The DOI matches its Crossref record; 17 of the 17 references it cites were found in a registry or an index.
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Open accessAbstract
Deep Neural Networks (DNNs) are vulnerable to Neural Trojan (NT) attacks where the adversary injects malicious behaviors during DNN training. This type of ‘backdoor’ attack is activated when the input is stamped with the trigger pattern specified by the attacker, resulting in an incorrect prediction of the model. Due to the wide application of DNNs in various critical fields, it is indispensable to inspect whether the pre-trained DNN has been trojaned before employing a model. Our goal in this paper is to address the security concern on unknown DNN to NT attacks and ensure safe model deployment. We propose DeepInspect, the first black-box Trojan detection solution with minimal prior knowledge of the model. DeepInspect learns the probability distribution of potential triggers from the queried model using a conditional generative model, thus retrieves the footprint of backdoor insertion. In addition to NT detection, we show that DeepInspect’s trigger generator enables effective Trojan mitigation by model patching. We corroborate the effectiveness, efficiency, and scalability of DeepInspect against the state-of-the-art NT attacks across various benchmarks. Extensive experiments show that DeepInspect offers superior detection performance and lower runtime overhead than the prior work.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Furthermore, DP may hurt the accuracy of the learned model [170], which may not be appealing to the industry.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
You Only Look Once: Unified, Real-Time Object Detection
Redmon, J., Divvala, S., Girshick, R., & Farhadi, A. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.91 · Cited by 53,803
Image-to-Image Translation with Conditional Adversarial Networks
Isola, P., Zhu, J.-Y., Zhou, T., & Efros, A. A. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.632 · Cited by 22,930
Dermatologist-level classification of skin cancer with deep neural networks
Esteva, A., Kuprel, B., Novoa, R. A., Ko, J., Swetter, S. M., Blau, H. M., & Thrun, S. (2017) · Nature · doi:10.1038/nature21056 · Cited by 14,362
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479
On Assessing ML Model Robustness: A Methodological Framework (Academic Track)
Awadid, A., & Robert, B. (2025) · OASIcs : OpenAccess Series in Informatics · doi:10.4230/oasics.saia.2024.1 · Cited by 4,723
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,577
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Cited by
Sorted by citations
Items 201–300 of 315
Robust Federated Learning with Attack-Adaptive AggregationPreprint
Wan, C. P., & Chen, Q. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.05257 · Cited by 13
NTD: Non-Transferability Enabled Backdoor DetectionPreprint
Li, Y., Ma, H., Zhang, Z., Gao, Y., Abuadbba, A., Fu, A., Zheng, Y., Al-Sarawi, S. F., & Abbott, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.11157 · Cited by 4
“For instance, Neural cleanse [13], ABS [14], and DeepInsepct [17] are ineffective when the trigger size becomes larger.”
BackgroundA General Framework for Defending Against Backdoor Attacks via Influence GraphPreprint
Sun, X., Li, J., Li, X., Wang, Z., Zhang, T., Qiu, H., Wu, F., & Fan, C. C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.14309 · Cited by 6
“(Chen et al., 2019; Qiao et al., 2019; Zhu et al., 2020) improve Neural Cleanse by learning the probability distribution of triggers via generative models; Liu et al. (2019) views the neurons that substantially change the output labels, when stimulations are introduced, as the backdoor neurons; and…”
BackgroundOn the Credibility of Backdoor Attacks Against Object Detectors in the Physical World
Doan, B. G., Nguyen, D. Q., Lindquist, C., Montague, P., Abraham, T., Vel, O. D., Camtepe, S. A., Kanhere, S. S., Abbasnejad, E., & Ranasinghe, D. C. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00079 · Cited by 5
Michscan: Black-Box Neural Network Integrity Checking at Runtime Through Power Analysis
Paul, R., & Zuzak, M. (2025) · IEEE International Symposium on Hardware Oriented Security and Trust (HOST) · doi:10.1109/host64725.2025.11050062 · Cited by 3
“Limited Black-Box: These techniques can be used in a scenario where the end-user has no access to model parameters [14], [28].”
A Defence Against Input-Agnostic Backdoor Attacks on Deep Neural Networks
Gao, Y., & Nepal, . (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-65610-2_4 · Cited by 3
RFL-LSU: A Robust Federated Learning Approach with Localized Stepwise Updates
Fan, S., Shi, H., Wang, C., Ma, R., & Wang, X. (2024) · ACM Transactions on Internet Technology · doi:10.1145/3690822 · Cited by 3
“Some detection algorithms analyze the model to detect backdoors [ 9 ], but such algorithms can still be bypassed [ 41 ].”
Unified Architectural Support for Secure and Robust Deep Learning
Javaheripi, M., Chen, H., & Koushanfar, F. (2020) · ACM/IEEE Design Automation Conference (DAC) · doi:10.1109/dac18072.2020.9218575 · Cited by 3
“We present DeepInspect (DI) [15] as a holistic solution to Trojan detection.”
MethodSelf-citationEDITH - A Robust Framework for Prevention of Cyber Attacks in the Covid Era
Mukhopadhyay, A., & Prajwal, A. (2021) · International Conference for Emerging Technology (INCET) · doi:10.1109/incet51464.2021.9456186 · Cited by 3
“Chen, H., Fu, et al.[22] talked about backdoor viruses being used to disrupt the working of Neural network training and also proposed a framework that can identify Trojan and other viruses without prior knowledge with low runtime.”
BackgroundEvolutionary artificial neural network for temperature control in a batch polymerization reactor
Sánchez-Ruíz, F. J., Hernandez, E. A., Terrones-Salgado, J., & Quiroz, L. J. F. (2023) · Ingenius · doi:10.17163/ings.n30.2023.07 · Cited by 3
Unlabeled backdoor poisoning on trained-from-scratch semi-supervised learning
Feng, L., Qian, Z., Zhang, X., & Li, S. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119453 · Cited by 3
Mitigating Backdoor Attacks on Deep Neural Networks
Fu, H., Sarmadi, A., Krishnamurthy, P., Garg, S., & Khorrami, F. (2023) · Springer eBooks · doi:10.1007/978-3-031-40677-5_16 · Cited by 3
State of the art: Security Testing of Machine Learning Development Systems
Das, S., Krishnamurthy, B., Das, R. R., & Shiva, S. G. (2024) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc60891.2024.10427598 · Cited by 3
“A framework for detecting and mitigating black-box Trojan attacks in DNN systems is developed by Chen et al. [15].”
Projan: A probabilistic trojan attack on deep neural networks
Saremi, M., Khalooei, M., Rastgoo, R., & Sabokrou, M. (2024) · Knowledge-Based Systems · doi:10.1016/j.knosys.2024.112565 · Cited by 3
Towards Physical World Backdoor Attacks Against Skeleton Action Recognition
Zheng, Q., Yu, Y., Yang, S., Liu, J., Lam, K., & Kot, A. C. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73195-2_13 · Cited by 3
Preference Poisoning Attacks on Reward Model Learning
Wu, J., Wang, J., Xiao, C., Wang, C., Zhang, N., & Vorobeychik, Y. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00094 · Cited by 17
“Prominent examples include model verification , which checks for anomalies in a model’s functionality [22], [29], [33], Trojan trigger detection , which aims to identify triggers [11], [12], [32], [45], [55], [71], [93], [100], [104], restoring compromised models which retrains, prunes, or…”
Breaking Distributed Backdoor Defenses for Federated Learning in Non-IID Settings
Yang, J., Shu, J., & Jia, X. (2022) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn57253.2022.00064 · Cited by 3
Being Single Has Benefits. Instance Poisoning to Deceive Malware ClassifiersPreprint
Shapira, T., Berend, D., Rosenberg, I., Liu, Y., Shabtai, A., & Elovici, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.16323 · Cited by 3
“In [8], the backdoor is detected by measuring the perturbation distance required to shift the target class.”
MethodTESDA: Transform Enabled Statistical Detection of Attacks in Deep Neural NetworksPreprint
Amarnath, C., Balwani, A., Ma, K., & Chatterjee, A. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.08447 · Cited by 3
“…CA, USA, 2022. mask from a potentially infected model, typically using machine learning methods to find and patch backdoors inserted into the DNN (Chen et al., 2019; Wang et al., 2019), (b) Identifies trigger mask patterns in the input to the DNN either through input perturbation (Gao et al.,…”
Backdoor Pony: Evaluating backdoor attacks and defenses in different domains
Mercier, A., Smolin, N., Sihlovec, O., Koffas, S., & Picek, S. (2023) · SoftwareX · doi:10.1016/j.softx.2023.101387 · Cited by 3
Gu, K., Zuo, Y., Tan, J., Yin, B., Yang, Z., & Li, X. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3509983 · Cited by 4
“Restrictions apply. on the global model [6], [7] or by detecting triggers [8], [9], [10], [11].”
Runtime Backdoor Detection for Federated Learning via Representational Dissimilarity Analysis
Zhang, X., Xue, X., Du, X., Xie, X., Liu, Y., & Sun, M. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3550330 · Cited by 5
“Thus,generalbackdoordetectionmethodsforpost-trained models[14],[15]arenotwell-suitedforthefederatedlearning context.”
Breaking the Illusion: A Critical Study of Backdoor Defense in Federated Learning With Non-IID Data
Ye, P., Li, Y., He, K., Li, Q., Qin, T., Wang, X., Yang, K., Zhang, C., & Chen, J. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3643155 · Cited by 2
“…model detection methods have been established for centralized learning, they often rely on computationally intensive trigger reverse engineering [17], [18], making them impractical in the FL context, where detection is performed before each round of federated aggregation across massive clients.”
Identifying Physically Realizable Triggers for Backdoored Face Recognition Networks
Raj, A., Pal, A., & Arora, C. (2021) · Proceedings - International Conference on Image Processing · doi:10.1109/icip42928.2021.9506564 · Cited by 3
Detecting Backdoor Attacks on Deep Neural Networks Based on Model Parameters Analysis
Ma, M., Li, H., & Kuang, X. (2022) · IEEE International Conference on Tools with Artificial Intelligence (ICTAI) · doi:10.1109/ictai56018.2022.00098 · Cited by 2
“Detection for the model-The main methods of backdoor detection for the model include Deeplnspect[18], Universal Litmus Patterns [19], and Meta Neural Trojan Detection[20].”
MethodA Novel Semi-Supervised Adversarially Learned Meta-Classifier for Detecting Neural Trojan Attacks
Ghahremani, S., Bidgoly, A. J., Nguyen, U. T., & Yau, D. K. Y. (2023) · IEEE Access · doi:10.1109/access.2023.3339542 · Cited by 2
“Recently, significant research efforts have been channeled into detecting Trojans within AI systems [19], [20], [21], [22], [23], [24], [25], [26], [27], [28], [29], [30].”
BackgroundMethodInfluentialX-HDNN: Explainable Hybrid DNN for Industrial Internet of Things Backdoor Attack Detection
Ahakonye, L. A. C., Nwakanma, C. I., Lee, J. M., & Kim, D. (2023) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc58733.2023.10393379 · Cited by 2
“Commonly used sophisticated strategies such as BadNets and trojan attacks enable backdoor attacks [10].”
BackgroundMethodDetecting Backdoor Attacks in Black-Box Neural Networks through Hardware Performance Counters
Alam, M., Wang, Y., & Maniatakos, M. (2024) · Design, Automation, and Test in Europe · doi:10.23919/date58400.2024.10546739 · Cited by 3
“Chen et al. first introduced a method to reverse engineer triggers by analyzing confidence scores from inference queries and using anomaly detection to identify backdoor inputs [8].”
BackgroundMethodAugmented Neural Fine-Tuning for Efficient Backdoor Purification
Karim, N., Arafat, A. A., Khalid, U., Guo, Z., & Rahnavard, N. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72989-8_23 · Cited by 5
Model X-ray : Detecting Backdoored Models via Decision Boundary
Su, Y., Zhang, J., Xu, T., Zhang, T., Zhang, W., & Yu, N. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3681075 · Cited by 4
TRIGS: Trojan Identification from Gradient-Based Signatures
Hussein, M. E., Janakiraman, S. S., & AbdAlmageed, W. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-78122-3_23 · Cited by 4
Securing ML Models on Websites: Face Recognition and Spoof Detection via IPFS Blockchain
Ramakanth Kumar, P., Jambur, P. V., Kulkarni, N. V., Kapini, N. S. R., Niranjan, R., Mathew, N. S., & Kheria, P. (2025) · International Conference on Intelligent and Innovative Technologies in Computing, Electrical and Electronics (IITCEE) · doi:10.1109/iitcee64140.2025.10915410 · Cited by 2
“Finally, existing solutions often struggle to maintain user privacy while balancing system performance, leaving room for further research into optimizing both security and usability [25].”
Evil from Within: Machine Learning Backdoors Through Dormant Hardware Trojans
Warnecke, A., Speith, J., Möller, J.-N., Rieck, K., & Paar, C. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00077 · Cited by 4
BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation
Yu, H., Xie, T., Gui, J., Wang, P., Cheng, P., Yi, P., & Wu, Y. (2025) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3690624.3709385 · Cited by 3
Arms Race in Deep Learning: A Survey of Backdoor Defenses and Adaptive Attacks
Mo, X., Sun, N., Zhang, L. Y., Luo, W., Gao, S., & Xiang, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-8183-9_24 · Cited by 2
Escaping Backdoor Attack Detection of Deep Learning
Xiong, Y., Xu, F., Zhong, S., & Li, Q. (2020) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-58201-2_29 · Cited by 2
“We utilized the conditional GAN to reconstruct triggers and applied DMAD [5] on them for outlier detection.”
BackgroundMethodInfluentialInterpretability Derived Backdoor Attacks Detection in Deep Neural Networks: Work-in-Progress
Wen, X., Jiang, W., Zhan, J., Wang, X., & He, Z. (2020) · ACM International Conference on Embedded Software (EMSOFT) · doi:10.1109/emsoft51651.2020.9244019 · Cited by 2
“Anomaly detection methods have also been introduced, which focus on the influence of perturbations on the outputs [5] [6].”
The Devil is in the GAN: Defending Deep Generative Models Against Backdoor Attacks
Rawat, A., Levacher, K., & Sinn, M. (2021) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.6359842 · Cited by 2
Sensitive Samples Revisited: Detecting Neural Network Attacks Using Constraint Solvers
Docena, A. N., Wahl, T., Pearce, T., & Fei, Y. (2021) · Electronic Proceedings in Theoretical Computer Science · doi:10.4204/eptcs.342.4 · Cited by 2
“, determining the probability distribution of potential triggers [3] or of prediction results under perturbations [4].”
BackgroundChen, C., Wei, L., Zhang, L., Peng, Y., & Ning, J. (2022) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-022-01377-6 · Cited by 2
“Similarly, the backdoor attack defense schemes proposed by Gao et al. [22] and Chen et al. [23] only target pixel image backdoor attacks.”
BackgroundDebiasing backdoor attack: A benign application of backdoor attack in eliminating data bias
Wu, S., He, Q., Zhang, Y., Lü, D., & Sang, J. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119171 · Cited by 3
PBE-Plan: Periodic Backdoor Erasing Plan for Trustworthy Federated Learning
Chen, B., Li, G., Chen, M., Liu, Y., Yi, X., & Li, J. (2023) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys60770.2023.00016 · Cited by 2
“Existing backdoor defenses can be categorized into four types: poisoned data detection [8], [9], backdoor-resilient learning [10]–[12], backdoor detection [13], [14] and back-door purification [15]–[19].”
BackgroundCorrecting the distribution of batch normalization signals for Trojan mitigation
Li, X., Xiang, Z. J., Miller, D. J., & Kesidis, G. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.128752 · Cited by 3
GuardianMPC: Backdoor-Resilient Neural Network Computation
Hashemi, M., Forte, D. J., & Ganji, F. (2025) · IEEE Access · doi:10.1109/access.2025.3528304 · Cited by 1
“Neu-ronInspect [120], DeepInspect [121], and Meta Neural Trojan Detection (MNTD) framework [122] are the cutting-edge approaches that are built based on the model inspection [119].”
Chen, Z., Zhang, M., Mostyn, C., Jiang, H., & Feng, X. (2024) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc59868.2024.10850041 · Cited by 1
DOBEL: detecting backdoors in ensemble learning
Kim, S., & Hahn, C. (2025) · Cluster Computing · doi:10.1007/s10586-024-04961-y · Cited by 1
“Moreover, given that DOBEL operates the model-level detection like the defenses introduced in [13, 14, 27], it is expected to provide detection against other attacks targeting to the different level of the model training process.”
InfluentialContrastive Learning and Feature Space Tactics: A Dual Approach to Strengthen Backdoor Attacks
Fu, H., Liu, M., & Li, R. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3587194 · Cited by 2
ArcGen: Generalizing Neural Backdoor Detection Across Diverse Architectures
Yang, Z., Luo, C., He, D., Li, Y., & Li, Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3610254 · Cited by 1
“There are two mainstream methods in the literature for detecting neural backdoors before deployment: training data analysis [5], [6], [7] and model analysis [8], [9], [10], [11], [12], [13], [14], [15], [16].”
InfluentialDataset ownership verification with invisible backdoors
Kim, S., & Hahn, C. (2025) · Applied Intelligence · doi:10.1007/s10489-025-06994-1 · Cited by 1
“Consequently, much of the backdoor research has aimed to operate within this setting, regardless of whether the goal is attack or defense [3, 23, 28, 33, 46 ].”
Backdoor Attacks on Neural Networks Via One-Bit Flip
Li, X., Luo, L., & Zeng, Q. (2025) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51701.2025.00412 · Cited by 1
“As backdoor attacks evolve, various defenses have been proposed to mitigate their threats, including backdoor detection [10, 22, 24, 42, 58, 64, 65], backdoor mitigation [37, 38, 40, 45, 49, 68], and input filtering [12, 23, 27, 43].”
VarDefense: Variance‐Based Defense against Poison Attack
Fan, M., Du, X., Liu, X., & Guo, W. (2021) · Wireless Communications and Mobile Computing · doi:10.1155/2021/1974822 · Cited by 1
“[17] proposed DeepInspect to detect the backdoor without resort to a clean dataset, which obtains competitive performance compared to neural cleanse.”
BackgroundTextBack: Watermarking Text Classifiers using Backdooring
Chattopadhyay, N., Kataria, R., & Chattopadhyay, A. (2022) · Euromicro Conference on Digital System Design (DSD) · doi:10.1109/dsd57027.2022.00053 · Cited by 1
“For example, works like DeepInspect [9] is a blackbox Trojan detection and mitigation framework for DNNs, TABOR [10] is an approach of inspecting and detecting backdoors in AI systems, Re-markable [11] attempts to remove watermarks by retraining with synthetic samples.”
MethodXMAM:X-raying models with a matrix to reveal backdoor attacks for federated learning
Zhang, J., Zhang, F., Jin, Q., Wang, Z., Lin, X., & Hei, X. (2023) · Digital Communications and Networks · doi:10.1016/j.dcan.2023.01.017 · Cited by 1
BadRes: Reveal the Backdoors Through Residual Connection
He, M., Chen, T., Zhou, H., Zhang, S., & Li, J. (2023) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49357.2023.10094691 · Cited by 1
“Although there are several defense methods for backdoor attacks like purifying the input [12], purifying the model [13, 14] and detecting backdoor [15, 16].”
MethodCTP: Defending Against Data Poisoning in Attack Traffic Detection Based Deep Neural Networks
Wang, L., Wang, X., Lv, Q., Wang, Y., Zhou, X., & Huang, W. (2023) · IEEE International Conference on Network Infrastructure and Digital Content (IC-NIDC) · doi:10.1109/ic-nidc59918.2023.10390737 · Cited by 1
“Several counter techniques for neural network backdoors have been proposed in the field of deep learning [5] [6] [7] [8] [9] [10].”
BackgroundEngravings, Secrets, and Interpretability of Neural Networks
Hobbs, N., Papakonstantinou, P. A., & Vaidya, J. S. (2024) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2024.3358759 · Cited by 1
Hardware Trojan for Lightweight Cryptoraphy Elephant
Takemoto, S., Ikezaki, Y., Nozaki, Y., & Yoshikawa, M. (2021) · IEEE Global Conference on Consumer Electronics (GCCE) · doi:10.1109/gcce53005.2021.9622003 · Cited by 1
Detection of Lying Electrical Vehicles in Charging Coordination Application Using Deep LearningPreprint
Shafee, A. A., Fouda, M. M., Mahmoud, M. M. E. A., Alasmary, W., Aljohani, A. J., & Amsaad, F. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.13813 · Cited by 1
“MLP is a type of deep neural networks (DNN) [28], which includes an input layer for receiving the input, an output layer”
BackgroundA Framework of Randomized Selection Based Certified Defenses Against Data Poisoning AttacksPreprint
Chen, R., Li, J., Wu, C., Sheng, B., & Li, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2009.08739 · Cited by 8
“Many heuristic defenses have been proposed (Wang et al. 2019; Chen et al. 2018; Chen et al. 2019; Gao et al. 2019; Tran, Li, and Madry 2018; Liu et al. 2019; Qiao, Yang, and Li 2019; Steinhardt, Koh, and Liang 2017) against data poisoning attacks, but the security level of those defenses is hard to measure.”
Online Defense of Trojaned Models using Misattributions.Preprint
Kiourti, P., Li, W., Roy, A., Sikka, K., & Jha, S. (2021) · arXiv (Cornell University) · Cited by 1
RABA: A Robust Avatar Backdoor Attack on Deep Neural Network.Preprint
He, Y., Shen, Z., Xia, C., Hua, J., Tong, W., & Zhong, S. (2021) · arXiv (Cornell University) · Cited by 1
RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP ModelsPreprint
Yang, W., Lin, Y., Li, P., Zhou, J., & Sun, X. S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.07831 · Cited by 31
“…detect poisoned samples or pre-process inputs to avoid the activation of the backdoor in the inference time; (2) Offline defenses (Liu et al., 2018a; Chen et al., 2019; Wang et al., 2019; Li et al., 2021) which choose to remove or mitigate the backdoor effect in the model before models are…”
BackgroundInfluentialLiu, Y., Mondal, A., Chakraborty, A., Zuzak, M., Jacobsen, N., Xing, D., & Srivastava, A. (2021) · Springer eBooks · doi:10.1007/978-3-642-27739-9_1654-1 · Cited by 1
Towards Robustness Evaluation of Backdoor Defense on Quantized Deep Learning ModelPreprint
Zhu, Y., Peng, H., Fu, A., Yang, W., Ma, H., Al-Sarawi, S. F., & Abbott, D. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4578346 · Cited by 1
Backdoor for Debias: Mitigating Model Bias with Backdoor Attack-Based Artificial BiasPreprint
Wu, S., He, Q., Lü, D., & Sang, J. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4806891 · Cited by 1
Liu, Y., Mondal, A., Chakraborty, A., Zuzak, M., Jacobsen, N., Xing, D., & Srivastava, A. (2025) · Springer eBooks · doi:10.1007/978-3-030-71522-9_1654 · Cited by 1
PoisHygiene: Detecting and Mitigating Poisoning Attacks in Neural NetworksPreprint
Guo, J., Wang, T., & Liu, C. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.11110
“Poisoning attacks on DNNs are typically categorized into backdoor attacks and AP attacks [49], both of which have received a significant amount of recent attention [16, 31, 33, 42, 43, 49, 51].”
BackgroundWen, J., Zhao, B. Z. H., Xue, M., & Qian, H. (2020) · arXiv (Cornell University)
Widen The Backdoor To Let More Attackers InPreprint
Datta, S., Lovisotto, G., Martinović, I., & Shadbolt, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.04571 · Cited by 1
“In model inspection, defenders attempt to reverse-engineer the triggers injected into the model by the attacker and later unlearn the trigger-sensitivity by removing neurons or re-training a model with legitimate data (Gao et al., 2019; Liu et al., 2019; Wang et al.; Chen et al., 2019).”
A Generic Enhancer for Backdoor Attacks on Deep Neural Networks
Abbasi, B., Zhong, Q., Zhang, L. Y., Gao, S., Robles‐Kelly, A., & Doss, R. (2023) · Communications in computer and information science · doi:10.1007/978-981-99-1648-1_25
SDBC: A Novel and Effective Self-Distillation Backdoor Cleansing Approach
Ran, S., Zheng, B., & Sun, M. (2023) · Communications in computer and information science · doi:10.1007/978-981-99-8148-9_23
Jones, A. J. (2024) · Advances in medical technologies and clinical practice book series · doi:10.4018/979-8-3693-1906-2.ch008
Can Federated Models Be Rectified Through Learning Negative Gradients?
Tahir, A., Tan, Z., & Babaagba, K. O. (2024) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-52265-9_2
DaBA: Data-free Backdoor Attack against Federated Learning via Malicious Server
Chen, K., Fang, L., Wang, M., & Yin, C. (2023) · International Conference on Image Processing, Computer Vision and Machine Learning (ICICML) · doi:10.1109/icicml60161.2023.10424802
Fu, F., Kiourti, P., & Li, W. (2023) · International Conference on Machine Learning and Applications · doi:10.1109/icmla58977.2023.00271 · Cited by 1
“Such an “unlocked" backdoor can be detected and recovered by the existing backdoor defense methods [29, 32, 50, 30, 33].”
BackgroundOCGEC: One-class Graph Embedding Classification for DNN Backdoor Detection
Jiang, H., Yu, H., Li, N., & Yi, P. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10650468
BlockDoor: Blocking Backdoor Based Watermarks in Deep Neural Networks
Puah, Y. H., Ngo, A. T., Chattopadhyay, N., & Chattopadhyay, A. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-80408-3_16
“Examples of such attack mitigation efforts include DeepInspect [3] and TABOR [4] which have been successful in defeating them.”
Mo, W., Chen, K., & Xiao, Y. (2025) · Mathematics · doi:10.3390/math13020272
“Unlike prior methods [23], our scheme maintains the model’s performance and provides a dual verification process that evaluates behavioral consistency, addressing the limitations of existing techniques that rely solely on model outputs [16,24].”
Partially training, isolating and unlearning, mitigating backdoor attack
Li, Y., Gao, H., Chen, H., Wang, Y., & Yu, C. P. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825788
Self-citationRoPAR: Enhancing Adversarial Robustness with Progressive Image Aggregation and Reordering Noise
An, J.-H., Hong, J.-H., Kim, H.-D., & Lee, S. (2024) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc54092.2024.10831979
“At the same time, preprocessing techniques aim to preemptively neutralize adversarial perturbations through methods ranging from basic data transformations to complex anomaly detection [18].”
Defending the Treasury: Deep Learning Strategies for Banking Security Against Trojan Threats
Kumari, A., Gupta, D., & Uppal, M. (2024) · International Conference on Technological Advancements in Computational Sciences (ICTACS) · doi:10.1109/ictacs62700.2024.10840954
“There are many issues to be considered, the most important of which is critical infrastructure [3].”
Distill To Detect: Amplifying Anomalies in Backdoor Models through Knowledge Distillation
Hu, C., Teng, X., Xing, W., Chen, H., Ye, C., & Han, M. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10888729
“FeatureRE demonstrated that their method outperforms existing reverse engineering-based detection methods (i.e., ABS [24], DeepInspect [25], TABOR [26], and K-arm [27]) as well as meta-learning-based detection methods (i.e., ULP [15] and MNTD [16]).”
Self-citationTrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learning
Liu, Y., Wang, Y., & Jia, J. (2025) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v39i1.32033
MCL++ : Strengthening Defenses Against Backdoor Poisoning Attacks
Shymala Gowri, S., & Sadasivam, G. S. (2025) · Cybernetics & Systems · doi:10.1080/01969722.2025.2483718
Layer Frozen Multi-Net & Latent Space Feature-Concealed Backdoor Samples Detection
Li, J., Luo, S., Pan, L., Zhang, C., Zhang, Z., & Lü, C. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107497
Defense Against Multi-target Multi-trigger Backdoor Attacks
Harikumar, H., Rana, S., Do, K., Gupta, S., Zong, W., Susilo, W., & Venkatesh, S. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-8295-9_22
ECP: Error Cluster Pruning Against Backdoor Attacks in Image Classification
Li, X., & Xing, H. (2025) · International Conference on Digital Image Processing and Computer Applications (DIPCA) · doi:10.1109/dipca65051.2025.11042352
“To mitigate backdoor attacks, extensive research has focused on developing defense mechanisms, which can be broadly categorized into detection-based [5], [6], [10], [11] and purification-based [7]-[9], [12] approaches.”
(2025) · Elsevier eBooks · doi:10.1016/b978-0-44-324840-5.00019-6
Model safety: backdoor defenses
Jiang, Y., Ma, X., & Wu, Z. (2025) · Elsevier eBooks · doi:10.1016/b978-0-44-324840-5.00016-0
A Forensic Analysis Framework for Machine Learning Model Poisoning Detection
Monkam, G. F., Yan, J., & Bastian, N. D. (2025) · Security and Privacy · doi:10.1002/spy2.70079
The Sinister Ghost in the Wooden Horse: From Ancient Myths to Industrial Fraud by Trojan Attack
Eakin, M., Khosravy, M., Adams, A., & Witkowski, O. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-96-2329-7_45
Sequential Feature-Based Backdoor Detection in Deep Neural Networks Via Few-Shot LearningPreprint
Haiyang, 于. Y., Fan, H. M., Tian, X. I. E., Yi, P., Zou, F., & Wu, Y. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5393659
Gnn-Dtbd: Gnn-Driven Dynamic Threshold Backdoor DetectionPreprint
Ahmad, A., Shah, A., Adnan, M., & Yuen, C. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5405320
AI-Shielder: Exploiting Backdoors to Defend Against Adversarial Attacks
Zhu, H. G., Zhang, S., & Chen, K. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3612270 · Cited by 1
“To the best of our knowledge, DeepInspect [29], TABOR [30], Neural Cleanse (NC) [2], and ABS [3] are the four state-of-the-art studies that can reconstruct the triggers in DNN models without requiring access to the training dataset containing triggers.”
Wang, S., Zhao, C., Lin, C., Zhao, Z., Yang, Z., Wang, Q., Shen, C. Q., & Guan, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3632218
“Gradient descent methods [17], [35], [65], [83], [84], [85] and generative adversarial network (GAN) [38], [86], [87] are used to triggers and detect backdoors.”
Semantic Consistency Guided Backdoor Trigger Inversion and InitDistillNet for Backdoor Detection
Hu, S., Huang, Z., Yu, Y., Guo, H., & Shen, G. (2025) · Communications in computer and information science · doi:10.1007/978-981-95-4109-6_33
Smart Mobility and Coverage in Ghats: Terrain-Aware Routing and Cost-Optimized MCDS Deployment
Jambur, P. V., Suma, B. J., Choudhari, M. M., & Roodagi, P. (2025) · International Conference on Computation System and Information Technology for Sustainable Solutions (CSITSS) · doi:10.1109/csitss67709.2025.11294762
“This work aims to bridge the gap by combining four key areas: real-time terrain modeling, energy-efficient routing, line-of-sight network construction, and cost-aware infrastructure deployment [16], [25].”
An In-model Spy in Edge Intelligence
Yang, F., Chen, P., Yan, Y., & Yang, Z. (2025) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1109/raid67961.2025.00023
“Run-time output verification schemes [46], [47], [48], [49] use inference outputs to identify suspicious behaviors of untrusted models.”
Dynamic Hybrid Backdoor Attack: Saliency-Guided Composite Triggers for Image Classification
Shen, Y., Wang, Y., Liu, Y., Yao, Z., Qiu, X., & Guo, S. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00133
“Subsequent research advanced toward more concealed and flexible mechanisms, including imperceptible geometric warps [4], quantization-based perturbations [5], sample-specific triggers [6]–[8], semantic triggers [2], [3], [9], and physical-world realizations [1], [10], [11].”
Metadata
- Authors
- Chen, H., Fu, C., Zhao, J., & Koushanfar, F.
- Affiliations
- University of California San Diego (US)
- Venue
- Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence
- Published
- 2019-08
- Pages
- 4658-4664
- OpenAlex
- W2966689772
- Cited by
- 314
- References
- 17
- Citations by year
- 2026: 15 · 2025: 43 · 2024: 51 · 2023: 55 · 2022: 49 · 2021: 69 · 2020: 30 · 2019: 1
- FWCI
- 14.25
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Joint Conference on Artificial Intelligence (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- backdoor attacks, deep neural network security, conditional generative models
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
