The DOI matches its Crossref record; 17 of the 17 references it cites were found in a registry or an index.
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Open accessAbstract
Deep Neural Networks (DNNs) are vulnerable to Neural Trojan (NT) attacks where the adversary injects malicious behaviors during DNN training. This type of ‘backdoor’ attack is activated when the input is stamped with the trigger pattern specified by the attacker, resulting in an incorrect prediction of the model. Due to the wide application of DNNs in various critical fields, it is indispensable to inspect whether the pre-trained DNN has been trojaned before employing a model. Our goal in this paper is to address the security concern on unknown DNN to NT attacks and ensure safe model deployment. We propose DeepInspect, the first black-box Trojan detection solution with minimal prior knowledge of the model. DeepInspect learns the probability distribution of potential triggers from the queried model using a conditional generative model, thus retrieves the footprint of backdoor insertion. In addition to NT detection, we show that DeepInspect’s trigger generator enables effective Trojan mitigation by model patching. We corroborate the effectiveness, efficiency, and scalability of DeepInspect against the state-of-the-art NT attacks across various benchmarks. Extensive experiments show that DeepInspect offers superior detection performance and lower runtime overhead than the prior work.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Furthermore, DP may hurt the accuracy of the learned model [170], which may not be appealing to the industry.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
You Only Look Once: Unified, Real-Time Object Detection
Redmon, J., Divvala, S., Girshick, R., & Farhadi, A. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.91 · Cited by 53,803
Image-to-Image Translation with Conditional Adversarial Networks
Isola, P., Zhu, J.-Y., Zhou, T., & Efros, A. A. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.632 · Cited by 22,930
Dermatologist-level classification of skin cancer with deep neural networks
Esteva, A., Kuprel, B., Novoa, R. A., Ko, J., Swetter, S. M., Blau, H. M., & Thrun, S. (2017) · Nature · doi:10.1038/nature21056 · Cited by 14,362
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479
On Assessing ML Model Robustness: A Methodological Framework (Academic Track)
Awadid, A., & Robert, B. (2025) · OASIcs : OpenAccess Series in Informatics · doi:10.4230/oasics.saia.2024.1 · Cited by 4,723
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,577
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Cited by
Sorted by citations
Items 101–200 of 315
Defending Backdoor Attacks on Vision Transformer via Patch Processing
Doan, K. D., Lao, Y., Yang, P., & Li, P. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i1.25125 · Cited by 30
Scalable Backdoor Detection in Neural Networks
Harikumar, H., Le, V., Rana, S., Bhattacharya, S., Gupta, S., & Venkatesh, S. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-67661-2_18 · Cited by 24
Cassandra: Detecting Trojaned Networks From Adversarial Perturbations
Zhang, X., Gupta, R., Mian, A. S., Rahnavard, N., & Shah, M. (2021) · IEEE Access · doi:10.1109/access.2021.3101289 · Cited by 25
“DeepInspect [4] uses conditional GAN to reconstruct trigger patterns for Trojan detection.”
MethodArtificial intelligence security and privacy: a survey
He, X., Xu, G., Han, X., Wang, Q., Zhao, L., Shen, C., Lin, C., Zhao, Z., Li, Q., Yang, L., et al. (2025) · Science China Information Sciences · doi:10.1007/s11432-025-4388-5 · Cited by 24
Information Leakage by Model Weights on Federated Learning
Xu, X.-Y., Wu, J., Yang, M., Luo, T., Duan, X., Li, W., Wu, Y., & Wu, B. L. (2020) · doi:10.1145/3411501.3419423 · Cited by 21
“DeepInspect [6] achieves similar performance as Neural Cleanse without white-box access to the model, but it still can be improved when detecting multi-target attacks.”
MethodSusceptibility & defense of satellite image-trained convolutional networks to backdoor attacks
Brewer, E., Lin, J., & Runfola, D. M. (2022) · Information Sciences · doi:10.1016/j.ins.2022.05.004 · Cited by 21
BDMMT: Backdoor Sample Detection for Language Models Through Model Mutation Testing
Wei, J., Fan, M. Y., Jiao, W., Jin, W., & Liu, T. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3376968 · Cited by 26
Trojan Signatures in DNN Weights
Fields, G., Samragh, M., Javaheripi, M., Koushanfar, F., & Javidi, T. (2021) · IEEE International Conference on Computer Vision Workshops · doi:10.1109/iccvw54120.2021.00008 · Cited by 20
“Follow up work [2] proposes to use a conditional GAN to replace the clean dataset and improve the runtime.”
BackgroundMethodInfluentialSelf-citationThe Dark Side of Dynamic Routing Neural Networks: Towards Efficiency Backdoor Injection
Chen, S., Chen, H., Haque, M., Liu, C., & Yang, W. H. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.02355 · Cited by 19
“Infected models can be identified by monitoring neuron activation [26], or by using model inversion to reconstruct the training set and determine if a model is infected [4].”
BackgroundSelf-citationWen, J., Zhao, B. Z. H., Xue, M., Oprea, A., & Qian, H. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3087332 · Cited by 19
“DeepInspect [44], a detection framework, is proposed to leverage a conditional generation model to learn the probability distribution of potential triggers from the queried model to retrieve fingerprints left behind during the insertion of the backdoor.”
A multitarget backdooring attack on deep neural networks with random location trigger
Xiao, Y., Liu, C., Ming-wen, Z., Yajie, W., Xinrui, L., Shuxiao, S., Yuexuan, M., & Zheng, J. (2021) · International Journal of Intelligent Systems · doi:10.1002/int.22785 · Cited by 19
“17,18 Suppose our attack method is a white box attack, that is, the attacker can access the training data set of the target classifier.”
MethodATTEQ-NN: Attention-based QoE-aware Evasive Backdoor Attacks
Gong, X., Chen, Y., Dong, J., & Wang, Q. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24012 · Cited by 18
“Since backdoor attacks tweak both the input (via the trigger) and the model, defenses can be categorized into data-based defenses [21], [15], [81], [68], [8], [69] and modelbased defenses [71], [44], [8], [26], [10], [37].”
BackgroundMethodYan, Z., Li, S., Zhao, R., Tian, Y., & Zhao, Y. (2023) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3579856.3582822 · Cited by 17
“Many model diagnosing methods [6, 49] have been developed to identify hidden backdoors, but the victim DNN models where backdoors are identified still need to be repaired by backdoor erasing methods.”
BackgroundMethodAI-Guardian: Defeating Adversarial Attacks using Backdoors
Zhu, H. G., Zhang, S., & Chen, K. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179473 · Cited by 18
“However, DeepInspect, TABOR and ABS can only reconstruct the trigger used in the class-agnostic backdoor, while the bijection backdoor can be viewed as multiple class-specific backdoors that share the same trigger as discussed in Section IV-A.”
BackgroundA Novel Framework for Smart Cyber Defence: A Deep-Dive Into Deep Learning Attacks and Defences
Arshad, I., Alsamhi, S. H., Qiao, Y., Lee, B., & Ye, Y. (2023) · IEEE Access · doi:10.1109/access.2023.3306333 · Cited by 21
“For example, here in [47], when inverting the models to extract the training data, ultimately violates data privacy which is the core of adopting FL.”
BackgroundMethodInfluentialTROJANZOO: Everything you ever wanted to know about neural backdoors (but were afraid to ask).Preprint
Pang, R., Zhang, Z., Gao, X., Xi, Z., Ji, S., Cheng, P., & Wang, T. (2020) · arXiv (Cornell University) · Cited by 19
Critical Path-Based Backdoor Detection for Deep Neural Networks
Jiang, W., Wen, X., Zhan, J., Wang, X., Song, Z., & Bian, C. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3201586 · Cited by 16
“The size of a trigger affects the detection performance of NC since it impacts the test statistics [7].”
BackgroundLiu, Z., Li, F., Li, Z., & Luo, B. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560678 · Cited by 17
Yu, Y., Liu, J., Guo, H., Mao, B., & Kato, N. (2023) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2023.3345379 · Cited by 16
“DeepInspect [44] learns the probability distribution of potential triggers from the queried model and retrieves the foot-print of backdoors.”
BackgroundQiu, H., Ma, H., Zhang, Z., Gao, Y., Zheng, Y., Fu, A., Zhou, P., Abbott, D., & Al-Sarawi, S. F. (2022) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2022.3197499 · Cited by 16
“TrojanNet attack can naturally bypass a number of backdoor inspection countermeasures such as Neural Cleanse [46], DeepInspect [47].”
BackgroundCan We Mitigate Backdoor Attack Using Adversarial Detection Methods?
Jin, K., Zhang, T., Shen, C. Q., Chen, Y., Fan, M. Y., Lin, C., & Liu, T. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3194642 · Cited by 25
“Most works [27], [28], [29], [30], [31], [32] attempted to detect and remove malicious backdoor in the target models.”
BackgroundMethodQuarantine: Sparsity Can Uncover the Trojan Attack Trigger for Free
Chen, T., Zhang, Z., Zhang, Y., Chang, S., Liu, S., & Wang, Z. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.00068 · Cited by 18
Backdoor Attack with Sample-Specific Triggers.Preprint
Li, Y., Li, Y., Wu, B., Li, L., He, R., & Lyu, S. (2020) · arXiv (Cornell University) · Cited by 16
Detecting backdoor in deep neural networks via intentional adversarial perturbations
Xue, M., Wu, Y., Wu, Z., Zhang, Y., Wang, J., & Liu, W. (2023) · Information Sciences · doi:10.1016/j.ins.2023.03.112 · Cited by 16
“Chen et al. [19] proposed a GAN-based defense method called DeepInspect.”
MethodXu, C., Liu, W., Zheng, Y., Wang, S., & Chang, C.-H. (2023) · IEEE Transactions on Circuits and Systems I Regular Papers · doi:10.1109/tcsi.2023.3298802 · Cited by 16
“DeepInspect [26] improved upon Neural Cleanse by reconstructing triggers for multiple suspected labels without any clean data and in one run, thus relaxing the reliance on prior knowledge of the defender and reducing the computational cost.”
BackgroundTextGuard: Provable Defense against Backdoor Attacks on Text Classification
Pei, H., Jia, J., Guo, W., Li, B., & Song, D. X. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24090 · Cited by 25
Backdoor Attacks on the DNN Interpretation System
Fang, S., & Choromanska, A. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i1.19935 · Cited by 16
Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attacks
Chen, S., Yang, W., Zhang, Z., Bi, X., & Sun, X. (2022) · Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP) · doi:10.18653/v1/2022.findings-emnlp.47 · Cited by 17
Trigger Hunting with a Topological Prior for Trojan DetectionPreprint
Hu, X., Lin, X., Cogswell, M., Yao, Y., Jha, S., & Chen, C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.08335 · Cited by 15
“Persistent-homology-based losses have been applied to other imaging (Abousamra et al., 2021; Wang et al., 2020a) and learning problems (Hofer et al., 2019; 2020; Carrière et al., 2020; Chen et al., 2019b).”
BackgroundMethodInfluentialOn Model Outsourcing Adaptive Attacks to Deep Learning Backdoor Defenses
Peng, H., Qiu, H., Ma, H., Wang, S., Fu, A., Al-Sarawi, S. F., Abbott, D., & Gao, Y. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3349869 · Cited by 17
“Because the usage of these triggers often already breaches threat model assumptions of some defenses, especially those model diagnosis [17], [24], and online data diagnosis defenses [16], [25], [45], it is unsurprisingly that they can trivially bypass those defenses.”
NeuralSanitizer: Detecting Backdoors in Neural Networks
Zhu, H., Zhao, Y., Zhang, S., & Chen, K. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3390599 · Cited by 14
“Similar to existing works [16], [17], [24], [52], Neural-Sanitizer mainly focuses on detecting the general backdoor with pattern triggers, i.e., the trigger is a pattern attached to the images and the backdoor can cause the victim model to misclassify any Image Attached by the Trigger (IAT) as the…”
BackgroundResultInfluentialSecurity threats to agricultural artificial intelligence: Position and perspective
Gao, Y., Camtepe, S. A., Sultan, N. H., Bui, H. T., Mahboubi, A., Aboutorab, H., Bewong, M., Islam, R., Islam, M. Z., Chauhan, A., et al. (2024) · Computers and Electronics in Agriculture · doi:10.1016/j.compag.2024.109557 · Cited by 18
Watch Out! Simple Horizontal Class Backdoor Can Trivially Evade Defense
Ma, H., Wang, S., Gao, Y., Zhang, Z., Qiu, H., Xue, M., Abuadbba, A., Fu, A., Nepal, ., & Abbott, D. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670361 · Cited by 16
A collaborative deep learning microservice for backdoor defenses in Industrial IoT networks
Liu, Q., Chen, L., Jiang, H., Wu, J., Wang, T., Peng, T., & Wang, G. (2021) · Ad Hoc Networks · doi:10.1016/j.adhoc.2021.102727 · Cited by 16
“To compensate for the limitation of heavy reliance on the access to training datasets, Chen et al. [25] proposed DeepInspect, the first black-box detection framework.”
BackgroundPoisoning Deep Reinforcement Learning Agents with In-Distribution TriggersPreprint
Ashcraft, C., & Karra, K. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.07798 · Cited by 31
“We hypothesize that this makes in-distributions more difficult to detect, because trigger de-2 tection methods typically rely on some manner of anomaly detection (Xu et al., 2019; Chen et al., 2018; 2019; Huang et al., 2019; Liu et al., 2019), and consequently more dangerous.”
Differential Analysis of Triggers and Benign Features for Black-Box DNN Backdoor Detection
Fu, H., Krishnamurthy, P., Garg, S., & Khorrami, F. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3297056 · Cited by 13
“[10], [40], [41], [54], [79] require enough clean validation samples for training the complex novelty detector models, especially for the neural-network-based novelty detectors.”
BackgroundSingle Image Backdoor Inversion via Robust Smoothed Classifiers
Sun, M.-J., & Kolter, J. Z. (2023) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52729.2023.00784 · Cited by 14
“A successful back-door inversion method should be able to recover a backdoor satisfying certain requirements.”
MethodChen, H., Gao, Y., Zhang, A., Sun, P., Jiang, N., Liu, W., & Wang, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3427432 · Cited by 13
“Similar to Neural Cleanse, DeepInspect [22], [23] and Unicorn [24] is also based on trigger synthesis.”
BackgroundSelf-citationT2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models
Wang, Z., Zhang, J., Shan, S., & Chen, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73013-9_7 · Cited by 19
A Feature-Based On-Line Detector to Remove Adversarial-Backdoors by Iterative Demarcation
Fu, H., Veldanda, A. K., Krishnamurthy, P., Garg, S., & Khorrami, F. (2022) · IEEE Access · doi:10.1109/access.2022.3141077 · Cited by 14
Toward a Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasures
Qiu, H., Ma, H., Zhang, Z., Abuadbba, A., Kang, W., Fu, A., & Gao, Y. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3324318 · Cited by 17
“Considering the severe consequences of backdoor attacks, great efforts [24] have been devoted to detecting or eliminating backdoors both from either offline inspection [8], [20], [25], [26], [27] or online inspection [9], [13], [28].”
BackgroundErichson, N. B., Taylor, D., Wu, Q., & Mahoney, M. W. (2021) · Society for Industrial and Applied Mathematics eBooks · doi:10.1137/1.9781611976700.12 · Cited by 18
“In contrast, we will present an efficient approach without such limitations; we detect backdoors and triggers for modern DNNs (e.g., ResNets) in just seconds (as opposed to hours [4, 34]).”
BackgroundMethodInfluentialUnderstanding the Threats of Trojaned Quantized Neural Network in Model Supply Chains
Pan, X., Zhang, M., Yan, Y., & Yang, M. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485881 · Cited by 13
“…two representative branches of trojan defenses categorized based on the applicable scenarios: (i) A major branch of backdoor defenses work under the scenario that the defender is provided with an image classifier and is required to determine whether the classifier is trojaned [13, 27, 43, 49, 60].”
BackgroundSoK: Machine Learning GovernancePreprint
Chandrasekaran, V., Jia, H., Thudi, A., Travers, A., Yaghini, M., & Papernot, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.10870 · Cited by 33
“layers) [202]–[204], investigate the gradients [205], or observe changes in the learned decision boundaries [206], [207].”
BackgroundInspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks
Wang, T., Yao, Y., Xu, F., Xu, M., An, S., & Wang, T. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i1.27780 · Cited by 12
“…methods aim to distinguish poisoned training samples from clean ones given that the current model is tro-janed (Tran, Li, and M ˛adry 2018; Chen et al. 2019a; Hayase et al. 2021); input filtering methods aim to detect whether an input has been corrupted or how to erase triggers in the…”
BackgroundQi, X., Jifeng, Z., Xie, C., & Yang, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.07240 · Cited by 28
“Moreover, even if the backdoor is successfully embedded into the target DNN model, it may still be detected (Xu et al., 2019; Chen et al., 2019; Wang et al., 2019) via a thorough diagnosis by service providers before industrial deployment.”
BackgroundDefenses in Adversarial Machine Learning: A Systematic Survey From the Lifecycle Perspective
Wu, B., Zhu, M., Zheng, M., Zhu, Z., Wei, S., Zhang, M., Chen, H., Yuan, D., Liu, L., & Liu, Q. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3611340 · Cited by 11
“DeepInspect [24] is the pioneering black-box backdoor defense method.”
Self-citationDetecting Trojaned DNNs Using Counterfactual Attributions
Sikka, K., Sur, I., Roy, A., Divakaran, A., & Jha, S. (2023) · IEEE International Conference on Assured Autonomy (ICAA) · doi:10.1109/icaa58325.2023.00019 · Cited by 15
“Trojaned models have been known to have shortcuts in the feature space [55, 7, 62] that allow triggers to switch the model’s prediction from other classes to the target class.”
TOP: Backdoor Detection in Neural Networks via Transferability of PerturbationPreprint
Huster, T. P., & Ekwedike, E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.10274 · Cited by 18
“Several backdoor detection techniques have been proposed in the literature [36, 13, 11, 40, 20, 6].”
A Survey of Security Protection Methods for Deep Learning Model
Peng, H., Bao, S., & Li, L. (2023) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2023.3314398 · Cited by 11
Towards robustness evaluation of backdoor defense on quantized deep learning models
Zhu, Y., Peng, H., Fu, A., Yang, W. Y., Ma, H., Al-Sarawi, S. F., Abbott, D., & Gao, Y. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124599 · Cited by 12
Odyssey: Creation, Analysis and Detection of Trojan Models
Edraki, M., Karim, N., Rahnavard, N., Mian, A. S., & Shah, M. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108407 · Cited by 12
Detect and Remove Watermark in Deep Neural Networks via Generative Adversarial Networks
Sun, S., Wang, H., Xue, M., Zhang, Y., Wang, J., & Liu, W. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-91356-4_18 · Cited by 15
Detecting Backdoor Attacks against Point Cloud Classifiers
Xiang, Z. J., Miller, D. J., Chen, S., Li, X., & Kesidis, G. (2022) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp43922.2022.9747194 · Cited by 10
TAD: Trigger Approximation based Black-box Trojan Detection for AIPreprint
Zhang, X., Chen, H., & Koushanfar, F. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.01815 · Cited by 10
“DeepInspect(DI) [8] is another model-level detection method.”
Self-citationYang, W., Li, L., Zhang, Z., Ren, X., Sun, X. S., & He, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.15543 · Cited by 10
“Against attacking methods, several backdoor defense meth-ods (Chen et al., 2019; Wang et al., 2019; Huang et al., 2019; Wang et al., 2020; Li et al., 2020) are proposed to detect potential triggers and erase backdoor effects hidden in the models.”
MethodMa, B., Zhao, C., Wang, D., & Meng, B. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103212 · Cited by 9
Black-Box Graph Backdoor Defense
Yang, X. Y., Li, G., Tao, X., Zhang, C., & Li, J. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-0808-6_10 · Cited by 9
Zhu, L., Ning, R., Jiang, L., Xin, C., & Wu, H. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i7.28611 · Cited by 9
“A similar idea was also discussed in (Chen et al. 2019b; Zhu et al. 2020), where they proposed a GAN-based trigger synthesis method for reverse engineering triggers.”
BackgroundMethodInfluentialROWBACK: RObust Watermarking for neural networks using BACKdoors
Chattopadhyay, N., & Chattopadhyay, A. (2021) · International Conference on Machine Learning and Applications · doi:10.1109/icmla52953.2021.00274 · Cited by 10
Deep Serial Number: Computational Watermarking for DNN Intellectual Property ProtectionPreprint
Tang, R., Du, M., & Hu, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.08960 · Cited by 12
“The embedded SN should be robust against various attack methods [2, 29, 33].”
MethodChen, C., Wei, L., Zhang, L., Peng, Y., & Ning, J. (2022) · Security and Communication Networks · doi:10.1155/2022/2985308 · Cited by 8
“SentiNet [39], Strip [15], NC [13], DeepInspect [28], and TABOR [42] can be seen as partially preserving model privacy because they are black-box access.”
BackgroundMethodInfluentialBadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models
Yuan, Z., Shi, J., Zhou, P., Gong, N. Z., & Sun, L. (2025) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52734.2025.02785 · Cited by 18
“For white-box detections, Neural Cleanse [42] and DeepInspect [4] use reverse engineering to identify potential triggers.”
SGBA: A stealthy scapegoat backdoor attack against deep neural networks
He, Y., Shen, Z., Xia, C., Hua, J., Tong, W., & Zhong, S. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103523 · Cited by 12
MT-MTD: Muti-Training based Moving Target Defense Trojaning Attack in Edged-AI network
Qiu, Y., Wu, J., Mumtaz, S., Li, J., Al‐Dulaimi, A., & Rodrigues, J. J. P. C. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500545 · Cited by 8
“Deep Inspect [7] detects backdoor attacks through model inversion and generation of adversarial networks.”
BackgroundTowards Effective and Robust Neural Trojan Defenses via Input Filtering
Do, K., Harikumar, H., Lê, H., Nguyen, D. H., Tran, T., Rana, S., Nguyen, D. K., Susilo, W., & Venkatesh, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-20065-6_17 · Cited by 8
An Adaptive Black-Box Defense Against Trojan Attacks (TrojDef)
Liu, G., Khreishah, A. A., Sharadgah, F., & Khalil, I. M. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3204283 · Cited by 9
“Neural Cleanse [17] and DeepInspect [19] are similar approaches that try to eliminate backdoors by reverse-engineering the Trojan trigger which utilizes the gradient information from the model.”
BackgroundDeep Serial Number: Computational Watermark for DNN Intellectual Property Protection
Tang, R., Du, M., & Hu, X. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-43427-3_10 · Cited by 8
“The embedded SN should be robust against various attack methods [2, 29, 33].”
MethodRe-markable: Stealing Watermarked Neural Networks Through Synthesis
Chattopadhyay, N., Viroy, C. S. Y., & Chattopadhyay, A. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-66626-2_3 · Cited by 8
Radio Signal Classification by Adversarially Robust Quantum Machine Learning
Wu, Y., Adermann, E., Thapa, C., Camtepe, S. A., Suzuki, H., & Usman, M. (2026) · Quantum Engineering · doi:10.1155/que2/2148816 · Cited by 16
“In practice, we set the significant level α to 0.05, which is the most commonly used value [40] and recommended as a standard level [41].”
InfluentialBackdoor Attacks on Deep Neural Networks via Transfer Learning from Natural Images
Matsuo, Y., & Takemoto, K. (2022) · Applied Sciences · doi:10.3390/app122412564 · Cited by 8
Graph BackdoorPreprint
Xi, Z., Pang, R., Ji, S., & Wang, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.11890 · Cited by 17
“Motivated by this, intensive research has been conducted on backdoor attacks on general deep neural network (DNN) models, either developing new attack variants [9,19,24,28,32, 47, 49, 65] or improving DNN resilience against existing attacks [7,8,10,13,16,31,56].”
BackgroundLiu, Y., Shen, G., Tao, G., Wang, Z., Ma, S., & Zhang, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.08820 · Cited by 9
“As far as we know, many existing solutions such as [17,24,38,41,48,68,69,71,77] have been tested in the competition by different performers.”
Precise Defense Approach Against Small-Scale Backdoor Attacks in Industrial Internet of Things
Ran, Z., Yao, Y. K., Li, W., Yang, W., Li, W., & Wu, Y. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3490579 · Cited by 6
“Many researches have been devoted to the design of effective trigger detection mechanisms [9], [10], [11], [12], [13].”
Gong, X., Tian, B., Xue, M., Wu, Y. L., Chen, Y., & Wang, Q. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3548970 · Cited by 7
“As far as we know, the exiting backdoor defense works can be categorized into data-based defense [40], [41], [42], [43], [44], [45] and model-based defense [44], [46], [47], [48], [49], [50], [51].”
DB-COVIDNet: A Defense Method against Backdoor Attacks
Shamshiri, S., Han, K. J., & Sohn, I. (2023) · Mathematics · doi:10.3390/math11204236 · Cited by 6
Quantization Backdoors to Deep Learning Models.Preprint
Ma, H., Qiu, H., Gao, Y., Zhang, Z., Abuadbba, A., Fu, A., Al-Sarawi, S. F., & Abbott, D. (2021) · arXiv (Cornell University) · Cited by 7
A lightweight backdoor defense framework based on image inpainting
Wei, Y., Gao, H., Wang, Y., Gao, Y., & Liu, H. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.03.052 · Cited by 6
Robust and privacy-preserving collaborative training: a comprehensive survey
Yang, F., Zhang, X., Guo, S., Chen, D., Gan, Y., Xiang, T., & Liu, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10797-0 · Cited by 17
Stealthy Backdoor Attacks On Deep Point Cloud Recognization Networks
Feng, L., Qian, Z., Zhang, X., & Li, S. (2023) · The Computer Journal · doi:10.1093/comjnl/bxad109 · Cited by 5
Don’t FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNs
Hammoud, H. A. A. K., Bibi, A., Torr, P. H. S., & Ghanem, B. (2023) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw59228.2023.00230 · Cited by 7
“Backdoor Defenses: As mentioned above, backdoor defenses try to detect the attack [14, 32, 22, 53, 20, 5, 41, 42, 24], mitigate the attack [31, 35, 8, 29], or both detect and mitigate the attack [43, 3, 46, 17, 32, 10, 21, 23, 37, 4].”
On the Vulnerability of Deep Reinforcement Learning to Backdoor Attacks in Autonomous Vehicles
Wang, Y., Sarkar, E., Jabari, S. E., & Maniatakos, M. (2023) · Springer eBooks · doi:10.1007/978-3-031-40677-5_13 · Cited by 5
Detection and Defense of Unlearnable Examples
Zhu, Y., Yu, L., & Gao, X.-S. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i15.29667 · Cited by 6
REStore: Exploring a Black-Box Defense against DNN Backdoors using Rare Event Simulation
Roux, Q. L., Kallas, K., & Furon, T. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00021 · Cited by 7
“For instance, DeepInspect [35] uses a generative model trained on a suspicious DNN to learn the distribution of possibly-backdoored inputs.”
BackgroundMethodAddressing Soft Error and Security Threats in DNNs Using Learning Driven Algorithmic Checks
Amarnath, C., Momtaz, M. I., & Chatterjee, A. (2021) · IEEE International On-Line Testing Symposium (IOLTS) · doi:10.1109/iolts52814.2021.9486685 · Cited by 5
“DeepInspect [13] utilizes DNNs trained to detect probable trigger distributions for attack detection.”
MethodNamvar, A., Thapa, C., Kanhere, S. S., & Camtepe, S. A. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-91431-8_57 · Cited by 5
MISA: Online Defense of Trojaned Models using Misattributions
Kiourti, P., Li, W., Roy, A., Sikka, K., & Jha, S. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485908 · Cited by 7
“Existing defenses against Trojan attacks can be broadly classified into the following five categories: (1) defenses that identify whether a neural network is Trojaned partly by reverse-engineering the Trojan trigger [9, 17, 19, 30, 37, 43, 55, 62], (2) defenses that erase the backdoor from the trained model without th…”
BackgroundImproving robustness of convolutional neural networks using element-wise activation scaling
Zhang, Z., Ren, H., He, Z., Zhou, W., & Liu, D. (2023) · Future Generation Computer Systems · doi:10.1016/j.future.2023.07.013 · Cited by 5
Defense Method Challenges Against Backdoor Attacks in Neural Networks
Shamshiri, S., & Sohn, I. (2024) · International Conference on Artificial Intelligence in Information and Communication (ICAIIC) · doi:10.1109/icaiic60209.2024.10463411 · Cited by 5
“Since, backdoor attacks are one of the major threats to all security systems based on NN, discussing the defense method challenges are of great importance [14], [15].”
BackgroundA Unified Framework for Task-Driven Data Quality ManagementPreprint
Wang, T., Zeng, Y., Jin, M., & Jia, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.05484 · Cited by 11
“In parallel with these research efforts, the ML community has intensively investigated techniques focused on addressing a broad variety of data quality issues, such as adversarial [8, 9] and mislabeled [10, 11] data detection, anomaly detection [12], dataset debiasing [13, 14, 15].”
BackgroundDBSSL: A Scheme to Detect Backdoor Attacks in Self-Supervised Learning Models
Huang, Y., Yang, G., Yuan, D., & Yu, S. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3525756 · Cited by 4
“Our DBSSL is based on the following fact: For a backdoored model, the adversarial perturbation required to transform a sample into the target class is significantly smaller than that required to transform it into a non-target class [15], [18], [19], [20], [21].”
Low-Frequency Black-Box Backdoor Attack via Evolutionary Algorithm
Qiao, Y., Liu, D., Wang, R., & Liang, K. (2025) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61041.2025.00737 · Cited by 5
“Defensive [4, 31–33, 41, 53, 59] and detective [3,15,26,50,57] mechanisms are commonly used for backdoor defenses.”
A Backdoor Embedding Method for Backdoor Detection in Deep Neural Networks
Liu, M., Zheng, H. Y., Liu, Q., Xing, X., & Dai, Y. (2022) · Communications in computer and information science · doi:10.1007/978-981-19-0468-4_1 · Cited by 4
Sub-Band Backdoor Attack in Remote Sensing Imagery
Islam, K. A., Wu, H., Xin, C., Ning, R., Zhu, L., & Li, J. (2024) · Algorithms · doi:10.3390/a17050182 · Cited by 4
“Similarly, defense methods have also been developed, including TABOR [13], DeepInspect [18], Gangsweep [16], etc.”
MethodResultInfluentialAttack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models
Fares, S., & Nandakumar, K. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02335 · Cited by 4
“Though many algorithms have been proposed for detecting poisoned models [17][7, 20, 24, 29, 49, 50, 52, 53, 56], most existing solutions have one or more of the following limitations: (i) poor generalizability : they are effective against only a specific type of attack (or a small class of attacks)…”
BackgroundResultA4FL: Federated Adversarial Defense via Adversarial Training and Pruning Against Backdoor Attack
Saeed-uz-zaman, Li, B., Hamid, M., Saleem, M., & Aman, M. (2025) · IEEE Access · doi:10.1109/access.2025.3568275 · Cited by 5
“Some defenses have acknowledged their limits or anticipated failure scenarios when using these triggers: [17], [23], [24].”
Prescriptive analytics with differential privacy
Harikumar, H., Rana, S., Gupta, S., Nguyen, T., Kaimal, R., & Venkatesh, S. (2021) · International Journal of Data Science and Analytics · doi:10.1007/s41060-021-00286-w · Cited by 4
“…[6,17,26] [18,29] Prescriptive analytics application domains Manufacturing [4,25], health and social policy [34], sale/marketing [8,9,35] education and research [34,58], and transport [1,65] Adversarial examples [14,30,36,41,64] Inverse classification [2,15,38,39,66] Differential privacy [19–21,”
BackgroundRule-Based Runtime Mitigation Against Poison Attacks on Neural Networks
Usman, M., Gopinath, D., Sun, Y., & Păsăreanu, C. S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17196-3_4 · Cited by 4
“DeepInspect [3] learns the probability distribution of potential triggers from the queried model using a conditional GAN model, which can be used for inspecting whether the pre-trained neural network has been trojaned.”
MethodCOLLIDER: A Robust Training Framework for Backdoor Data
Dolatabadi, H. M., Erfani, S., & Leckie, C. A. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-26351-4_41 · Cited by 4
Defending against backdoor attack on deep neural networks based on multi-scale inactivation
Zhang, A., Chen, H., Wang, X., Li, J., Gao, Y., & Wang, X. (2024) · Information Sciences · doi:10.1016/j.ins.2024.121562 · Cited by 5
Self-citation
Metadata
- Authors
- Chen, H., Fu, C., Zhao, J., & Koushanfar, F.
- Affiliations
- University of California San Diego (US)
- Venue
- Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence
- Published
- 2019-08
- Pages
- 4658-4664
- OpenAlex
- W2966689772
- Cited by
- 314
- References
- 17
- Citations by year
- 2026: 15 · 2025: 43 · 2024: 51 · 2023: 55 · 2022: 49 · 2021: 69 · 2020: 30 · 2019: 1
- FWCI
- 14.25
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Joint Conference on Artificial Intelligence (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- backdoor attacks, deep neural network security, conditional generative models
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
