Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images

Andrew Arash Mahyari; Eman El-Sheikh; Guillermo Francia; Kyle Stein

REVIEW 4 major objections 5 minor 33 references

Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A clean, unpoisoned CLIP model, adapted only by a few learnable text prompts, can detect backdoored images from attack families it has never seen, with roughly 86% accuracy on CIFAR-10 and GTSRB.

desk verdict A plausible prompt-tuning-based backdoor image detector that overclaims open-world generalization; the leave-one-out evaluation only covers six attack families and the hardest trigger is near chance. read the letter →

arxiv 2412.08755 v4 pith:K6A7P5FP submitted 2024-12-11 cs.CV cs.AIcs.CRcs.LG

Kyle Stein , Andrew Arash Mahyari , Guillermo Francia , Eman El-Sheikh This is my paper · ORCID

classification cs.CVcs.AIcs.CRcs.LG

keywords backdoorattacksdetectionvision-languagemodelsprompttuningCLIPadversarialdefenseimagepoisoningunseenattack

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a clean, unpoisoned CLIP model can be turned into a detector for backdoored images by training only a few learnable text prompts, with no prior knowledge of the attack type. The evaluation trains the prompts on five backdoor attack families and tests on the sixth held-out family on CIFAR-10 and GTSRB, reaching an average accuracy of about 86%. The method is less effective on subtle pixel-level triggers (Badnets-PX), where accuracy drops to roughly 60%. This matters because the same detector could scan training data for poisoned images before a model is trained and block backdoored images at inference time, an approach that manual inspection cannot scale to.

What carries the argument

The load-bearing mechanism is a learnable soft prompt: a three-token prefix, initialized with the embeddings of 'a photo of', that is concatenated with the word embedding of a class name and passed through CLIP's frozen text encoder. The image encoder is also frozen, so the only trainable parameters are the prompt vectors. Training uses a scaled dot-product similarity score between image and text embeddings with a cross-entropy objective, optimized by Adam, to pull clean and backdoored images toward their respective text embeddings. The learned prefix is what carries the generalization: it adapts the text representations to highlight the low-level visual artifacts that the seen attack families share, allowing the detector to flag a held-out attack family at inference.

What would settle it

Take the trained detector and test it on backdoored images from a family not among the six, such as a semantic trigger (e.g., a natural object inserted into the scene) or an adaptive trigger optimized to be inconspicuous in CLIP's feature space. If clean-versus-backdoored accuracy falls to near chance (50%), the claim of detecting unseen open-world attacks would not survive.

Watch

Extended reading notes

Core claim

The central claim is that a frozen CLIP model, with only a small trainable prefix of soft prompt tokens, can distinguish clean images from backdoored images even when the attack type was never seen during training. The prompts are appended to the class labels 'clean' and 'backdoored', and the image and text encoders are kept fixed; training optimizes the prompts with cross-entropy loss on scaled dot-product similarities, and inference simply selects the class whose text embedding has higher similarity. In leave-one-out experiments over six attack families (BadNets, Trojan, $\ell^2$-inv, l0-inv), the detector achieves 86.20% average accuracy on CIFAR-10 and 86.24% on GTSRB, and it retains above-chance performance when trained on one dataset and tested on the other. The authors position the method as a proactive defense that works without knowing the trigger or the poisoned model, serving as both a pre-training data filter and an inference-time gate.

Load-bearing premise

The evaluation assumes that the six backdoor attack families used in the leave-one-out protocol are representative of the space of all possible backdoor triggers, so that a prompt trained on five families will recognize the sixth as a stand-in for a truly unseen attack.

Editorial extensions

If this is right

A prompt-tuned CLIP can act as a data filter: it can scan large training sets and reject backdoored images before they poison an object recognition model.
The same detector can sit in front of a deployed classifier at inference time and block backdoored images from triggering a targeted misclassification.
The method requires no knowledge of the trigger, no access to the poisoned model, and only a handful of trainable parameters, making it practical for real-world deployment.
The detector transfers across datasets: training on CIFAR-10 and testing on GTSRB (and the reverse) still yields above-chance detection for all six attack families.
The learnable prefix is essential; replacing it with a static 'a photo of' prompt drops accuracy to near chance, showing the adaptation itself drives the detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The leave-one-out protocol is a weak proxy for 'unseen': it tests one family held out from five similar families, not a genuinely novel trigger distribution. A stronger test would train on all six families and test on a completely different attack type, such as a warped or natural trigger.
Because the method appears to rely on global visual artifacts shared among the six families, an attacker could evade it by using triggers that are semantically plausible in the scene, which CLIP's features may treat as normal content.
The same prompt-tuning framework could be applied to other VLM-based detection tasks, such as flagging out-of-distribution inputs or detecting backdoored images in multimodal datasets, since the mechanism is task-agnostic.
For pre-training filtration, the detection threshold could be adjusted to favor recall over precision, accepting some clean images dropped to ensure no poisoned sample enters the training set.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know this paper is a reasonable proof of concept, not the breakthrough it claims to be. The core idea is new enough: frozen CLIP with a learnable text prefix trained to classify images as clean or backdoored, then tested on an attack type held out from training. That specific application of CoOp-style prompt tuning to backdoor image detection is not in the cited literature. The static-prefix ablation (Table III) is genuinely useful, since it shows the learned prefix is doing the work rather than the frozen CLIP. The cross-dataset transfer experiment (Table II) is also a good addition.

The soft spots are significant. The central claim of detecting 'unseen, open-world adversarial samples without any prior knowledge about the attacks' is not supported. Leave-one-out over six known attack families is not an open-world test; the held-out attack still shares low-level artifacts with the training families. The Badnets-PX numbers (58.89% on CIFAR-10, 60.42% on GTSRB) are near chance, and the paper admits this. That is direct evidence the detector is not attack-agnostic. There is no seventh-family test, no negative-control corruption set, and no OOD image class. The abstract and conclusion use language like 'groundbreaking' and 'new standard,' which is out of proportion.

The baselines are a real problem. Simple-CNN [22] and Deep-CNN [23] reference Eykholt et al. and Stallkamp et al. respectively, but those papers do not describe those CNN architectures. No architecture details, training budgets, or hyperparameters are given. There is no comparison to a CLIP linear probe or to BDetCLIP, even though BDetCLIP is cited. No code or attack-generation parameters are provided.

The stress-test note is right that the open-world portion of the claim is unsupported. However, the paper is not circular in the fitting sense: the held-out attack is not used to train the prompts. The limitation is about generalization scope, not internal validity.

Who gets value from this: researchers working on data-curation filters or backdoor defenses, who may find this a useful baseline to compare against once the evaluation gaps are filled. It deserves a serious referee, but with major revisions expected. I would not cite it in its current form, and I would not bring it to reading group as-is, but I would send it to peer review rather than desk reject.

Recommendation: engage with it, ask for the missing comparisons, a real unseen-family test, corrected references, and code release. The core idea is worth one more round.

Referee Report

4 major / 5 minor

Summary. The paper proposes a backdoor-image detector based on prompt tuning of a frozen CLIP model. Learnable text prompts are trained for the binary classes 'clean' and 'backdoored' on images drawn from five backdoor attack families, and the held-out sixth family is used for evaluation on CIFAR-10 and GTSRB, including cross-dataset transfer experiments. The central claim is that a clean, unpoisoned CLIP model can detect unseen, open-world backdoor images without attack-specific knowledge, with an average accuracy of about 86% on the two datasets.

Significance. If the open-world claim were supported, this would be a practical and lightweight defense for pre-training data filtering and inference-time gating. The core idea of prompting a frozen CLIP model for binary clean/backdoored discrimination is simple, does not require a poisoned model, and is easy to describe. However, the evidence currently supports only detection of held-out triggers within a closed set of six related attack families; the open-world generalization claim is not established. The near-chance result on Badnets-PX in Table I and the absence of any truly unseen attack family are substantial limitations. The paper does not provide machine-checked proofs or code, and the baseline comparisons are not reproducible as described.

major comments (4)

[Section III, Experiment Settings; Table I] The leave-one-out protocol evaluates only five training families and the sixth held-out family from the same fixed set; this is not an open-world test. Table I shows that the held-out trigger least similar to the training families, Badnets-PX, is detected at 58.89% on CIFAR-10 and 60.42% on GTSRB, near chance, while patch-like triggers exceed 94%. This pattern indicates that the prompt separates low-level artifacts shared by the five training families rather than learning a general property of backdoors. To support the Section I claim of detecting 'unseen, open-world adversarial samples without having any prior knowledge about the attacks,' the authors should test on at least one attack family never seen in training, add a negative-control set of natural corruptions, and report performance for each held-out attack rather than only as an average.
[Section III, Cross-Generalization Experiment; Table II] The cross-dataset experiment transfers between CIFAR-10 and GTSRB but still holds out only the same six families used in training; it therefore tests dataset shift, not trigger-distribution shift. The text in Section III-B correctly describes the dataset transfer, but the broader 'unseen trigger' generalization claim remains confined to the six-family set. In addition, the evaluation uses a balanced 50/50 clean/backdoored test set and a fixed similarity-score decision rule with no threshold analysis, so the reported accuracies do not quantify behavior under open-world prevalence or allow users to trade false positives against false negatives.
[Section III, Experiment Settings and Table I] The CNN baselines are not reproducible as described. The architectures of Simple-CNN and Deep-CNN are not specified beyond layer counts, and references [22] and [23] do not define them: [22] is Eykholt et al. on physical adversarial attacks and [23] is Stallkamp et al. on the GTSRB dataset. Training budgets, hyperparameters, and data splits for these baselines are also missing. Without this information, the comparisons in Table I cannot be independently verified, and the stated improvements over baselines are not established. The authors should add full baseline details or cite the actual architecture sources.
[Section IV, Conclusion; Table III] The conclusion frames the method as establishing 'a new benchmark' for backdoor defense, but no comparison is made to a CLIP linear probe or to existing backdoor detectors such as BDetCLIP [19]. The only ablation (Table III) compares the learned prefix with a static prefix. While the learned-prefix gains are large, they do not show that prompt-tuned CLIP is competitive with or superior to available alternatives. Adding at least one VLM-based or feature-based detection baseline would substantially strengthen the claimed benchmark status.

minor comments (5)

[Section II-A] The heading 'Preliminaries and Insignts' contains a typo; it should be 'Insights'. There is also a typo 'advesaries' in the same section.
[Section III-C] The text refers to 'Backdoor-PX' where the attack is 'Badnets-PX'; please use consistent naming throughout the paper.
[Table III] The table note says 'Values are shown in blue,' but the table is not in color in the manuscript; please indicate these values by a different formatting cue.
[Section II-B] The method uses only the class labels 'clean' and 'backdoored' and discards the object class names; a sentence explaining this design choice would improve clarity.
[Section III-C] The t-SNE visualization is described qualitatively; adding a quantitative separation metric such as a silhouette score or class-conditional embedding distance would better support the visual claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation; the leave-one-out evaluation is a generalization-validity concern, not a self-referential reduction.

full rationale

The central pipeline is a standard prompt-tuning binary classifier: CLIP encoders are frozen, a learnable prefix is optimized with cross-entropy on similarity scores against the text embeddings for 'clean' and 'backdoored' (Section II-B). The held-out attack type contributes no gradients and is never used for prompt selection, so the reported accuracies are not fitted values renamed as predictions. The phrase 'unseen attack' is explicitly operationalized in Section III as 'the attack type excluded during training,' which is a narrow within-family holdout rather than open-world generalization; the near-chance Badnets-PX results (58.89% on CIFAR-10 and 60.42% on GTSRB, Table I) support that limitation. However, an unsupported generalization claim is a validity or benchmark-design issue, not circularity: no equation in the paper reduces to its own input, and no load-bearing conclusion is justified by a self-citation. The only self-citation ([3], a reinforcement-learning exploration reference in the introduction) is not load-bearing. There is no uniqueness theorem imported from the authors, no ansatz smuggled in via citation, and no renaming of a known result. The paper's derivation is therefore self-contained with respect to circularity, even though the 'open-world' claim is stronger than the leave-one-out evidence supports.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The main load-bearing assumptions are that CLIP's frozen features separate backdoored from clean images and that the six chosen attack types represent the space of backdoor triggers. The paper provides no code, no attack-generation parameters, and no analysis of how the balanced class prior affects results. There are no invented physical entities; the learnable prompt vectors are standard model parameters, not new theoretical constructs.

free parameters (6)

Logit scaling factor alpha = 100
Chosen by hand to amplify dot-product similarities before cross-entropy; no ablation is reported, though it affects optimization and accuracy.
Learning rate = 1e-5
Adam learning rate for the learnable prefix embeddings; fixed without reported tuning (Section III, Experiment Settings).
Number of prompt tokens = 3
The prefix length is set to three tokens; no ablation on length is given.
Training epochs = 10
Fixed number of epochs with batch size 128; no early stopping or epoch sensitivity analysis.
Batch size = 128
Fixed batch size; not varied.
Prefix initialization = "a photo of"
The learnable tokens are initialized with word embeddings of "a photo of" to speed convergence (Section II-B); the choice may influence results.

assumptions (4)

domain assumption CLIP's frozen image encoder embeds backdoored images in a way that can be separated from clean images using text-prompt-guided similarity in the joint embedding space.
The whole method depends on this property; it is validated only on six attack types, not proven generally.
domain assumption The six attack types implemented (BadNets, Trojan, l2-inv, l0-inv) are representative of backdoor attacks, so a detector trained on five can stand in for detecting unseen attacks.
This is the inductive leap behind the leave-one-out evaluation in Section III; it is not established.
ad hoc to paper Clean and backdoored images are equally prevalent in the training and test sets.
The protocol randomly selects equal numbers of images per attack type to match clean images (Section III), creating a 50/50 prior that does not reflect real poisoning rates.
domain assumption The implementations of the six attacks in the experiments are faithful to their original papers.
No code or attack-generation parameters are provided, so correctness and fidelity are assumed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images." pith.science (2026). https://pith.science/paper/K6A7P5FP

@misc{pith2026241208755,
  author       = {Pith},
  title        = {Pith review of: Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/K6A7P5FP}},
  note         = {Machine review of arXiv:2412.08755}
}

read the original abstract

Backdoor attacks pose a critical threat by embedding hidden triggers into inputs, causing models to misclassify them into target labels. While extensive research has focused on mitigating these attacks in object recognition models through weight fine-tuning, much less attention has been given to detecting backdoored samples directly. Given the vast datasets used in training, manual inspection for backdoor triggers is impractical, and even state-of-the-art defense mechanisms fail to fully neutralize their impact. To address this gap, we introduce a groundbreaking method to detect unseen backdoored images during both training and inference. Leveraging the transformative success of prompt tuning in Vision Language Models (VLMs), our approach trains learnable text prompts to differentiate clean images from those with hidden backdoor triggers. Experiments demonstrate the exceptional efficacy of this method, achieving an impressive average accuracy of 86% across two renowned datasets for detecting unseen backdoor triggers, establishing a new standard in backdoor defense.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 24 canonical work pages

[22]

Badnets: Evaluating backdooring attacks on deep neural net- works,

T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural net- works,” IEEE Access, vol. 7, pp. 47 230–47 244, 2019

work page 2019
[23]

Learning transferable visual models from natu- ral language supervision,

A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natu- ral language supervision,” in International conference on machine learning . PMLR, 2021, pp. 8748–8763

work page 2021
[19]

Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,

J. Guo, Y . Li, X. Chen, H. Guo, L. Sun, and C. Liu, “Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,” arXiv preprint arXiv:2302.03251 , 2023

arXiv 2023
[1]

Mvitv2: Improved multiscale vision transformers for classification and de- tection,

Y . Li, C.-Y . Wu, H. Fan, K. Mangalam, B. Xiong, J. Malik, and C. Feichtenhofer, “Mvitv2: Improved multiscale vision transformers for classification and de- tection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 4804–4814

work page 2022
[2]

Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images

to reinforcement learning [3] and natural language pro- cessing [4], setting new benchmarks in performance and innovation. However, this remarkable success has made them prime targets for sophisticated adversarial manipulations. Among the most insidious threats are backdoor attacks, which stealthily embed hidden patterns—known as trig- gers—into models, c...

work page Pith review arXiv 2025
[3]

Policy augmentation: An exploration strategy for faster convergence of deep reinforcement learning algorithms,

A. Mahyari, “Policy augmentation: An exploration strategy for faster convergence of deep reinforcement learning algorithms,” in ICASSP 2021-2021 IEEE In- ternational Conference on Acoustics, Speech and Sig- nal Processing (ICASSP). IEEE, 2021, pp. 3505–3509

work page 2021
[4]

Elasticface: Elastic margin loss for deep face recog- nition,

F. Boutros, N. Damer, F. Kirchbuchner, and A. Kuijper, “Elasticface: Elastic margin loss for deep face recog- nition,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2022, pp. 1578–1587

work page 2022
[5]

Reflection backdoor: A natural backdoor attack on deep neural networks,

Y . Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in Computer Vision–ECCV 2020: 16th Eu- ropean Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16. Springer, 2020, pp. 182–199

work page 2020

Show all 33 references

[6]

Bert: Pre-training of deep bidirectional transformers for language understanding,

J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of the North American Chapter of the Association for Com- putational Linguistics, 2019

2019
[7]

Universal adversarial attacks with natural triggers for text classification,

L. Song, X. Yu, H.-T. Peng, and K. Narasimhan, “Universal adversarial attacks with natural triggers for text classification,” in Proceedings of the North Amer- ican Chapter of the Association for Computational Linguistics, 2021

2021
[8]

Trojaning attack on neural networks,

Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in 25th Annual Network And Distributed System Secu- rity Symposium (NDSS 2018) . Internet Soc, 2018

2018
[9]

Black-box backdoor defense via zero-shot image pu- rification,

Y . Shi, M. Du, X. Wu, Z. Guan, J. Sun, and N. Liu, “Black-box backdoor defense via zero-shot image pu- rification,” Advances in Neural Information Processing Systems, vol. 36, 2024

2024
[10]

a photo of

and test on the other (e.g. GTSRB), while ensuring that the model is still trained on seen triggers and tested on unseen triggers. Table II illustrates the impressive results of these experiments. For instance, in the initial tests (CIFAR- 10 → GTSRB), our model achieves an av...
[11]

Minimal: mining models for universal adversarial triggers,

Y . K. Singla, S. Parekh, S. Singh, C. Chen, B. Krish- namurthy, and R. R. Shah, “Minimal: mining models for universal adversarial triggers,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 10, 2022, pp. 11 330–11 339

2022
[12]

Activa- tion gradient based poisoned sample detection against backdoor attacks,

D. Yuan, S. Wei, M. Zhang, L. Liu, and B. Wu, “Activa- tion gradient based poisoned sample detection against backdoor attacks,” arXiv preprint arXiv:2312.06230 , 2023

2023 arXiv
[13]

Shared adver- sarial unlearning: Backdoor mitigation by unlearning shared adversarial examples,

S. Wei, M. Zhang, H. Zha, and B. Wu, “Shared adver- sarial unlearning: Backdoor mitigation by unlearning shared adversarial examples,” Advances in Neural In- formation Processing Systems , vol. 36, 2024

2024
[14]

Refit: a unified watermark removal framework for deep learning systems with limited data,

X. Chen, W. Wang, C. Bender, Y . Ding, R. Jia, B. Li, and D. Song, “Refit: a unified watermark removal framework for deep learning systems with limited data,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security , 2021, pp. 321–335

2021
[15]

Rab: Provable robustness against backdoor attacks,

M. Weber, X. Xu, B. Karlaˇs, C. Zhang, and B. Li, “Rab: Provable robustness against backdoor attacks,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 1311–1328

2023
[16]

Neural attention distillation: Erasing backdoor triggers from deep neural networks,

Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks,” in Proceedings of the 3rd International Conference on Learning Representations (ICLR), 2021

2021
[17]

One-shot neural backdoor erasing via adversarial weight masking,

S. Chai and J. Chen, “One-shot neural backdoor erasing via adversarial weight masking,” Advances in Neural Information Processing Systems , vol. 35, pp. 22 285– 22 299, 2022

2022
[18]

A simple unified framework for detecting out-of-distribution samples and adversarial attacks,

K. Lee, K. Lee, H. Lee, and J. Shin, “A simple unified framework for detecting out-of-distribution samples and adversarial attacks,” Advances in neural informa- tion processing systems , vol. 31, 2018

2018
[20]

Fast and lightweight vision- language model for adversarial traffic sign detection,

F. Mumcu and Y . Yilmaz, “Fast and lightweight vision- language model for adversarial traffic sign detection,” Electronics, vol. 13, no. 11, p. 2172, 2024

2024
[21]

Bdetclip: Multimodal prompting contrastive test-time backdoor detection,

Y . Niu, S. He, Q. Wei, Z. Wu, F. Liu, and L. Feng, “Bdetclip: Multimodal prompting contrastive test-time backdoor detection,” arXiv preprint arXiv:2405.15269, 2024

2024
[24]

Robust physical-world attacks on deep learning visual classification,

K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rah- mati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 1625–1634

2018
[25]

Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,

J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,” Neural net- works, vol. 32, pp. 323–332, 2012

2012
[26]

Deep residual learning for image recognition,

K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

2016
[27]

How much can clip benefit vision-and-language tasks?

S. Shen, L. H. Li, H. Tan, M. Bansal, A. Rohrbach, K.-W. Chang, Z. Yao, and K. Keutzer, “How much can clip benefit vision-and-language tasks?” arXiv preprint arXiv:2107.06383, 2021

2021 arXiv
[28]

Learning to prompt for vision-language models,

K. Zhou, J. Yang, C. C. Loy, and Z. Liu, “Learning to prompt for vision-language models,” International Journal of Computer Vision, vol. 130, no. 9, pp. 2337– 2348, 2022

2022
[29]

Conditional prompt learning for vision-language models,

——, “Conditional prompt learning for vision-language models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2022, pp. 16 816–16 825

2022
[30]

Adam: A method for stochastic opti- mization,

D. P. Kingma, “Adam: A method for stochastic opti- mization,” arXiv preprint arXiv:1412.6980 , 2014

2014 arXiv
[31]

Invisible backdoor attacks on deep neural networks via steganography and regularization,

S. Li, M. Xue, B. Z. H. Zhao, H. Zhu, and X. Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” IEEE Transactions on Dependable and Secure Computing , vol. 18, no. 5, pp. 2088–2105, 2020

2020
[32]

Learning multiple layers of features from tiny images,

A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

2009
[33]

Visualizing data using t-sne

L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research , vol. 9, no. 11, 2008

2008

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [22]

Badnets: Evaluating backdooring attacks on deep neural net- works,

T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural net- works,” IEEE Access, vol. 7, pp. 47 230–47 244, 2019

work page 2019

[2] [23]

Learning transferable visual models from natu- ral language supervision,

A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natu- ral language supervision,” in International conference on machine learning . PMLR, 2021, pp. 8748–8763

work page 2021

[3] [19]

Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,

J. Guo, Y . Li, X. Chen, H. Guo, L. Sun, and C. Liu, “Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,” arXiv preprint arXiv:2302.03251 , 2023

arXiv 2023

[4] [1]

Mvitv2: Improved multiscale vision transformers for classification and de- tection,

Y . Li, C.-Y . Wu, H. Fan, K. Mangalam, B. Xiong, J. Malik, and C. Feichtenhofer, “Mvitv2: Improved multiscale vision transformers for classification and de- tection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 4804–4814

work page 2022

[5] [2]

Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images

to reinforcement learning [3] and natural language pro- cessing [4], setting new benchmarks in performance and innovation. However, this remarkable success has made them prime targets for sophisticated adversarial manipulations. Among the most insidious threats are backdoor attacks, which stealthily embed hidden patterns—known as trig- gers—into models, c...

work page Pith review arXiv 2025

[6] [3]

Policy augmentation: An exploration strategy for faster convergence of deep reinforcement learning algorithms,

A. Mahyari, “Policy augmentation: An exploration strategy for faster convergence of deep reinforcement learning algorithms,” in ICASSP 2021-2021 IEEE In- ternational Conference on Acoustics, Speech and Sig- nal Processing (ICASSP). IEEE, 2021, pp. 3505–3509

work page 2021

[7] [4]

Elasticface: Elastic margin loss for deep face recog- nition,

F. Boutros, N. Damer, F. Kirchbuchner, and A. Kuijper, “Elasticface: Elastic margin loss for deep face recog- nition,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2022, pp. 1578–1587

work page 2022

[8] [5]

Reflection backdoor: A natural backdoor attack on deep neural networks,

Y . Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in Computer Vision–ECCV 2020: 16th Eu- ropean Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16. Springer, 2020, pp. 182–199

work page 2020