The DOI matches its Crossref record; 17 of the 17 references it cites were found in a registry or an index.
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Open accessAbstract
Deep Neural Networks (DNNs) are vulnerable to Neural Trojan (NT) attacks where the adversary injects malicious behaviors during DNN training. This type of ‘backdoor’ attack is activated when the input is stamped with the trigger pattern specified by the attacker, resulting in an incorrect prediction of the model. Due to the wide application of DNNs in various critical fields, it is indispensable to inspect whether the pre-trained DNN has been trojaned before employing a model. Our goal in this paper is to address the security concern on unknown DNN to NT attacks and ensure safe model deployment. We propose DeepInspect, the first black-box Trojan detection solution with minimal prior knowledge of the model. DeepInspect learns the probability distribution of potential triggers from the queried model using a conditional generative model, thus retrieves the footprint of backdoor insertion. In addition to NT detection, we show that DeepInspect’s trigger generator enables effective Trojan mitigation by model patching. We corroborate the effectiveness, efficiency, and scalability of DeepInspect against the state-of-the-art NT attacks across various benchmarks. Extensive experiments show that DeepInspect offers superior detection performance and lower runtime overhead than the prior work.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Furthermore, DP may hurt the accuracy of the learned model [170], which may not be appealing to the industry.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [170]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
You Only Look Once: Unified, Real-Time Object Detection
Redmon, J., Divvala, S., Girshick, R., & Farhadi, A. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.91 · Cited by 53,803
Image-to-Image Translation with Conditional Adversarial Networks
Isola, P., Zhu, J.-Y., Zhou, T., & Efros, A. A. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.632 · Cited by 22,930
Dermatologist-level classification of skin cancer with deep neural networks
Esteva, A., Kuprel, B., Novoa, R. A., Ko, J., Swetter, S. M., Blau, H. M., & Thrun, S. (2017) · Nature · doi:10.1038/nature21056 · Cited by 14,362
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602
Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015) · Procedings of the British Machine Vision Conference 2015 · doi:10.5244/c.29.41 · Cited by 5,479
On Assessing ML Model Robustness: A Methodological Framework (Academic Track)
Awadid, A., & Robert, B. (2025) · OASIcs : OpenAccess Series in Informatics · doi:10.4230/oasics.saia.2024.1 · Cited by 4,723
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,577
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Cited by
Sorted by citations
Items 301–315 of 315
Fortifying AI Systems: Emerging Threats and Security Countermeasures
Rahaman, H., Chatterjee, A., & Bhunia, S. (2026) · SN Computer Science · doi:10.1007/s42979-025-04658-y
“For example, spectral signatures can detect poisoned data [17], while GAN-based models capture the true data distribution to improve robustness against poisoning [22].”
Niktabe, S., Sharma, D. P., & Lashkari, A. H. (2026) · The Journal of Supercomputing · doi:10.1007/s11227-026-08494-6 · Cited by 2
BDBR: Towards Resistant Backdoor Defense via Boundary Reconstruction
Yan, H., Zheng, X., Yang, S., & Wang, X. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11460794
Sibai: A Few-Shot Meta-Classifier for Poisoning Detection in Federated Learning
Götz, M., Kraub, T., & Dmitrienko, A. (2025) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51701.2025.00361
“Chen et al. [9] present DeepInspect, a black-box method utilizing model inversion and anomaly detection for backdoor detection.”
Yu, H., Hong, F., Xie, T., Zou, F., Yi, P., & Wu, Y. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3689133
“Another line of work aims to expose backdoors through behavioral probing, such as trigger inversion or activation analysis [20], [21], [22].”
Wahed, M. K. Y. A., Zughuol, B., Alzubi, M., & Bashabsheh, M. (2026) · International Conference on AI Innovations and Industry (ICAIII) · doi:10.1109/icaiii69475.2026.11521380
Mahesh Kumar, M., Usha Rani, H., Keerthi, B., Reddeesha, G., Bhavani, B., & Vamsi, B. (2026) · International Conference on Knowledge Engineering and Communication Systems (ICKECS) · doi:10.1109/ickecs70176.2026.11527851
“Similar black-box detection and mitigation frameworks such as DeepInspect [8].”
TrustSeed: Lightweight Attestation Protocol for Ensuring LLM Integrity
Alsharkawy, M., Ahmed, M. A., Nassar, H., Gonzalez, J., Khdr, H., Abboud, O., Xiao, X., & Henkel, J. (2026) · Design, Automation, and Test in Europe · doi:10.23919/date69613.2026.11539273
“Other works [5], [26] assume black-box access during deployment and attempt to verify the integrity of the model only through input–output behavior.”
Efficient Backdoor Mitigation in Federated Learning With Contrastive Loss
Ferguson, H. C., Ning, R., Wu, H., Zhu, L., Xin, C., Uddin, M. S., & Li, J. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3711587
“In centralized learning, several prominent methods have been proposed for backdoor defense, including Neural Cleanse [26], DeepInspect [36], and TABOR [37].”
Expert-Driven AI: Empowering Models with Agentic Adaptation and Transparent Explainability
Jambur, P. V., Sowmyarani, C. N., Rangaswamy, S., Dayananda, P., & Subramanya, K. N. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-19321-6_31
Minimal-Overhead Backdoor Detection via Entropy-Guided Activation Substitution
Li, B., Hu, T., Liu, X., Zhang, B., Ouyang, Q., Yi, P., Zhang, S., & Ma, H. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-2859-1_38
Training-Time Backdoor Sample Filtering via Loss and Uncertainty Dynamics
Mao, W., Zhang, X., Ke, Y., Han, J., Li, W., Cui, Y., Xiao, K., & Xu, G. (2026) · International Conference on Mechatronics, Robotics, and Artificial Intelligence (MRAI) · doi:10.1109/mrai70020.2026.11621182
“[18], [38] employ reverse engineering triggers to detect backdoor models and identify target labels.”
BPO: Backdoor Purification via Overwriting
Huang, L., Wang, T., Zhang, L. Y., Qin, C., & Zhang, X. (2026) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2026.3717987 · Cited by 1
“In addition, several studies explored backdoor purification meth-ods that leveraged Generative Adversarial Networks (GANs) to invert triggers [43], [44], [45].”
FedMCE: Model Capacity Effect for Backdoor Detection in Federated Learning
Chen, X. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-6834-4_6
Architecture-Level Backdoors in Malware Detection Models for Trustworthy Artificial Intelligence
Yu, Z., Xiong, X., Ju, Y., & Kang, F. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11728471
“Another class of methods relies solely on the target model itself, detecting backdoors via trigger inversion or minimal-perturbation analysis, such as Neural Cleanse [24] and its extensions [25], as well as several black-box detection strategies [26], [27].”
Metadata
- Authors
- Chen, H., Fu, C., Zhao, J., & Koushanfar, F.
- Affiliations
- University of California San Diego (US)
- Venue
- Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence
- Published
- 2019-08
- Pages
- 4658-4664
- OpenAlex
- W2966689772
- Cited by
- 314
- References
- 17
- Citations by year
- 2026: 15 · 2025: 43 · 2024: 51 · 2023: 55 · 2022: 49 · 2021: 69 · 2020: 30 · 2019: 1
- FWCI
- 14.25
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Joint Conference on Artificial Intelligence (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- backdoor attacks, deep neural network security, conditional generative models
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
