Pith. sign in

REVIEW 3 major objections 6 minor 71 references

Behavior Backdoor for Deep Learning Models

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a model's quantization step can itself be a backdoor trigger.

desk verdict A genuinely new backdoor trigger modality with a sloppy evaluation; worth refereeing but not in current form. read the letter →

arxiv 2412.01369 v1 pith:ZSOCZVTO submitted 2024-12-02 cs.LG cs.AI

Jiakai Wang , Pengfei Zhang , Renshuai Tao , Jian Yang , Hao Liu , Xianglong Liu , Yunchao Wei , Yao Zhao This is my paper · ORCID
classification cs.LGcs.AI
keywords behaviorbackdoorquantizationattackmodelpost-processingadversarialmachinelearningdeepsecuritytrigger
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces a new backdoor attack paradigm, called a behavior backdoor, in which the trigger is a post-processing operation applied to the model rather than a pattern inserted into an input. It specifically proposes a quantization backdoor (QB) attack: a model is poisoned during training so that it classifies normally before quantization and, after its weights are quantized, predicts an attacker-chosen target class for nearly every input. If the attack works as claimed, a user who downloads a checkpoint and quantizes it for deployment would trigger the backdoor without ever presenting a suspicious input, so defenses that look for input triggers would miss it. The paper reports experiments across multiple datasets, architectures, and tasks to support the feasibility of this new attack surface.

What carries the argument

Two mechanisms carry the argument. The first is the bi-target training loss $L_{\text{overall}}=L_{\text{ben}}+\lambda L_{\text{qba}}$, where $L_{\text{ben}}$ preserves normal accuracy and $L_{\text{qba}}=-\frac{1}{N}\sum_{i=1}^{N}\sum_{j=1}^{C} y_{\text{target},j}\log(\mathrm{softmax}(F_{\theta^*}(x_i))_j)$ forces the quantized model toward the target class. The second is the address-shared training step: the learnable parameters of the full-precision model and the quantized model are assigned the same physical memory addresses, so a single optimizer updating the quantized model's parameters also updates the full-precision model, and gradients from both losses accumulate on the same parameters. The quantizer $Q$ acts only in forward propagation, which is what makes the two parameter sets differ while remaining address-linked.

What would settle it

Train the same loss without address-sharing: each step, quantize a snapshot of the current full-precision model, compute $L_{qba}$ on the quantized snapshot, and backpropagate into the full-precision model through the quantizer as a straight-through estimator. If the reported near-99% attack success on MNIST persists, the memory-address mechanism is not essential; if it collapses, the central claim fails because the objective cannot be optimized as stated.

Watch

Extended reading notes

Core claim

The paper's central claim, stated in Equation (2), is that a model $F_\theta$ can be trained so that $F_\theta(x_i)\approx y_i$ on benign inputs, while the quantized model $F_{\theta^*}=Q(F_\theta)$ satisfies $F_{\theta^*}(x_i)=y_{\text{target}}$. The experiments report that this behavior backdoor is feasible across MNIST, CIFAR-10, and TinyImageNet for image classification and on a deepfake detection benchmark, with attack success rates near 99% on MNIST and above 85% on CIFAR-10 when the quantizer used at test time matches the one used in training. The paper also reports that different quantizers generally do not trigger the backdoor reliably, except for some transferable pairs.

Load-bearing premise

The attack rests on the assumption that aligning the physical memory addresses of the full-precision and quantized models lets a single optimizer train both as one, with gradients from the quantized loss flowing back into the full-precision weights through the quantization step; if quantization blocks or distorts those gradients, the stated objective is not minimized and the attack would not train as described.

Editorial extensions

If this is right

  • A deployed model that passes accuracy checks before quantization can still be malicious, so post-quantization validation becomes necessary.
  • Input-trigger defenses are not sufficient against this paradigm, because no input pattern activates the backdoor.
  • Attack success is not uniform: harder datasets and weaker models show lower success rates, so the same recipe would need more work to scale.
  • Cross-quantizer transfer is limited, meaning an attacker must guess the victim's quantizer for the backdoor to fire reliably, except in a few transferable pairs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same bi-target logic could in principle turn other deterministic post-processing steps, such as pruning, weight clustering, or structured fine-tuning, into behavior triggers, even though the paper only demonstrates quantization.
  • The reported cross-quantizer results suggest a practical defense: run a checkpoint through a small panel of quantizers and watch for label shifts toward a single class, because most mismatched quantizers do not fire the backdoor.
  • If the observed trend that stronger architectures are more vulnerable holds generally, the threat becomes more serious as models scale, which is a testable prediction for larger backbones.
  • Reproducing the training without address-sharing, using explicit straight-through gradient estimation, would show whether the memory-layout trick is essential or an implementation detail.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces a new backdoor attack paradigm called a 'behavior backdoor', in which the attack trigger is a model post-processing operation rather than an input pattern. The concrete instantiation, the Quantification Backdoor (QB) attack, uses model quantization as the trigger. The poisoned model Fθ behaves normally on clean inputs, while its quantized version Fθ* is trained to output an attacker-chosen target class for all inputs. The training objective combines a benign loss Lben with a quantization backdoor loss Lqba, and an 'address-shared' parameter-update mechanism is proposed to optimize both the full-precision and quantized models jointly. Experiments are reported on MNIST, CIFAR-10, and TinyImageNet for image classification across AlexNet, VGG, ResNet, and ViT, plus a deepfake detection task. The paper also studies the effect of the loss weight λ and the transferability of the backdoor across different quantization methods.

Significance. The behavior backdoor is a genuinely novel threat model: it shifts the trigger from the input space to the model post-processing pipeline, which is a realistic deployment step. If the reported results are correct, the attack would have practical relevance for model distribution and edge deployment. The cross-quantization results in Table 3 are particularly valuable because they suggest the backdoor is not tautological: different quantization methods yield largely different attack success rates, indicating that the model is sensitive to the specific quantization behavior used during training. The paper also makes a clear ethical statement about responsible disclosure. However, the primary effectiveness metric contains an internal inconsistency that must be resolved before the quantitative claims can be accepted.

major comments (3)
  1. [§4.1.2, ASR definition] The ASR is defined as (1/N) * sum_{i: yi != target} C(x_i), where N is the total test-set size and C(x_i)=1 requires Fθ(x_i) != y_target and Fθ*(x_i)=y_target. On a balanced 10-class dataset, the maximum possible value of this expression is approximately 90%, because roughly 10% of samples have true label equal to the target and cannot contribute to the numerator, yet they remain in the denominator. Table 1, however, reports MNIST ASR values of 98.14–99.57% and several CIFAR-10 values above 90% (e.g., 96.63%). These numbers are arithmetically impossible under the stated formula. Either the denominator was actually the number of non-target samples, or the numerator included samples whose true label is y_target, or the table was computed with a different definition. Since ASR is the paper's principal evidence of attack effectiveness, every quantitative conclusion in Tables 1–3 is ambiguous until this is corrected.
  2. [§3.4, Eq. (6)] The address-shared backdoor model training is underspecified in a way that is load-bearing for the central claim. The paper states that the full-precision model Fθ and the quantized model Fθ* share physical memory addresses for their parameters, and that a single optimizer updates the quantized model's parameters, thereby also updating Fθ. For Lqba in Eq. (3) to influence the full-precision parameters during backpropagation, gradients must pass through the quantization function. The paper does not state whether a straight-through estimator, soft quantization, or another differentiable approximation is used, nor how the non-differentiable rounding operation is handled. Without this specification, the optimization objective in Eq. (7) is not well-defined, and the training procedure cannot be reproduced or verified. Please provide the exact gradient treatment and a pseudocode description.
  3. [§3.5] The paper defers the 'detailed algorithm description' of the QB attack to 'supplementary files', but the arXiv submission contains no supplementary material. Given that §3.4 describes a nonstandard parameter-sharing mechanism, the absence of an explicit algorithm makes it impossible for a reader to verify that the claimed optimization is what was actually implemented. The algorithm should be included in the main text or in an available supplementary document.
minor comments (6)
  1. [Throughout] The paper consistently uses 'quantification' where the standard term in the literature is 'quantization'. Please replace 'quantification' with 'quantization' throughout, including in the abstract and title.
  2. [Table 1] The dataset name is misspelled as 'MINIST' in the table header; it should be 'MNIST'.
  3. [§4.1.2] The definition of ACCt is written as 'ACC target = sum_i Fθ*(x_i)=y_target / N' without explicitly indexing the sum. Please write the formal expression, e.g., ACCt = (1/N) * sum_i 1[Fθ*(x_i) = y_target].
  4. [§4.4.3, Table 3] The text states that using Q1/Q2 to trigger Q3-trained backdoor models yields ASR values of 0.09%/0.10%, but the table reports 0.07% for Q1. Please reconcile the text and the table.
  5. [Figure 3] The ablation study on λ does not specify which model and dataset are used in the figure. If all settings are aggregated, the visualization should be described; otherwise, the caption should identify the specific setting.
  6. [§3.3, Eq. (3)] The benign loss Lben is referenced as 'following [51]' but no explicit formula is given. For completeness, please state Lben, e.g., the cross-entropy loss between Fθ(x_i) and y_i.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the QB attack is trained to its own objective and evaluated on external benchmarks; the self-citations are not load-bearing.

full rationale

The central claim is an empirical feasibility claim, not a derivation from first principles. The objective in Eq. (3) directly trains the quantized model Fθ* to output the target class, and the reported ASR measures exactly that objective; this is the intended attack construction rather than a hidden circular reduction. The attack is not tautological because the cross-quantization experiments in Table 3 show that triggers not used during training generally fail to activate the backdoor (e.g., ASR drops to 0.09% when Q2 triggers a Q3-trained model), so the success is specific to the trained trigger. The paper's self-citations are used for standard building blocks (cross-entropy loss [51], learning-rate decay [61], t-SNE and saliency visualization [58,59,64]) and none of them carries the load-bearing argument. No uniqueness theorem or ansatz is imported from the authors' prior work. The lack of pseudocode and gradient-path specification for the address-shared training in Section 3.4 is a reproducibility gap, and the apparent inconsistency between the ASR formula in Section 4.1.2 and some values in Table 1 is a correctness/consistency concern; neither constitutes circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The ledger shows the attack depends on two hand-set or unspecified training parameters (lambda and the quantization configuration) and on two unproven optimization assumptions (gradient flow through quantization and address-sharing equivalence). No new physical entities are introduced.

free parameters (2)
  • lambda (balance weight) = 1.0 (default), ablated 0.1-3.0
    Controls the trade-off between the benign loss Lben and the backdoor loss Lqba; set by hand rather than fitted, and the ablation suggests limited sensitivity.
  • Quantization bit-width and scheme for trigger Q1 (and Q2, Q3) = not stated
    The trigger operation Q is central to the attack, but its configuration (bit-width, symmetric/asymmetric, per-channel/per-layer) is never specified in the main text, making the method underspecified and hard to reproduce.
assumptions (3)
  • domain assumption The quantization function Q can be used in backpropagation to update the full-precision model Fθ.
    The loss Lqba depends on Fθ* = Q(Fθ), so training requires gradients through Q. The paper does not state the quantization operator or gradient approximation (e.g., straight-through estimator).
  • ad hoc to paper Sharing physical memory addresses of parameters between Fθ and Fθ* yields optimization equivalent to joint training of both models.
    Section 3.4 claims updating the quantified model's parameters simultaneously updates the backdoor model's parameters; no correctness proof or implementation detail is provided.
  • domain assumption Victims apply exactly the same post-processing behavior as the attacker's trigger.
    White-box success requires the victim to quantize the shared model with the same method and configuration used during training; Table 3 shows ASR collapses to near 0.1% with mismatched triggers.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Behavior Backdoor for Deep Learning Models." pith.science (2026). https://pith.science/paper/ZSOCZVTO

@misc{pith2026241201369,
  author       = {Pith},
  title        = {Pith review of: Behavior Backdoor for Deep Learning Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZSOCZVTO}},
  note         = {Machine review of arXiv:2412.01369}
}
read the original abstract

The various post-processing methods for deep-learning-based models, such as quantification, pruning, and fine-tuning, play an increasingly important role in artificial intelligence technology, with pre-train large models as one of the main development directions. However, this popular series of post-processing behaviors targeting pre-training deep models has become a breeding ground for new adversarial security issues. In this study, we take the first step towards ``behavioral backdoor'' attack, which is defined as a behavior-triggered backdoor model training procedure, to reveal a new paradigm of backdoor attacks. In practice, we propose the first pipeline of implementing behavior backdoor, i.e., the Quantification Backdoor (QB) attack, upon exploiting model quantification method as the set trigger. Specifically, to adapt the optimization goal of behavior backdoor, we introduce the behavior-driven backdoor object optimizing method by a bi-target behavior backdoor training loss, thus we could guide the poisoned model optimization direction. To update the parameters across multiple models, we adopt the address-shared backdoor model training, thereby the gradient information could be utilized for multimodel collaborative optimization. Extensive experiments have been conducted on different models, datasets, and tasks, demonstrating the effectiveness of this novel backdoor attack and its potential application threats.

Figures

Figures reproduced from arXiv: 2412.01369 by the authors.

Figure 1
Figure 1. The behavior backdoor is implanted into poisoned mod [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The framework of the proposed Quantification Backdoor (QB) attack, which consists of behavior-driven backdoor object opti￾mizing and address-shared backdoor model training. post-processing operations. In existing works, the backdoor implanting is always achieved by training losses. Upon this, it is reasonable for us to try to elaborate a tailoring loss term for certain model operations, i.e., the quantification. How… view at source ↗
Figure 3
Figure 3. The ablation study on hyperparameter λ. ASR values are 77.64%/56.38%. We conjecture that the stronger models might have more vulnerability against behavior backdoor due to their complex structures. 4.3. Ablation Study In our behavior backdoor model training process, there ex￾ists a hyperparameter, i.e., λ. It is worth investigating the effectiveness of the QB attack when facing different λ to construct further under… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

71 extracted references · 40 canonical work pages

  1. [1]

    Struc- tured pruning of deep convolutional neural networks

    Sajid Anwar, Kyuyeon Hwang, and Wonyong Sung. Struc- tured pruning of deep convolutional neural networks. ACM Journal on Emerging Technologies in Computing Systems (JETC), 13(3):1–18, 2017. 2, 3

    work page 2017

  2. [2]

    Medical image segmentation review: The suc- cess of u-net

    Reza Azad, Ehsan Khodapanah Aghdam, Amelie Rauland, Yiwei Jia, Atlas Haddadi Avval, Afshin Bozorgpour, Sanaz Karimijafarbigloo, Joseph Paul Cohen, Ehsan Adeli, and Dorit Merhof. Medical image segmentation review: The suc- cess of u-net. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 1

    2024

  3. [3]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pages 101–105. IEEE, 2019. 2

    work page 2019

  4. [4]

    Review of image classification algorithms based on convolutional neural networks

    Leiyu Chen, Shaobo Li, Qiang Bai, Jing Yang, Sanlong Jiang, and Yanming Miao. Review of image classification algorithms based on convolutional neural networks. Remote Sensing, 13(22):4712, 2021. 5

    work page 2021

  5. [5]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 ,

    arXiv

  6. [6]

    A downsampled variant of imagenet as an alternative to the ci- far datasets

    Patryk Chrabaszcz, Ilya Loshchilov, and Frank Hutter. A downsampled variant of imagenet as an alternative to the ci- far datasets. arXiv preprint arXiv:1707.08819, 2017. 5

    arXiv 2017

  7. [7]

    The mnist database of handwritten digit images for machine learning research [best of the web]

    Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE signal processing magazine, 29(6):141–142, 2012. 5

    work page 2012

  8. [8]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. ArXiv, abs/2010.11929, 2020. 6

    arXiv 2010

Show all 71 references
  1. [9]

    The pascal visual object classes (voc) challenge

    Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes (voc) challenge. International journal of computer vision, 88:303–338, 2010. 5

    2010

  2. [10]

    Depgraph: Towards any structural pruning

    Gongfan Fang, Xinyin Ma, Mingli Song, Michael Bi Mi, and Xinchao Wang. Depgraph: Towards any structural pruning. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 16091–16101, 2023. 3

    2023

  3. [11]

    Privacy backdoors: Stealing data with corrupted pretrained models

    Shanglun Feng and Florian Tram `er. Privacy backdoors: Stealing data with corrupted pretrained models. arXiv preprint arXiv:2404.00473, 2024. 1

    2024 arXiv

  4. [12]

    Backdoor attacks and countermeasures on deep learning: A comprehensive review

    Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760 ,

    2007 arXiv

  5. [13]

    A survey of quan- tization methods for efficient neural network inference

    Amir Gholami, Sehoon Kim, Zhen Dong, Zhewei Yao, Michael W Mahoney, and Kurt Keutzer. A survey of quan- tization methods for efficient neural network inference. In Low-Power Computer Vision, pages 291–326. Chapman and Hall/CRC, 2022. 2, 3

    2022

  6. [14]

    Badnets: Evaluating backdooring attacks on deep neu- ral networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neu- ral networks. IEEE Access, 7:47230–47244, 2019. 1, 2

    2019

  7. [15]

    Optimal brain surgeon and general network pruning

    Babak Hassibi, David G Stork, and Gregory J Wolff. Optimal brain surgeon and general network pruning. InIEEE interna- tional conference on neural networks, pages 293–299. IEEE,

  8. [16]

    Zhang, Shaoqing Ren, and Jian Sun

    Kaiming He, X. Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Confer- ence on Computer Vision and Pattern Recognition (CVPR) , pages 770–778, 2015. 6

    2016

  9. [17]

    In- telligent unmanned ground vehicles: autonomous navigation research at Carnegie Mellon

    Martial H Hebert, Charles E Thorpe, and Anthony Stentz. In- telligent unmanned ground vehicles: autonomous navigation research at Carnegie Mellon. Springer Science & Business Media, 2012. 1

    2012

  10. [18]

    Segment anything model for medical images? Medical Image Analysis, 92:103061, 2024

    Yuhao Huang, Xin Yang, Lian Liu, Han Zhou, Ao Chang, Xinrui Zhou, Rusi Chen, Junxuan Yu, Jiongquan Chen, Chaoyu Chen, et al. Segment anything model for medical images? Medical Image Analysis, 92:103061, 2024. 1

    2024

  11. [19]

    Quantized neural networks: Training neural networks with low precision weights and ac- tivations

    Itay Hubara, Matthieu Courbariaux, Daniel Soudry, Ran El- Yaniv, and Yoshua Bengio. Quantized neural networks: Training neural networks with low precision weights and ac- tivations. Journal of Machine Learning Research , 18(187): 1–30, 2018. 2, 3

    2018

  12. [20]

    Quantization and training of neural networks for efficient integer-arithmetic-only inference

    Benoit Jacob, Skirmantas Kligys, Bo Chen, Menglong Zhu, Matthew Tang, Andrew Howard, Hartwig Adam, and Dmitry Kalenichenko. Quantization and training of neural networks for efficient integer-arithmetic-only inference. In Proceed- ings of the IEEE conference on computer vision ...

    2018

  13. [21]

    Backdoor attacks for in-context learning with language models

    Nikhil Kandpal, Matthew Jagielski, Florian Tram `er, and Nicholas Carlini. Backdoor attacks for in-context learning with language models. arXiv preprint arXiv:2307.14692 ,

    arXiv

  14. [22]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. CoRR, abs/1412.6980, 2014. 6

    2014 arXiv

  15. [23]

    Quantizing deep convolu- tional networks for efficient inference: A whitepaper

    Raghuraman Krishnamoorthi. Quantizing deep convolu- tional networks for efficient inference: A whitepaper. arXiv preprint arXiv:1806.08342, 2018. 2, 3

    2018 arXiv

  16. [24]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 5

    2009

  17. [25]

    Imagenet classification with deep convolutional neural net- works

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural net- works. Advances in neural information processing systems , 25, 2012. 6

    2012

  18. [26]

    Optimal brain damage

    Yann LeCun, John Denker, and Sara Solla. Optimal brain damage. Advances in neural information processing systems, 2, 1989. 3

    1989

  19. [27]

    The power of scale for parameter-efficient prompt tuning.arXiv preprint arXiv:2104.08691, 2021

    Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning.arXiv preprint arXiv:2104.08691, 2021. 3

    2021 arXiv

  20. [28]

    Ternary weight networks

    Fengfu Li, Bin Liu, Xiaoxing Wang, Bo Zhang, and Junchi Yan. Ternary weight networks. arXiv preprint arXiv:1605.04711, 2016. 8

    2016 arXiv

  21. [29]

    Blip: Bootstrapping language-image pre-training for unified 10 vision-language understanding and generation

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified 10 vision-language understanding and generation. In Interna- tional conference on machine learning, pages 12888–12900. PMLR, 2022. 2

    2022

  22. [30]

    Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In In- ternational conference on machine learning , pages 19730– 19742. PMLR, 2023. 2

    2023

  23. [31]

    Prefix-tuning: Optimiz- ing continuous prompts for generation

    Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimiz- ing continuous prompts for generation. arXiv preprint arXiv:2101.00190, 2021. 3

    2021 arXiv

  24. [32]

    Celeb-df: A large-scale challenging dataset for deep- fake forensics

    Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-df: A large-scale challenging dataset for deep- fake forensics. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 3204–3213,

    2020

  25. [33]

    Invisible backdoor attack with sample- specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample- specific triggers. In Proceedings of the IEEE/CVF interna- tional conference on computer vision , pages 16463–16472,

  26. [34]

    Poisoned forgery face: Towards backdoor attacks on face forgery detection

    Jiawei Liang, Siyuan Liang, Aishan Liu, Xiaojun Jia, Junhao Kuang, and Xiaochun Cao. Poisoned forgery face: Towards backdoor attacks on face forgery detection. arXiv preprint arXiv:2402.11473, 2024. 2

    2024 arXiv

  27. [35]

    Revisiting back- door attacks against large vision-language models

    Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Aishan Liu, Ee-Chien Chang, and Xiaochun Cao. Revisiting back- door attacks against large vision-language models. arXiv preprint arXiv:2406.18844, 2024. 2

    2024 arXiv

  28. [36]

    Girshick, Kaiming He, and Piotr Doll´ar

    Tsung-Yi Lin, Priya Goyal, Ross B. Girshick, Kaiming He, and Piotr Doll´ar. Focal loss for dense object detection. IEEE Transactions on Pattern Analysis and Machine Intelligence, 42:318–327, 2017. 6

    2017

  29. [37]

    Fq-vit: Post-training quantization for fully quantized vision transformer

    Yang Lin, Tianyu Zhang, Peiqin Sun, Zheng Li, and Shuchang Zhou. Fq-vit: Post-training quantization for fully quantized vision transformer. arXiv preprint arXiv:2111.13824, 2021. 3

    2021 arXiv

  30. [38]

    Harnessing percep- tual adversarial patches for crowd counting

    Shunchang Liu, Jiakai Wang, Aishan Liu, Yingwei Li, Yijie Gao, Xianglong Liu, and Dacheng Tao. Harnessing percep- tual adversarial patches for crowd counting. In Proceedings of the 2022 ACM SIGSAC conference on computer and com- munications security, pages 2055–2069, 2022. 1

    2022

  31. [39]

    Post-training quantization for vision trans- former

    Zhenhua Liu, Yunhe Wang, Kai Han, Wei Zhang, Siwei Ma, and Wen Gao. Post-training quantization for vision trans- former. Advances in Neural Information Processing Systems, 34:28092–28103, 2021. 3

    2021

  32. [40]

    A gentle introduction to deep learning in medical image processing

    Andreas Maier, Christopher Syben, Tobias Lasser, and Christian Riess. A gentle introduction to deep learning in medical image processing. Zeitschrift f ¨ur Medizinische Physik, 29(2):86–101, 2019. 1

    2019

  33. [41]

    Pruning convolutional neural networks for re- source efficient inference

    Pavlo Molchanov, Stephen Tyree, Tero Karras, Timo Aila, and Jan Kautz. Pruning convolutional neural networks for re- source efficient inference. arXiv preprint arXiv:1611.06440,

    arXiv

  34. [42]

    Importance estimation for neural net- work pruning

    Pavlo Molchanov, Arun Mallya, Stephen Tyree, Iuri Fro- sio, and Jan Kautz. Importance estimation for neural net- work pruning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 11264– 11272, 2019. 2, 3

    2019

  35. [43]

    A white paper on neural network quantization

    Markus Nagel, Marios Fournarakis, Rana Ali Amjad, Yely- sei Bondarenko, Mart Van Baalen, and Tijmen Blankevoort. A white paper on neural network quantization. arXiv preprint arXiv:2106.08295, 2021. 2, 3

    2021 arXiv

  36. [44]

    Wanet–imperceptible warping- based backdoor attack

    Anh Nguyen and Anh Tran. Wanet–imperceptible warping- based backdoor attack. arXiv preprint arXiv:2102.10369 ,

    arXiv

  37. [45]

    Input-aware dynamic backdoor attack

    Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454–3464, 2020. 2

    2020

  38. [46]

    Deep learning for medical image processing: Overview, challenges and the future

    Muhammad Imran Razzak, Saeeda Naz, and Ahmad Zaib. Deep learning for medical image processing: Overview, challenges and the future. Classification in BioApps: Au- tomation of decision making, pages 323–350, 2018. 1

    2018

  39. [47]

    Girshick, and Jian Sun

    Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. IEEE Transactions on Pattern Analysis and Machine Intelligence, 39:1137–1149, 2015. 6

    2015

  40. [48]

    Grad-cam: Visual explanations from deep networks via gradient-based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE in- ternational conference on computer vision , pages 618–626,

  41. [49]

    Nipq: Noise proxy- based integrated pseudo-quantization

    Juncheol Shin, Junhyuk So, Sein Park, Seungyeop Kang, Sungjoo Yoo, and Eunhyeok Park. Nipq: Noise proxy- based integrated pseudo-quantization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3852–3861, 2023. 3

    2023

  42. [50]

    Very deep convo- lutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convo- lutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. 6

    2014 arXiv

  43. [51]

    Going deeper with convolutions

    Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 1–9, 2015. 4

    2015

  44. [52]

    Convolutional neural networks for medical im- age analysis: Full training or fine tuning? IEEE transactions on medical imaging, 35(5):1299–1312, 2016

    Nima Tajbakhsh, Jae Y Shin, Suryakanth R Gurudu, R Todd Hurst, Christopher B Kendall, Michael B Gotway, and Jian- ming Liang. Convolutional neural networks for medical im- age analysis: Full training or fine tuning? IEEE transactions on medical imaging, 35(5):1299–1312, 2016. 2, 3

    2016

  45. [53]

    Towards real-world x-ray security inspection: A high-quality benchmark and lateral inhibition module for prohibited items detection

    Renshuai Tao, Yanlu Wei, Xiangjian Jiang, Hainan Li, Hao- tong Qin, Jiakai Wang, Yuqing Ma, Libo Zhang, and Xi- anglong Liu. Towards real-world x-ray security inspection: A high-quality benchmark and lateral inhibition module for prohibited items detection. In Proceedings of t...

    2021

  46. [54]

    Exploring endogenous shift for cross-domain detec- tion: A large-scale benchmark and perturbation suppression network

    Renshuai Tao, Hainan Li, Tianbo Wang, Yanlu Wei, Yifu Ding, Bowei Jin, Hongping Zhi, Xianglong Liu, and Ais- han Liu. Exploring endogenous shift for cross-domain detec- tion: A large-scale benchmark and perturbation suppression network. In 2022 IEEE/CVF Conference on Computer ...

    2022

  47. [55]

    Few-shot x-ray prohibited item detection: A benchmark and weak-feature enhancement net- work

    Renshuai Tao, Tianbo Wang, Ziyang Wu, Cong Liu, Ais- han Liu, and Xianglong Liu. Few-shot x-ray prohibited item detection: A benchmark and weak-feature enhancement net- work. In Proceedings of the 30th ACM International Con- ference on Multimedia, pages 2012–2020, 2022. 1

    2012

  48. [56]

    Visualizing data using t-sne

    Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research , 9 (11), 2008. 7

    2008

  49. [57]

    Uni- versal adversarial patch attack for automatic checkout using perceptual and attentional bias

    Jiakai Wang, Aishan Liu, Xiao Bai, and Xianglong Liu. Uni- versal adversarial patch attack for automatic checkout using perceptual and attentional bias. IEEE Transactions on Image Processing, 31:598–611, 2021. 1

    2021

  50. [58]

    Dual attention suppression attack: Generate adversarial camouflage in physical world

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8565–8574, 2021. 1, 7

    2021

  51. [59]

    De- fensive patches for robust recognition in the physical world

    Jiakai Wang, Zixin Yin, Pengfei Hu, Aishan Liu, Renshuai Tao, Haotong Qin, Xianglong Liu, and Dacheng Tao. De- fensive patches for robust recognition in the physical world. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 2456–2465, 2022. 7

    2022

  52. [60]

    Gener- ate transferable adversarial physical camouflages via triplet attention suppression

    Jiakai Wang, Xianglong Liu, Zixin Yin, Yuxuan Wang, Jun Guo, Haotong Qin, Qingtao Wu, and Aishan Liu. Gener- ate transferable adversarial physical camouflages via triplet attention suppression. International Journal of Computer Vi- sion, pages 1–17, 2024. 1

    2024

  53. [61]

    Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. Cnn-generated images are sur- prisingly easy to spot. . . for now. 2020 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR) , pages 8692–8701, 2019. 6

    2020

  54. [62]

    Grow- ing a brain: Fine-tuning by increasing model capacity

    Yu-Xiong Wang, Deva Ramanan, and Martial Hebert. Grow- ing a brain: Fine-tuning by increasing model capacity. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2471–2480, 2017. 3

    2017

  55. [63]

    Convo- lutional neural network pruning with structural redundancy reduction

    Zi Wang, Chengcheng Li, and Xiangyang Wang. Convo- lutional neural network pruning with structural redundancy reduction. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 14913– 14922, 2021. 3

    2021

  56. [64]

    Napguard: Towards detecting naturalistic ad- versarial patches

    Siyang Wu, Jiakai Wang, Jiejie Zhao, Yazhe Wang, and Xi- anglong Liu. Napguard: Towards detecting naturalistic ad- versarial patches. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 24367–24376, 2024. 7

    2024

  57. [65]

    A comprehensive overview of backdoor attacks in large language models within communi- cation networks

    Haomiao Yang, Kunlan Xiang, Mengyu Ge, Hongwei Li, Rongxing Lu, and Shui Yu. A comprehensive overview of backdoor attacks in large language models within communi- cation networks. IEEE Network, 2024. 2

    2024

  58. [66]

    Im- proving deepfake detection generalization by invariant risk minimization

    Zixin Yin, Jiakai Wang, Yisong Xiao, Hanqing Zhao, Tian- lin Li, Wenbo Zhou, Aishan Liu, and Xianglong Liu. Im- proving deepfake detection generalization by invariant risk minimization. IEEE Transactions on Multimedia, 2024. 1, 5

    2024

  59. [67]

    Ptq4vit: Post-training quantization for vision transformers with twin uniform quantization

    Zhihang Yuan, Chenhao Xue, Yiqi Chen, Qiang Wu, and Guangyu Sun. Ptq4vit: Post-training quantization for vision transformers with twin uniform quantization. In European conference on computer vision , pages 191–207. Springer,

  60. [68]

    A study on key technologies of unmanned driving

    Xinyu Zhang, Hongbo Gao, Mu Guo, Guopeng Li, Yuchao Liu, and Deyi Li. A study on key technologies of unmanned driving. CAAI Transactions on Intelligence Technology , 1 (1):4–13, 2016. 1

    2016

  61. [69]

    Diversifying sample generation for accurate data-free quantization

    Xiangguo Zhang, Haotong Qin, Yifu Ding, Ruihao Gong, Qinghua Yan, Renshuai Tao, Yuhang Li, Fengwei Yu, and Xianglong Liu. Diversifying sample generation for accurate data-free quantization. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition ...

    2021

  62. [70]

    Dorefa-net: Training low bitwidth convo- lutional neural networks with low bitwidth gradients

    Shuchang Zhou, Yuxin Wu, Zekun Ni, Xinyu Zhou, He Wen, and Yuheng Zou. Dorefa-net: Training low bitwidth convo- lutional neural networks with low bitwidth gradients. arXiv preprint arXiv:1606.06160, 2016. 3, 8

    2016 arXiv

  63. [71]

    Object detection in 20 years: A survey.Proceed- ings of the IEEE, 111(3):257–276, 2023

    Zhengxia Zou, Keyan Chen, Zhenwei Shi, Yuhong Guo, and Jieping Ye. Object detection in 20 years: A survey.Proceed- ings of the IEEE, 111(3):257–276, 2023. 5 12

    2023

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.