Trojaning Attack on Neural Networks
Open accessAbstract
With the fast spread of machine learning techniques, sharing and adopting public machine learning models become very popular.This gives attackers many new opportunities.In this paper, we propose a trojaning attack on neural networks.As the models are not intuitive for human to understand, the attack features stealthiness.Deploying trojaned models can cause various severe consequences including endangering human lives (in applications like autonomous driving).We first inverse the neural network to generate a general trojan trigger, and then retrain the model with reversed engineered training data to inject malicious behaviors to the model.The malicious behaviors are only activated by inputs stamped with the trojan trigger.In our attack, we do not need to tamper with the original training process, which usually takes weeks to months.Instead, it takes minutes to hours to apply our attack.Also, we do not require the datasets that are used to train the model.In practice, the datasets are usually not shared due to privacy or copyright concerns.We use five different applications to demonstrate the power of our attack, and perform a deep analysis on the possible factors that affect the attack.The results show that our attack is highly effective and efficient.The trojaned behaviors can be successfully triggered (with nearly 100% possibility) without affecting its test accuracy for normal input and even with better accuracy on public dataset.Also, it only takes a small amount of time to attack a complex neuron network model.In the end, we also discuss possible defense against such attacks.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
An alternative to assuming an honest server in key distribution is incorporating an additional party or a public bulletin board known to clients and trusted not to collude with the server.
“An alternative to this assumption would be incorporating an additional party or a public bulletin board (see, e.g., [398]) into the model that is known to the clients and trusted to not collude with the server.”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [398]
The Introduction and Possible Defenses sections discuss trojan attacks on neural networks, not key distribution. Searches for a public bulletin board, an additional trusted party, and an honest server found no passage addressing the cited example. (LLM, conf=0.78)
Experimental — accuracy not yet measuredBy sharing the model parameters instead of data, FL introduces new attack surfaces at training time by enhancing the capabilities of the adversary.
“By sharing the model parameters instead of data, FL introduces new attack surfaces at training time by enhancing the capabilities of the adversary [16].”
From Vulnerabilities in federated learning (2021) · cites this paper as [16]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380 · see citing works
Self-citationLabaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,100 · see citing works
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267 · see citing works
Convolutional Neural Networks for Sentence Classification
Kim, Y. (2014) · Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.3115/v1/d14-1181 · Cited by 14,831 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542 · see citing works
“Librispeech: an ASR corpus based on public domain audio books,”
Panayotov, V., Chen, G., Povey, D., & Khudanpur, S. (2015) · 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) · doi:10.1109/icassp.2015.7178964 · Cited by 6,072 · see citing works
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
Practical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495 · see citing works
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,123 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Pang, B., & Lee, L. (2005) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.3115/1219840.1219855 · Cited by 2,153 · see citing works
Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
Xu, W., Evans, D., & Qi, Y. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23198 · Cited by 1,859 · see citing works
Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition
Sharif, M., Bhagavatula, S., Bauer, L., & Reiter, M. K. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978392 · Cited by 1,530 · see citing works
Li, X., & Roth, D. (2002) · International Conference on Computational Linguistics · doi:10.3115/1072228.1072378 · Cited by 1,270 · see citing works
Age and gender classification using convolutional neural networks
Levi, G., & Hassncer, T. (2015) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw.2015.7301352 · Cited by 1,179 · see citing works
Evaluating the Visualization of What a Deep Neural Network Has Learned
Samek, W., Binder, A., Montavon, G., Lapuschkin, S., & Muller, K.-R. (2017) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2016.2599820 · Cited by 1,164 · see citing works
Convolutional Neural Networks for Sentence ClassificationPreprint
Kim, Y. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1408.5882 · Cited by 1,112 · see citing works
The MegaFace Benchmark: 1 Million Faces for Recognition at Scale
Kemelmacher-Shlizerman, I., Seitz, S. M., Miller, D., & Brossard, E. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.527 · Cited by 912 · see citing works
Learn++: an incremental learning algorithm for supervised neural networks
Polikar, R., Upda, L., Upda, S. S., & Honavar, V. (2001) · IEEE Transactions on Systems, Man and Cybernetics, Part C (Applications and Reviews) · doi:10.1109/5326.983933 · Cited by 888 · see citing works
Can machine learning be secure?
Barreno, M., Nelson, B. A., Sears, R., Joseph, A. D., & Tygar, J. D. (2006) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1128817.1128824 · Cited by 852 · see citing works
Age and Gender Estimation of Unfiltered Faces
Eidinger, E., Enbar, R., & Hassner, T. (2014) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2014.2359646 · Cited by 814 · see citing works
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796 · see citing works
Pang, B., & Lee, L. (2005) · arXiv (Cornell University) · doi:10.48550/arxiv.cs/0506075 · Cited by 744 · see citing works
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658 · see citing works
Towards Making Systems Forget with Machine Unlearning
Cao, Y., & Yang, J. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.35 · Cited by 622 · see citing works
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization
Muñoz-González, L., Biggio, B., Demontis, A., Paudice, A., Wongrassamee, V., Lupu, E. C., & Roli, F. (2017) · Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3128572.3140451 · Cited by 549 · see citing works
Visualizing Deep Convolutional Neural Networks Using Natural Pre-images
Mahendran, A., & Vedaldi, A. (2016) · International Journal of Computer Vision · doi:10.1007/s11263-016-0911-8 · Cited by 487 · see citing works
Carlini, N., Mishra, P., Vaidya, T., Zhang, Y., Sherr, M., Shields, C., Wagner, D., & Zhou, W. (2016) · USENIX Security Symposium · Cited by 455 · see citing works
Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection MethodsPreprint
Carlini, N., & Wagner, D. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1705.07263 · Cited by 323 · see citing works
Is feature selection secure against training data poisoning?Preprint
Huang, X. X., Biggio, B., Gavin Brown, B., Fumera, G., Eckert, C. M., & Roli, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.07933 · Cited by 310 · see citing works
Nguyen, A. M., Yosinski, J., & Clune, J. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1602.03616 · Cited by 248 · see citing works
MagNet: a Two-Pronged Defense against Adversarial ExamplesPreprint
Meng, D., & Chen, H. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1705.09064 · Cited by 234 · see citing works
Adversarial Example Defense: Ensembles of Weak Defenses are not Strong
He, W., Wei, J., Chen, X., Carlini, N., & Song, D. X. (2017) · Cited by 221 · see citing works
Latent Factor Guided Convolutional Neural Networks for Age-Invariant Face Recognition
Wen, Y., Li, Z., & Qiao, Y. (2016) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2016.529 · Cited by 162 · see citing works
A Methodology for Formalizing Model-Inversion Attacks
Wu, X., Fredrikson, M., Jha, S., & Naughton, J. F. (2016) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf.2016.32 · Cited by 153 · see citing works
Generative Poisoning Attack Method Against Neural NetworksPreprint
Yang, C., Wu, Q., Li, H. H., & Chen, Y. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1703.01340 · Cited by 141 · see citing works
Poisoning behavioral malware clustering
Biggio, B., Rieck, K., Ariu, D., Wressnegger, C., Corona, I., Giacinto, G., & Roli, F. (2014) · doi:10.1145/2666652.2666666 · Cited by 138 · see citing works
Evading Classifiers by Morphing in the Dark
Dang, H., Huang, Y., & Chang, E.-C. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3133978 · Cited by 110 · see citing works
An incremental-learning neural network for the classification of remote-sensing images
Bruzzone, L., & Prieto, D. F. (1999) · Pattern Recognition Letters · doi:10.1016/s0167-8655(99)00091-4 · Cited by 62 · see citing works
Geigel, A. (2013) · Journal of Computer Security · doi:10.3233/jcs-2012-0460 · Cited by 38 · see citing works
Comparing Incremental Learning Strategies for Convolutional Neural Networks
Lomonaco, V., & Maltoni, D. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-46182-3_15 · Cited by 25 · see citing works
Mishra, A. (2019) · doi:10.1002/9781119556749.ch15 · Cited by 23 · see citing works
Geigel, A. (2014) · NSUWorks (Nova Southeastern University) · doi:10.13140/rg.2.1.4138.7680 · Cited by 5 · see citing works
Flagged first, then by citations
2 of the 49 references couldn’t be matched to a known paper.
Research works printed but not linked: 2
- [26]26. D. Erhan, A. Courville, and Y. Bengio, "Understanding representations learned in deep architectures," Department dInformatique et Recherche Operationnelle, University of Montreal, QC, Canada, Tech. Rep, vol. 1355, 2010.
- [62]62. G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu, "Dolphinattack: Inaudible voice commands," in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS '17. New York, NY, USA: ACM, 2017, pp. 103-117.
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Self-citationExplaining Explanations: An Overview of Interpretability of Machine Learning
Gilpin, L. H., Bau, D., Yuan, B. Z., Bajwa, A., Specter, M., & Kagal, L. (2018) · 2018 IEEE 5th International Conference on Data Science and Advanced Analytics (DSAA) · doi:10.1109/dsaa.2018.00018 · Cited by 2,507 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
A survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999 · see citing works
Verifynet: Secure and verifiable federated learning
Xu, G., Li, H., Liu, S., Yang, K., & Lin, X. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2929409 · Cited by 839 · see citing works
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828 · see citing works
Aldoseri, A., Al‐Khalifa, K. N., & Hamouda, A. M. S. (2023) · Applied Sciences · doi:10.3390/app13127082 · Cited by 838 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Adversarial Attacks and Defenses in Deep Learning
Ren, K., Zheng, T., Qin, Z., & Liu, X. (2020) · Engineering · doi:10.1016/j.eng.2019.12.012 · Cited by 678 · see citing works
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural NetworksPreprint
Shafahi, A., Huang, W., Najibi, M., Suciu, O., Studer, C., Dumitraş, T., & Goldstein, T. (2018) · arXiv (Cornell University) · doi:10.3929/ethz-b-000460348 · Cited by 626 · see citing works
Protecting Intellectual Property of Deep Neural Networks with Watermarking
Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M. P., Huang, H., & Molloy, I. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196550 · Cited by 556 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
Self-citationPrivacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Ditto: Fair and Robust Federated Learning Through PersonalizationPreprint
Li, T., Hu, S., Beirami, A., & Smith, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.04221 · Cited by 496 · see citing works
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018) · arXiv · doi:10.48550/arxiv.1811.03728 · Cited by 485 · see citing works
Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243834 · Cited by 475 · see citing works
When Machine Learning Meets Privacy: A Survey and Outlook
Liu, B., Ding, M., Shaham, S., Rahayu, W., Farokhi, F., & Lin, Z. (2022) · ACM Computing Surveys · doi:10.1145/3436755 · Cited by 455 · see citing works
ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation
Liu, Y., Lee, W., Tao, G., Ma, S., Aafer, Y., & Zhang, X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363216 · Cited by 419 · see citing works
Self-citationTurning Your Weakness Into a Strength: Watermarking Deep Neural Networks by BackdooringPreprint
Adi, Y., Baum, C., Cissé, M., Benny Pinkas, B., & Keshet, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.04633 · Cited by 395 · see citing works
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning
Barni, M., Kallas, K., & Tondi, B. (2019) · Proceedings - International Conference on Image Processing · doi:10.1109/icip.2019.8802997 · Cited by 360 · see citing works
Weight Poisoning Attacks on Pretrained Models
Kurita, K., Michel, P., & Neubig, G. (2020) · Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/2020.acl-main.249 · Cited by 354 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
Adversarial frontier stitching for remote neural network watermarking
Merrer, E. L., Pérez, P., & Trédan, G. (2019) · Neural Computing and Applications · doi:10.1007/s00521-019-04434-z · Cited by 342 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
VeriFL: Communication-Efficient and Fast Verifiable Aggregation for Federated Learning
Guo, X., Liu, Z., Li, J., Gao, J., Hou, B., Dong, C., & Baker, T. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3043139 · Cited by 319 · see citing works
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/647 · Cited by 314 · see citing works
Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
Li, S., Xue, M., Zhao, B. Z. H., Zhu, H., & Zhang, X. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3021407 · Cited by 325 · see citing works
Self-citationAdvances in Adversarial Attacks and Defenses in Computer Vision: A Survey
Akhtar, N., Mian, A. S., Kardan, N., & Shah, M. (2021) · IEEE Access · doi:10.1109/access.2021.3127960 · Cited by 319 · see citing works
A Backdoor Attack Against LSTM-Based Text Classification Systems
Dai, J., Chen, C., & Li, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2941376 · Cited by 298 · see citing works
Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295 · see citing works
Privacy and Security Issues in Deep Learning: A Survey
Liu, X., Xie, L., Wang, Y., Zou, J., Xiong, J., Ying, Z., & Vasilakos, A. V. (2020) · IEEE Access · doi:10.1109/access.2020.3045078 · Cited by 285 · see citing works
Bit-Flip Attack: Crushing Neural Network With Progressive Bit Search
Rakin, A. S., He, Z., & Fan, D. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00130 · Cited by 275 · see citing works
Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction
Liang, B., Li, H., Su, M., Li, X., Shi, W., & Wang, X. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2018.2874243 · Cited by 274 · see citing works
Detecting AI Trojans Using Meta Neural Analysis
Xu, X., Wang, Q., Li, H., Borisov, N., Gunter, C. A., & Li, B. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00034 · Cited by 278 · see citing works
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
Chou, E., Tramer, F., & Pellegrino, G. (2020) · 2020 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00025 · Cited by 281 · see citing works
Qayyum, A., Usama, M., Qadir, J., & Al-Fuqaha, A. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2975048 · Cited by 257 · see citing works
Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Vulnerabilities in federated learning
Bouacida, N., & Mohapatra, P. (2021) · IEEE Access · doi:10.1109/access.2021.3075203 · Cited by 248 · see citing works
Clean-Label Backdoor Attacks on Video Recognition Models
Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., & Jiang, Y. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01445 · Cited by 247 · see citing works
NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
Ma, S., Liu, Y., Tao, G., Lee, W., & Zhang, X. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23415 · Cited by 247 · see citing works
Self-citationMiller, D. J., Xiang, Z. J., & Kesidis, G. (2020) · Proceedings of the IEEE · doi:10.1109/jproc.2020.2970615 · Cited by 238 · see citing works
WaNet -- Imperceptible Warping-based Backdoor AttackPreprint
Nguyen, A., & Tran, A. N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.10369 · Cited by 296 · see citing works
Dynamic Backdoor Attacks Against Machine Learning Models
Salem, A., Wen, R., Michael Backes, A., Ma, S., & Zhang, Y. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00049 · Cited by 227 · see citing works
Self-citationBackdoor Attacks Against Deep Learning Systems in the Physical World
Wenger, E., Passananti, J., Bhagoji, A. N., Yao, Y., Zheng, H.-T., & Zhao, B. Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00614 · Cited by 233 · see citing works
Input-Aware Dynamic Backdoor AttackPreprint
Nguyen, A., & Tran, A. T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.08138 · Cited by 221 · see citing works
Γιάνναρος, Α., Karras, A., Theodorakopoulos, L., Karras, C., Kranias, P., Schizas, N., Kalogeratos, G., & Tsolis, D. K. (2023) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp3030025 · Cited by 215 · see citing works
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Doan, K., Lao, Y., Zhao, W., & Li, P. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01175 · Cited by 211 · see citing works
Neural Network Inversion in Adversarial Setting via Background Knowledge Alignment
Yang, Z., Zhang, J., Chang, E., & Liang, Z. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354261 · Cited by 246 · see citing works
Backdoor Attacks to Graph Neural Networks
Zhang, Z., Jia, J., Wang, B., & Gong, N. Z. (2021) · Proceedings of the 26th ACM Symposium on Access Control Models and Technologies · doi:10.1145/3450569.3463560 · Cited by 220 · see citing works
Composite Backdoor Attack for Deep Neural Network by Mixing Existing Benign Features
Lin, J., Xu, L., Liu, Y., & Zhang, X. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3423362 · Cited by 202 · see citing works
Self-citationONION: A Simple and Effective Defense Against Textual Backdoor Attacks
Qi, F., Chen, Y., Li, M., Yao, Y., Liu, Z., & Sun, M. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.752 · Cited by 222 · see citing works
TBT: Targeted Neural Network Attack With Bit Trojan
Rakin, A. S., He, Z., & Fan, D. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01321 · Cited by 200 · see citing works
BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements
Chen, X., Salem, A., Chen, D., Michael Backes, A., Ma, S., Shen, Q., Wu, Z., & Zhang, Y. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485837 · Cited by 221 · see citing works
Self-citationMembership Leakage in Label-Only Exposures
Li, Z., & Zhang, Y. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484575 · Cited by 226 · see citing works
DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection
Rieger, P., Nguyen, T. D., Miettinen, M., & Sadeghi, A.-R. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23156 · Cited by 202 · see citing works
DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
Qiu, H., Zeng, Y., Guo, S., Zhang, T., Meikang Qiu, A., & Thuraisingham, B. M. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453108 · Cited by 196 · see citing works
Machine Learning Security: Threats, Countermeasures, and Evaluations
Xue, M., Yuan, C., Wu, H., Zhang, Y., & Liu, W. (2020) · IEEE Access · doi:10.1109/access.2020.2987435 · Cited by 197 · see citing works
Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defenses
Deng, Y., Zhang, T., Lou, G., Zheng, X., Jin, J., & Han, Q. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3071405 · Cited by 195 · see citing works
Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs
Kolouri, S., Saha, A., Pirsiavash, H., & Hoffmann, H. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00038 · Cited by 190 · see citing works
Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications
Flowers, B., Buehrer, R. M., & Headley, W. C. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2934069 · Cited by 184 · see citing works
A training-integrity privacy-preserving federated learning scheme with trusted execution environment
Chen, Y., Luo, F., Li, T., Xiang, T., Liu, Z., & Li, J. (2020) · Information Sciences · doi:10.1016/j.ins.2020.02.037 · Cited by 188 · see citing works
A survey on deep learning for cybersecurity: Progress, challenges, and opportunities
Macas, M., Wu, C., & Fuertes, W. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109032 · Cited by 192 · see citing works
A Little Is Enough: Circumventing Defenses For Distributed LearningPreprint
Baruch, M., Baruch, G., & Goldberg, Y. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.06156 · Cited by 184 · see citing works
When Machine Unlearning Jeopardizes Privacy
Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484756 · Cited by 195 · see citing works
Model-Reuse Attacks on Deep Learning Systems
Ji, Y., Zhang, X., Ji, S., Luo, X., & Wang, T. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243757 · Cited by 174 · see citing works
Self-citationBlind Backdoors in Deep Learning ModelsPreprint
Bagdasaryan, E., & Shmatikov, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.03823 · Cited by 175 · see citing works
An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks
Tang, R., Du, M., Liu, N., Yang, F., & Hu, X. (2020) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3394486.3403064 · Cited by 172 · see citing works
BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning
Jia, J., Liu, Y., & Gong, N. Z. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833644 · Cited by 171 · see citing works
Self-citationAdversarial machine learning :
Vassilev, A., Oprea, A., Fordyce, A. J., & Anderson, H. S. (2024) · doi:10.6028/nist.ai.100-2e2023 · Cited by 193 · see citing works
Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., & Sun, M. (2021) · doi:10.18653/v1/2021.acl-long.37 · Cited by 190 · see citing works
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
Costa, J. C., Roxo, T., Proença, H. P. M. C., & Inácio, P. R. M. (2024) · IEEE Access · doi:10.1109/access.2024.3395118 · Cited by 168 · see citing works
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive ReviewPreprint
Gao, Y., Doan, B. G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, ., & Kim, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.10760 · Cited by 207 · see citing works
Self-citationWhen Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning AttacksPreprint
Suciu, O., Mărginean, R., Kaya, Y., Daumé, H., & Dumitraş, T. (2018) · arXiv (Cornell University) · Cited by 150 · see citing works
Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
Fang, M., Gong, N. Z., & Liu, J. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3380072 · Cited by 151 · see citing works
Macas, M., Wu, C., & Fuertes, W. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.122223 · Cited by 160 · see citing works
Practical Hidden Voice Attacks against Speech and Speaker Recognition Systems
Abdullah, H., García, W., Peeters, C., Traynor, P., Butler, K. R. B., & Wilson, J. N. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23362 · Cited by 142 · see citing works
Adversarial XAI Methods in Cybersecurity
Kuppa, A., & Le‐Khac, N. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3117075 · Cited by 146 · see citing works
Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification
Cheng, S., Liu, Y., Ma, S., & Zhang, X. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i2.16201 · Cited by 137 · see citing works
Self-citation(2019) · doi:10.1145/3474085.3475591 · Cited by 134 · see citing works
Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer
Qi, F., Chen, Y., Zhang, X., Li, M., Liu, Z., & Sun, M. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.374 · Cited by 143 · see citing works
Self-citationBig Data Analytics for Large-scale Wireless Networks
Dai, H., Wong, R. C.-W., Wang, H. H., Zheng, Z., & Vasilakos, A. V. (2019) · ACM Computing Surveys · doi:10.1145/3337065 · Cited by 131 · see citing works
STRIP: A Defence Against Trojan Attacks on Deep Neural NetworksPreprint
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.06531 · Cited by 127 · see citing works
TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI SystemsPreprint
Guo, W., Wang, L., Xing, X., Du, M., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.01763 · Cited by 154 · see citing works
Girdhar, M., Hong, J., & Moore, J. (2023) · IEEE Open Journal of Vehicular Technology · doi:10.1109/ojvt.2023.3265363 · Cited by 126 · see citing works
On the Suitability of Lp-Norms for Creating and Preventing Adversarial Examples
Sharif, M., Bauer, L., & Reiter, M. K. (2018) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw.2018.00211 · Cited by 128 · see citing works
Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination DetectionPreprint
Tang, D., Wang, X., Tang, H., & Zhang, K. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.00686 · Cited by 121 · see citing works
Poison Ink: Robust and Invisible Backdoor Attack
Zhang, J., Chen, D., Huang, Q., Liao, J., Zhang, W., Feng, H., Hua, G., & Yu, N. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3201472 · Cited by 121 · see citing works
Adversarial Neuron Pruning Purifies Backdoored Deep ModelsPreprint
Wu, D., & Wang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14430 · Cited by 122 · see citing works
Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
Wang, R., Zhang, G., Liu, S., Chen, P., Xiong, J., & Wang, M. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58592-1_14 · Cited by 116 · see citing works
Ünal, D., Hammoudeh, M. A. A., Khan, M. A., Abuarqoub, A., Epiphaniou, G., & Hamila, R. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102393 · Cited by 116 · see citing works
Tian, Y., Wang, S., Xiong, J., Bi, R., Zhou, Z., & Bhuiyan, M. Z. A. (2023) · IEEE Transactions on Computational Biology and Bioinformatics · doi:10.1109/tcbb.2023.3243932 · Cited by 123 · see citing works
Chen, C., & Dai, J. (2021) · Neurocomputing · doi:10.1016/j.neucom.2021.04.105 · Cited by 114 · see citing works
Physical Adversarial Attack Meets Computer Vision: A Decade Survey
Wei, H., Tang, H., Jia, X., Wang, Z., Yu, H., Li, Z., Satoh, S., Gool, L. V., & Wang, Z. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3430860 · Cited by 115 · see citing works
- Authors
- Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X.
- Affiliations
- Purdue University West Lafayette (US)
- Nanjing University (CN)
- Venue
- Proceedings 2018 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2018
- OpenAlex
- W2753783305
- Cited by
- 1,270
- References
- 49
- Citations by year
- 2026: 114 · 2025: 193 · 2024: 206 · 2023: 184 · 2022: 149 · 2021: 185 · 2020: 153 · 2019: 59 · 2018: 26 · 2017: 1
- FWCI
- 43.17
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- public-domain
- Locations
- Network and Distributed System Security Symposium (publishedVersion, public-domain)
- Rutgers University Community Repository (Rutgers University) (submittedVersion)
- Purdue e-Pubs (Purdue University System) (submittedVersion)
- Funders
- National Science Foundation (1748764, 1320444, 1409668)
- Defense Advanced Research Projects Agency (FA-8650-15-C-7562, FA8650-15C)
- Office of Naval Research (N000141712947, N000141410468)
- Sandia National Laboratories (1701331)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- neural network security, stealthy attacks, model poisoning, autonomous driving safety
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
