The DOI matches its Crossref record; 47 of the 49 references it cites were found in a registry or an index.
Trojaning Attack on Neural Networks
Open accessAbstract
With the fast spread of machine learning techniques, sharing and adopting public machine learning models become very popular.This gives attackers many new opportunities.In this paper, we propose a trojaning attack on neural networks.As the models are not intuitive for human to understand, the attack features stealthiness.Deploying trojaned models can cause various severe consequences including endangering human lives (in applications like autonomous driving).We first inverse the neural network to generate a general trojan trigger, and then retrain the model with reversed engineered training data to inject malicious behaviors to the model.The malicious behaviors are only activated by inputs stamped with the trojan trigger.In our attack, we do not need to tamper with the original training process, which usually takes weeks to months.Instead, it takes minutes to hours to apply our attack.Also, we do not require the datasets that are used to train the model.In practice, the datasets are usually not shared due to privacy or copyright concerns.We use five different applications to demonstrate the power of our attack, and perform a deep analysis on the possible factors that affect the attack.The results show that our attack is highly effective and efficient.The trojaned behaviors can be successfully triggered (with nearly 100% possibility) without affecting its test accuracy for normal input and even with better accuracy on public dataset.Also, it only takes a small amount of time to attack a complex neuron network model.In the end, we also discuss possible defense against such attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“An alternative to this assumption would be incorporating an additional party or a public bulletin board (see, e.g., [398]) into the model that is known to the clients and trusted to not collude with the server.”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [398]
Experimental — accuracy not yet measuredIn the citing paper
“By sharing the model parameters instead of data, FL introduces new attack surfaces at training time by enhancing the capabilities of the adversary [16].”
From Vulnerabilities in federated learning (2021) · cites this paper as [16]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380
Self-citationLabaca-Castro, R. (2023) · Springer eBooks · doi:10.1007/978-3-658-40442-0_9 · Cited by 21,119
FaceNet: A unified embedding for face recognition and clustering
Schroff, F., Kalenichenko, D., & Philbin, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298682 · Cited by 15,267
Convolutional Neural Networks for Sentence Classification
Kim, Y. (2014) · Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.3115/v1/d14-1181 · Cited by 14,831
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
DeepFace: Closing the Gap to Human-Level Performance in Face Verification
Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014) · 2014 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2014.220 · Cited by 6,542
“Librispeech: an ASR corpus based on public domain audio books,”
Panayotov, V., Chen, G., Povey, D., & Khudanpur, S. (2015) · 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) · doi:10.1109/icassp.2015.7178964 · Cited by 6,072
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments
Huang, G. B., Mattar, M., Berg, T. L., & Miller, E. G. (2008) · HAL · Cited by 4,445
Flagged first, then by citations
2 of the 49 references couldn’t be matched to a known paper.
Research works printed but not linked: 2
- [26]26. D. Erhan, A. Courville, and Y. Bengio, "Understanding representations learned in deep architectures," Department dInformatique et Recherche Operationnelle, University of Montreal, QC, Canada, Tech. Rep, vol. 1355, 2010.
- [62]62. G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu, "Dolphinattack: Inaudible voice commands," in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS '17. New York, NY, USA: ACM, 2017, pp. 103-117.
Cited by
Sorted by citations
Items 801–900 of 1,001
Do Backdoors Assist Membership Inference Attacks?
Goto, Y., Ashizawa, N., Shibahara, T., & Yanai, N. (2024) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-64954-7_13 · Cited by 3
ReVeil: Unconstrained Concealed Backdoor Attack on Deep Neural Networks using Machine Unlearning
Alam, M., Lamri, H., & Maniatakos, M. (2025) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1109/dac63849.2025.11133199 · Cited by 5
MalModel: hiding malicious payload in mobile deep learning models with black-box backdoor attack
Hua, J., Wang, K., Wang, M., Bai, G., Luo, X., & Wang, H. (2025) · Automated Software Engineering · doi:10.1007/s10515-025-00569-7 · Cited by 6
Backdoor Attacks on Self-Supervised Learning
Saha, A., Tejankar, A., Koohpayegani, S. A., & Pirsiavash, H. (2021) · Maryland Shared Open Access Repository (USMAI Consortium) · doi:10.13016/m2djnb-qbvh · Cited by 3
Chen, C., Wei, L., Zhang, L., & Ning, J. (2021) · ACM Turing Celebration Conference - China (ACM TURC) · doi:10.1145/3472634.3472660 · Cited by 3
Multipurpose Watermarking Approach for Copyright and Integrity of Steganographic Autoencoder Models
Wei, G., Chang, C., Bai, Y., Fan, Y., Tao, L., & Li, L. (2021) · Security and Communication Networks · doi:10.1155/2021/9936661 · Cited by 3
RetractedDNN Intellectual Property Extraction Using Composite Data
Mosafi, I., David, E. O., Altshuler, Y., & Netanyahu, N. S. (2022) · Entropy · doi:10.3390/e24030349 · Cited by 3
Mitigating Targeted Bit-Flip Attacks via Data Augmentation: An Empirical Study
Zhang, Z., Wang, M., Chen, W., Qiu, H., & Qiu, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-10989-8_48 · Cited by 4
Integrity Authentication in Tree Models
Zhao, W., Lao, Y., & Li, P. (2022) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3534678.3539428 · Cited by 4
VPN: Verification of Poisoning in Neural Networks
Sun, Y., Usman, M., Gopinath, D., & Păsăreanu, C. S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-21222-2_1 · Cited by 5
Breaking Distributed Backdoor Defenses for Federated Learning in Non-IID Settings
Yang, J., Shu, J., & Jia, X. (2022) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn57253.2022.00064 · Cited by 3
A Blockchain-Based Federated-Learning Framework for Defense against Backdoor Attacks
Lü, L., Qin, J., & Luo, J. (2023) · Electronics · doi:10.3390/electronics12112500 · Cited by 3
Balancing Robustness and Covertness in NLP Model Watermarking: A Multi-Task Learning Approach
Dai, L., Mao, J., Xu, L., Fan, X., & Zhou, X. (2023) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc58397.2023.10218209 · Cited by 3
Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning AttacksPreprint
Schwarzschild, A., Goldblum, M., Gupta, A. K., Dickerson, J. P., & Goldstein, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.12557 · Cited by 100
How Secure is Distributed Convolutional Neural Network on IoT Edge Devices?Preprint
Mohammed, H., Odetola, T. A., & Hasan, S. R. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.09276 · Cited by 4
Being Single Has Benefits. Instance Poisoning to Deceive Malware ClassifiersPreprint
Shapira, T., Berend, D., Rosenberg, I., Liu, Y., Shabtai, A., & Elovici, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.16323 · Cited by 3
Self-citationTowards a Robust and Trustworthy Machine Learning System Development.Preprint
Xiong, P., Buffett, S., Iqbal, S., Lamontagne, P., Mamun, M., & Molyneaux, H. (2021) · arXiv (Cornell University) · Cited by 3
TESDA: Transform Enabled Statistical Detection of Attacks in Deep Neural NetworksPreprint
Amarnath, C., Balwani, A., Ma, K., & Chatterjee, A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.08447 · Cited by 3
Backdoor Pony: Evaluating backdoor attacks and defenses in different domains
Mercier, A., Smolin, N., Sihlovec, O., Koffas, S., & Picek, S. (2023) · SoftwareX · doi:10.1016/j.softx.2023.101387 · Cited by 3
Neutralizing Backdoors through Information Conflicts for Large Language ModelsPreprint
Chen, Z., Sun, Y., Gong, X., Gao, J., & Lam, K. (2024) · Qeios · doi:10.32388/fv951p · Cited by 6
Robust Federated Learning with Adaptable Learning Rate
Zhou, J., Zhong, Z., Wang, J., Zhang, X., Chen, F., & Yan, C. (2021) · 2021 7th International Conference on Big Data and Information Analytics (BigDIA) · doi:10.1109/bigdia53151.2021.9619731 · Cited by 2
Self-citationExperimental Analyses of the Physical Surveillance Risks in Client-Side Content Scanning
Hooda, A., Labunets, A., Kohno, T., & Fernandes, E. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.241401 · Cited by 2
Resilient Federated Learning Using Trimmed-Clipping Aggregation
Bhowmick, C., & Koutsoukos, X. (2024) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa62245.2024.00031 · Cited by 3
Detecting All-to-One Backdoor Attacks in Black-Box DNNs via Differential Robustness to Noise
Fu, H., Krishnamurthy, P., Garg, S., & Khorrami, F. (2025) · IEEE Access · doi:10.1109/access.2025.3543333 · Cited by 2
Runtime Backdoor Detection for Federated Learning via Representational Dissimilarity Analysis
Zhang, X., Xue, X., Du, X., Xie, X., Liu, Y., & Sun, M. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3550330 · Cited by 5
Self-citationExploring Inherent Backdoors in Deep Learning Models
Tao, G., Cheng, S., Wang, Z., Ma, S., An, S., Liu, Y., Shen, G., Zhang, Z., Mao, Y., & Zhang, X. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00078 · Cited by 3
Self-citationWang, S. (2025) · Transportation Research Record Journal of the Transportation Research Board · doi:10.1177/03611981251320384 · Cited by 2
Red alarm: Controllable backdoor attack in continual learning
Gao, R., & Liu, W. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107479 · Cited by 2
BDEKD: mitigating backdoor attacks in NLP models via ensemble knowledge distillation
Zhang, Z., Miao, X., Zhou, C., Shang, C., Chen, X., Kong, X., Huang, W. H., & Cao, Y. (2025) · Complex & Intelligent Systems · doi:10.1007/s40747-025-02006-4 · Cited by 2
Technological Framework for a Secure and Resilient Food Supply Chain
Fischer, M., Tönjes, R., Bohara, R., Ross, M., Hegde, A., Wressnegger, C., & Brunner, M. J. (2025) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr64739.2025.11130161 · Cited by 3
A Client-level Assessment of Collaborative Backdoor Poisoning in Non-IID Federated Learning
Lai, P., Liu, G., Phan, N., Khalil, I. M., Khreishah, A. A., & Wu, X. (2025) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs63083.2025.00010 · Cited by 2
Resilient automatic model selection for mobility prediction
Atiiq, S. A., Gehrmann, C., Khalil, K., Sternby, J., & Yuan, Y. (2025) · Cluster Computing · doi:10.1007/s10586-025-05661-x · Cited by 2
Stealthy Backdoor Attack against Object Detection
Ning, X., Xie, Q., Xu, J., Jiang, W., Liu, X., Li, J., & Ma, Y. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11227680 · Cited by 2
Provable Repair of Deep Neural Network Defects by Preimage Synthesis and Property Refinement
Ma, J.-N., Wang, J.-Y., Xuan, Q., & Wang, Z. (2025) · Conference on Computer and Communications Security · doi:10.1145/3719027.3765057 · Cited by 3
Trap: Mitigating Poisoning-Based Backdoor Attacks by Treating Poison With Poison
Li, C., Li, Z., Pan, M., & Li, X. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3644371 · Cited by 2
Zhang, M., Hu, C., Cao, X., Sajjanhar, A., Yang, Z., Hassan, M. U., Jin, Z. G., & Li, J. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3655513 · Cited by 2
BadSAD: Clean-Label Backdoor Attacks Against Deep Semi-Supervised Anomaly Detection
Cheng, H., Xu, D., & Yuan, S. (2025) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata66926.2025.11402072 · Cited by 2
Trustworthy AI for secure and robust machine learning through blockchain enabled data integrity
Abdu, S., Bewuketu, G., Getaneh, D., Alam, M. N., Fernandez, A. C., Basco, A. B. A., Hasan, Z., & Serajuddin, M. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-01443-5 · Cited by 2
Identifying Physically Realizable Triggers for Backdoored Face Recognition Networks
Raj, A., Pal, A., & Arora, C. (2021) · Proceedings - International Conference on Image Processing · doi:10.1109/icip42928.2021.9506564 · Cited by 3
Менисов, А. Б., Lomako, A. G., & Dudkin, A. S. (2022) · Scientific and technical journal of information technologies mechanics and optics · doi:10.17586/2226-1494-2022-22-4-742-750 · Cited by 2
SVFLS: A Secure and Verifiable Federated Learning Training Scheme
Liu, Y., Hu, G., Zhang, Y., & Zhang, M. (2022) · Communications in computer and information science · doi:10.1007/978-981-19-8445-7_9 · Cited by 2
Self-citationDetecting Backdoor Attacks on Deep Neural Networks Based on Model Parameters Analysis
Ma, M., Li, H., & Kuang, X. (2022) · IEEE International Conference on Tools with Artificial Intelligence (ICTAI) · doi:10.1109/ictai56018.2022.00098 · Cited by 2
Zhang, L., Peng, Y., Wei, L., Chen, C., & Zhang, X. (2023) · Security and Communication Networks · doi:10.1155/2023/9308909 · Cited by 2
Self-citationBackdoor Attack on Deep Neural Networks in Perception Domain
Mo, X., Zhang, L. Y., Sun, N., Luo, W., & Gao, S. (2023) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn54540.2023.10191661 · Cited by 2
Adversarial AI Threats on Digitization of Nuclear Power Plants
Gupta, K. D., Talukder, S. K., & Alam, S. B. (2023) · Transactions of the American Nuclear Society · doi:10.13182/t130-43034 · Cited by 2
A Novel Semi-Supervised Adversarially Learned Meta-Classifier for Detecting Neural Trojan Attacks
Ghahremani, S., Bidgoly, A. J., Nguyen, U. T., & Yau, D. K. Y. (2023) · IEEE Access · doi:10.1109/access.2023.3339542 · Cited by 2
X-HDNN: Explainable Hybrid DNN for Industrial Internet of Things Backdoor Attack Detection
Ahakonye, L. A. C., Nwakanma, C. I., Lee, J. M., & Kim, D. (2023) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc58733.2023.10393379 · Cited by 2
WaTrojan: Wavelet domain trigger injection for backdoor attacks
Zhang, Z., Ding, J., Zhang, Q., & Deng, Q. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103767 · Cited by 2
FL-GUARD: A Holistic Framework for Run-Time Detection and Recovery of Negative Federated Learning
Hong, L., Shou, L., Chen, K., Chen, G., & Wu, S. (2024) · Data Science and Engineering · doi:10.1007/s41019-024-00243-0 · Cited by 2
Enhanced Coalescence Backdoor Attack Against DNN Based on Pixel Gradient
Yin, J., Chen, H., Li, J., & Gao, Y. (2024) · Neural Processing Letters · doi:10.1007/s11063-024-11469-4 · Cited by 2
Zhang, X., Zheng, B., Hu, J., Li, C., & Bai, X. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i15.29629 · Cited by 2
Self-citationBeyond Recognition : Privacy Protections in a Surveilled World
Le, M. (2024) · Linköping studies in science and technology. Dissertations · doi:10.3384/9789180756761 · Cited by 2
Highly Evasive Targeted Bit-Trojan on Deep Neural Networks
Jin, L., Jiang, W., Zhan, J., & Wen, X. (2024) · IEEE Transactions on Computers · doi:10.1109/tc.2024.3416705 · Cited by 3
Detecting Textual Backdoor Attacks via Class Difference for Text Classification System
Kwon, H., & Jun, L. E. E. (2024) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2023edp7160 · Cited by 2
Sun, F., Pei, B., & Chen, G. (2024) · doi:10.1109/icsip61881.2024.10671403 · Cited by 2
Augmented Neural Fine-Tuning for Efficient Backdoor Purification
Karim, N., Arafat, A. A., Khalid, U., Guo, Z., & Rahnavard, N. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72989-8_23 · Cited by 5
Model X-ray : Detecting Backdoored Models via Decision Boundary
Su, Y., Zhang, J., Xu, T., Zhang, T., Zhang, W., & Yu, N. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3681075 · Cited by 4
Towards Stricter Black-box Integrity Verification of Deep Neural Network Models
He, C., Bai, X., Ma, X., Zhu, B., Hu, P., Fu, J., Jin, H., & Zhang, D. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3681691 · Cited by 2
Data Poisoning Quantization Backdoor Attack
Huynh, T., Tran, A., Doan, K. D., & Pham, T. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72907-2_3 · Cited by 3
Adversarial Attacks on Federated Learning Revisited: a Client-Selection Perspective
Lyu, X., Li, S., Wang, N., Li, T., Chen, D., & Chen, Y. (2024) · IEEE Conference on Communications and Network Security · doi:10.1109/cns62487.2024.10735606 · Cited by 2
Securing Machine Learning Against Data Poisoning Attacks
Allheeib, N. (2024) · International Journal of Data Warehousing and Mining · doi:10.4018/ijdwm.358335 · Cited by 4
Adversarially Robust Anti-Backdoor Learning
Zhao, Q., & Wressnegger, C. (2024) · doi:10.1145/3689932.3694763 · Cited by 2
What Makes Vision Transformers Robust Towards Bit-Flip Attack?
Zhou, X., Kundu, S., Chen, D., Huang, J., & Beerel, P. A. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-78186-5_28 · Cited by 2
TRIGS: Trojan Identification from Gradient-Based Signatures
Hussein, M. E., Janakiraman, S. S., & AbdAlmageed, W. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-78122-3_23 · Cited by 4
An Invisible Backdoor Attack Based on Semantic Feature
Chen, Y., Xu, X., Wang, X., Li, Z., & Chen, W. (2025) · International Journal of Pattern Recognition and Artificial Intelligence · doi:10.1142/s0218001425500041 · Cited by 6
Evil from Within: Machine Learning Backdoors Through Dormant Hardware Trojans
Warnecke, A., Speith, J., Möller, J.-N., Rieck, K., & Paar, C. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00077 · Cited by 4
BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation
Yu, H., Xie, T., Gui, J., Wang, P., Cheng, P., Yi, P., & Wu, Y. (2025) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3690624.3709385 · Cited by 3
Timber! Poisoning Decision Trees
Calzavara, S., Cazzaro, L., & Vettori, M. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00051 · Cited by 2
Semantic-Aware Framework for Backdoor Detection in AI Models
Fu, K., & Dai, J. (2025) · International Journal on Semantic Web and Information Systems · doi:10.4018/ijswis.378675 · Cited by 2
Unveiling Security Vulnerabilities in Git Large File Storage Protocol
Chen, Y., Wang, Q., YANG, Y. Q., Chen, Y., Li, Y., & Ji, S. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00123 · Cited by 2
Arms Race in Deep Learning: A Survey of Backdoor Defenses and Adaptive Attacks
Mo, X., Sun, N., Zhang, L. Y., Luo, W., Gao, S., & Xiang, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-8183-9_24 · Cited by 2
Pruning Strategies for Backdoor Defense in LLMs
Chapagain, S., Hamdi, S. M., & Boubrahimi, S. F. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3760946 · Cited by 5
A Poisoning Attack Against the Recognition Model Trained by the Data Augmentation Method
Yang, Y., Li, L., Chang, L., & Gu, T. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-62460-6_49 · Cited by 2
zoNNscan: A Boundary-Entropy Index for Zone Inspection of Neural Models
Jaouen, A., & Merrer, E. L. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-89453-5_3 · Cited by 2
Escaping Backdoor Attack Detection of Deep Learning
Xiong, Y., Xu, F., Zhong, S., & Li, Q. (2020) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-58201-2_29 · Cited by 2
Interpretability Derived Backdoor Attacks Detection in Deep Neural Networks: Work-in-Progress
Wen, X., Jiang, W., Zhan, J., Wang, X., & He, Z. (2020) · ACM International Conference on Embedded Software (EMSOFT) · doi:10.1109/emsoft51651.2020.9244019 · Cited by 2
Sensitive Samples Revisited: Detecting Neural Network Attacks Using Constraint Solvers
Docena, A. N., Wahl, T., Pearce, T., & Fei, Y. (2021) · Electronic Proceedings in Theoretical Computer Science · doi:10.4204/eptcs.342.4 · Cited by 2
Backdoor Filter: Mitigating Visible Backdoor Triggers in Dataset
Wei, Z., Shi, J., Duan, Y., Liu, R., Ye, H., & Liu, Z. (2021) · IEEE International Conference on Digital Twins and Parallel Intelligence (DTPI) · doi:10.1109/dtpi52967.2021.9540109 · Cited by 2
Can Optical Trojans Assist Adversarial Perturbations?
Boloor, A., Wu, T., Naughton, P., Chakrabarti, A., Zhang, X., & Vorobeychik, Y. (2021) · IEEE International Conference on Computer Vision Workshops · doi:10.1109/iccvw54120.2021.00019 · Cited by 3
Self-citationNeural Network Based Glitch Physically Unclonable Function
Nozaki, Y., & Yoshikawa, M. (2021) · IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON) · doi:10.1109/uemcon53757.2021.9666509 · Cited by 2
Trojan Attacks and Defense for Speech Recognition
Zong, W., Chow, Y.-W., Susilo, W., & Kim, J. (2022) · Communications in computer and information science · doi:10.1007/978-981-16-9576-6_14 · Cited by 2
Chen, C., Wei, L., Zhang, L., Peng, Y., & Ning, J. (2022) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-022-01377-6 · Cited by 2
Inconspicuous Data Augmentation Based Backdoor Attack on Deep Neural Networks
Xu, C., Liu, W., Zheng, Y., Wang, S., & Chang, C.-H. (2022) · IEEE International System-on-Chip Conference (SOCC) · doi:10.1109/socc56010.2022.9908113 · Cited by 2
Offensive Machine Learning Methods and the Cyber Kill Chain
Turtiainen, H., Costin, A., Polyakov, A., & Hämäläinen, T. (2022) · Artificial Intelligence and Cybersecurity · doi:10.1007/978-3-031-15030-2_6 · Cited by 2
Attacks on ML Systems: From Security Analysis to Attack Mitigation
Zou, Q., Zhang, L., Singhal, A., Sun, X., & Liu, P. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-23690-7_7 · Cited by 2
Debiasing backdoor attack: A benign application of backdoor attack in eliminating data bias
Wu, S., He, Q., Zhang, Y., Lü, D., & Sang, J. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119171 · Cited by 3
Natural and Imperceptible Backdoor Attack against Deep Neural Networks
Ni, S., Wang, X., Shang, Y., & Zhang, L. (2023) · International Conference on Electronic Communication and Artificial Intelligence (ICECAI) · doi:10.1109/icecai58670.2023.10176925 · Cited by 2
ACQ: Few-shot Backdoor Defense via Activation Clipping and Quantizing
Jin, Y., Zhang, X., Lou, J., & Chen, X. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612410 · Cited by 2
Self-citationBidirectional Contrastive Split Learning for Visual Question Answering
Sun, Y., & Ochiai, H. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i19.30158 · Cited by 2
Text Select-Backdoor: Selective Backdoor Attack for Text Recognition Systems
Kwon, H., & Baek, J.-W. (2024) · IEEE Access · doi:10.1109/access.2024.3436586 · Cited by 2
CatchBackdoor: Backdoor Detection via Critical Trojan Neural Path Fuzzing
Jin, H., Chen, R., Chen, J., Zheng, H., Zhang, Y., & Wang, H. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72970-6_6 · Cited by 2
Multi-Target Invisibly Trojaned Networks for Visual Recognition and Detection
Zhou, X., Jiang, W., Qi, S., & Mu, Y. (2021) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/477 · Cited by 2
Security of Deep Learning Models in 5G Networks: Proposition of Security Assessment Process
Ftaimi, A., & Mazri, T. (2021) · Smart innovation, systems and technologies · doi:10.1007/978-981-16-3637-0_28 · Cited by 2
Zhang, Q., Wang, C., Xin, C., & Wu, H. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.05184 · Cited by 4
Hacking Neural Networks: A Short IntroductionPreprint
Kissner, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07658 · Cited by 2
Decamouflage: A Framework to Detect Image-Scaling Attacks on Convolutional Neural NetworksPreprint
Kim, B., Abuadbba, A., Gao, Y., Zheng, Y., Ahmed, M. E., Kim, H., & Nepal, . (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.03735 · Cited by 2
Detecting Adversarial Patches with Class Conditional Reconstruction NetworksPreprint
Deng, P., Rahman, M. S., & Wright, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.05850 · Cited by 2
Spinning Sequence-to-Sequence Models with Meta-BackdoorsPreprint
Bagdasaryan, E., & Shmatikov, V. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.10443 · Cited by 4
Towards robust image classification with deep learning and real-time DNN inference on mobile
Zhao, P. (2020) · doi:10.17760/d20416558 · Cited by 2
Autonomous System Subversion Tactics: Prototypes and Recommended Countermeasures
Spirito, C. M., Gomez, J., Simon, T., Zhang, F., Yockey, P., Sharma, T., Skolnick, A., Kerby, L., Mena, P., Elzinga, E., et al. (2022) · doi:10.2172/1901802 · Cited by 2
Metadata
- Authors
- Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X.
- Affiliations
- Purdue University West Lafayette (US)
- Nanjing University (CN)
- Venue
- Proceedings 2018 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2018
- OpenAlex
- W2753783305
- Cited by
- 1,270
- References
- 49
- Citations by year
- 2026: 114 · 2025: 193 · 2024: 206 · 2023: 184 · 2022: 149 · 2021: 185 · 2020: 153 · 2019: 59 · 2018: 26
- FWCI
- 43.17
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- public-domain
- Locations
- Network and Distributed System Security Symposium (publishedVersion, public-domain)
- Rutgers University Community Repository (Rutgers University) (submittedVersion)
- Purdue e-Pubs (Purdue University System) (submittedVersion)
- Funders
- National Science Foundation (1748764, 1320444, 1409668)
- Defense Advanced Research Projects Agency (FA-8650-15-C-7562, FA8650-15C)
- Office of Naval Research (N000141712947, N000141410468)
- Sandia National Laboratories (1701331)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- neural network security, stealthy attacks, model poisoning, autonomous driving safety
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
