Pith. sign in

REVIEW 5 major objections 5 minor 50 references

Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that training a backdoored network with Sharpness-Aware Minimization amplifies the trigger's effect on backdoor-related neurons, and that this single change raises the true positive rate of five standard poisoned-sample…

desk verdict Useful empirical plug-in: SAM pre-training plus feature scaling improves most PSDs under weak backdoors, but the feature-scaling step is under-specified enough to block reproduction until fixed. read the letter →

arxiv 2411.11525 v1 pith:UIX4SPWV submitted 2024-11-18 cs.CV

Mingda Zhang , Mingli Zhu , Zihao Zhu , Baoyuan Wu This is my paper · ORCID
classification cs.CV
keywords backdoorattackspoisonedsampledetectionsharpness-awareminimizationtrigger-activatedchangefeaturescalingweakdeeplearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that backdoor attacks are hard to catch not only because of the detector, but because weak attacks leave too small a trace in the model's feature space. It shows a positive correlation between the backdoor effect—measured by how much a trigger changes neuron activations—and the success of poisoned-sample detection. The authors' fix is to train the suspect model with Sharpness-Aware Minimization (SAM) instead of vanilla SGD, which amplifies the trigger's effect on backdoor-related neurons while leaving other neurons less affected. Feeding features from the SAM-trained model (after a covariance-based scaling step) into existing detection methods substantially improves their true positive rate, including an average gain of 34.38% across five detectors on CIFAR-10. The claim is that SAM-enhanced training is a model-agnostic, data-independent plug-in that makes any feature-based poisoned-sample detector more reliable.

What carries the argument

The load-bearing mechanism is Sharpness-Aware Minimization (SAM), which solves a min-max objective $\min_\theta \max_{\|\epsilon\|\le\rho}\mathcal{L}(\theta+\epsilon)$, forcing the model toward flat minima. The paper argues that in a backdoored model this selective sharpness minimization strengthens the response of backdoor-related neurons (those already exhibiting high Trigger-Activated Change) while suppressing unrelated neurons, effectively increasing the feature-space gap between poisoned and clean samples. A secondary mechanism is the Stage-2 feature scaling: features $g=\phi_{\theta_{\text{SAM}}}(x)$ are projected with PCA and whitened as $g_s=\Sigma^{-1/2}P g$, using a covariance estimate built from reference clean samples and dynamically collected likely-clean samples. That scaling keeps the gains stable by reducing the inflated variance of clean features. TAC (Trigger-Activated Change) is the metric that quantifies the backdoor effect and supplies the paper's correlation analysis.

What would settle it

Estimate the covariance matrix in Stage-2 using only the externally supplied clean reference samples, removing the dynamically collected 'potential clean samples.' If the reported TPR gains (e.g., +34.38% on CIFAR-10) disappear or shrink dramatically under this variant while SAM training is unchanged, the specific contribution of the dynamic sample selection—rather than SAM itself—would be exposed. Conversely, if the gains persist, the circularity concern is resolved.

Watch

Extended reading notes

Core claim

The paper's central claim is that the difficulty of detecting poisoned samples is largely governed by the strength of the backdoor effect in the trained model, and that this effect can be deliberately amplified at training time without touching the attack. Concretely, they define the backdoor effect via Trigger-Activated Change (TAC), the mean of the top-K per-neuron activation differences between clean and triggered inputs. Across attacks and detectors they measure a Pearson correlation of 0.71 between top-K TAC and detection AUC, which motivates treating backdoor strength as a controllable knob. They then show that training the backdoored model with Sharpness-Aware Minimization (SAM)—which minimizes a worst-case perturbed loss—selectively increases TAC on high-TAC (backdoor) neurons, increases their weight norms, and separates poisoned from clean features, as confirmed by silhouette scores and distance-to-center plots. A feature-scaling step (whitening with PCA plus a covariance estimate) counters SAM's tendency to inflate intra-class variance of clean samples. Applied to five off-the-shelf detectors, SAM-enhanced PSD improves TPR on average by 34.38% on CIFAR-10 and by large margins on GTSRB, across ten attack types and weak settings such as 0.5%–1% poisoning ratios.

Load-bearing premise

The method's feature-scaling step estimates a covariance matrix using 'potential clean samples dynamically collected from the poisoned dataset,' but the paper never specifies how those samples are selected; if the selection relies on the same detection method being evaluated, part of the reported improvement could be circular.

Editorial extensions

If this is right

  • Any existing feature-based PSD method (AC, Spectre, SCAn, SS, Beatrix) can be wrapped with SAM training and feature scaling, without changing the detector's internals.
  • Weak backdoor attacks that previously evaded detection—low poisoning ratio (0.5–1%) or weak triggers like Adap-Blend—become detectable with average TPR gains over 25% on CIFAR-10 for four detector/attack combinations.
  • Because the method works after training on poisoned data, it applies to the standard pre-training defense pipeline: detect-and-filter before final training.
  • The reported correlation between backdoor effect and detection performance suggests that other training-time interventions that selectively amplify backdoor neurons could yield similar gains, not only SAM.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the TAC–AUC correlation is causal, then backdoor defenses that suppress the backdoor (like FT-SAM post-training) might inadvertently make detection harder; the two goals are in tension.
  • The feature-scaling step resembles a Mahalanobis whitening of the feature space; a natural testable extension is whether simpler statistics (e.g., a per-dimension variance normalization without PCA) achieve the same stability at lower cost.
  • The paper's dynamic clean-sample selection is underspecified; evaluating whether a fixed external clean reference yields the same gains would isolate SAM's contribution from that of the covariance estimator.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes SAM-enhanced PSD, a three-stage pipeline for poisoned-sample detection. It first trains a backdoored model with Sharpness-Aware Minimization, then extracts feature representations, applies a feature-scaling step that uses PCA and a covariance matrix estimated from reference clean samples and 'potential clean samples dynamically collected from the poisoned dataset,' and finally feeds the scaled features into any off-the-shelf poisoned-sample detection method. The authors report that SAM amplifies the backdoor effect (measured by TAC) and that this improves detection, with an average +34.38% TPR improvement on CIFAR-10.

Significance. The empirical observation that the backdoor effect is positively correlated with detection performance is a useful and clearly presented insight, and the proposal to use SAM as a training-side enhancement is novel and complementary to existing PSD methods. The evaluation is broad, covering ten attacks, five detectors, and several datasets and architectures, which is a strength if the results are reliable. The method is also model-agnostic in the sense that it can wrap any feature-based PSD, which enhances its practical appeal. However, the central empirical claim currently rests on an underspecified feature-scaling step and single-run results, so the significance of the contribution is not yet fully established.

major comments (5)
  1. [§3.4, Stage-2] The feature-scaling step is underspecified. The covariance matrix Sigma is estimated from 'reference clean samples and potential clean samples dynamically collected from the poisoned dataset,' but the selection rule for the 'potential clean samples' is never defined, and the algorithmic process is deferred to a supplementary material that is not included in the submission. The scaled features g_s = Σ^{−1/2} P g are fed directly into every evaluated PSD, and the ablation in Table 3 shows that FS alone produces large gains (e.g., Beatrix on Blended from 5.0 to 27.1 TPR). If the dynamic collection uses the same detection method being enhanced, or any information derived from the poisoned model's predictions, the reported improvements could be partly an artifact of information leakage rather than an effect of SAM. This is load-bearing for the paper's main claim. The authors must specify the selection procedure and demonstrate that it does not reuse the evaluated PSD or otherwise leak detection-relevant information.
  2. [§3.3, Proposition 3.1] Proposition 3.1 is stated without proof. The condition involves quantities that are not precisely defined in the main text (e.g., a_j, ℓ'(θ), and the norm term in the denominator), and the remark's conclusion that neurons satisfying the condition are backdoor neurons is asserted rather than derived. Since this proposition is the paper's main theoretical justification for why SAM strengthens the backdoor effect, a complete proof or a precise reference to where it is proved must be provided.
  3. [§4.2, Tables 1-3] All experimental results are reported as single numbers without standard deviations, confidence intervals, or significance tests. Several results go in the opposite direction of the headline claim, e.g., SCAn on BadNets in Table 1 has TPR decreasing from 96.0 to 95.2 and F1 from 98.0 to 97.6; AC on BadNets has F1 dropping from 97.1 to 42.5 because FPR rises from 0.1% to 13.3%. The aggregate '+34.38% TPR on average' may hide substantial instability, especially on weak attacks. The authors should provide multi-seed statistics and explicitly discuss cases where SAM-enhanced PSD degrades performance.
  4. [§3.2, Fig. 2] The correlation analysis reports a Pearson coefficient of 0.71 and R² = 0.51 without confidence intervals, p-values, or a description of the regression model. The scatter plot mixes multiple attack types, poisoning ratios, and detection methods, so the apparent correlation between TAC and AUC could be confounded by attack-specific or detector-specific effects. A per-attack or multi-level analysis is needed to substantiate the causal narrative that increasing the backdoor effect improves detection.
  5. [§1, Introduction] The introduction states that the approach is 'model-agnostic and data-independent.' However, Stage-2 explicitly uses reference clean samples and a covariance matrix estimated from the poisoned dataset, and Stage-1 trains a model on the poisoned dataset; the method is therefore data-dependent. Please correct this characterization or clarify what 'data-independent' is intended to mean.
minor comments (5)
  1. [§3.4, Stage-3] There are typos: 'Integrading' should be 'Integrating' and 'off-the-shell' should be 'off-the-shelf'.
  2. [§3.3, Eq. (1)] Equation (1) has garbled formatting for the layer/neuron indices and the norm expression; the equation should be typeset clearly so that f_k^{(l)} and the activation difference are unambiguous.
  3. [§2, Related Work] The sentence 'Studies have shown that SAM can lead to increased sparsity in active neurons ... (related studies)' contains the placeholder '(related studies)' instead of proper citations; this should be replaced with actual references.
  4. [§4.4, Fig. 9] The text contains 'As shown in Fig. 9 (assuming the correct figure reference)', which is an editing artifact. The figure reference should be corrected and the relationship between Fig. 8 and Fig. 9 clarified.
  5. [§4.1 and §3.4] The manuscript repeatedly refers to 'supplementary material' for results on Tiny ImageNet, VGG19-BN, DenseNet-161, and for the algorithm details of SAM-enhanced PSD, but no supplementary material is included in the submission. These results and details are therefore not verifiable in the present manuscript.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: SAM training is independent of the PSDs it enhances; the under-specified Stage-2 feature-scaling step is a reproducibility concern, not a demonstrated circular step.

full rationale

The central derivation is self-contained: Stage-1 SAM training of the backdoored model does not use any detector outcome, and the subsequent PSD evaluation is an out-of-sample comparison on the resulting features, so the reported improvements are not fitted parameters renamed as predictions. The TAC-based backdoor-effect analysis is an independent empirical and theoretical observation, not a restatement of the detection results, and the claimed positive correlation is measured rather than defined into existence. Self-citations such as FT-SAM, BackdoorBench, and AGPD are used for settings, baselines, or contrast, and none of them carries the load of the main claim that SAM amplification improves off-the-shelf PSDs. Two weaknesses are flagged but do not rise to demonstrated circularity. First, Stage-2 estimates the covariance matrix Sigma from 'reference clean samples and potential clean samples dynamically collected from the poisoned dataset' without specifying how the potential clean samples are selected; if that selection reused the PSD being enhanced, the scaling would create information leakage, but the text does not state this and the algorithm is deferred to supplementary material, so no specific reduction can be exhibited from the paper itself. Second, Proposition 3.1 is stated without a proof in the main text and is not used to construct the empirical predictions, which is a rigor and completeness concern rather than a circular one. Overall, the derivation chain is not circular by the paper's own equations, and the score reflects only minor unresolved specification issues.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or architectural entities. Its central quantitative claims rest on four assumptions, the most fragile being the TAC-detectability link and the transfer of the two-layer theory to deep networks. The only hand-chosen hyperparameter in the method is rho=0.1; two more parameters (PCA dimension, potential-clean-sample rule) are unstated.

free parameters (3)
  • rho (SAM perturbation budget) = 0.1
    Chosen by hand and reported in Section 4.1 as the default for all experiments. Figure 6 shows the results are relatively insensitive to rho.
  • PCA component count in Stage-2 projection = not stated
    The projection matrix P is estimated via PCA, but the retained dimensionality is not reported, making the feature scaling under-specified.
  • Selection rule for 'potential clean samples' in covariance estimation = not stated
    Stage-2 requires 'potential clean samples dynamically collected from the poisoned dataset' to estimate Sigma; the rule is not defined in the main text.
assumptions (4)
  • domain assumption TAC measured with known poisoned samples and triggers is a valid proxy for backdoor effect, and a larger TAC leads to better detection.
    Used in Section 3.2; supported only by a correlation of 0.71 over a limited set of attacks and detectors.
  • ad hoc to paper SAM's behavior on a two-layer ReLU network (Proposition 3.1) transfers to deep networks used in experiments.
    Proposition 3.1 is stated without proof and for a simplified model; the paper assumes the mechanism holds for ResNet, VGG, and DenseNet.
  • domain assumption Auxiliary clean samples (250 per class) are truly clean and representative of the training distribution.
    Used for covariance estimation in Stage-2; if the auxiliary set is poisoned or biased, the scaling is corrupted.
  • domain assumption BackdoorBench default attack configurations are representative of real backdoor threats.
    All attacks use BackdoorBench defaults (Section 4.1), so results may not generalize beyond these settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization." pith.science (2026). https://pith.science/paper/UIX4SPWV

@misc{pith2026241111525,
  author       = {Pith},
  title        = {Pith review of: Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UIX4SPWV}},
  note         = {Machine review of arXiv:2411.11525}
}
abstract

Backdoor attack has been considered as a serious security threat to deep neural networks (DNNs). Poisoned sample detection (PSD) that aims at filtering out poisoned samples from an untrustworthy training dataset has shown very promising performance for defending against data poisoning based backdoor attacks. However, we observe that the detection performance of many advanced methods is likely to be unstable when facing weak backdoor attacks, such as low poisoning ratio or weak trigger strength. To further verify this observation, we make a statistical investigation among various backdoor attacks and poisoned sample detections, showing a positive correlation between backdoor effect and detection performance. It inspires us to strengthen the backdoor effect to enhance detection performance. Since we cannot achieve that goal via directly manipulating poisoning ratio or trigger strength, we propose to train one model using the Sharpness-Aware Minimization (SAM) algorithm, rather than the vanilla training algorithm. We also provide both empirical and theoretical analysis about how SAM training strengthens the backdoor effect. Then, this SAM trained model can be seamlessly integrated with any off-the-shelf PSD method that extracts discriminative features from the trained model for detection, called SAM-enhanced PSD. Extensive experiments on several benchmark datasets show the reliable detection performance of the proposed method against both weak and strong backdoor attacks, with significant improvements against various attacks ($+34.38\%$ TPR on average), over the conventional PSD methods (i.e., without SAM enhancement). Overall, this work provides new insights about PSD and proposes a novel approach that can complement existing detection methods, which may inspire more in-depth explorations in this field.

Figures

Figures reproduced from arXiv: 2411.11525 by the authors.

Figure 1
Figure 1. T-SNE visualizations for the impact of poisoning ra [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 3
Figure 3. The differences in all TACs between the model trained [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Comparison of the intra-class feature variance between [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: Detection performance of base PSD with SAM-enhanced PSD (SAM) under different poisoning ratios on CIFAR10 and [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Distribution of distances between the target clean sam [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 6
Figure 6. Figure 6: Detection performance of base PSD with SAM [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 8
Figure 8. Figure 8: Neuron weight norm combined with TAC between the model trained with SAM and the model trained with Vanilla training under [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: The differences in all weight norms between the model [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 31 canonical work pages

  1. [1]

    Entropy-sgd: Biasing gradient descent into wide valleys

    Pratik Chaudhari, Anna Choromanska, Stefano Soatto, Yann LeCun, Carlo Baldassi, Christian Borgs, Jennifer Chayes, Levent Sagun, and Riccardo Zecchina. Entropy-sgd: Biasing gradient descent into wide valleys. Journal of Statistical Me- chanics: Theory and Experiment, 2019(12):124018, 2019. 3

    work page 2019

  2. [2]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018. 2, 3, 5

    arXiv 2018

  3. [3]

    Effective backdoor defense by exploiting sensitivity of poisoned sam- ples

    Weixin Chen, Baoyuan Wu, and Haoqian Wang. Effective backdoor defense by exploiting sensitivity of poisoned sam- ples. In Advances in Neural Information Processing Systems, pages 9727–9737, 2022. 3

    work page 2022

  4. [4]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 ,

    arXiv

  5. [5]

    When vision transformers outperform resnets without pre- training or strong data augmentations

    Xiangning Chen, Cho-Jui Hsieh, and Boqing Gong. When vision transformers outperform resnets without pre- training or strong data augmentations. arXiv preprint arXiv:2106.01548, 2021. 3

    arXiv 2021

  6. [6]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In inter- national conference on machine learning, pages 1310–1320. PMLR, 2019. 3

    2019

  7. [7]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 11946–11956, 2021. 2

    work page 2021

  8. [8]

    Sharpness-aware minimization for efficiently improving generalization

    Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. arXiv preprint arXiv:2010.01412,

    arXiv 2010

Show all 50 references
  1. [9]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Pro- ceedings of the 35th Annual Computer Security Applications Conference, pages 113–125, 2019. 2, 3, 5

    2019

  2. [10]

    Badnets: Evaluating backdooring attacks on deep neu- ral networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neu- ral networks. IEEE Access, 7:47230–47244, 2019. 1, 2, 5

    2019

  3. [11]

    Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled predic- tion consistency

    Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled predic- tion consistency. In The Eleventh International Conference on Learning Representations. 3

  4. [12]

    Spectre: Defending against backdoor attacks us- ing robust statistics

    Jonathan Hayase, Weihao Kong, Raghav Somani, and Se- woong Oh. Spectre: Defending against backdoor attacks us- ing robust statistics. InInternational Conference on Machine Learning, pages 4129–4139, 2021. 2, 3, 5

    2021

  5. [13]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 5

    2016

  6. [14]

    Flat minima.Neu- ral computation, 9(1):1–42, 1997

    Sepp Hochreiter and J ¨urgen Schmidhuber. Flat minima.Neu- ral computation, 9(1):1–42, 1997. 3

    1997

  7. [15]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017. 5

    2017

  8. [16]

    Distilling cognitive backdoor patterns within an image

    Hanxun Huang, Xingjun Ma, Sarah Erfani, and James Bai- ley. Distilling cognitive backdoor patterns within an image. arXiv preprint arXiv:2301.10908, 2023. 5

    2023 arXiv

  9. [17]

    Backdoor defense via decoupling the training process

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In International Conference on Learning Representations. 3

  10. [18]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 5

    2009

  11. [19]

    Asam: Adaptive sharpness-aware minimiza- tion for scale-invariant learning of deep neural networks

    Jungmin Kwon, Jeongseop Kim, Hyunseo Park, and In Kwon Choi. Asam: Adaptive sharpness-aware minimiza- tion for scale-invariant learning of deep neural networks. In International Conference on Machine Learning , pages 5905–5914. PMLR, 2021. 3

    2021

  12. [20]

    Invisible backdoor attack with sample- specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample- specific triggers. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision, 2021. 2, 5

    2021

  13. [21]

    Anti-backdoor learning: Training clean models on poisoned data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, 34:14900–14912, 2021. 3

    2021

  14. [22]

    Reconstructive neuron prun- ing for backdoor defense

    Yige Li, Xixiang Lyu, Xingjun Ma, Nodens Koren, Lingjuan Lyu, Bo Li, and Yu-Gang Jiang. Reconstructive neuron prun- ing for backdoor defense. In International Conference on Machine Learning, pages 19837–19854. PMLR, 2023. 3

    2023

  15. [23]

    Badclip: Dual- embedding guided backdoor attack on multimodal con- trastive learning

    Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badclip: Dual- embedding guided backdoor attack on multimodal con- trastive learning. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 24645–24654, 2024. 3

    2024

  16. [24]

    Trojaning attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th Annual Network and Dis- tributed System Security Symposium, 2018. 5

    2018

  17. [25]

    The” beatrix”resurrections: Ro- bust backdoor detection via gram matrices

    Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang. The” beatrix”resurrections: Ro- bust backdoor detection via gram matrices. arXiv preprint arXiv:2209.11715, 2022. 3, 5

    2022 arXiv

  18. [26]

    Wanet - impercepti- ble warping-based backdoor attack

    Tuan Anh Nguyen and Anh Tuan Tran. Wanet - impercepti- ble warping-based backdoor attack. In International Confer- ence on Learning Representations, 2021. 5

    2021

  19. [27]

    Evaluating llm–generated multimodal diagnosis from medical images and symptom analysis

    Dimitrios P Panagoulias, Maria Virvou, and George A Tsihrintzis. Evaluating llm–generated multimodal diagnosis from medical images and symptom analysis. arXiv preprint arXiv:2402.01730, 2024. 1

    2024 arXiv

  20. [28]

    Revisiting the assumption of latent sep- arability for backdoor defenses

    Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. Revisiting the assumption of latent sep- arability for backdoor defenses. In International Conference on Learning Representations, 2023. 2, 3, 5 9

    2023

  21. [29]

    Silhouettes: a graphical aid to the inter- pretation and validation of cluster analysis

    Peter J Rousseeuw. Silhouettes: a graphical aid to the inter- pretation and validation of cluster analysis. Journal of com- putational and applied mathematics, 20:53–65, 1987. 7

    1987

  22. [30]

    Imagenet large scale visual recognition challenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, San- jeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:211–252, 2015. 5

    2015

  23. [31]

    When llm meets hypergraph: A sociological analysis on personality via online social networks

    Zhiyao Shu, Xiangguo Sun, and Hong Cheng. When llm meets hypergraph: A sociological analysis on personality via online social networks. In Proceedings of the 33rd ACM In- ternational Conference on Information and Knowledge Man- agement, pages 2087–2096, 2024. 1

    2024

  24. [32]

    Very deep convo- lutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convo- lutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. 5

    2014 arXiv

  25. [33]

    Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch

    Hossein Souri, Liam Fowl, Rama Chellappa, Micah Gold- blum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In Advances in neural information processing systems, pages 19165–19178, 2022. 2

    2022

  26. [34]

    The german traffic sign recognition bench- mark: a multi-class classification competition

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. The german traffic sign recognition bench- mark: a multi-class classification competition. In The 2011 international joint conference on neural networks , pages 1453–1460. IEEE, 2011. 5

    2011

  27. [35]

    Demon in the variant: Statistical analysis of {DNNs} for ro- bust backdoor contamination detection

    Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. Demon in the variant: Statistical analysis of {DNNs} for ro- bust backdoor contamination detection. In USENIX Security Symposium, pages 1541–1558, 2021. 2, 3, 5

    2021

  28. [36]

    Spectral sig- natures in backdoor attacks

    Brandon Tran, Jerry Li, and Aleksander Madry. Spectral sig- natures in backdoor attacks. Advances in neural information processing systems, 31, 2018. 3, 5

    2018

  29. [37]

    Label-consistent backdoor attacks

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019. 2, 5

    1912 arXiv

  30. [38]

    Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples

    Shaokui Wei, Mingda Zhang, Hongyuan Zha, and Baoyuan Wu. Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples. Advances in Neural Information Processing Systems, 36:25876–25909, 2023. 3

    2023

  31. [39]

    Backdoor- bench: A comprehensive benchmark of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoor- bench: A comprehensive benchmark of backdoor learning. In Thirty-sixth Conference on Neural Information Process- ing Systems Datasets and Benchmarks Track, 2022. 5

    2022

  32. [40]

    Defenses in adversarial machine learning: A survey

    Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu. Defenses in adversarial machine learning: A survey. arXiv preprint arXiv:2312.08890, 2023. 2

    2023 arXiv

  33. [41]

    Backdoorbench: A comprehensive benchmark and analysis of backdoor learning.arXiv preprint arXiv:2401.15002, 2024

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Mingli Zhu, Ruotong Wang, Li Liu, and Chao Shen. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning.arXiv preprint arXiv:2401.15002, 2024. 1

    2024 arXiv

  34. [42]

    Adversarial neuron prun- ing purifies backdoored deep models

    Dongxian Wu and Yisen Wang. Adversarial neuron prun- ing purifies backdoored deep models. Advances in Neural Information Processing Systems, 34:16913–16925, 2021. 3

    2021

  35. [43]

    Introspection of dnn-based perception functions in au- tomated driving systems: State-of-the-art and open research challenges

    Hakan Yekta Yatbaz, Mehrdad Dianati, and Roger Wood- man. Introspection of dnn-based perception functions in au- tomated driving systems: State-of-the-art and open research challenges. IEEE Transactions on Intelligent Transportation Systems, 2023. 1

    2023

  36. [44]

    Activation gradient based poisoned sam- ple detection against backdoor attacks

    Danni Yuan, Shaokui Wei, Mingda Zhang, Li Liu, and Baoyuan Wu. Activation gradient based poisoned sam- ple detection against backdoor attacks. arXiv preprint arXiv:2312.06230, 2023. 3

    2023 arXiv

  37. [45]

    Rethink- ing the backdoor attacks’ triggers: A frequency perspective

    Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethink- ing the backdoor attacks’ triggers: A frequency perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16473–16481, 2021. 2, 5

    2021

  38. [46]

    Data- free backdoor removal based on channel lipschitzness

    Runkai Zheng, Rongjun Tang, Jianze Li, and Li Liu. Data- free backdoor removal based on channel lipschitzness. In European Conference on Computer Vision, pages 175–191. Springer, 2022. 2, 3

    2022

  39. [47]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization

    Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4466–4477, 2023. 3, 8

    2023

  40. [48]

    Neural polarizer: A lightweight and effective backdoor de- fense via purifying poisoned features

    Mingli Zhu, Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. Neural polarizer: A lightweight and effective backdoor de- fense via purifying poisoned features. InThirty-seventh Con- ference on Neural Information Processing Systems, 2023. 3

    2023

  41. [49]

    Breaking the false sense of security in backdoor defense through re- activation attack

    Mingli Zhu, Siyuan Liang, and Baoyuan Wu. Breaking the false sense of security in backdoor defense through re- activation attack. arXiv preprint arXiv:2405.16134, 2024. 2

    2024 arXiv

  42. [50]

    Surrogate gap minimization improves sharpness-aware training

    Juntang Zhuang, Boqing Gong, Liangzhe Yuan, Yin Cui, Hartwig Adam, Nicha Dvornek, Sekhar Tatikonda, James Duncan, and Ting Liu. Surrogate gap minimization improves sharpness-aware training. arXiv preprint arXiv:2203.08065,

    arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.