Pith. sign in

REVIEW 4 major objections 4 minor 70 references

FLARE: Toward Universal Dataset Purification against Backdoor Attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FLARE claims that backdoor-poisoned samples can be filtered by aggregating abnormal activations from all hidden layers and removing the more stable cluster, reaching near-perfect detection across 22 attacks.

desk verdict FLARE attacks a real gap in dataset purification—A2A and UT attacks—but its 'universal' near-perfect claim is only as strong as the stability threshold ξ, which Table VIII shows is tuned on the evaluation attacks and fragile. read the letter →

arxiv 2411.19479 v3 pith:GF4RMAXG submitted 2024-11-29 cs.CR cs.AIcs.CVcs.LG

Linshan Hou , Wei Luo , Zhongyun Hua , Songhua Chen , Leo Yu Zhang , Yiming Li This is my paper · ORCID
classification cs.CRcs.AIcs.CVcs.LG
keywords datasetpurificationbackdoorattacksall-to-alluntargetedclusterstabilitybatchnormalizationfeaturemapspoisonedsampledetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FLARE aims to make dataset purification universal by removing poisoned training samples before model training, regardless of the attack mode. It first argues that existing purification methods assume backdoor connections are simpler to learn than benign features, an assumption that fails for all-to-all and untargeted attacks. Instead of relying on input-output behavior or a single layer, FLARE builds a per-sample signature from abnormal activations in every hidden layer and uses cluster stability to pick the poisoned cluster. On 22 attacks across CIFAR-10 and Tiny-ImageNet, it reports near-100% true positive rates with false positive rates near zero, plus near-zero attack success rates after retraining or unlearning. The payoff is a single proactive defense that works where previous purification methods break down.

What carries the argument

The central object is the all-layer abnormal-activation representation. For each sample, FLARE takes the output of every hidden layer, aligns each feature map with a Gaussian transform built from that layer's batch-normalization mean and variance, extracts the minimum value of each aligned feature map, and concatenates these minima across all channels and layers into one vector. That vector is reduced with UMAP and clustered with HDBSCAN; FLARE then repeatedly drops the last hidden layers until a stable subspace is found, splits the root of the condensed cluster tree into two clusters, and labels the cluster with higher stability as poisoned, where stability is the density-level gap between a cluster's first appearance and the point where it divides.

What would settle it

Construct a backdoor attack whose trigger is designed to raise, not lower, channel-wise minima after batch-normalization alignment, for instance a bright additive patch on all poisoned images, and evaluate FLARE on CIFAR-10 at a 10% poisoning rate; if the true positive rate drops far below the reported near-100%, the core premise that poisoned samples register as abnormally small aligned activations is false.

Watch

Extended reading notes

Core claim

The paper's central claim is that poisoned samples are detectable by the abnormal activations they leave across the whole network, not in any one layer. It states that current purification defenses inherit the latent assumption that trigger-to-label connections are easier to learn than benign features; that assumption holds for all-to-one attacks but breaks for all-to-all and untargeted attacks, where models do not converge faster on poisoned data, triggers are not saliency-dominant, and perturbations affect poisoned and benign samples similarly. FLARE therefore aggregates the minimum value of each batch-normalization-aligned feature map across all hidden layers into one representation, reduces it, selects a subspace that keeps benign samples together, and labels the more stable of two clusters as poisoned. The paper reports that this procedure detects 22 representative attacks at true positive rates near 100% and false positive rates near 0%, keeps benign accuracy essentially intact, and resists an adaptive attack that deliberately reduces latent separation.

Load-bearing premise

The method assumes that backdoor triggers drive some feature-map activations to abnormally small values after batch-normalization alignment, and that poisoned samples then form a tighter, more stable cluster than benign samples.

Editorial extensions

If this is right

  • Purification-based defense becomes viable for all-to-all and untargeted backdoor attacks, not just the all-to-one case where existing methods already work.
  • Defenders no longer need clean reference samples or knowledge of the trigger; the same detector applies across attack families, target labels, and poisoning rates down to 2%.
  • Detected poisoned samples can be used in two ways: dropping them and retraining from scratch, or unlearning them from the already-trained backdoored model, with both routes reported to leave attack success rates near zero.
  • Because the signature spans all hidden layers, attacks that hide separation in any single layer or in input-output statistics remain findable.
  • Models trained from the purified dataset keep benign accuracy close to that of the original backdoored model, so the defense does not trade away normal task performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same "most stable cluster is the anomaly" criterion could transfer to other clean-label or memorization-based dataset poisonings, since the mechanism only requires a compact anomalous cluster.
  • Editorial inference: architectures without batch normalization would need a different alignment scheme; testing FLARE with layer normalization or group normalization backbones would show whether the abnormal-minimum signal is specific to batch-normalization statistics.
  • Editorial inference: the paper leaves open whether the minimum-value signal comes from the trigger itself or from label re-assignment; separating these two causes could inform the trigger-reconstruction follow-up the authors list as future work.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes FLARE, a dataset purification defense against backdoor attacks. It first argues that existing purification methods rely on the assumption that trigger-to-target connections are simpler to learn than benign features, an assumption that fails for all-to-all (A2A) and untargeted (UT) attacks. FLARE trains a model on the suspicious dataset, aligns each hidden-layer feature map with BN statistics, extracts channel-wise minima from each aligned feature map, aggregates these minima across all hidden layers, reduces dimensionality with UMAP, clusters with HDBSCAN, selects a stable subspace by dropping the last few layers, and labels the more stable of the two root clusters as poisoned. Experiments on CIFAR-10 and Tiny-ImageNet across 22 attacks report near-perfect TPR/FPR and near-zero post-purification ASR for both retraining-from-scratch and backdoor-removal variants, plus an adaptive-attack evaluation against Ada-Patch. The code is made available through two public toolboxes.

Significance. If the empirical claims hold, FLARE is a meaningful advance: it targets attack modes (A2A and UT) where prior purification defenses largely fail, it uses information from all hidden layers rather than a single layer, and it provides two post-detection strategies. The paper also gives a useful negative result, namely that early-convergence, dominant-trigger, perturbation-consistency, and single-layer-latent-separability assumptions degrade for A2A/UT attacks. The evaluation is broad (22 attacks, two datasets, several architectures, poisoning-rate variation) and the code is publicly available. The main weaknesses are that the stability threshold ξ is tuned on the evaluated attack configurations, the core cluster-stability assumption is asserted rather than directly validated, and no multiple-seed statistics are reported; these gaps currently prevent the 'universal' and 'near 0% FPR' claims from being fully established.

major comments (4)
  1. [V-E, Table VIII] The universal near-zero-FPR claim is not yet established because the stability threshold ξ is tuned on the evaluated attacks. In the ablation, ξ is varied from 0.01 to 0.05 on the same five attack configurations that appear in the headline tables: BadNets (A2O), LC, ISSBA, BadNets (A2A), and BadNets (UT). Table VIII shows a sharp threshold effect: LC's FPR jumps from 0.00% at ξ=0.03 to 33.89% at ξ=0.04, and BadNets (A2A)'s FPR jumps from 0.00% at ξ=0.04 to 40.67% at ξ=0.05. The paper fixes ξ=0.02 'by default' after observing these results. Since a defender does not know the attack mode, there is no principled way to choose ξ in the safe interval, and the paper does not provide an attack-disjoint validation or a data-driven selection rule. Please add such validation or temper the universality claim.
  2. [IV-C2, Definition IV.1, Eq. (8)] The detection rule that the more stable of the two root clusters is the poisoned cluster is an assumption loaded into Definition IV.1 and Eq. (8) rather than derived or validated. The supporting text asserts that poisoned samples 'tend to aggregate into a tight cluster' and remain stable across density levels, while benign clusters fragment; however, no experiment directly compares the stability of the benign root cluster with that of the poisoned cluster, and no failure case is examined. Because this is the step that determines which cluster is removed, the paper should provide a dedicated validation (e.g., stability distributions on clean data and on each attack mode) before claiming universal detection.
  3. [IV-B1, Eq. (2)] The alignment transformation is written as the normal probability density function, P(a;μ,σ²)=1/√(2πσ²) exp(−(a−μ)/(2σ²)). As written it does not map all inputs to [0,1] (the density exceeds 1 for small σ), and the exponent is missing the square. Since the subsequent extraction of channel-wise minima in Eq. (3) depends on this alignment, the formula needs to be corrected (likely to the Gaussian CDF Φ((a−μ)/σ)) and the exact implemented transformation stated. If this is only a typesetting error, it should be fixed because it affects reproducibility.
  4. [V-B, Tables I-IV] The paper reports no multiple-seed results or variance for any metric, although the tables present values such as 100.00% TPR and 0.00% FPR exactly. Given that the headline claim is near-perfect and stable performance across many attacks, the authors should report mean and standard deviation over at least several independent training runs (or explain why the UMAP/HDBSCAN and model-training randomness do not affect the results). Without this, the exact zeros in Table I and Table II cannot be distinguished from a favorable random draw.
minor comments (4)
  1. [V-E] The sentence 'We also examined from 1 to 5' is missing the variable d; please rephrase as 'We also varied d from 1 to 5' and report the corresponding results rather than stating they are omitted.
  2. [II and VI] Several typos remain: 'traped' should be 'trapped' in Section II, 'FALRE' in the text around Algorithm 1 should be 'FLARE', and 'experimetns' in Section V-E should be 'experiments'.
  3. [Figure 8 caption] The caption says 'various target labels' but the x-axis is the poisoning rate; please correct the caption to match the figure.
  4. [Eq. (9)] In Eq. (9), the objective minimizes over θ but the model is written as M(x;θ′); this mismatch should be reconciled for clarity.

Circularity Check

1 steps flagged · score 4.0 of 10

Headline detection results are partly tuned to the evaluation suite: the ξ=0.02 default is chosen after observing FPR cliffs at neighboring thresholds on the same attacks later reported as universal.

  1. fitted input called prediction [Section V-E (Ablation Study, 'Impact of the Hyper-parameters'), Table VIII]
    "Detection performance of FLARE against various backdoor attacks under different threshold ξ. ... Given the uniform results, we omit detailed data for these variations and set ξ to 0.02 and d to 3 by default."

    The default threshold ξ is selected by inspecting TPR/FPR on exactly the kinds of attacks later used as headline evidence: Table VIII evaluates BadNets (A2O), LC, ISSBA, BadNets (A2A), and BadNets (UT), all of which appear in the main result tables. The surrounding table shows a cliff: at ξ=0.04, LC FPR jumps to 33.89%; at ξ=0.05, BadNets-A2A FPR jumps to 40.67%. Choosing ξ=0.02 after seeing these values means the reported 'near 0% FPR' on these attacks is not an independent prediction but a post-hoc selection on the evaluation set. Because no attack-disjoint validation or separate hyperparameter selection is reported, the central 'universal near-zero FPR' claim is partially fitted to the benchmark configurations rather than derived from a parameter-free mechanism.

full rationale

FLARE's core pipeline is not self-definitional: the BN-aligned min-activation representation, the UMAP/HDBSCAN clustering, and the subspace selection are all defined without using ground-truth poison labels, and the 'higher stability cluster is poisoned' rule is tested against external labels via TPR/FPR. No load-bearing result is justified solely by the authors' own prior work; self-citations such as [17] and [43] are motivational/related-work references rather than the source of the claimed detection guarantee. The only concrete circularity-like issue is the evaluation-set tuning of ξ: the default value is chosen after examining FPR across attacks that are then reported as evidence of universality, and Table VIII shows the method is sensitive to this choice at neighboring thresholds. This does not reduce the entire derivation to its input, but it does mean the headline near-zero FPRs are not fully independent predictions for those attacks. A defense-unaware observer cannot infer ξ without reproducing the same benchmark sweep, so the 'universal' claim is stronger than the validation protocol supports. Overall, the derivation is mostly self-contained, but the hyperparameter selection creates a partial fitted-input-called-prediction issue, warranting a moderate score of 4.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

FLARE's central result rests on several domain assumptions about how backdoor triggers manifest in hidden activations and how HDBSCAN stability behaves; these are not derived, and the key threshold xi is tuned on the evaluation attacks. No new physical entities are introduced; the only new formal object is the cluster-stability metric in Definition IV.1.

free parameters (4)
  • Cluster stability threshold xi = 0.02
    Default chosen after grid search from 0.01 to 0.05 on the evaluation attacks; Table VIII shows LC FPR jumps to 33.89% at xi=0.04 and 0.05, so the choice is data-dependent and affects central detection performance.
  • Maximum traversal depth d = 3
    Set by ablation over 1 to 5; performance is reported stable across this range, so it is a minor but still hand-chosen hyperparameter.
  • UMAP dimensionality reduction hyperparameters
    The paper does not report n_neighbors/min_dist or random seed; these affect the embedding and hence clustering, so exact replication is under-specified.
  • HDBSCAN min_cluster_size
    Not reported; HDBSCAN's condensed tree and stability values depend on this parameter, which is central to cluster stability.
assumptions (6)
  • domain assumption Defender can train a model on the suspicious dataset and has no benign reference samples; adversary only poisons the dataset, not the training process.
    Used in the threat model (Sec. III-A); it excludes attacks that manipulate training or require clean data, so 'universal' scope is narrower than stated.
  • domain assumption Backdoor-related features induce abnormally large or small activations, captured by per-channel minima after BN alignment.
    Invoked in Sec. IV-B2 to justify extracting minimum values; supported only by a citation [57] and not derived.
  • domain assumption Poisoned samples form a tighter, more stable cluster than benign samples across HDBSCAN density levels.
    Used in Sec. IV-C2 and Definition IV.1 to decide which of two clusters is poisoned; this is the core inductive bias of the detector.
  • domain assumption Shallow layers encode shared semantic information and deeper layers encode class-distinguishing features, so excluding the last k layers makes benign samples cluster together.
    Assumed in the stable subspace selection module (Sec. IV-C2); the adaptive search over k relies on this heuristic.
  • domain assumption Batch normalization statistics from the backdoored model are a valid alignment reference for detecting anomalies across feature maps.
    Used in Eq. (2) to map activations to [0,1]; BN statistics themselves are computed from the potentially poisoned training set, so the normalization is not independent of the anomalies.
  • domain assumption UMAP preserves the separation structure needed for HDBSCAN clustering, and HDBSCAN's condensed tree encodes cluster stability as defined.
    The whole detection pipeline depends on these algorithmic behaviors (Sec. IV-C1), which are not proven for poisoned-data settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FLARE: Toward Universal Dataset Purification against Backdoor Attacks." pith.science (2026). https://pith.science/paper/GF4RMAXG

@misc{pith2026241119479,
  author       = {Pith},
  title        = {Pith review of: FLARE: Toward Universal Dataset Purification against Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GF4RMAXG}},
  note         = {Machine review of arXiv:2411.19479}
}
read the original abstract

Deep neural networks (DNNs) are susceptible to backdoor attacks, where adversaries poison datasets with adversary-specified triggers to implant hidden backdoors, enabling malicious manipulation of model predictions. Dataset purification serves as a proactive defense by removing malicious training samples to prevent backdoor injection at its source. We first reveal that the current advanced purification methods rely on a latent assumption that the backdoor connections between triggers and target labels in backdoor attacks are simpler to learn than the benign features. We demonstrate that this assumption, however, does not always hold, especially in all-to-all (A2A) and untargeted (UT) attacks. As a result, purification methods that analyze the separation between the poisoned and benign samples in the input-output space or the final hidden layer space are less effective. We observe that this separability is not confined to a single layer but varies across different hidden layers. Motivated by this understanding, we propose FLARE, a universal purification method to counter various backdoor attacks. FLARE aggregates abnormal activations from all hidden layers to construct representations for clustering. To enhance separation, FLARE develops an adaptive subspace selection algorithm to isolate the optimal space for dividing an entire dataset into two clusters. FLARE assesses the stability of each cluster and identifies the cluster with higher stability as poisoned. Extensive evaluations on benchmark datasets demonstrate the effectiveness of FLARE against 22 representative backdoor attacks, including all-to-one (A2O), all-to-all (A2A), and untargeted (UT) attacks, and its robustness to adaptive attacks. Codes are available at \href{https://github.com/THUYimingLi/BackdoorBox}{BackdoorBox} and \href{https://github.com/vtu81/backdoor-toolbox}{backdoor-toolbox}.

Figures

Figures reproduced from arXiv: 2411.19479 by the authors.

Figure 1
Figure 1. The benign accuracy (BA) and backdoor elimination [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 3
Figure 3. Grad-CAM visualization of saliency regions for benign [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Difference in prediction confidences for benign and poisoned samples on CIFAR-10 under input-level and weight-level [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: T-SNE visualization of latent representations across different hidden layers on the CIFAR-10 dataset. A total of 2,000 [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: The main pipeline of FLARE. Stage 1: Latent Representation Extraction: A backdoored model is trained on a poisoned dataset, and each training sample xi is forwarded to generate feature maps at hidden layers. The value ranges of each feature map are aligned using the st…
Figure 6
Figure 6. Figure 6: These small but stable benign clusters can signif [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Performance of our defense across different target labels of CIFAR-10. The consistently high TPR and low FPR across [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: The impact of the poisoning rate on CIFAR-10. The consistently high TPR and low FPR across various target labels [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 61 canonical work pages

  1. [1]

    Physgan: Generating physical-world-resilient adversarial examples for autonomous driving

    Zelun Kong, Junfeng Guo, Ang Li, and Cong Liu. Physgan: Generating physical-world-resilient adversarial examples for autonomous driving. InCVPR, 2020

    work page 2020

  2. [2]

    A survey of deep learning techniques for au- tonomous driving.J

    Sorin Grigorescu, Bogdan Trasnea, Tiberiu Cocias, and Gigel Macesanu. A survey of deep learning techniques for au- tonomous driving.J. Field Robot., 37(3):362–386, 2020

    work page 2020

  3. [3]

    Mutual component analysis for heterogeneous face recog- nition.ACM Trans

    Zhifeng Li, Dihong Gong, Qiang Li, Dacheng Tao, and Xuelong Li. Mutual component analysis for heterogeneous face recog- nition.ACM Trans. Intell. Syst. Technol., 7(3):1–23, 2016

    work page 2016

  4. [4]

    Com- mon feature discriminant analysis for matching infrared face images to optical face images.IEEE Trans

    Zhifeng Li, Dihong Gong, Yu Qiao, and Dacheng Tao. Com- mon feature discriminant analysis for matching infrared face images to optical face images.IEEE Trans. Image Process., 23(6):2436–2445, 2014

    work page 2014

  5. [5]

    Detecting and corrupting convolution-based unlearnable examples

    Minghui Li, Xianlong Wang, Zhifei Yu, Shengshan Hu, Ziqi Zhou, Longling Zhang, and Leo Yu Zhang. Detecting and corrupting convolution-based unlearnable examples. InAAAI, 2023

    work page 2023

  6. [6]

    Badrobot: Manipulating embodied llms in the physical world

    Hangtao Zhang, Chenyu Zhu, Xianlong Wang, Ziqi Zhou, Changgan Yin, Minghui Li, Lulu Xue, Yichen Wang, Shengshan Hu, Aishan Liu, et al. Badrobot: Manipulating embodied llms in the physical world. InICLR, 2024

    work page 2024

  7. [7]

    Decaf: Data distribution decompose attack against federated learning

    Zhiyang Dai, Yansong Gao, Chunyi Zhou, Anmin Fu, Zhi Zhang, Minhui Xue, Yifeng Zheng, and Yuqing Zhang. Decaf: Data distribution decompose attack against federated learning. IEEE Trans. Inf. Forensics Secur., 2025

    work page 2025

  8. [8]

    Improving generaliza- tion of universal adversarial perturbation via dynamic maximin optimization

    Yechao Zhang, Yingzhe Xu, Junyu Shi, Leo Yu Zhang, Sheng- shan Hu, Minghui Li, and Yanjun Zhang. Improving generaliza- tion of universal adversarial perturbation via dynamic maximin optimization. InAAAI, 2025

    work page 2025

Show all 70 references
  1. [9]

    Pb-uap: Hybride universal adversarial attack for image segmentation

    Yufei Song, Ziqi Zhou, Minghui Li, Xianlong Wang, Hangtao Zhang, Menghao Deng, Wei Wan, Shengshan Hu, and Leo Yu Zhang. Pb-uap: Hybride universal adversarial attack for image segmentation. InICASSP, 2025

    2025

  2. [10]

    Bad- Nets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.IEEE Access, 2017

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Bad- Nets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.IEEE Access, 2017

    2017

  3. [11]

    Backdoor Learning: A Survey.IEEE Trans

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor Learning: A Survey.IEEE Trans. Neural Netw. Learn. Syst., 2022. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 14

    2022

  4. [12]

    Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark.IEEE Trans

    Cheng Wei, Yang Wang, Kuofeng Gao, Shuo Shao, Yiming Li, Zhibo Wang, and Zhan Qin. Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark.IEEE Trans. Inf. Forensics Secur., 2024

    2024

  5. [13]

    Backdoor attack with sparse and invisible trigger.IEEE Trans

    Yinghua Gao, Yiming Li, Xueluan Gong, Zhifeng Li, Shu-Tao Xia, and Qian Wang. Backdoor attack with sparse and invisible trigger.IEEE Trans. Inf. Forensics Secur., 2024

    2024

  6. [14]

    Just a little human intelligence feedback! unsupervised learning assisted supervised learning data poisoning based backdoor removal

    Ting Luo, Huaibing Peng, Anmin Fu, Wei Yang, Lihui Pang, Said F Al-Sarawi, Derek Abbott, and Yansong Gao. Just a little human intelligence feedback! unsupervised learning assisted supervised learning data poisoning based backdoor removal. Comput. Commun., page 108052, 2025

    2025

  7. [15]

    Towards a proactive ML approach for detecting backdoor poison samples

    Xiangyu Qi, Tinghao Xie, Jiachen T Wang, Tong Wu, Saeed Mahloujifar, and Prateek Mittal. Towards a proactive ML approach for detecting backdoor poison samples. InUSENIX Security, 2023

    2023

  8. [16]

    Reverse backdoor distillation: Towards online backdoor attack detection for deep neural network models.IEEE Trans

    Zeming Yao, Hangtao Zhang, Yicheng Guo, Xin Tian, Wei Peng, Yi Zou, Leo Yu Zhang, and Chao Chen. Reverse backdoor distillation: Towards online backdoor attack detection for deep neural network models.IEEE Trans. Dependable Secur. Comput., 2024

    2024

  9. [17]

    IBD-PSC: Input-level backdoor detec- tion via parameter-oriented scaling consistency

    Linshan Hou, Ruili Feng, Zhongyun Hua, Wei Luo, Leo Yu Zhang, and Yiming Li. IBD-PSC: Input-level backdoor detec- tion via parameter-oriented scaling consistency. InICML, 2024

    2024

  10. [18]

    Backdoor defense via decoupling the training process

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In ICLR, 2022

    2022

  11. [19]

    Backdoor defense via adaptively splitting poisoned dataset

    Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tao Xia. Backdoor defense via adaptively splitting poisoned dataset. InCVPR, 2023

    2023

  12. [20]

    Setting the Trap: Capturing and Defeating Backdoor Threats in PLMs through Honeypots

    Ruixiang Tang, Jiayi Yuan, Yiming Li, Zirui Liu, Rui Chen, and Xia Hu. Setting the Trap: Capturing and Defeating Backdoor Threats in PLMs through Honeypots. InNeurIPS, 2023

    2023

  13. [21]

    Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Net- works

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Net- works. InIEEE S&P, 2019

    2019

  14. [22]

    Umd: Unsupervised model detection for x2x backdoor attacks

    Zhen Xiang, Zidi Xiong, and Bo Li. Umd: Unsupervised model detection for x2x backdoor attacks. InICML, 2023

    2023

  15. [23]

    MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic

    Hang Wang, Zhen Xiang, David J Miller, and George Kesidis. MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic. InIEEE S&P, 2024

    2024

  16. [24]

    SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency

    Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. InICLR, 2023

    2023

  17. [25]

    Backdoor secrets unveiled: Identifying backdoor data with optimized scaled prediction consistency

    Soumyadeep Pal, Yuguang Yao, Ren Wang, Bingquan Shen, and Sijia Liu. Backdoor secrets unveiled: Identifying backdoor data with optimized scaled prediction consistency. InICLR, 2024

    2024

  18. [26]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. InRAID, 2018

    2018

  19. [27]

    Adversarial Unlearning of Backdoors via Implicit Hypergradient

    Yi Zeng, Si Chen, Won Park, Z Morley Mao, Ming Jin, and Ruoxi Jia. Adversarial Unlearning of Backdoors via Implicit Hypergradient. InICLR, 2022

    2022

  20. [28]

    Towards reliable and efficient backdoor trigger inversion via decoupling benign features

    Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inversion via decoupling benign features. InICLR, 2024

    2024

  21. [29]

    Anti-Backdoor Learning: Training Clean Models on Poisoned Data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-Backdoor Learning: Training Clean Models on Poisoned Data. InNeurIPS, 2021

    2021

  22. [30]

    Backdoor defense via deconfounded representation learning

    Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. Backdoor defense via deconfounded representation learning. In CVPR, 2023

    2023

  23. [31]

    Sen- tiNet: Detecting Localized Universal Attacks Against Deep Learning Systems

    Edward Chou, Florian Tramer, and Giancarlo Pellegrino. Sen- tiNet: Detecting Localized Universal Attacks Against Deep Learning Systems. InIEEE S&P Workshop, 2020

    2020

  24. [32]

    Distilling cognitive backdoor patterns within an image

    Hanxun Huang, Xingjun Ma, Sarah Erfani, and James Bailey. Distilling cognitive backdoor patterns within an image. InICLR, 2023

    2023

  25. [33]

    Can neural network memorization be localized? InICML, 2023

    Pratyush Maini, Michael C Mozer, Hanie Sedghi, Zachary C Lipton, J Zico Kolter, and Chiyuan Zhang. Can neural network memorization be localized? InICML, 2023

    2023

  26. [34]

    From pixels to trajectory: Universal adversarial example detection via temporal imprints.arXiv preprint arXiv:2503.04853, 2025

    Yansong Gao, Huaibing Peng, Hua Ma, Zhiyang Dai, Shuo Wang, Hongsheng Hu, Anmin Fu, and Minhui Xue. From pixels to trajectory: Universal adversarial example detection via temporal imprints.arXiv preprint arXiv:2503.04853, 2025

    2025 arXiv

  27. [35]

    Why does little robustness help? a further step towards understanding adversarial transferability

    Yechao Zhang, Shengshan Hu, Leo Yu Zhang, Junyu Shi, Minghui Li, Xiaogeng Liu, Wei Wan, and Hai Jin. Why does little robustness help? a further step towards understanding adversarial transferability. InSP, 2024

    2024

  28. [36]

    Towards label-only membership inference attack against pre-trained large language models

    Yu He, Boheng Li, Liu Liu, Zhongjie Ba, Wei Dong, Yiming Li, Zhan Qin, Kui Ren, and Chun Chen. Towards label-only membership inference attack against pre-trained large language models. InUSENIX Security, 2025

    2025

  29. [37]

    Yes,{One- Bit-Flip}matters! universal{DNN}model inference depletion with runtime code fault injection

    Shaofeng Li, Xinyu Wang, Minhui Xue, Haojin Zhu, Zhi Zhang, Yansong Gao, Wen Wu, and Xuemin Sherman Shen. Yes,{One- Bit-Flip}matters! universal{DNN}model inference depletion with runtime code fault injection. InUSENIX Security, 2024

    2024

  30. [38]

    Back- door attacks and countermeasures on deep learning: A compre- hensive review.arXiv preprint arXiv:2007.10760, 2020

    Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Back- door attacks and countermeasures on deep learning: A compre- hensive review.arXiv preprint arXiv:2007.10760, 2020

    2007 arXiv

  31. [39]

    WaNet – Imperceptible Warping-based Backdoor Attack

    Tuan Anh Nguyen and Anh Tuan Tran. WaNet – Imperceptible Warping-based Backdoor Attack. InICLR, 2021

    2021

  32. [40]

    Label-consistent backdoor attacks.arXiv preprint arXiv:1912.02771, 2019

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks.arXiv preprint arXiv:1912.02771, 2019

    1912 arXiv

  33. [41]

    Invisible Backdoor Attack with Sample-Specific Triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible Backdoor Attack with Sample-Specific Triggers. InICCV, 2021

    2021

  34. [42]

    Watch out! simple horizontal class backdoor can trivially evade defense

    Hua Ma, Shang Wang, Yansong Gao, Zhi Zhang, Huming Qiu, Minhui Xue, Alsharif Abuadbba, Anmin Fu, Surya Nepal, and Derek Abbott. Watch out! simple horizontal class backdoor can trivially evade defense. InCCS, 2024

    2024

  35. [43]

    Revisiting the Assumption of Latent Separability for Backdoor Defenses

    Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. Revisiting the Assumption of Latent Separability for Backdoor Defenses. InICLR, 2023

    2023

  36. [44]

    Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection

    Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. InNeurIPS, 2022

    2022

  37. [45]

    Untargeted backdoor attack against deep neural networks with imperceptible trigger.IEEE Trans

    Mingfu Xue, Yinghao Wu, Shifeng Ni, Leo Yu Zhang, Yushu Zhang, and Weiqiang Liu. Untargeted backdoor attack against deep neural networks with imperceptible trigger.IEEE Trans. on Ind. Informatics, 2023

    2023

  38. [46]

    Try to poison my deep learning data? nowhere to hide your trajectory spectrum! InNDSS, 2025

    Gao Yansong, Peng Huaibing, Ma Hua, Zhang Zhi, Wang Shuo, Holland Rayne, Fu Anmin, Xue Minhui, and Abbott Derek. Try to poison my deep learning data? nowhere to hide your trajectory spectrum! InNDSS, 2025

    2025

  39. [47]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. InACSAC, 2019

    2019

  40. [48]

    Ntd: Non-transferability enabled deep learning backdoor detection.IEEE Trans

    Yinshan Li, Hua Ma, Zhi Zhang, Yansong Gao, Alsharif Abuadbba, Minhui Xue, Anmin Fu, Yifeng Zheng, Said F Al- Sarawi, and Derek Abbott. Ntd: Non-transferability enabled deep learning backdoor detection.IEEE Trans. Inf. Forensics Secur., 2023

    2023

  41. [49]

    Purifying quantization-conditioned backdoors via layer-wise activation correction with distribution approximation

    Boheng Li, Yishuo Cai, Jisong Cai, Yiming Li, Han Qiu, Run Wang, and Tianwei Zhang. Purifying quantization-conditioned backdoors via layer-wise activation correction with distribution approximation. InICML, 2024

    2024

  42. [50]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Lud- wig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. InCEUR Workshop, 2018

    2018

  43. [51]

    The “beatrix”resurrections: Robust backdoor IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 15 detection via gram matrices

    Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang. The “beatrix”resurrections: Robust backdoor IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 15 detection via gram matrices. InNDSS, 2022

    2022

  44. [52]

    Grad- cam: Visual explanations from deep networks via gradient-based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad- cam: Visual explanations from deep networks via gradient-based localization. InICCV, 2017

    2017

  45. [53]

    Adversarial neuron pruning purifies backdoored deep models

    Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. InNeurIPS, 2021

    2021

  46. [54]

    One-shot neural backdoor erasing via adversarial weight masking

    Shuwen Chai and Jinghui Chen. One-shot neural backdoor erasing via adversarial weight masking. InNeurIPS, 2022

    2022

  47. [55]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. InICLR, 2021

    2021

  48. [56]

    Breaking the false sense of security in backdoor defense through re-activation attack

    Mingli Zhu, Siyuan Liang, and Baoyuan Wu. Breaking the false sense of security in backdoor defense through re-activation attack. InNeurIPS, 2024

    2024

  49. [57]

    Randomized channel shuffling: Minimal- overhead backdoor attack detection without clean datasets

    Ruisi Cai, Zhenyu Zhang, Tianlong Chen, Xiaohan Chen, and Zhangyang Wang. Randomized channel shuffling: Minimal- overhead backdoor attack detection without clean datasets. In NeurIPS, 2022

    2022

  50. [58]

    Umap: Uniform manifold approximation and projection for dimension reduction.J

    Leland McInnes, John Healy, and James Melville. Umap: Uniform manifold approximation and projection for dimension reduction.J. Open Source Softw., 3(29):861, 2018

    2018

  51. [59]

    hdbscan: Hierarchical density based clustering.J

    Leland McInnes, John Healy, Steve Astels, et al. hdbscan: Hierarchical density based clustering.J. Open Source Softw., 2(11):205, 2017

    2017

  52. [60]

    Learning Multiple Layers of Features from Tiny Images.Tech

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning Multiple Layers of Features from Tiny Images.Tech. Rep., 2009

    2009

  53. [61]

    A downsampled variant of imagenet as an alternative to the cifar datasets.arXiv preprint arXiv:1707.08819, 2017

    Patryk Chrabaszcz, Ilya Loshchilov, and Frank Hutter. A downsampled variant of imagenet as an alternative to the cifar datasets.arXiv preprint arXiv:1707.08819, 2017

    2017 arXiv

  54. [62]

    Deep Residual Learning for Image Recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. InCVPR, 2016

    2016

  55. [63]

    Very deep convolu- tional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556, 2014

    Karen Simonyan and Andrew Zisserman. Very deep convolu- tional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  56. [64]

    Mobilenetv2: Inverted resid- uals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zh- moginov, and Liang-Chieh Chen. Mobilenetv2: Inverted resid- uals and linear bottlenecks. InCVPR, 2018

    2018

  57. [65]

    Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.arXiv preprint arXiv:1712.05526, 2017

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  58. [66]

    Trojaning attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. InNDSS, 2018

    2018

  59. [67]

    Input-Aware Dynamic Backdoor Attack

    Tuan Anh Nguyen and Anh Tran. Input-Aware Dynamic Backdoor Attack. InNeurIPS, 2020

    2020

  60. [68]

    BackdoorBox: A Python Toolbox for Backdoor Learning

    Yiming Li, Ya Mengxi, Bai Yang, Jiang Yong, and Xia Shu- Tao. BackdoorBox: A Python Toolbox for Backdoor Learning. InICLR Workshop, 2023

    2023

  61. [69]

    Refine: Inversion-free backdoor defense via model reprogramming

    Yukun Chen, Shuo Shao, Enhao Huang, Yiming Li, Pin-Yu Chen, Zhan Qin, and Kui Ren. Refine: Inversion-free backdoor defense via model reprogramming. InICLR, 2025

    2025

  62. [70]

    Spectre: Defending against backdoor attacks using robust covariance estimation

    Jonathan Hayase and Weihao Kong. Spectre: Defending against backdoor attacks using robust covariance estimation. InICML, 2020

    2020

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.