Ozdayi, M. S., Kantarcioglu, M., & Gel, Y. R. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i10.17118 · Cited by 30 · see citing works
Open-sourced Dataset Protection via Backdoor WatermarkingPreprint
Li, Y., Zhang, Z., Bai, J., Wu, B., Jiang, Y., & Xia, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.05821 · Cited by 30 · see citing works
Self-citationNNoculation: Broad Spectrum and Targeted Treatment of Backdoored DNNs.Preprint
Veldanda, A. K., Liu, K., Tan, B., Krishnamurthy, P., Khorrami, F., Karri, R., Dolan-Gavitt, B., & Garg, S. (2020) · arXiv (Cornell University) · Cited by 29 · see citing works
Deep Probabilistic Models to Detect Data Poisoning AttacksPreprint
Subedar, M., Ahuja, N. A., Krishnan, R., Ndiour, I., & Tickoo, O. (2019) · arXiv.org · doi:10.48550/arxiv.1912.01206 · Cited by 28 · see citing works
On the Trade-off between Adversarial and Backdoor Robustness
Weng, C., Lee, Y.-T., & Wu, S.-H. (2020) · neural information processing systems · Cited by 27 · see citing works
TrojDRL: Trojan Attacks on Deep Reinforcement Learning AgentsPreprint
Kiourti, P., Wardega, K., Jha, S., & Li, W. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.06638 · Cited by 25 · see citing works
ConFoc: Content-Focus Protection Against Trojan Attacks on Neural NetworksPreprint
Villarreal-Vasquez, M., & Bhargava, B. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.00711 · Cited by 25 · see citing works
Input-Aware Dynamic Backdoor Attack
Nguyen, T. A., & Tran, A. N. (2020) · neural information processing systems · Cited by 25 · see citing works
DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data AugmentationPreprint
Qiu, H., Zeng, Y., Guo, S., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.07006 · Cited by 25 · see citing works
Backdoor Attacks on Facial Recognition in the Physical WorldPreprint
Wenger, E., Passananti, J., Yao, Y., Zheng, H.-T., & Zhao, B. Y. (2020) · arXiv (Cornell University) · Cited by 23 · see citing works
Backdoor Attacks on Federated Meta-Learning
Chen, C.-L., Golubchik, L., & Paolieri, M. (2020) · arXiv · doi:10.48550/arxiv.2006.07026 · Cited by 22 · see citing works
Backdoor Attack through Frequency DomainPreprint
Wang, T., Yao, Y., Xu, F., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.10991 · Cited by 22 · see citing works
Design of intentional backdoors in sequential modelsPreprint
Yang, Z., Iyer, N., Reimann, J., & Virani, N. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09972 · Cited by 21 · see citing works
Scalable Backdoor Detection in Neural Networks
Harikumar, H., Le, V., Rana, S., Bhattacharya, S., Gupta, S., & Venkatesh, S. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-67661-2_18 · Cited by 21 · see citing works
Li, S., Ma, S., Xue, M., & Zhao, B. Z. H. (2022) · Lecture notes in computer science · doi:10.1007/978-3-030-98795-4_13 · Cited by 21 · see citing works
TrojanNet: Embedding Hidden Trojan Horse Models in Neural Networks.Preprint
Guo, C., Wu, R., & Weinberger, K. Q. (2020) · arXiv (Cornell University) · Cited by 19 · see citing works
Exposing Backdoors in Robust Machine Learning Models.Preprint
Soremekun, E., Udeshi, S., Chattopadhyay, S., & Zeller, A. (2020) · arXiv (Cornell University) · Cited by 18 · see citing works
Veldanda, A. K., Liu, K., Tan, B., Krishnamurthy, P., Khorrami, F., Karri, R., Dolan-Gavitt, B., & Garg, S. (2021) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3474369.3486874 · Cited by 18 · see citing works
Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural NetworksPreprint
Chan, A., & Ong, Y.-S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.08040 · Cited by 17 · see citing works
BlockFLA: Accountable Federated Learning via Hybrid Blockchain ArchitecturePreprint
Desai, H. B., Özdayi, M. S., & Kantarcıoğlu, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.07427 · Cited by 17 · see citing works
Adversarial Defense Via Local Flatness Regularization
Xu, J., Li, Y., Jiang, Y., et al. (2020) · Proceedings - International Conference on Image Processing · doi:10.1109/icip40778.2020.9191346 · Cited by 16 · see citing works
Self-citationBackdoor Attacks on the DNN Interpretation System
Fang, S., & Choromanska, A. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i1.19935 · Cited by 16 · see citing works
Backdoor Attack with Sample-Specific Triggers.Preprint
Li, Y., Li, Y., Wu, B., Li, L., He, R., & Lyu, S. (2020) · arXiv (Cornell University) · Cited by 16 · see citing works
Self-citationRed Alarm for Pre-trained Models: Universal Vulnerabilities by Neuron-Level Backdoor Attacks.Preprint
Zhang, Z., Xiao, G., Li, Y., Lv, T. S., Qi, F., Liu, Z., Wang, Y., Jiang, X., & Sun, M. (2021) · arXiv (Cornell University) · Cited by 14 · see citing works
Self-citationHow to Inject Backdoors with Better Consistency: Logit Anchoring on Clean DataPreprint
Zhang, Z., Lyu, L., Wang, W., Sun, L., & Sun, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.01300 · Cited by 14 · see citing works
Dyn-Backdoor: Backdoor Attack on Dynamic Link Prediction
Chen, J., Xiong, H., Zheng, H., et al. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3301673 · Cited by 14 · see citing works
Using Honeypots to Catch Adversarial Attacks on Neural Networks
Shan, S. (2021) · ACM Workshop on Moving Target Defense (MTD) · doi:10.1145/3474370.3485655 · Cited by 13 · see citing works
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13 · see citing works
Umer, M., Dawson, G., & Robi Polikar, A. (2020) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn48605.2020.9206809 · Cited by 13 · see citing works
Understanding the Threats of Trojaned Quantized Neural Network in Model Supply Chains
Pan, X., Zhang, M., Yan, Y., & Yang, M. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485881 · Cited by 13 · see citing works
Backdoor Attacks to Graph Neural NetworksPreprint
Zhang, Z., Jia, J., Wang, B., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.11165 · Cited by 12 · see citing works
Model Agnostic Defence against Backdoor Attacks in Machine LearningPreprint
Udeshi, S., Peng, S., Woo, G., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.02203 · Cited by 12 · see citing works
Poisoning MorphNet for Clean-Label Backdoor Attack to Point CloudsPreprint
Tian, G., Jiang, W., Liu, W., & Mu, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.04839 · Cited by 11 · see citing works
What Do Deep Nets Learn? Class-wise Patterns Revealed in the Input SpacePreprint
Zhao, S., Ma, X., Wang, Y., Bailey, J., Li, B., & Jiang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.06898 · Cited by 10 · see citing works
Self-citationCheck Your Other Door! Creating Backdoor Attacks in the Frequency DomainPreprint
Hammoud, H. A. A. K., & Ghanem, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.05507 · Cited by 8 · see citing works
On Hiding Neural Networks Inside Neural NetworksPreprint
Guo, C., Wu, R., & Weinberger, K. Q. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.10078 · Cited by 7 · see citing works
Quantization Backdoors to Deep Learning Commercial FrameworksPreprint
Ma, H., Qiu, H., Gao, Y., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.09187 · Cited by 7 · see citing works
A Unified Framework for Task-Driven Data Quality ManagementPreprint
Wang, T., Zeng, Y., Jin, M., & Jia, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.05484 · Cited by 5 · see citing works
Deep Feature Space Trojan Attack of Neural Networks by Controlled DetoxificationPreprint
Cheng, S., Liu, Y., Ma, S., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.11212 · Cited by 3 · see citing works
Analyzing Accuracy Loss in Randomized Smoothing DefensesPreprint
Gao, Y., Rosenberg, H., Fawaz, K., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.01595 · Cited by 2 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
Cinà, A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., & Roli, F. (2023) · ACM Computing Surveys · doi:10.1145/3585385 · Cited by 152 · see citing works
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“3) How to Improve the Backdoor Attack Effect During Local Model Training: Backdoor attacks during the local model training phase require attackers to have complete con-trol over compromised clients [39], [49], [242].”
BackgroundInfluentialNguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130 · see citing works
An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences
Guo, W., Tondi, B., & Barni, M. (2022) · IEEE Open Journal of Signal Processing · doi:10.1109/ojsp.2022.3190213 · Cited by 91 · see citing works
Black-box Detection of Backdoor Attacks with Limited Information and Data
Dong, Y., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., & Zhu, J. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01617 · Cited by 92 · see citing works
Threats and Defenses in the Federated Learning Life Cycle: A Comprehensive Survey and Challenges
Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., & Ding, W. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3563537 · Cited by 38 · see citing works
Self-citationBapFL: You can Backdoor Personalized Federated Learning
Ye, T., Chen, C., Wang, Y., Li, X., & Gao, M. (2024) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3649316 · Cited by 17 · see citing works
Chen, C., Wei, L., Zhang, L., Peng, Y., & Ning, J. (2022) · Security and Communication Networks · doi:10.1155/2022/2985308 · Cited by 8 · see citing works
A lightweight backdoor defense framework based on image inpainting
Wei, Y., Gao, H., Wang, Y., Gao, Y., & Liu, H. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.03.052 · Cited by 6 · see citing works
- Authors
- Li, Y., Jiang, Y., Li, Z., & Xia, S.-T.
- Affiliations
- Tsinghua Shenzhen International Graduate School (CN)
- Peng Cheng Laboratory (CN)
- Tencent (China) (CN)
- Venue
- IEEE Transactions on Neural Networks and Learning Systems
- Published
- 2024-01
- Volume
- 35
- Issue
- 1
- Pages
- 5-22
- ISSN
- 2162-237X (ISSN-L)
- 2162-2388
- OpenAlex
- W3042368254
- Cited by
- 682
- References
- 194
- Citations by year
- 2026: 130 · 2025: 185 · 2024: 160 · 2023: 123 · 2022: 44 · 2021: 33 · 2020: 7
- FWCI
- 42.14
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Transactions on Neural Networks and Learning Systems (publishedVersion)
- PubMed (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Funders
- National Natural Science Foundation of China (62171248)
- PCNL Key Project (PCL2021A07)
- Shenzhen Science and Technology Innovation Commission (Research Center for Computer Network
- Tencent Rhino-Bird Research Program
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- backdoor attacks, deep neural network, data poisoning, backdoor defense, adversarial attacks, backdoor triggers, benchmark dataset
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
