The DOI matches its Crossref record; 47 of the 49 references it cites were found in a registry or an index.
Trojaning Attack on Neural Networks
Open accessAbstract
With the fast spread of machine learning techniques, sharing and adopting public machine learning models become very popular.This gives attackers many new opportunities.In this paper, we propose a trojaning attack on neural networks.As the models are not intuitive for human to understand, the attack features stealthiness.Deploying trojaned models can cause various severe consequences including endangering human lives (in applications like autonomous driving).We first inverse the neural network to generate a general trojan trigger, and then retrain the model with reversed engineered training data to inject malicious behaviors to the model.The malicious behaviors are only activated by inputs stamped with the trojan trigger.In our attack, we do not need to tamper with the original training process, which usually takes weeks to months.Instead, it takes minutes to hours to apply our attack.Also, we do not require the datasets that are used to train the model.In practice, the datasets are usually not shared due to privacy or copyright concerns.We use five different applications to demonstrate the power of our attack, and perform a deep analysis on the possible factors that affect the attack.The results show that our attack is highly effective and efficient.The trojaned behaviors can be successfully triggered (with nearly 100% possibility) without affecting its test accuracy for normal input and even with better accuracy on public dataset.Also, it only takes a small amount of time to attack a complex neuron network model.In the end, we also discuss possible defense against such attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“An alternative to this assumption would be incorporating an additional party or a public bulletin board (see, e.g., [398]) into the model that is known to the clients and trusted to not collude with the server.”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [398]
Experimental — accuracy not yet measuredIn the citing paper
“By sharing the model parameters instead of data, FL introduces new attack surfaces at training time by enhancing the capabilities of the adversary [16].”
From Vulnerabilities in federated learning (2021) · cites this paper as [16]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380
Self-citationLabaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,119
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267
Convolutional Neural Networks for Sentence Classification
Kim, Y. (2014) · Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.3115/v1/d14-1181 · Cited by 14,831
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
“Librispeech: an ASR corpus based on public domain audio books,”
Panayotov, V., Chen, G., Povey, D., & Khudanpur, S. (2015) · 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) · doi:10.1109/icassp.2015.7178964 · Cited by 6,072
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445
Flagged first, then by citations
2 of the 49 references couldn’t be matched to a known paper.
Research works printed but not linked: 2
- [26]26. D. Erhan, A. Courville, and Y. Bengio, "Understanding representations learned in deep architectures," Department dInformatique et Recherche Operationnelle, University of Montreal, QC, Canada, Tech. Rep, vol. 1355, 2010.
- [62]62. G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu, "Dolphinattack: Inaudible voice commands," in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS '17. New York, NY, USA: ACM, 2017, pp. 103-117.
Cited by
Sorted by citations
Items 501–600 of 1,001
Hijack Vertical Federated Learning Models as One Party
Qiu, P., Zhang, X., Ji, S., Li, C., Pu, Y., Yang, X., & Wang, T. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3358081 · Cited by 19
Self-citationChillara, A. K., Saxena, P., Maiti, R. R., Gupta, M., Kondapalli, R., Zhang, Z., & Kesavan, K. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00834-y · Cited by 12
BIC-Based Mixture Model Defense Against Data Poisoning Attacks on Classifiers: A Comprehensive Study
Li, X., Miller, D. J., Xiang, Z. J., & Kesidis, G. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3365548 · Cited by 12
Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks
Wang, T., Yao, Y., Xu, F., Xu, M., An, S., & Wang, T. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i1.27780 · Cited by 12
Physical Backdoor: Towards Temperature-Based Backdoor Attacks in the Physical World
Yin, W., Lou, J., Zhou, P., Xie, Y., Feng, D., Sun, Y., Zhang, T., & Sun, L. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.01210 · Cited by 12
A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks
Li, Z., Sun, H., Xia, P., Xia, B., Rui, X., Zhang, W., Guo, Q., Fu, Z., & Li, B. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3472510 · Cited by 17
BadMerging: Backdoor Attacks Against Model Merging
Zhang, J., Chi, J., Li, Z., Cai, K., Zhang, Y., & Tian, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690284 · Cited by 26
Nullius in Explanans: an ethical risk assessment for explainable AI
Nannini, L., Huyskes, D., Panai, E., Pistilli, G., & Tartaro, A. (2024) · Ethics and Information Technology · doi:10.1007/s10676-024-09800-7 · Cited by 16
Mutual Information Guided Backdoor Mitigation for Pre-Trained Encoders
Han, T., Sun, W., Ding, Z., Fang, C., Qian, H., Li, J., Chen, Z., & Zhang, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3550062 · Cited by 12
Self-citationSaber, A. M., Farag, H. E. Z., Youssef, A., & Kundur, D. (2025) · IEEE Transactions on Instrumentation and Measurement · doi:10.1109/tim.2025.3589705 · Cited by 12
FooBaR: Fault Fooling Backdoor Attack on Neural Network Training
Breier, J., Hou, X., Ochoa, M., & Solano, J. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3166671 · Cited by 13
Zhang, X., Jin, Y., Wang, T., Lou, J., & Chen, X. (2022) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3503161.3548065 · Cited by 13
Self-citationEmbedding and extraction of knowledge in tree ensemble classifiers
Huang, W., Zhao, X., & Huang, X. (2021) · Machine Learning · doi:10.1007/s10994-021-06068-6 · Cited by 14
Customizing Triggers with Concealed Data Poisoning.Preprint
Wallace, E., Zhao, T. Z., Feng, S., & Singh, S. (2020) · arXiv (Cornell University) · Cited by 12
Federated Multi-Task Learning for Competing Constraints.Preprint
Tian, L., Hu, S., Beirami, A., & Smith, V. (2020) · arXiv (Cornell University) · Cited by 12
Covert Channel Attack to Federated Learning Systems.Preprint
Costa, G., Pinelli, F., Soderi, S., & Tolomei, G. (2021) · arXiv (Cornell University) · Cited by 12
Adversarial Perturbation Attacks on ML-based CAD
Liu, K., Yang, H., Ma, Y., Tan, B., Yu, B., Young, E. F. Y., Karri, R., & Garg, S. (2020) · ACM Transactions on Design Automation of Electronic Systems · doi:10.1145/3408288 · Cited by 36
DeepDIST: A Black-Box Anti-Collusion Framework for Secure Distribution of Deep Models
Cheng, H., Li, X., Wang, H., Zhang, X., Liu, X., Wang, M., & Li, F. (2023) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2023.3284914 · Cited by 11
Self-citationPhantomSound: Black-Box, Query-Efficient Audio Adversarial Attack via Split-Second Phoneme Injection
Guo, H., Wang, G., Wang, Y., Chen, B., Yan, Q., & Li, X. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607240 · Cited by 12
Stealthy dynamic backdoor attack against neural networks for image classification
Dong, L., Qiu, J., Fu, Z., Chen, L., Cui, X., & Shen, Z. (2023) · Applied Soft Computing · doi:10.1016/j.asoc.2023.110993 · Cited by 11
Poison-Tolerant Collaborative Filtering Against Poisoning Attacks on Recommender Systems
Baker, T., Li, T., Jia, J., Zhang, B., Tan, C., & Zomaya, A. Y. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3354462 · Cited by 13
Multi-Turn Hidden Backdoor in Large Language Model-powered Chatbot Models
Chen, B., Ivanov, N., Wang, G., & Yan, Q. (2024) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3634737.3656289 · Cited by 14
OdScan: Backdoor Scanning for Object Detection Models
Cheng, S., Shen, G., Tao, G., Zhang, K., Zhang, Z., An, S., Xu, X., Li, Y., Ma, S., & Zhang, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00119 · Cited by 15
Self-citationLotus: Evasive and Resilient Backdoor Attacks through Sub-Partitioning
Cheng, S., Tao, G., Liu, Y., Shen, G., An, S., Feng, S., Xu, X., Zhang, K., Ma, S., & Zhang, X. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02342 · Cited by 12
Self-citationMachine Learning Security: Threat Model, Attacks, and Challenges
Koball, C., Wang, Y., Rimal, B. P., & Vaidyan, V. M. (2024) · Computer · doi:10.1109/mc.2024.3396357 · Cited by 11
Invisible backdoor attack with attention and steganography
Chen, W., Xu, X., Wang, X., Zhou, H., Li, Z., & Chen, Y. (2024) · Computer Vision and Image Understanding · doi:10.1016/j.cviu.2024.104208 · Cited by 12
BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning
Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., Zhu, M., Wang, R., Liu, L., & Shen, C. (2025) · International Journal of Computer Vision · doi:10.1007/s11263-025-02447-x · Cited by 16
BAIT: Large Language Model Backdoor Scanning by Inverting Attack Target
Shen, G., Cheng, S., Zhang, Z., Tao, G., Zhang, K., Guo, H., Yan, L., Jin, X., An, S., Ma, S., et al. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00103 · Cited by 19
Self-citationUse Procedural Noise to Achieve Backdoor Attack
Chen, X., Ma, Y., & Lu, S. (2021) · IEEE Access · doi:10.1109/access.2021.3110239 · Cited by 14
Discovery of AI/ML Supply Chain Vulnerabilities within Automotive Cyber-Physical Systems
Williams, D., Clark, C., McGahan, R., Potteiger, B., Cohen, D., & Musau, P. (2022) · IEEE International Conference on Assured Autonomy (ICAA) · doi:10.1109/icaa52185.2022.00020 · Cited by 11
Zero-Trust for the System Design Lifecycle
Bossuyt, D. L. V., Hale, B., Arlitt, R. M., & Papakonstantinou, N. (2023) · Journal of Computing and Information Science in Engineering · doi:10.1115/1.4062597 · Cited by 11
Defending against Insertion-based Textual Backdoor Attacks via Attribution
Li, J., Wu, Z., Ping, W., Xiao, C., & Vydiswaran, V. G. V. (2023) · Findings of the Association for Computational Linguistics: ACL (Findings of ACL) · doi:10.18653/v1/2023.findings-acl.561 · Cited by 15
Detecting Trojaned DNNs Using Counterfactual Attributions
Sikka, K., Sur, I., Roy, A., Divakaran, A., & Jha, S. (2023) · IEEE International Conference on Assured Autonomy (ICAA) · doi:10.1109/icaa58325.2023.00019 · Cited by 15
Data Poisoning Attack on Deep Neural Network and Some Defense Methods
Dang, T. K., Tran-Truong, P. T., & Tran, P. T. (2020) · International Conference on Advanced Computing and Applications (ACOMP) · doi:10.1109/acomp50827.2020.00010 · Cited by 12
Decamouflage: A Framework to Detect Image-Scaling Attacks on CNN
Kim, B., Abuadbba, A., Gao, Y., Zheng, Y., Ahmed, M. E., Nepal, ., & Kim, H. (2021) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48987.2021.00023 · Cited by 12
TOP: Backdoor Detection in Neural Networks via Transferability of PerturbationPreprint
Huster, T. P., & Ekwedike, E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.10274 · Cited by 18
Accumulative Poisoning Attacks on Real-time DataPreprint
Pang, T., Yang, X. H., Dong, Y., Su, H., & Zhu, J. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.09993 · Cited by 14
A Synergetic Attack against Neural Network Classifiers combining Backdoor and Adversarial Examples
Liu, G., Khalil, I., Khreishah, A., & Phan, N. (2021) · 2021 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata52589.2021.9671964 · Cited by 11
Test-Time Detection of Backdoor Triggers for Poisoned Deep Neural Networks
Li, X., Xiang, Z., Miller, D. J., & Kesidis, G. (2022) · ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) · doi:10.1109/icassp43922.2022.9746573 · Cited by 11
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13
PublicCheck: Public Integrity Verification for Services of Run-time Deep Models
Wang, S., Abuadbba, A., Agarwal, S., Moore, K., Sun, R., Xue, M., Nepal, ., Camtepe, S. A., & Kanhere, S. S. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179380 · Cited by 11
A Survey of Security Protection Methods for Deep Learning Model
Peng, H., Bao, S., & Li, L. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3314398 · Cited by 11
The Perils of Learning From Unlabeled Data: Backdoor Attacks on Semi-supervised Learning
Shejwalkar, V., Lyu, L., & Houmansadr, A. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00436 · Cited by 12
Energy-Adaptive and Robust Monitoring for Smart Farms Based on Solar-Powered Wireless Sensors
Chen, D., Zhang, Q., Chen, I.-R., Ha, D. S., & Cho, J.-H. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3409525 · Cited by 10
Pre-trained Trojan Attacks for Visual Recognition
Liu, A., Liu, X., Zhang, X., Xiao, Y., Zhou, Y., Liang, S., Wang, J., Cao, X., & Tao, D. (2025) · International Journal of Computer Vision · doi:10.1007/s11263-024-02333-y · Cited by 34
Self-citationA Systematic Literature Review of Machine Unlearning Techniques in Neural Networks
Cevallos, I., Benalcázar, M. E., Caraguay, Á. L. V., Zea, J. A., & López, L. I. B. (2025) · Computers · doi:10.3390/computers14040150 · Cited by 10
Hanif, M. A., Chattopadhyay, N., Ouni, B., & Shafique, M. (2025) · IEEE Access · doi:10.1109/access.2025.3571995 · Cited by 12
JailbreakLens : Visual Analysis of Jailbreak Attacks Against Large Language Models
Feng, Y., Chen, Z., Kang, Z., Wang, S., Tian, H., Zhang, W., Zhu, M., & Chen, W. (2025) · IEEE Transactions on Visualization and Computer Graphics · doi:10.1109/tvcg.2025.3575694 · Cited by 19
Minimal Multi-Layer Modifications of Deep Neural Networks
Refaeli, I., & Katz, G. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-21222-2_4 · Cited by 10
Robust backdoor injection with the capability of resisting network transfer
Feng, L., Li, S., Qian, Z., & Zhang, X. (2022) · Information Sciences · doi:10.1016/j.ins.2022.08.123 · Cited by 10
Self-citationNeural networks memorise personal information from one sample
Hartley, J., Sanchez, P. P., Haider, F., & Tsaftaris, S. A. (2023) · Scientific Reports · doi:10.1038/s41598-023-48034-3 · Cited by 10
Feature Importance-Based Backdoor Attack in NSL-KDD
Jang, J., An, Y., Kim, D., & Choi, D. (2023) · Electronics · doi:10.3390/electronics12244953 · Cited by 15
DeepVenom: Persistent DNN Backdoors Exploiting Transient Weight Perturbations in Memories
Cai, K., Chowdhuryy, M. H. I., Zhang, Z., & Yao, F. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00223 · Cited by 12
Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognition
Hammoud, H. A. A. K., Liu, S., Alkhrashi, M., AlBalawi, F., & Ghanem, B. (2024) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw63382.2024.00348 · Cited by 15
Odyssey: Creation, Analysis and Detection of Trojan Models
Edraki, M., Karim, N., Rahnavard, N., Mian, A. S., & Shah, M. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108407 · Cited by 12
Detecting Backdoor Attacks against Point Cloud Classifiers
Xiang, Z. J., Miller, D. J., Chen, S., Li, X., & Kesidis, G. (2022) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp43922.2022.9747194 · Cited by 10
Verifying Neural Networks Against Backdoor Attacks
Pham, L. H., & Sun, J. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-13185-1_9 · Cited by 13
Adversarial Learning in the Cyber Security DomainPreprint
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2020) · arXiv (Cornell University) · Cited by 10
TAD: Trigger Approximation based Black-box Trojan Detection for AIPreprint
Zhang, X., Chen, H., & Koushanfar, F. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.01815 · Cited by 10
Self-citationYang, W., Li, L., Zhang, Z., Ren, X., Sun, X. S., & He, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.15543 · Cited by 10
DistFL: Distribution-aware Federated Learning for Mobile ScenariosPreprint
Liu, B., Cai, Y., Zhang, Z., Li, Y., Wang, L., Li, D., Guo, Y., & Chen, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.11619 · Cited by 10
Ma, B., Zhao, C., Wang, D., & Meng, B. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103212 · Cited by 9
A stealthy and robust backdoor attack via frequency domain transform
Hou, R., Huang, T., Yan, H., Ke, L., & Tang, W. (2023) · World Wide Web · doi:10.1007/s11280-023-01153-3 · Cited by 9
FDNet: Imperceptible backdoor attacks via frequency domain steganography and negative sampling
Dong, L., Fu, Z., Chen, L., Ding, H., Zheng, C., Cui, X., & Shen, Z. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127546 · Cited by 9
Zhu, L., Ning, R., Jiang, L., Xin, C., & Wu, H. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i7.28611 · Cited by 9
A novel robust black-box fingerprinting scheme for deep classification neural networks
Mo, M., Wang, C., Guo, Q., Bian, S., Huang, Q., & Zhang, X. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124201 · Cited by 10
Self-citationAnti-Backdoor Model: A Novel Algorithm to Remove Backdoors in a Non-Invasive Way
Chen, C., Hong, H., Xiang, T., & Xie, M. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3436508 · Cited by 10
Trojan Attacks and Countermeasures on Deep Neural Networks from Life-Cycle Perspective: A Review
Jin, L., Wen, X., Jiang, W., Zhan, J., & Zhou, X. (2025) · ACM Computing Surveys · doi:10.1145/3727640 · Cited by 14
Feng, Y., & Qian, Q. (2025) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2025.3555566 · Cited by 10
Eliminating Backdoors in Neural Code Models for Secure Code Understanding
Sun, W., Chen, Y., Fang, C., Feng, Y., Xiao, Y., Guo, A., Zhang, Q., Chen, Z., Xu, B., & Liu, Y. (2025) · Proceedings of the ACM on software engineering. · doi:10.1145/3715782 · Cited by 15
Self-citationFLARE: Toward Universal Dataset Purification Against Backdoor Attacks
Hou, L., Luo, W., Hua, Z., Chen, S., Zhang, L. Y., & Li, Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3581719 · Cited by 11
Autonomous Driving Security: A Comprehensive Threat Model of Attacks and Mitigation Strategies
Hoque, M. A., & Hasan, R. (2022) · IEEE World Forum on Internet of Things (WF-IoT) · doi:10.1109/wf-iot54382.2022.10152219 · Cited by 9
DBIA: Data-Free Backdoor Attack Against Transformer Networks
Lv, P., Ma, H., Zhou, J., Liang, R., Chen, K., Zhang, S., & Yang, Y. (2023) · IEEE International Conference on Multimedia and Expo (ICME) · doi:10.1109/icme55011.2023.00479 · Cited by 9
Yang, D., Luo, S., Zhou, J., Pan, L., Yang, X., & Xing, J. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119743 · Cited by 9
Model-Contrastive Learning for Backdoor Elimination
Yue, Z., Xia, J., Ling, Z., Hu, M., Wang, T., Wei, X. H., & Chen, M. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612415 · Cited by 12
Learning a robust foundation model against clean-label data poisoning attacks at downstream tasks
Zhou, T., Yan, H., Han, B., Liu, L., & Zhang, J. (2023) · Neural Networks · doi:10.1016/j.neunet.2023.10.034 · Cited by 10
Yin, H., Yin, Z., Gao, Z., Su, H., Zhang, X., & Luo, B. (2023) · Journal of Information and Intelligence · doi:10.1016/j.jiixd.2023.10.006 · Cited by 9
Self-citationMitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlation
He, X., Xu, Q., Wang, J., Rubinstein, B. I. P., & Cohn, T. (2023) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2023.emnlp-main.60 · Cited by 19
Temporal-Distributed Backdoor Attack against Video Based Action Recognition
Li, X., Wang, S., Huang, R., Gowda, M., & Kesidis, G. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i4.28104 · Cited by 9
Embedding Backdoors as the Facial Features
He, C., Xue, M., Wang, J., & Liu, W. (2020) · ACM Turing Celebration Conference - China (ACM TURC) · doi:10.1145/3393527.3393567 · Cited by 9
Dynamic Backdoors with Global Average Pooling
Koffas, S., Picek, S., & Conti, M. (2022) · IEEE International Conference on Artificial Intelligence Circuits and Systems (AICAS) · doi:10.1109/aicas54282.2022.9869920 · Cited by 10
Identifying a Training-Set Attack's Target Using Renormalized Influence Estimation
Hammoudeh, Z., & Lowd, D. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3559335 · Cited by 19
WAFFLE: Watermarking in Federated LearningPreprint
Atli, B. G., Xia, Y., Marchal, S., & Asokan, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.07298 · Cited by 9
What Do Deep Nets Learn? Class-wise Patterns Revealed in the Input SpacePreprint
Zhao, S., Ma, X., Wang, Y., Bailey, J., Li, B., & Jiang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.06898 · Cited by 13
Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word SubstitutionPreprint
Qi, F., Yao, Y., Xu, S., Liu, Z., & Sun, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.06361 · Cited by 9
Detecting Scene-Plausible Perceptible Backdoors in Trained DNNs Without Access to the Training Set
Xiang, Z., Miller, D. J., Wang, H., & Kesidis, G. (2021) · Neural Computation · doi:10.1162/neco_a_01376 · Cited by 8
Beating Backdoor Attack at Its Own Game
Liu, M., Sangiovanni-Vincentelli, A. L., & Yue, X. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00426 · Cited by 11
Invisible Intruders: Label-Consistent Backdoor Attack Using Re-Parameterized Noise Trigger
Wang, B., Yu, F., Wei, F., Li, Y., & Wang, W. (2024) · IEEE Transactions on Multimedia · doi:10.1109/tmm.2024.3412388 · Cited by 9
Self-citationEfficient Method for Robust Backdoor Detection and Removal in Feature Space Using Clean Data
Vršnak, D., Subašić, M., & Lončarić, S. (2025) · IEEE Access · doi:10.1109/access.2025.3531716 · Cited by 8
Imperceptible Backdoor Attacks on Text-Guided 3D Scene Grounding
Liu, D., & Hu, W. (2025) · IEEE Transactions on Multimedia · doi:10.1109/tmm.2025.3543050 · Cited by 8
Invisible Backdoor Attack against Self-supervised Learning
Zhang, H., Wang, Z., Li, B., Lin, F., Han, T., Jin, M., Zhan, C., Du, M., Wang, H., & Ma, S. (2025) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52734.2025.02402 · Cited by 8
Self-citationBadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models
Yuan, Z., Shi, J., Zhou, P., Gong, N. Z., & Sun, L. (2025) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52734.2025.02785 · Cited by 18
Cui, C., Ma, Y., Park, S., Yang, Z., Zhou, Y., Liu, P., Lu, J., Peng, J., Zhang, J., Zhang, R., et al. (2026) · Proceedings of the IEEE · doi:10.1109/jproc.2026.3678829 · Cited by 37
Maximum Entropy Loss, the Silver Bullet Targeting Backdoor Attacks in Pre-trained Language Models
Liu, Z., Shen, B., Lin, Z., Wang, F., & Wang, W. (2023) · Findings of the Association for Computational Linguistics: ACL (Findings of ACL) · doi:10.18653/v1/2023.findings-acl.237 · Cited by 8
Self-citationMEDIC: Remove Model Backdoors via Importance Driven Cloning
Xu, Q., Tao, G., Honorio, J., Liu, Y., An, S., Shen, G., Cheng, S., & Zhang, X. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01962 · Cited by 9
Self-citationPalette: Physically-Realizable Backdoor Attacks Against Video Recognition Models
Gong, X., Fang, Z., Li, B., Wang, T., Chen, Y., & Wang, Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3314792 · Cited by 9
SGBA: A stealthy scapegoat backdoor attack against deep neural networks
He, Y., Shen, Z., Xia, C., Hua, J., Tong, W., & Zhong, S. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103523 · Cited by 12
Backdoor Attacks Against Low-Earth Orbit Satellite Fingerprinting
Zhao, T., Wang, N., Wu, Y., Zhang, W., & Wang, X. (2024) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps61880.2024.10620841 · Cited by 8
Sharath, D. H., & Ansari, A. (2020) · SAE technical papers on CD-ROM/SAE technical paper series · doi:10.4271/2020-01-0719 · Cited by 8
MT-MTD: Muti-Training based Moving Target Defense Trojaning Attack in Edged-AI network
Qiu, Y., Wu, J., Mumtaz, S., Li, J., Al‐Dulaimi, A., & Rodrigues, J. J. P. C. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500545 · Cited by 8
Metadata
- Authors
- Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X.
- Affiliations
- Purdue University West Lafayette (US)
- Nanjing University (CN)
- Venue
- Proceedings 2018 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2018
- OpenAlex
- W2753783305
- Cited by
- 1,270
- References
- 49
- Citations by year
- 2026: 114 · 2025: 193 · 2024: 206 · 2023: 184 · 2022: 149 · 2021: 185 · 2020: 153 · 2019: 59 · 2018: 26
- FWCI
- 43.17
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- public-domain
- Locations
- Network and Distributed System Security Symposium (publishedVersion, public-domain)
- Rutgers University Community Repository (Rutgers University) (submittedVersion)
- Purdue e-Pubs (Purdue University System) (submittedVersion)
- Funders
- National Science Foundation (1748764, 1320444, 1409668)
- Defense Advanced Research Projects Agency (FA-8650-15-C-7562, FA8650-15C)
- Office of Naval Research (N000141712947, N000141410468)
- Sandia National Laboratories (1701331)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- neural network security, stealthy attacks, model poisoning, autonomous driving safety
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
