The DOI matches its Crossref record; 47 of the 49 references it cites were found in a registry or an index.
Trojaning Attack on Neural Networks
Open accessAbstract
With the fast spread of machine learning techniques, sharing and adopting public machine learning models become very popular.This gives attackers many new opportunities.In this paper, we propose a trojaning attack on neural networks.As the models are not intuitive for human to understand, the attack features stealthiness.Deploying trojaned models can cause various severe consequences including endangering human lives (in applications like autonomous driving).We first inverse the neural network to generate a general trojan trigger, and then retrain the model with reversed engineered training data to inject malicious behaviors to the model.The malicious behaviors are only activated by inputs stamped with the trojan trigger.In our attack, we do not need to tamper with the original training process, which usually takes weeks to months.Instead, it takes minutes to hours to apply our attack.Also, we do not require the datasets that are used to train the model.In practice, the datasets are usually not shared due to privacy or copyright concerns.We use five different applications to demonstrate the power of our attack, and perform a deep analysis on the possible factors that affect the attack.The results show that our attack is highly effective and efficient.The trojaned behaviors can be successfully triggered (with nearly 100% possibility) without affecting its test accuracy for normal input and even with better accuracy on public dataset.Also, it only takes a small amount of time to attack a complex neuron network model.In the end, we also discuss possible defense against such attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“An alternative to this assumption would be incorporating an additional party or a public bulletin board (see, e.g., [398]) into the model that is known to the clients and trusted to not collude with the server.”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [398]
Experimental — accuracy not yet measuredIn the citing paper
“By sharing the model parameters instead of data, FL introduces new attack surfaces at training time by enhancing the capabilities of the adversary [16].”
From Vulnerabilities in federated learning (2021) · cites this paper as [16]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380
Self-citationLabaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,119
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267
Convolutional Neural Networks for Sentence Classification
Kim, Y. (2014) · Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.3115/v1/d14-1181 · Cited by 14,831
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
“Librispeech: an ASR corpus based on public domain audio books,”
Panayotov, V., Chen, G., Povey, D., & Khudanpur, S. (2015) · 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) · doi:10.1109/icassp.2015.7178964 · Cited by 6,072
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445
Flagged first, then by citations
2 of the 49 references couldn’t be matched to a known paper.
Research works printed but not linked: 2
- [26]26. D. Erhan, A. Courville, and Y. Bengio, "Understanding representations learned in deep architectures," Department dInformatique et Recherche Operationnelle, University of Montreal, QC, Canada, Tech. Rep, vol. 1355, 2010.
- [62]62. G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu, "Dolphinattack: Inaudible voice commands," in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS '17. New York, NY, USA: ACM, 2017, pp. 103-117.
Cited by
Sorted by citations
Items 601–700 of 1,001
Seeds of SEED: NMT-Stroke: Diverting Neural Machine Translation through Hardware-based Faults
Cai, K., Chowdhuryy, M. H. I., Zhang, Z., & Yao, F. (2021) · International Symposium on Secure and Private Execution Environment Design (SEED) · doi:10.1109/seed51797.2021.00019 · Cited by 8
A Trigger Exploration Method for Backdoor Attacks on Deep Learning-Based Traffic Control Systems
Wang, Y., Maniatakos, M., & Jabari, S. E. (2021) · IEEE Conference on Decision and Control (CDC) · doi:10.1109/cdc45484.2021.9683577 · Cited by 9
Stealthy Attack on Algorithmic-Protected DNNs via Smart Bit Flipping
Ghavami, B., Movi, S., Fang, Z., & Shannon, L. (2021) · IEEE International Symposium on Quality Electronic Design · doi:10.1109/isqed54688.2022.9806152 · Cited by 9
DeepC2: AI-Powered Covert Command and Control on OSNs
Wang, Z., Liu, C., Cui, X., Yin, J., Liu, J., Wu, D., & Liu, Q. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-15777-6_22 · Cited by 13
Chen, C., Wei, L., Zhang, L., Peng, Y., & Ning, J. (2022) · Security and Communication Networks · doi:10.1155/2022/2985308 · Cited by 8
An Adaptive Black-Box Defense Against Trojan Attacks (TrojDef)
Liu, G., Khreishah, A. A., Sharadgah, F., & Khalil, I. M. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3204283 · Cited by 9
Carnerero-Cano, J., Muñoz-González, L., Spencer, P., & Lupu, E. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.00040 · Cited by 11
Asvadishirehjini, A., Kantarcıoğlu, M., & Malin, B. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.08855 · Cited by 14
Mitigating Sybil Attacks on Differential Privacy based Federated LearningPreprint
Jiang, Y., Li, Y., Zhou, Y., & Zheng, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.10572 · Cited by 8
DBIA: Data-free Backdoor Injection Attack against Transformer NetworksPreprint
Lv, P., Ma, H., Zhou, J., Liang, R., Chen, K., Zhang, S., & Yang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.11870 · Cited by 17
Tamper Resistant Design of Convolutional Neural Network Hardware Accelerator
Yu, H., Sun, P., Halak, B., Shanthakumar, K., & Kázmierski, T. J. (2023) · Asian Hardware Oriented Security and Trust Symposium (AsianHOST) · doi:10.1109/asianhost59942.2023.10409319 · Cited by 7
Minimalism is King! High-Frequency Energy-Based Screening for Data-Efficient Backdoor Attacks
Xun, Y., Jia, X., Gu, J., Liu, X., Guo, Q., & Cao, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3380821 · Cited by 7
Feng, Y., & Qian, Q. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103129 · Cited by 8
Privacy-Preserving Machine Learning Based on Cryptography: A Survey
Chen, C., Wei, L., Xie, J., & Shi, Y. (2025) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3729234 · Cited by 9
A survey of backdoor attacks and defences: From deep neural networks to large language models
Jin, L., Jiang, W., Wen, X., Lin, M.-Y., Zhan, J., Zhou, X.-Z., Habtie, M. A., & Werghi, N. (2025) · Journal of Electronic Science and Technology · doi:10.1016/j.jnlest.2025.100326 · Cited by 11
Unifying ground and air: a comprehensive review of deep learning-enabled CAVs and UAVs
Zia, M. U., Xiang, W., Huang, T., Ahmad, J., Chattha, J. N., Naqvi, I. H., & Butt, F. A. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-025-11425-1 · Cited by 10
Ilari, L., Tiribelli, S., & Caruso, F. (2026) · AI and Ethics · doi:10.1007/s43681-025-00935-x · Cited by 8
AT-BOD: An Adversarial Attack on Fool DNN-Based Blackbox Object Detection Models
Elaalami, I. A., Olatunji, S. O., & Zagrouba, R. (2022) · Applied Sciences · doi:10.3390/app12042003 · Cited by 8
Anti-Neuron Watermarking: Protecting Personal Data Against Unauthorized Neural Networks
Zou, Z., Gong, B., & Wang, L. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19778-9_26 · Cited by 12
Model Poisoning Attack on Neural Network Without Reference Data
Zhang, X., Zhang, H., Zhang, G., Li, H., Yu, D., Cheng, X., & Hu, P. (2023) · IEEE Transactions on Computers · doi:10.1109/tc.2023.3280133 · Cited by 7
Self-citationNBA: defensive distillation for backdoor removal via neural behavior alignment
Ying, Z., & Wu, B. L. (2023) · Cybersecurity · doi:10.1186/s42400-023-00154-z · Cited by 12
FMDL: Federated Mutual Distillation Learning for Defending Backdoor Attacks
Sun, H., Zhu, W., Sun, Z., Cao, M., & Liu, W. (2023) · Electronics · doi:10.3390/electronics12234838 · Cited by 7
Kim, T.-H., Choi, S.-H., & Choi, Y.-H. (2023) · IEEE Access · doi:10.1109/access.2023.3342922 · Cited by 8
A Backdoor Approach With Inverted Labels Using Dirty Label-Flipping Attacks
Mengara, O. (2024) · IEEE Access · doi:10.1109/access.2024.3382839 · Cited by 8
Audio Steganography Based Backdoor Attack for Speech Recognition Software
Zhang, M., Ji, S., Cai, H., Dong, H., Zhang, P., & Li, Y. (2024) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac61105.2024.00161 · Cited by 7
Kwon, H., Roh, J., Yoon, H., & Park, K.-W. (2020) · International Conference on Intelligent Information Technology (ICIIT) · doi:10.1145/3385209.3385216 · Cited by 7
Pixdoor: A Pixel-space Backdoor Attack on Deep Learning Models
Arshad, I., Asghar, M. N., Qiao, Y., Lee, B., & Ye, Y. (2021) · European Signal Processing Conference (EUSIPCO) · doi:10.23919/eusipco54536.2021.9616118 · Cited by 7
A Fully Decentralized Homomorphic Federated Learning Framework
Bose, A., & Li, B. (2023) · IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) · doi:10.1109/mass58611.2023.00029 · Cited by 7
10 Security and Privacy Problems in Large Foundation Models
Jia, J., Liu, H., & Gong, N. Z. (2023) · Springer eBooks · doi:10.1007/978-3-031-42637-7_8 · Cited by 8
Arshad, I., Alsamhi, S. H., Qiao, Y., Lee, B., & Ye, Y. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3384938 · Cited by 7
Security-Preserving Federated Learning via Byzantine-Sensitive Triplet Distance
Lee, Y., Park, S., & Kang, J. (2024) · IEEE International Symposium on Biomedical Imaging (ISBI) · doi:10.1109/isbi56570.2024.10635545 · Cited by 7
EPPS: Efficient Privacy-Preserving Scheme in Distributed Deep Learning
Li, Y., Li, H., Xu, G., Liu, S., & Lu, R. (2019) · Globecom · doi:10.1109/globecom38437.2019.9013395 · Cited by 7
A Novel Trojan Attack against Co-learning Based ASR DNN System
Li, M., Wang, X., Huo, D., Wang, H., Liu, C., Wang, Y., Wang, Y., & Xu, Z. (2021) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd49262.2021.9437669 · Cited by 7
Regula Sub-rosa: Latent Backdoor Attacks on Deep Neural NetworksPreprint
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.10447 · Cited by 7
Graph BackdoorPreprint
Xi, Z., Pang, R., Ji, S., & Wang, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.11890 · Cited by 17
Liu, Y., Shen, G., Tao, G., Wang, Z., Ma, S., & Zhang, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.08820 · Cited by 9
Self-citationLocal perturbation-based black-box federated learning attack for time series classification
Chen, S., Yuan, J., Wang, Z., & Sun, Y. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.04.048 · Cited by 6
UNIT: Backdoor Mitigation via Automated Neural Distribution Tightening
Cheng, S., Shen, G., Zhang, K., Tao, G., An, S., Guo, H., Ma, S., & Zhang, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73033-7_15 · Cited by 8
Self-citationGong, X., Tian, B., Xue, M., Wu, Y. L., Chen, Y., & Wang, Q. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3548970 · Cited by 7
Secure AI Systems: Emerging Threats and Defense Mechanisms
Rahaman, H., Chatterjee, A., & Bhunia, S. (2024) · Proceedings - Asian Test Symposium/Proceedings · doi:10.1109/ats64447.2024.10915428 · Cited by 6
Adversarial Machine Learning: A 20-Year Survey of Attacks, Defenses, and Standards
Tekeste, B., Al-Hussaeni, K., Fung, B. C. M., Alawadhi, I. M., & Fachkha, C. (2026) · IEEE Access · doi:10.1109/access.2026.3690620 · Cited by 7
Topological safeguard for evasion attack interpreting the neural networks’ behavior
Echeberria-Barrio, X., Gil, A., Mendialdua, I., & Orduna-Urrutia, R. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.110130 · Cited by 6
Leverage NLP Models Against Other NLP Models: Two Invisible Feature Space Backdoor Attacks
Li, X., Lu, X. Z., & Li, P. (2024) · IEEE Transactions on Reliability · doi:10.1109/tr.2024.3375526 · Cited by 7
Need for Speed: Taming Backdoor Attacks with Speed and Precision
Ma, Z., Yang, Y., Liu, Y., Yang, T., Liu, X., Li, T., & Qin, Z. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00216 · Cited by 6
Self-citationExploring the Orthogonality and Linearity of Backdoor Attacks
Zhang, K., Cheng, S., Shen, G., Tao, G., An, S., Makur, A., Ma, S., & Zhang, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00225 · Cited by 10
Self-citationGenerative AI for Cyberdefense
Singh, A., Singh, D., & Singh, R. (2024) · Studies in computational intelligence · doi:10.1007/978-981-97-8460-8_7 · Cited by 6
Diffusion Model Empowered Efficient Data Distillation Method for Cloud-Edge Collaboration
Chai, Z., Lin, Y., Gao, Z., Yu, X., & Xie, Z. (2025) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2025.3527647 · Cited by 9
Clean-label backdoor attack based on robust feature attenuation for speech recognition
Cai, H., Zhang, P., Xiao, Y., Ji, S., Xiao, M., & Cheng, L. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.127546 · Cited by 7
Boundary augment: A data augment method to defend poison attack
Chen, X., Ma, Y., Lu, S., & Yu, Y. (2021) · IET Image Processing · doi:10.1049/ipr2.12325 · Cited by 6
The Impact of Data Distribution on Fairness and Robustness in Federated Learning
Özdayi, M. S., & Kantarcıoğlu, M. (2021) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tpsisa52974.2021.00022 · Cited by 7
Evolutionary computation and machine learning in security
Picek, S., & Jakobović, D. (2022) · Genetic and Evolutionary Computation Conference Companion (GECCO Companion) · doi:10.1145/3520304.3534087 · Cited by 6
A Robust Framework for Adaptive Selection of Filter Ensembles to Detect Adversarial Inputs
Roy, A., & Dasgupta, D. (2022) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w54100.2022.00019 · Cited by 6
KerbNet: A QoE-Aware Kernel-Based Backdoor Attack Framework
Gong, X., Chen, Y., Huang, H., Kong, W., Wang, Z., Shen, C. Q., & Wang, Q. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3286842 · Cited by 6
DB-COVIDNet: A Defense Method against Backdoor Attacks
Shamshiri, S., Han, K. J., & Sohn, I. (2023) · Mathematics · doi:10.3390/math11204236 · Cited by 6
AIPA: An Adversarial Imperceptible Patch Attack on Medical Datasets and its Interpretability
Dunston, S. D., & Rajam, V. M. A. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103574 · Cited by 6
Deep-Learning Model Extraction Through Software-Based Power Side-Channel
Zhang, X. D., Ding, A. A., & Fei, Y. (2023) · doi:10.1109/iccad57390.2023.10323806 · Cited by 6
Self-citationShortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attacks
Li, Y., He, J., Huang, H., Sun, J., Ma, X., & Jiang, Y. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3605597 · Cited by 27
Study of scale-free structures in feed-forward neural networks against backdoor attacks
Kaviani, S., & Sohn, I. (2020) · ICT Express · doi:10.1016/j.icte.2020.11.004 · Cited by 6
Alrawashdeh, K., & Goldsmith, S. (2020) · IEEE Applied Imagery Pattern Recognition Workshop · doi:10.1109/aipr50011.2020.9425293 · Cited by 8
Alrawashdeh, K., & Goldsmith, S. (2020) · IEEE International Symposium on Technology and Society (ISTAS) · doi:10.1109/istas50296.2020.9462227 · Cited by 7
Adversarial Initialization - when your network performs the way I want -Preprint
Grosse, K., Trost, T. A., Mosbach, M., & Michael Backes, A. (2019) · arXiv (Cornell University) · Cited by 6
Xiang, Z. J., Miller, D. J., Wang, H., & Kesidis, G. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07970 · Cited by 6
Bait and Switch: Online Training Data Poisoning of Autonomous Driving SystemsPreprint
Patel, N., Krishnamurthy, P., Garg, S., & Khorrami, F. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.04065 · Cited by 12
Quantization Backdoors to Deep Learning Models.Preprint
Ma, H., Qiu, H., Gao, Y., Zhang, Z., Abuadbba, A., Fu, A., Al-Sarawi, S. F., & Abbott, D. (2021) · arXiv (Cornell University) · Cited by 7
Robust and privacy-preserving collaborative training: a comprehensive survey
Yang, F., Zhang, X., Guo, S., Chen, D., Gan, Y., Xiang, T., & Liu, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10797-0 · Cited by 17
Self-citationTowards robust neural networks: Exploring counterfactual causality-based repair
Liu, F., Du, X., Ding, H., & Qian, J. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.125082 · Cited by 6
FLSAD: Defending Backdoor Attacks in Federated Learning via Self-Attention Distillation
Chen, L., Liu, X., Wang, A., Zhai, W., & Cheng, X. (2024) · Symmetry · doi:10.3390/sym16111497 · Cited by 7
FedSweep: Unlearning Backdoors in Federated Learning
Qiu, Z., Zhong, Q., Qi, M., & Zhang, L. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-8173-0_11 · Cited by 5
LaserGuider: A Laser Based Physical Backdoor Attack Against Deep Neural Networks
Xu, Y., Chen, G., Song, F., & Chen, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95767-3_13 · Cited by 5
Wang, J., Shen, H., Ke, W., & Liu, X. H. (2025) · IEEE Access · doi:10.1109/access.2025.3586416 · Cited by 5
Unified Neural Backdoor Removal With Only Few Clean Samples Through Unlearning and Relearning
Min, N. M., Pham, L. H., & Sun, J. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3586499 · Cited by 8
Semantic and Precise Trigger Inversion: Detecting Backdoored Language Models
Xie, C., He, J., Yang, Y., Guo, S., Zhang, T., & Xiang, T. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3594037 · Cited by 6
ChainMarks: Securing DNN Watermark with Cryptographic Chain
Choi, B., Wang, S., Choi, I., & Sun, K. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3736214 · Cited by 5
Entangled Threats: A Unified Kill Chain Model for Quantum Machine Learning Security
Debus, P., Wendlinger, M., Tscharke, K., Herr, D., Brügmann, C., de Mello, D. O., Ulmanis, J., Erhard, A., Schmidt, A., & Petsch, F. (2025) · IEEE International Conference on Quantum Computing and Engineering (QCE) · doi:10.1109/qce65121.2025.00183 · Cited by 5
Are Your LLM-based Text-to-SQL Models Secure? Exploring SQL Injection via Backdoor Attacks
Lin, M., Zhang, H., Lao, J., Li, R., Zhou, Y., Yang, C., Cao, Y., & Tang, M. (2025) · Proceedings of the ACM on Management of Data · doi:10.1145/3769762 · Cited by 16
Exploring Model Poisoning Attack to Convolutional Neural Network Based Brain Tumor Detection Systems
Lata, K., Singh, P., & Saini, S. (2024) · International Symposium on Quality Electronic Design (ISQED) · doi:10.1109/isqed60706.2024.10528710 · Cited by 5
LateBA: Latent Backdoor Attack on Deep Bug Search via Infrequent Execution Codes
Yi, X., Li, G., Huang, W., Lin, X., Li, J., & Liu, Y. (2024) · Asia-Pacific Symposium on Internetware · doi:10.1145/3671016.3674806 · Cited by 5
Self-citationYuan, A., Oprea, A., & Tan, C. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00026 · Cited by 5
An AI-driven solution to prevent adversarial attacks on mobile Vehicle-to-Microgrid services
Omara, A., & Kantarcı, B. (2024) · Simulation Modelling Practice and Theory · doi:10.1016/j.simpat.2024.103016 · Cited by 6
Isolation-Based Debugging for Neural Networks
Chen, J., Wang, J., Sun, Y., Cheng, P., & Chen, J. (2024) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3650212.3652132 · Cited by 7
Split Edge-Cloud Neural Networks for Better Adversarial Robustness
Douch, S., Abid, M. R., Zine-Dine, K., Bouzidi, D., & Benhaddou, D. (2024) · IEEE Access · doi:10.1109/access.2024.3487435 · Cited by 5
E-SAGE: Explainability-Based Defense Against Backdoor Attacks on Graph Neural Networks
Yuan, D., Xu, X., Yu, L., Han, T., Li, R., & Han, M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-71464-1_33 · Cited by 7
Adaptive Backdoor Attacks With Reasonable Constraints on Graph Neural Networks
Dong, X., Li, J., Li, S., You, Z., Qu, Q., Kholodov, Y. A., & Shen, Y. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3543020 · Cited by 6
Stealthy Backdoor Attacks on Semantic Symbols in Semantic Communications
Zhou, Y., Hu, R. Q., & Qian, Y. (2024) · Globecom · doi:10.1109/globecom52923.2024.10901411 · Cited by 5
$$\textsf {DEVA}$$: Decentralized, Verifiable Secure Aggregation for Privacy-Preserving Learning
Tsaloli, G., Liang, B., Brunetta, C., Banegas, G., & Mitrokotsa, A. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-91356-4_16 · Cited by 5
Benchmarking the Effect of Poisoning Defenses on the Security and Bias of Deep Learning Models
Baracaldo, N., Ahmed, F., Eykholt, K., Zhou, Y., Priya, S., Lee, T., Kadhe, S., Tan, M., Polavaram, S., Suggs, S., et al. (2023) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00010 · Cited by 6
Don’t FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNs
Hammoud, H. A. A. K., Bibi, A., Torr, P. H. S., & Ghanem, B. (2023) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw59228.2023.00230 · Cited by 7
RAI4IoE: Responsible AI for Enabling the Internet of Energy
Xue, M., Nepal, ., Liu, L., Sethuvenkatraman, S., Yuan, X., Rudolph, C., Sun, R., & Eisenhauer, G. (2023) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa58951.2023.00012 · Cited by 6
UMA: Facilitating Backdoor Scanning via Unlearning-Based Model Ablation
Zhao, Y., Li, C., & Chen, K. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30183 · Cited by 5
Adaptive Robust Learning Against Backdoor Attacks in Smart Homes
Zhang, J., Wang, Z., Ma, Z., & Ma, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3392772 · Cited by 5
REStore: Exploring a Black-Box Defense against DNN Backdoors using Rare Event Simulation
Roux, Q. L., Kallas, K., & Furon, T. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00021 · Cited by 7
Neuron Sensitivity-Guided Test Case Selection
Huang, D., Bu, Q., Fu, Y., Qing, Y., Xie, X., Chen, J., & Cui, H. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3672454 · Cited by 8
Generative Adversarial Network Based Image-Scaling Attack and Defense Modeling
Li, J., Chen, H., Li, Z., Zhang, A., Wang, X., Wang, X., & Xia, F. (2024) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2024.3418822 · Cited by 5
Meng, L., Gong, X., & Chen, Y. (2024) · Chinese Journal of Electronics · doi:10.23919/cje.2023.00.041 · Cited by 5
Kwon, H., Yoon, H., & Park, K.-W. (2020) · International Conference on Software Engineering and Information Management (ICSIM) · doi:10.1145/3378936.3378938 · Cited by 5
Stronger Targeted Poisoning Attacks Against Malware Detection
Narisada, S., Sasaki, S., Hidano, S., Uchibayashi, T., Suganuma, T., Hiji, M., & Kiyomoto, S. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-65411-5_4 · Cited by 6
Detecting Trojan Attacks on Deep Neural Networks
Singh, J., & Sharmila, V. C. (2020) · International Conference on Computer, Communication and Signal Processing (ICCCSP) · doi:10.1109/icccsp49186.2020.9315256 · Cited by 5
Backdoor learning curves: explaining backdoor poisoning beyond influence functions
Ciná, A. E., Grosse, K., Vascon, S., Demontis, A., Biggio, B., Roli, F., & Pelillo, M. (2024) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-024-02363-5 · Cited by 14
Disrupting Audio Event Detection Deep Neural Networks with White Noise
dos Santos, R., Kassetty, A. V., & Nilizadeh, S. (2021) · Technologies · doi:10.3390/technologies9030064 · Cited by 5
Combining Defences Against Data-Poisoning Based Backdoor Attacks on Neural Networks
Milakovic, A., & Mayer, R. L. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-10684-2_3 · Cited by 5
Metadata
- Authors
- Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X.
- Affiliations
- Purdue University West Lafayette (US)
- Nanjing University (CN)
- Venue
- Proceedings 2018 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2018
- OpenAlex
- W2753783305
- Cited by
- 1,270
- References
- 49
- Citations by year
- 2026: 114 · 2025: 193 · 2024: 206 · 2023: 184 · 2022: 149 · 2021: 185 · 2020: 153 · 2019: 59 · 2018: 26
- FWCI
- 43.17
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- public-domain
- Locations
- Network and Distributed System Security Symposium (publishedVersion, public-domain)
- Rutgers University Community Repository (Rutgers University) (submittedVersion)
- Purdue e-Pubs (Purdue University System) (submittedVersion)
- Funders
- National Science Foundation (1748764, 1320444, 1409668)
- Defense Advanced Research Projects Agency (FA-8650-15-C-7562, FA8650-15C)
- Office of Naval Research (N000141712947, N000141410468)
- Sandia National Laboratories (1701331)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- neural network security, stealthy attacks, model poisoning, autonomous driving safety
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
