DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Open accessAbstract
Deep Neural Networks (DNNs) are vulnerable to Neural Trojan (NT) attacks where the adversary injects malicious behaviors during DNN training. This type of ‘backdoor’ attack is activated when the input is stamped with the trigger pattern specified by the attacker, resulting in an incorrect prediction of the model. Due to the wide application of DNNs in various critical fields, it is indispensable to inspect whether the pre-trained DNN has been trojaned before employing a model. Our goal in this paper is to address the security concern on unknown DNN to NT attacks and ensure safe model deployment. We propose DeepInspect, the first black-box Trojan detection solution with minimal prior knowledge of the model. DeepInspect learns the probability distribution of potential triggers from the queried model using a conditional generative model, thus retrieves the footprint of backdoor insertion. In addition to NT detection, we show that DeepInspect’s trigger generator enables effective Trojan mitigation by model patching. We corroborate the effectiveness, efficiency, and scalability of DeepInspect against the state-of-the-art NT attacks across various benchmarks. Extensive experiments show that DeepInspect offers superior detection performance and lower runtime overhead than the prior work.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
DP may hurt the accuracy of the learned model.
“Furthermore, DP may hurt the accuracy of the learned model [170], which may not be appealing to the industry.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
You Only Look Once: Unified, Real-Time Object Detection
Redmon, J., Divvala, S., Girshick, R., & Farhadi, A. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.91 · Cited by 53,803 · see citing works
Image-to-Image Translation with Conditional Adversarial Networks
Isola, P., Zhu, J.-Y., Zhou, T., & Efros, A. A. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.632 · Cited by 22,930 · see citing works
Dermatologist-level classification of skin cancer with deep neural networks
Esteva, A., Kuprel, B., Novoa, R. A., Ko, J., Swetter, S. M., Blau, H. M., & Thrun, S. (2017) · Nature · doi:10.1038/nature21056 · Cited by 14,362 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479 · see citing works
On Assessing ML Model Robustness: A Methodological Framework (Academic Track)
Awadid, A., & Robert, B. (2025) · OASIcs : OpenAccess Series in Informatics · doi:10.4230/oasics.saia.2024.1 · Cited by 4,723 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural NetworksPreprint
Shafahi, A., Huang, W., Najibi, M., Suciu, O., Studer, C., Dumitraş, T., & Goldstein, T. (2018) · arXiv (Cornell University) · doi:10.3929/ethz-b-000460348 · Cited by 626 · see citing works
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018) · arXiv · doi:10.48550/arxiv.1811.03728 · Cited by 485 · see citing works
SentiNet: Detecting Physical Attacks Against Deep Learning SystemsPreprint
Chou, E., Tramèr, F., Pellegrino, G., & Boneh, D. (2018) · arXiv (Cornell University) · Cited by 76 · see citing works
Stealthy poisoning attacks on PCA-based anomaly detectors
Rubinstein, B. I. P., Nelson, B. A., Huang, L., Joseph, A. D., Lau, S.-H., Rao, S. B., Taft, N., & Tygar, J. D. (2009) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1639562.1639592 · Cited by 62 · see citing works
DeepFense: Online Accelerated Defense Against Adversarial Deep LearningPreprint
Rouhani, B. D., Samragh, M., Javaheripi, M., Javidi, T., & Koushanfar, F. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1709.02538 · Cited by 10 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Self-citationSecurity and Privacy Challenges of Large Language Models: A Survey
Das, B. C., Amini, M. H., & Wu, Y. (2025) · ACM Computing Surveys · doi:10.1145/3712001 · Cited by 445 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Detecting AI Trojans Using Meta Neural Analysis
Xu, X., Wang, Q., Li, H., Borisov, N., Gunter, C. A., & Li, B. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00034 · Cited by 278 · see citing works
Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263 · see citing works
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural NetworksPreprint
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., & Ma, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.05930 · Cited by 264 · see citing works
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Doan, K., Lao, Y., Zhao, W., & Li, P. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01175 · Cited by 211 · see citing works
DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
Qiu, H., Zeng, Y., Guo, S., Zhang, T., Meikang Qiu, A., & Thuraisingham, B. M. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453108 · Cited by 196 · see citing works
Rethinking the Backdoor Attacks’ Triggers: A Frequency Perspective
Zeng, Y., Park, W., Mao, Z. M., & Jia, R. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01616 · Cited by 193 · see citing works
A survey of Deep Neural Network watermarking techniques
Li, Y., Wang, H., & Barni, M. (2021) · Neurocomputing · doi:10.1016/j.neucom.2021.07.051 · Cited by 177 · see citing works
An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks
Tang, R., Du, M., Liu, N., Yang, F., & Hu, X. (2020) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3394486.3403064 · Cited by 172 · see citing works
BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning
Jia, J., Liu, Y., & Gong, N. Z. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833644 · Cited by 171 · see citing works
Adversarial machine learning :
Vassilev, A., Oprea, A., Fordyce, A. J., & Anderson, H. S. (2024) · doi:10.6028/nist.ai.100-2e2023 · Cited by 194 · see citing works
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
Cinà, A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., & Roli, F. (2023) · ACM Computing Surveys · doi:10.1145/3585385 · Cited by 152 · see citing works
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive ReviewPreprint
Gao, Y., Doan, B. G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, ., & Kim, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.10760 · Cited by 207 · see citing works
Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification
Cheng, S., Liu, Y., Ma, S., & Zhang, X. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i2.16201 · Cited by 137 · see citing works
FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information
Cao, X., Jia, J., Zhang, Z., & Gong, N. Z. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179336 · Cited by 126 · see citing works
Adversarial Neuron Pruning Purifies Backdoored Deep ModelsPreprint
Wu, D., & Wang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14430 · Cited by 122 · see citing works
Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
Wang, R., Zhang, G., Liu, S., Chen, P., Xiong, J., & Wang, M. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58592-1_14 · Cited by 116 · see citing works
RAB: Provable Robustness Against Backdoor Attacks
Weber, M., Xu, X., Karlaš, B., Zhang, C., & Li, B. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179451 · Cited by 115 · see citing works
Wang, Z., Zhai, J., & Ma, S. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01465 · Cited by 111 · see citing works
An Invisible Black-Box Backdoor Attack Through Frequency Domain
Wang, T., Yao, Y., Xu, F., An, S., Tong, H., & Wang, T. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-19778-9_23 · Cited by 127 · see citing works
Rethinking the Trigger of Backdoor AttackPreprint
Li, Y., Zhai, T., Wu, B., Jiang, Y., Li, Z., & Xia, S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.04692 · Cited by 132 · see citing works
Trojaning Language Models for Fun and Profit
Zhang, X., Zhang, Z., Ji, S., & Wang, T. (2021) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp51992.2021.00022 · Cited by 103 · see citing works
Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning
Li, L., Song, D., Li, X., Zeng, J., Ma, R., & Qiu, X. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.241 · Cited by 112 · see citing works
Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networks
Gao, Y., Kim, Y., Doan, B. G., Zhang, Z., Zhang, G., Nepal, ., Ranasinghe, D. C., & Kim, H. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3055844 · Cited by 96 · see citing works
Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models
Shan, S., Ding, W., Passananti, J., Wu, S. L., Zheng, H.-T., & Zhao, B. Y. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00207 · Cited by 117 · see citing works
Yang, W., Li, L., Zhang, Z., Ren, X., Sun, X., & He, B. (2021) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2021.naacl-main.165 · Cited by 107 · see citing works
Backdoor Defense with Machine Unlearning
Liu, Y., Fan, M., Chen, C., Liu, X., Ma, Z., Wang, L., & Ma, J. (2022) · IEEE INFOCOM 2022 - IEEE Conference on Computer Communications · doi:10.1109/infocom48880.2022.9796974 · Cited by 95 · see citing works
An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences
Guo, W., Tondi, B., & Barni, M. (2022) · IEEE Open Journal of Signal Processing · doi:10.1109/ojsp.2022.3190213 · Cited by 91 · see citing works
Black-box Detection of Backdoor Attacks with Limited Information and Data
Dong, Y., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., & Zhu, J. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01617 · Cited by 92 · see citing works
A Tale of Evil Twins: Adversarial Inputs versus Poisoned Models
Pang, R., Shen, H., Zhang, X., Ji, S., Vorobeychik, Y., Luo, X., Liu, A., & Wang, T. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417253 · Cited by 85 · see citing works
Zhao, Z., Chen, X., Xuan, Y., Dong, Y., Wang, D., & Liang, K. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01478 · Cited by 84 · see citing works
Rethinking Stealthiness of Backdoor Attack against NLP Models
Yang, W., Lin, Y., Li, P., Zhou, J., & Sun, X. (2021) · doi:10.18653/v1/2021.acl-long.431 · Cited by 82 · see citing works
Testability and Dependability of AI Hardware: Survey, Trends, Challenges, and Perspectives
Su, F., Liu, C., & Stratigopoulos, H. (2023) · IEEE Design and Test · doi:10.1109/mdat.2023.3241116 · Cited by 78 · see citing works
TrojDRL: Evaluation of Backdoor Attacks on Deep Reinforcement Learning
Kiourti, P., Wardega, K., Jha, S., & Li, W. (2020) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1109/dac18072.2020.9218663 · Cited by 73 · see citing works
DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injection
Li, Y., Hua, J., Wang, H., Chen, C., & Liu, Y. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) · doi:10.1109/icse43902.2021.00035 · Cited by 75 · see citing works
A Systematic Review of Adversarial Machine Learning Attacks, Defensive Controls and Technologies
Malik, J., Muthalagu, R., & Pawar, P. M. (2024) · IEEE Access · doi:10.1109/access.2024.3423323 · Cited by 76 · see citing works
Liu, Y., Mondal, A., Chakraborty, A., Zuzak, M., Jacobsen, N., Xing, D., & Srivastava, A. (2020) · International Symposium on Quality Electronic Design (ISQED) · doi:10.1109/isqed48828.2020.9137011 · Cited by 70 · see citing works
ProFlip: Targeted Trojan Attack with Progressive Bit Flips
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00762 · Cited by 71 · see citing works
Self-citationTowards Inspecting and Eliminating Trojan Backdoors in Deep Neural Networks
Guo, W., Wang, L., Xu, Y. H., Xing, X., Du, M., & Song, D. X. (2020) · Proceedings · doi:10.1109/icdm50108.2020.00025 · Cited by 68 · see citing works
Adversarial Unlearning of Backdoors via Implicit Hypergradient
Zeng, Y., Chen, S., Park, W., Mao, Z. M., Jin, M., & Jia, R. (2021) · VTechWorks (Virginia Tech) · doi:10.48550/arxiv.2110.03735 · Cited by 88 · see citing works
RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models
Yang, W., Lin, Y., Li, P., Zhou, J., & Sun, X. (2021) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2021.emnlp-main.659 · Cited by 72 · see citing works
NeuronInspect: Detecting Backdoors in Neural Networks via Output ExplanationsPreprint
Huang, X., Alzantot, M., & Srivastava, M. B. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07399 · Cited by 85 · see citing works
On Certifying Robustness against Backdoor Attacks via Randomized SmoothingPreprint
Wang, B., Cao, X., jia, J., & Gong, N. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11750 · Cited by 63 · see citing works
ADFL: Defending backdoor attacks in federated learning via adversarial distillation
Zhu, C., Zhang, J., Sun, X., Chen, B., & Meng, W. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103366 · Cited by 61 · see citing works
Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks
Qi, X., Xie, T., Pan, R., Zhu, J., Yang, Y., & Bu, K. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01299 · Cited by 55 · see citing works
Piccolo: Exposing Complex Backdoors in NLP Transformer Models
Liu, Y., Shen, G., Tao, G., An, S., Ma, S., & Zhang, X. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833579 · Cited by 54 · see citing works
Naseri, M., Hayes, J., & Cristofaro, E. D. (2020) · arXiv (Cornell University) · Cited by 54 · see citing works
Athena: Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0072 · Cited by 51 · see citing works
Wang, H., Xiang, Z. J., Miller, D. J., & Kesidis, G. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00015 · Cited by 53 · see citing works
T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text ClassificationPreprint
Azizi, A., Tahmid, I. A., Waheed, A., Mangaokar, N., Pu, J., Javed, M., Reddy, C. K. A., & Viswanath, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.04264 · Cited by 51 · see citing works
Imperceptible Backdoor Attack: From Input Space to Feature Representation
Zhong, N., Qian, Z., & Zhang, X. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/242 · Cited by 49 · see citing works
Defense-Resistant Backdoor Attacks Against Deep Neural Networks in Outsourced Cloud Environment
Gong, X., Chen, Y., Wang, Q., Huang, H., Meng, L., Shen, C. Q., & Zhang, Q. (2021) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2021.3087237 · Cited by 47 · see citing works
Yoshida, K., & Fujino, T. (2020) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3411508.3421375 · Cited by 47 · see citing works
Backdoor Defense via Deconfounded Representation Learning
Zhang, Z., Liu, Q., Wang, Z., Lu, Z., & Hu, Q. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01177 · Cited by 46 · see citing works
Transferable Graph Backdoor Attack
Yang, S., Doan, B. G., Montague, P., Vel, O. D., Abraham, T., Camtepe, S. A., Ranasinghe, D. C., & Kanhere, S. S. (2022) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3545948.3545976 · Cited by 45 · see citing works
TrojanPuzzle: Covertly Poisoning Code-Suggestion Models
Aghakhani, H., Dai, W., Manoel, A., Fernandes, X., Kharkar, A., Kruegel, C., Vigna, G., Evans, D., Zorn, B., & Sim, R. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00140 · Cited by 52 · see citing works
Triggerless Backdoor Attack for NLP Tasks with Clean Labels
Gan, L., Li, J., Zhang, T., Li, X., Meng, Y., Wu, F. Q., Yang, Y., Guo, S., & Fan, C. C. (2022) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2022.naacl-main.214 · Cited by 45 · see citing works
Backdoor Attacks and Defenses Targeting Multi-Domain AI Models: A Comprehensive Review
Zhang, S., Pan, Y., Liu, Q., Yan, Z., Choo, K. R., & Wang, G. (2024) · ACM Computing Surveys · doi:10.1145/3704725 · Cited by 47 · see citing works
Backdoors in Neural Models of Source Code
Ramakrishnan, G., & Albarghouthi, A. (2022) · Proceedings - International Conference on Pattern Recognition/Proceedings/International Conference on Pattern Recognition · doi:10.1109/icpr56361.2022.9956690 · Cited by 42 · see citing works
Few-shot Backdoor Defense Using Shapley Estimation
Guan, J., Tu, Z., He, R., & Tao, D. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01300 · Cited by 42 · see citing works
Security for Machine Learning-based Software Systems: A Survey of Threats, Practices, and Challenges
Chen, H., & Babar, M. A. (2023) · ACM Computing Surveys · doi:10.1145/3638531 · Cited by 50 · see citing works
Self-citationText Backdoor Detection Using an Interpretable RNN Abstract Model
Fan, M., Si, Z., Xie, X., Liu, Y., & Liu, T. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3103064 · Cited by 38 · see citing works
You Are Catching My Attention: Are Vision Transformers Bad Learners under Backdoor Attacks?
Yuan, Z., Zhou, P., Zou, K., & Cheng, Y. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02357 · Cited by 40 · see citing works
Complex Backdoor Detection by Symmetric Feature Differencing
Liu, Y., Shen, G., Tao, G., Wang, Z., Ma, S., & Zhang, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01458 · Cited by 37 · see citing works
Defense against neural trojan attacks: A survey
Kaviani, S., & Sohn, I. (2020) · Neurocomputing · doi:10.1016/j.neucom.2020.07.133 · Cited by 37 · see citing works
Defending against Backdoor Attacks in Natural Language Generation
Sun, X., Li, X., Meng, Y., Ao, X., Lyu, L., Li, J., & Zhang, T. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i4.25656 · Cited by 38 · see citing works
Li, M., Zhong, Q., Zhang, L. Y., Du, Y., Zhang, J., & Xiang, Y. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00062 · Cited by 34 · see citing works
Ali, H., Chen, D., Harrington, M., Salazar, N., Ameedi, M. A., Khan, A. F., Butt, A. R., & Cho, J.-H. (2023) · IEEE Access · doi:10.1109/access.2023.3326410 · Cited by 37 · see citing works
Backdoor Attack and Defense on Deep Learning: A Survey
Bai, Y., Xing, G., Wu, H., Rao, Z., Ma, C., Wang, S., Liu, X., Zhou, Y., Tang, J., Huang, K., et al. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2024.3482723 · Cited by 36 · see citing works
AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value AnalysisPreprint
Guo, J., Li, A., & Liu, C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.14880 · Cited by 39 · see citing works
Mengara, O., Avila, A. R., & Falk, T. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355816 · Cited by 32 · see citing works
Enhancing Backdoor Attacks With Multi-Level MMD Regularization
Xia, P., Niu, H., Li, Z., & Li, B. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3161477 · Cited by 32 · see citing works
Quantization Backdoors to Deep Learning Commercial Frameworks
Ma, H., Qiu, H., Gao, Y., Zhang, Z., Abuadbba, A., Xue, M., Fu, A., Zhang, J., Al-Sarawi, S. F., & Abbott, D. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3271956 · Cited by 30 · see citing works
Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers
Li, Y., Chen, Z., Cortellazzi, J., Pendlebury, F., Tu, K., Pierazzi, F., Cavallaro, L., & Wang, G. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179347 · Cited by 34 · see citing works
FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning
Zhao, C., Wen, Y., Li, S., Liu, F., & Meng, D. (2021) · ACM Workshop on Information Hiding and Multimedia Security (IH&MMSec) · doi:10.1145/3437880.3460403 · Cited by 29 · see citing works
Stealthy Backdoors as Compression Artifacts
Tian, Y., Suya, F., Xu, F., & Evans, D. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3160359 · Cited by 27 · see citing works
Redeem Myself: Purifying Backdoors in Deep Learning Models using Self Attention Distillation
Gong, X., Chen, Y., Wang, Y., Wang, Q., Gu, Y., Huang, H., & Shen, C. Q. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179375 · Cited by 28 · see citing works
Backdoor Cleansing with Unlabeled Data
Pang, L., Sun, T., Ling, H., & Chen, C. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.01176 · Cited by 28 · see citing works
Xiang, Z. J., Miller, D. J., & Kesidis, G. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102280 · Cited by 27 · see citing works
Zhou, Y., Ni, T., Lee, W., & Zhao, Q. (2025) · Transactions on Artificial Intelligence · doi:10.53941/tai.2025.100003 · Cited by 34 · see citing works
Detection of Lying Electrical Vehicles in Charging Coordination Using Deep Learning
Shafee, A. A., Fouda, M. M., Mahmoud, M. M. E. A., Aljohani, A. J., Alasmary, W., & Amsaad, F. (2020) · IEEE Access · doi:10.1109/access.2020.3028097 · Cited by 25 · see citing works
Fragile Neural Network Watermarking with Trigger Image Set
Zhu, R., Ping, W., Li, S., Yin, Z., Zhang, X., & Qian, Z. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-82136-4_23 · Cited by 25 · see citing works
A Case Study of Integrating Fairness Visualization Tools in Machine Learning Education
Mashhadi, A., Zolyomi, A., & Quedado, J. (2022) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/3491101.3503568 · Cited by 25 · see citing works
Stealthy and Flexible Trojan in Deep Learning Framework
Wang, Y., Chen, K., Tan, Y., Huang, S., Ma, W., & Li, Y. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3164073 · Cited by 25 · see citing works
A defense method against backdoor attacks on neural networks
Kaviani, S., Shamshiri, S., & Sohn, I. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.118990 · Cited by 25 · see citing works
Robust federated learning with attack-adaptive aggregation
Wan, C. P. (2022) · doi:10.14711/thesis-991012994506603412 · Cited by 24 · see citing works
TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoors
Pang, R., Zhang, Z., Gao, X., Xi, Z., Ji, S., Cheng, P., Luo, X., & Wang, T. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00048 · Cited by 31 · see citing works
A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems
Roux, Q. L., Bourbao, E., Teglia, Y., & Kallas, K. (2024) · IEEE Access · doi:10.1109/access.2024.3382584 · Cited by 24 · see citing works
AI-Lancet: Locating Error-inducing Neurons to Optimize Neural Networks
Zhao, Y., Zhu, H. G., Chen, K., & Zhang, S. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484818 · Cited by 23 · see citing works
Verification of integrity of deployed deep learning models using Bayesian Optimization
Kuttichira, D. P., Gupta, S., Nguyen, D., Rana, S., & Venkatesh, S. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.108238 · Cited by 23 · see citing works
NTD: Non-Transferability Enabled Deep Learning Backdoor Detection
Li, Y., Ma, H., Zhang, Z., Gao, Y., Abuadbba, A., Xue, M., Fu, A., Zheng, Y., Al-Sarawi, S. F., & Abbott, D. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3312973 · Cited by 27 · see citing works
Resisting Distributed Backdoor Attacks in Federated Learning: A Dynamic Norm Clipping Approach
Guo, Y., Wang, Q., Ji, T., Wang, X., & Li, P. (2021) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata52589.2021.9671910 · Cited by 22 · see citing works
Backdoor Attacks on Time Series: A Generative Approach
Jiang, Y., Ma, X., Erfani, S., & Bailey, J. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00034 · Cited by 24 · see citing works
Evaluating the Robustness of Trigger Set-Based Watermarks Embedded in Deep Neural Networks
Lee, S., Song, W., Jana, S., Cha, M., & Son, S. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3196790 · Cited by 21 · see citing works
Tutorial: Toward Robust Deep Learning against Poisoning Attacks
Chen, H., & Koushanfar, F. (2022) · ACM Transactions on Embedded Computing Systems · doi:10.1145/3574159 · Cited by 21 · see citing works
Self-citation
- Authors
- Chen, H., Fu, C., Zhao, J., & Koushanfar, F.
- Affiliations
- University of California San Diego (US)
- Venue
- Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence
- Published
- 2019-08
- Pages
- 4658-4664
- OpenAlex
- W2966689772
- Cited by
- 314
- References
- 17
- Citations by year
- 2026: 15 · 2025: 43 · 2024: 51 · 2023: 55 · 2022: 49 · 2021: 69 · 2020: 30 · 2019: 1 · 2018: 1
- FWCI
- 14.25
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Joint Conference on Artificial Intelligence (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- backdoor attacks, deep neural network security, conditional generative models
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
