Pith. sign in

REVIEW 4 major objections 6 minor 63 references

Filter, Obstruct and Dilute: Defending Against Backdoor Attacks on Semi-Supervised Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A new plug-in defense, Backdoor Invalidator, brings average backdoor attack success in semi-supervised classifiers from 84.7% down to 1.8% without sacrificing clean-data accuracy.

desk verdict A useful SSL backdoor defense with a solid ASR-reduction core, undermined by an abstract that overclaims clean-accuracy preservation and a missing comparison to an SSL-specific countermeasure. read the letter →

arxiv 2502.05755 v1 pith:4ZDXXANP submitted 2025-02-09 cs.LG

Xinrui Wang , Chuanxing Geng , Wenhai Wan , Shao-yuan Li , Songcan Chen This is my paper · ORCID
classification cs.LG MSC 68T0568T07
keywords backdoorattacksemi-supervisedlearningdefensecomplementaryGaussianfilteringtriggermix-updatapoisoningadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that semi-supervised image classifiers can be made robust to data-poisoning backdoor attacks by a plug-in training procedure that never needs to detect poisoned samples. The defense, called Backdoor Invalidator (BI), attacks the mechanism the adversary relies on: the spurious correlation a trigger pattern forms with the target class. It filters trigger-like high-frequency noise with a Gaussian blur, replaces part of the usual consistency loss with complementary-label learning, and dilutes the trigger-to-class link by mixing unlabeled examples with labeled ones. On CIFAR-10, SVHN, STL-10 and CIFAR-100, the paper reports average attack success falling from 84.7% to 1.8% across five backdoor attacks, with clean accuracy roughly preserved. If correct, this gives SSL practitioners a defense that works with existing SSL methods instead of requiring a separate detection stage.

What carries the argument

The load-bearing mechanism is the disruption of the spurious trigger-to-target correlation. Three components carry this. The Gaussian Filter is a preprocessing convolution that smooths trigger patterns, which behave like high-frequency noise. Complementary learning replaces the consistency loss with a loss over 'not-label' estimates; the transition matrix $Q \in \mathbb{R}^{c\times c}$, with $Q_{ij} = P(y \neq j \mid y = i)$, converts class probabilities into complementary-label probabilities so ordinary supervised learning and complementary learning share the same optimum. Trigger mix-up blends labeled data with high-confidence unlabeled data, with the mixing weight favoring the clean labeled part, so the trigger is associated with no single class. The theoretical result (Theorem 1) states that when $Q$ is invertible the minimizer of the complementary risk equals the minimizer of the standard risk; Theorem 2 gives a Rademacher-complexity bound on the generalization gap.

What would settle it

Poison 0.2% of the labeled set with the same Mosaic trigger while keeping the paper's unlabeled poisoning, then train FixMatch with BI; if attack success rises markedly above 1.8%, the threat-model boundary is the decisive limitation. A second check: construct a low-frequency trigger that survives the Gaussian filter (e.g., a smooth full-image perturbation) and measure ASR; if it exceeds the claimed 1-4% range, the filtering component is not sufficient by itself.

Watch

Extended reading notes

Core claim

The central claim is that backdoor attacks on semi-supervised learning succeed because the model learns an artificial one-to-one association between the trigger pattern and the target class, and that this association can be broken by training the model to learn the opposite: which classes an image does not belong to. BI implements this by (1) Gaussian-filtering inputs so noise-like triggers are attenuated before the model sees them, (2) replacing the consistency loss in the first training stage with a complementary loss that uses labels of the form 'not class j', with a transition matrix Q converting ordinary probabilities into complementary probabilities, and (3) in the second stage mixing high-confidence unlabeled data with labeled data so the trigger becomes associated with mixed classes rather than a single target. The paper reports that this reduces the average attack success rate from 84.7% to 1.8% over CL-Badnets, Narcissus, DeHiB, Mosaic and Freq, with clean accuracy close to the un-defended baseline, and proves that the complementary loss has the same optimal classifier as the consistency loss it replaces.

Load-bearing premise

The defense assumes the adversary poisons only unlabeled data and never the labeled set; if labeled examples carry the trigger, the supervised loss in Eq. (3) would directly teach the trigger-to-target association and the reported protection would no longer hold.

Editorial extensions

If this is right

  • If BI is correct, existing SSL methods such as FixMatch, FlexMatch, MixMatch and SemiReward can be hardened against unlabeled-data backdoor attacks without retraining from scratch or adding a detection step.
  • The reported attack success of roughly 1-4% against Mosaic and Freq, where off-the-shelf supervised defenses (fine-tuning, fine-pruning, NAD, ABL) leave ASR at 44-98%, implies that supervised-learning defenses do not transfer to the SSL setting.
  • The equivalence of the optimal classifier under complementary loss and consistency loss means the defense does not change the learning target, only the pathway to it.
  • Because BI's two-stage schedule injects mix-up later in training, early training focuses on feature learning, which the paper's pilot experiments tie to reduced backdoor implantability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same 'one-to-all' logic could be applied to other spurious-correlation phenomena in SSL, such as shortcut learning from class-imbalanced unlabeled data, where training against 'not-class' labels may suppress shortcuts as it suppresses triggers.
  • An adaptive adversary who knows about BI could try low-frequency triggers that survive Gaussian filtering; the paper does not test this, so the defense's robustness under adaptive attacks remains open.
  • Because BI relies on labeled data to anchor feature learning, its own Table 4 shows clean accuracy degrades sharply when labels are extremely scarce; a direct implication is that BI's benefit is bounded by the labeled-data budget of the SSL task.
  • A testable extension would be to vary the Gaussian kernel radius per attack frequency content rather than using a fixed radius, which the sensitivity analysis suggests as a tunable CA-ASR trade-off.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Backdoor Invalidator (BI), a plug-in defense for semi-supervised learning (SSL) against backdoor attacks that poison unlabeled data. BI combines three components: a Gaussian filter applied during data pre-processing, a complementary-learning objective with an estimated transition matrix Q to obstruct trigger-target correlation, and a two-stage training procedure with trigger mix-up to dilute the correlation. Experiments are reported on CIFAR10, SVHN, STL10, and CIFAR100 using FixMatch, FlexMatch, MixMatch, and SemiReward against five attacks (CL-Badnets, Narcissus, DeHiB, Mosaic, Freq), with comparisons to four existing defenses and an ablation study. The paper also provides a theoretical analysis claiming that optimizing the complementary loss preserves the optimal classifier of the consistency loss and derives a Rademacher-complexity generalization bound.

Significance. The problem is timely and important: SSL is vulnerable to backdoor attacks, and few defenses are tailored to this setting. The paper's plug-in design is practically attractive, and the empirical coverage is substantial: four datasets, four SSL methods, five attacks, and multiple defense baselines. The ablation in Table 3 supports the individual contribution of each component, and the appendix gives pseudocode for the complementary-label and transition-matrix estimation. If the claims were appropriately qualified, the ASR reductions would be a useful step for the community. However, the abstract's clean-accuracy claim is contradicted by the paper's own tables, the theoretical guarantee is conditional on an unmeasured pseudo-label error and an invertible Q, and the evaluation lacks variance reporting. These issues currently weaken the central claims as stated.

major comments (4)
  1. [Section 4, Theorem 2, Eq. (6)] The abstract claims that BI 'does not sacrifice accuracy on clean data', but the paper's own results contradict this. In Table 1, FixMatch w/ BI on CIFAR100 reaches 65.4% CA against Mosaic versus 71.1% for FixMatch alone (a 5.7-point drop) and 67.6% versus 70.8% for Freq (a 3.2-point drop); similar drops appear for FlexMatch w/ BI. Table 2 repeats these numbers. Moreover, Section 5.2 explicitly acknowledges that 'BI sometimes compromises clean data accuracy to enhance backdoor defense effectiveness.' Since clean-accuracy preservation is a core selling point of the defense, the abstract and conclusion must be revised to state the trade-off conditionally and to quantify where accuracy loss occurs.
  2. [Section 2 and Appendix D] The theoretical guarantee is weaker than the abstract suggests. Theorem 2 bounds the excess risk in terms of a term 2M2ϵ, where ϵ is any value satisfying the condition that the average deviation between estimated pseudo complementary labels and true labels is at most ϵ. The paper does not measure ϵ, derive an upper bound for it, or provide a practical way to verify it from data, so the bound is conditional on an unverified quantity. In addition, Theorem 1 requires Assumption 1 (calibrated g*) and an invertible transition matrix Q, but Q is estimated from the model's own predictions (Algorithm 3); the paper does not analyze how Q-estimation error affects the minimizer identity or the generalization bound. These issues should be stated explicitly and the 'theoretical guarantee' claim in the abstract tempered accordingly.
  3. [Appendix B.2.1 and Tables 1-6] The defense is validated only under the threat model where adversaries poison unlabeled data without access to the labeled set. Under that assumption, the defense is plausible because the supervised loss in Eq. (3) involves clean labeled data. However, Appendix D concedes that combined labeled and unlabeled poisoning is not handled. If an adversary can poison even a small fraction of labeled examples, the supervised loss in Eq. (3) would directly associate the trigger with the target class and likely restore high ASR. Because this threat-model restriction is not stated in the abstract, the paper should either add experiments with labeled-data poisoning to delineate the validity of the defense or explicitly scope the claims to the unlabeled-poisoning-only setting.
  4. [General reporting of results] The empirical claims lack a measure of uncertainty. The appendix reports that CIFAR10 and SVHN results are the median of 5 runs, STL10 the median of 3 runs, and CIFAR100 a single run, but the tables report only point values without standard deviations or confidence intervals. The clean-accuracy preservation claim relies on small differences in some cells (e.g., Table 1, FixMatch w/ BI on CIFAR10 CL-Badnets, CA 93.4 vs 93.9), and the single-run CIFAR100 results are the ones showing the largest CA drops. Reporting variance would let readers judge whether the ASR reductions and CA differences are statistically meaningful.
minor comments (6)
  1. [Section 2 heading] The heading 'Backgroud' should be 'Background'.
  2. [Section 3.3 and Section 5.2] There are duplicated words: 'to dilute the the influence' and 'evaluate the the proposed method'.
  3. [Appendix A and Algorithm 1] The numbering of algorithms is inconsistent: in the main text (Section 3.2) the authors refer to 'Algorithm 1 and Algorithm 2' for complementary-label generation and transition-matrix estimation, but in the appendix Algorithm 2 is the complementary-label generation routine and Algorithm 3 is the transition-matrix estimation routine; moreover, Algorithm 1 in the appendix calls 'Algorithm 1' at step 5, which should refer to the complementary-label generation routine.
  4. [Table 1 and Table 2 captions] The asterisk in 'DeHiB*' is not defined in the table captions; the distinction between DeHiB and DeHiB* appears only in Section 5.1.
  5. [Figure 2 caption] The caption says 'from a casual perspective', which should be 'from a causal perspective'.
  6. [Table 5] The notation for poison ratios is inconsistent: the caption uses 'Poison ratio: pc' but the text uses both p and pc; the relation between the two should be defined clearly.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central ASR reductions are empirical results against external attacks, and the theoretical bounds are conditional but not self-referential.

full rationale

The paper's main claim is an empirical defense result: BI reduces average ASR from 84.7% to 1.8% across five external backdoor attacks (CL-Badnets, Narcissus, DeHiB, Mosaic, Freq). These attacks are implemented from original-author code or from published specifications (Section 5.1, Appendix B.2.3), and the defense hyperparameters (Gaussian filter radius gamma=1, mixup coefficient alpha_min=0.2) are fixed across the main tables rather than fitted to the target ASR values. The sensitivity analysis in Figures 5-6 explores trade-offs but does not retroactively select per-attack parameters, so the headline results are not statistically forced. The theoretical analysis is also not circular: Theorem 1 is a standard identifiability argument relying on invertibility of the transition matrix Q and the stated Assumption 1, both drawn from prior external work [57], and Theorem 2 gives a Rademacher-complexity bound conditional on an unmeasured pseudo-label error epsilon. That condition makes the theory a conditional guarantee, not an independent empirical certification, but it does not assume the defense's conclusion. The use of model predictions to generate complementary labels and to estimate Q is self-referential in the algorithmic sense of self-training, but it is not a definitional identification of the defense outcome with its inputs. The only self-citation, reference [45] in Related Works, is one of several safe-SSL citations and is not load-bearing. The paper's internal inconsistency between the abstract's claim that BI 'does not sacrifice accuracy on clean data' and Table 1's CIFAR100 drops, plus its own acknowledgement in Section 5.2 that 'BI sometimes compromises clean data accuracy,' is a correctness/overclaim issue rather than circularity. Similarly, Appendix D's limitation to unlabeled-only poisoning restricts scope but does not make the derivation circular. No equation in the paper reduces to another by construction, and no prediction is renamed from a fitted parameter.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The central empirical claim rests on the unlabeled-only poisoning threat model, on the high-frequency trigger profile inherited from [39], and on theoretical assumptions of calibrated predictions and invertible Q. No new physical or mathematical entities are introduced; the defense is a combination of existing techniques.

free parameters (3)
  • Gaussian filter radius gamma = 1
    Chosen by hand for the main experiments; sensitivity analysis in Figure 5 shows it moderates the CA/ASR tradeoff, and Appendix B.2.4 notes it could be reduced for the Freq attack to improve clean accuracy.
  • Trigger mix-up coefficient alpha_min = 0.2
    Default value for the cosine scheduler in Eq. (5); sensitivity analysis in Figure 6 shows stable performance when alpha_min > 0.2.
  • Stage-one iteration count t1 = not reported
    Controls how long complementary learning runs before the mix-up stage; required by Algorithm 1 but no value is given in the paper, making exact replication dependent on unseen code.
assumptions (6)
  • domain assumption Assumption 1: the optimal classifier satisfies g*_i(x) = P(y = i|x) for all classes i.
    Used in Theorem 1 to equate the complementary-loss minimizer with the standard-loss minimizer; deep networks are not guaranteed to be perfectly calibrated.
  • domain assumption Transition matrix Q mapping true labels to complementary labels is invertible.
    Required for Theorem 1; invertibility of the estimated Q is not verified in the experiments.
  • domain assumption Successful SSL backdoor triggers are full-image, repetitive, high-frequency patterns that Gaussian filtering can attenuate.
    Adopted from [39] in Section 3.1; if an attacker uses low-frequency or localized triggers, the filter component is ineffective.
  • domain assumption Only unlabeled data are poisoned; labeled data are clean and carefully inspected.
    Stated in Section 2 and used in the threat model; Appendix D acknowledges the combined-poisoning case is not handled.
  • domain assumption Pseudo-labeling error on unlabeled data is bounded by epsilon.
    Theorem 2's generalization bound is conditional on this unmeasured quantity; the paper does not estimate epsilon experimentally.
  • standard math Standard Rademacher complexity and Talagrand contraction inequalities apply.
    Used in the proof of Theorem 2 in Appendix E; this is standard learning-theory machinery.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Filter, Obstruct and Dilute: Defending Against Backdoor Attacks on Semi-Supervised Learning." pith.science (2026). https://pith.science/paper/4ZDXXANP

@misc{pith2026250205755,
  author       = {Pith},
  title        = {Pith review of: Filter, Obstruct and Dilute: Defending Against Backdoor Attacks on Semi-Supervised Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4ZDXXANP}},
  note         = {Machine review of arXiv:2502.05755}
}
read the original abstract

Recent studies have verified that semi-supervised learning (SSL) is vulnerable to data poisoning backdoor attacks. Even a tiny fraction of contaminated training data is sufficient for adversaries to manipulate up to 90\% of the test outputs in existing SSL methods. Given the emerging threat of backdoor attacks designed for SSL, this work aims to protect SSL against such risks, marking it as one of the few known efforts in this area. Specifically, we begin by identifying that the spurious correlations between the backdoor triggers and the target class implanted by adversaries are the primary cause of manipulated model predictions during the test phase. To disrupt these correlations, we utilize three key techniques: Gaussian Filter, complementary learning and trigger mix-up, which collectively filter, obstruct and dilute the influence of backdoor attacks in both data pre-processing and feature learning. Experimental results demonstrate that our proposed method, Backdoor Invalidator (BI), significantly reduces the average attack success rate from 84.7\% to 1.8\% across different state-of-the-art backdoor attacks. It is also worth mentioning that BI does not sacrifice accuracy on clean data and is supported by a theoretical guarantee of its generalization capability.

Figures

Figures reproduced from arXiv: 2502.05755 by the authors.

Figure 1
Figure 1. Following previous settings[56], poisoned data is ex￾clusively introduced into the unlabeled set, as the labeled set is typically subjected to careful inspection. Our goal is to prevent adversaries from manipulating test data outputs from the true la￾bel to the targeted one under the poisoned dataset. even worse in SSL, where adversaries can manipulate about 90% of the SSL model’s output during inference by embed￾di… view at source ↗
Figure 2
Figure 2. Visualization of the mechanism behind successful backdoor attacks in SSL from a casual perspective. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Visualization of two successful backdoor triggers (in [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The data mix-up does not compromise the trigger pat [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Sensitivity analysis on γ. ing method that makes greater use of unlabeled data, es￾pecially in the early stages of training. It is important to note that although we make certain assumptions about the characteristics of backdoor triggers based on the conclu￾sions drawn…
Figure 6
Figure 6. Figure 6: Sensitivity analysis on αmin. of approaches[34]. In this section, we focus on methods that adopt self-training paradigm, which represents the most mainstream techniques in modern SSL[38]. The core con￾cept involves treating the model’s output probabilities as ei￾ther s…
Figure 7
Figure 7. Figure 7: ASR of our method across different target classes under Freq and Mosaic. B.2. Details of the hyperparameters of experiments B.2.1. Training hyperparameters. Initially, we train and assess other SSL (Semi-Supervised Learning) methods employing a unified codebase, as fou…
Figure 8
Figure 8. Figure 8: Visualization of the 100 poisoned images (dog as the target class) of two most successful SSL backdoor attacks: Mosaic on the [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 10
Figure 10. Figure 10: ASR of Mosaic attack for different target classes. [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

63 extracted references · 61 canonical work pages

  1. [56]

    Deep neural backdoor in semi-supervised learning: Threats and countermeasures

    Zhicong Yan, Jun Wu, Gaolei Li, Shenghong Li, and Mohsen Guizani. Deep neural backdoor in semi-supervised learning: Threats and countermeasures. IEEE Transactions on Infor- mation Forensics and Security, 16:4827–4842, 2021. 1

    work page 2021

  2. [1]

    Masktune: Mitigating spurious correlations by forcing to explore

    Saeid Asgari, Aliasghar Khani, Fereshte Khani, Ali Gho- lami, Linh Tran, Ali Mahdavi Amiri, and Ghassan Hamarneh. Masktune: Mitigating spurious correlations by forcing to explore. Advances in Neural Information Process- ing Systems, 35:23284–23296, 2022. 1

    work page 2022

  3. [2]

    Rademacher and gaussian complexities: Risk bounds and structural results

    Peter L Bartlett and Shahar Mendelson. Rademacher and gaussian complexities: Risk bounds and structural results. Journal of Machine Learning Research , 3(Nov):463–482,

    work page

  4. [3]

    Mixmatch: A holistic approach to semi-supervised learning

    David Berthelot, Nicholas Carlini, Ian Goodfellow, Nicolas Papernot, Avital Oliver, and Colin A Raffel. Mixmatch: A holistic approach to semi-supervised learning. Advances in neural information processing systems, 32, 2019. 15

    work page 2019

  5. [4]

    Remix- match: Semi-supervised learning with distribution alignment and augmentation anchoring

    David Berthelot, Nicholas Carlini, Ekin D Cubuk, Alex Ku- rakin, Kihyuk Sohn, Han Zhang, and Colin Raffel. Remix- match: Semi-supervised learning with distribution alignment and augmentation anchoring. ICLR, 2020. 8

    work page 2020

  6. [5]

    Poisoning the unlabeled dataset of {Semi- Supervised} learning

    Nicholas Carlini. Poisoning the unlabeled dataset of {Semi- Supervised} learning. In 30th USENIX Security Symposium (USENIX Security 21), pages 1577–1592, 2021. 1

    work page 2021

  7. [6]

    Semi-supervised learning

    Olivier Chapelle, Bernhard Sch ¨olkopf, and Alexander Zien. Semi-supervised learning. The MIT Press, 5, 2006. 1

    work page 2006

  8. [7]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018. 8

    arXiv 2018

Show all 63 references
  1. [8]

    Softmatch: Addressing the quantity-quality trade-off in semi-supervised learning

    Hao Chen, Ran Tao, Yue Fan, Yidong Wang, Jindong Wang, Bernt Schiele, Xing Xie, Bhiksha Raj, and Marios Sav- vides. Softmatch: Addressing the quantity-quality trade-off in semi-supervised learning. ICLR, 2023. 8

    2023

  2. [9]

    A practical clean-label backdoor attack with limited information in vertical federated learning

    Peng Chen, Jirui Yang, Junxiong Lin, Zhihui Lu, Qiang Duan, and Hongfeng Chai. A practical clean-label backdoor attack with limited information in vertical federated learning. In ICDM, pages 41–50. IEEE, 2023. 6, 7

    2023

  3. [10]

    An analysis of single-layer networks in unsupervised feature learning

    Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In AISTATS, pages 215–223. JMLR Workshop and Conference Proceedings, 2011. 12

    2011

  4. [11]

    Rethinking back- door data poisoning attacks in the context of semi-supervised learning

    Marissa Connor and Vincent Emanuele. Rethinking back- door data poisoning attacks in the context of semi-supervised learning. arXiv preprint arXiv:2212.02582, 2022. 8

    2022 arXiv

  5. [12]

    Black-box detection of back- door attacks with limited information and data

    Yinpeng Dong, Xiao Yang, Zhijie Deng, Tianyu Pang, Zihao Xiao, Hang Su, and Jun Zhu. Black-box detection of back- door attacks with limited information and data. In CVPR, pages 16482–16491, 2021. 8

    2021

  6. [13]

    Learning with multiple complementary labels

    Lei Feng, Takuo Kaneko, Bo Han, Gang Niu, Bo An, and Masashi Sugiyama. Learning with multiple complementary labels. In ICML, pages 3072–3081. PMLR, 2020. 4

    2020

  7. [14]

    Unbiased risk es- timator to multi-labeled complementary label learning

    Yi Gao, Miao Xu, and Min-Ling Zhang. Unbiased risk es- timator to multi-labeled complementary label learning. In IJCAI, pages 3732–3740. IJCAI, 2023. 4

    2023

  8. [15]

    Complementary to multiple labels: A correlation-aware correction approach

    Yi Gao, Miao Xu, and Min-Ling Zhang. Complementary to multiple labels: A correlation-aware correction approach. IEEE Transactions on Pattern Analysis and Machine Intelli- gence, 2024. 4

    2024

  9. [16]

    Identifying vulner- abilities in the machine learning model supply chain

    T Gu, B Dolan-Gavitt, and S BadNets. Identifying vulner- abilities in the machine learning model supply chain. In Proceedings of the Neural Information Processing Sympo- sium Workshop Mach. Learning Security (MLSec), pages 1– 5, 2017. 3, 6, 7

    2017

  10. [17]

    Safe deep semi-supervised learning for unseen-class unlabeled data

    Lan-Zhe Guo, Zhen-Yu Zhang, Yuan Jiang, Yu-Feng Li, and Zhi-Hua Zhou. Safe deep semi-supervised learning for unseen-class unlabeled data. In ICML, pages 3897–3906. PMLR, 2020. 8

    2020

  11. [18]

    Robust semi-supervised learning when not all classes have labels

    Lan-Zhe Guo, Yi-Ge Zhang, Zhi-Fan Wu, Jie-Jing Shao, and Yu-Feng Li. Robust semi-supervised learning when not all classes have labels. Advances in Neural Information Pro- cessing Systems, 35:3305–3317, 2022. 8

    2022

  12. [19]

    Theoretical foundations of gaussian con- volution by extended box filtering

    Pascal Gwosdek, Sven Grewenig, Andr ´es Bruhn, and Joachim Weickert. Theoretical foundations of gaussian con- volution by extended box filtering. In Scale Space and Vari- ational Methods in Computer Vision: Third International Conference, SSVM 2011, Ein-Gedi, Israel, May 29–Ju...

    2011

  13. [20]

    Learning from complementary labels

    Takashi Ishida, Gang Niu, Weihua Hu, and Masashi Sugiyama. Learning from complementary labels. Advances in neural information processing systems, 30, 2017. 4, 18

    2017

  14. [21]

    Bidirectional adaptation for ro- bust semi-supervised learning with inconsistent data distri- butions

    Lin-Han Jia, Lan-Zhe Guo, Zhi Zhou, Jie-Jing Shao, Yuke Xiang, and Yu-Feng Li. Bidirectional adaptation for ro- bust semi-supervised learning with inconsistent data distri- butions. In ICML, pages 14886–14901. PMLR, 2023. 8

    2023

  15. [22]

    Learn- ing multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learn- ing multiple layers of features from tiny images. https://www.cs.utoronto.ca/, 2009. 12

    2009

  16. [23]

    Pseudo-label: The simple and effi- cient semi-supervised learning method for deep neural net- works

    Dong-Hyun Lee et al. Pseudo-label: The simple and effi- cient semi-supervised learning method for deep neural net- works. In Workshop on challenges in representation learn- ing, ICML, page 896. Atlanta, 2013. 8

    2013

  17. [24]

    Instant: Semi-supervised learning with instance-dependent thresholds

    Muyang Li, Runze Wu, Haoyu Liu, Jun Yu, Xun Yang, Bo Han, and Tongliang Liu. Instant: Semi-supervised learning with instance-dependent thresholds. Advances in Neural In- formation Processing Systems, 36, 2024. 4

    2024

  18. [25]

    Semireward: A general re- ward model for semi-supervised learning

    Siyuan Li, Weiyang Jin, Zedong Wang, Fang Wu, Zicheng Liu, Cheng Tan, and Stan Z Li. Semireward: A general re- ward model for semi-supervised learning. ICLR, 2024. 15

    2024

  19. [26]

    Anti-backdoor learning: Training clean models on poisoned data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, 34:14900–14912, 2021. 7, 8

    2021

  20. [27]

    Neural attention distillation: Erasing back- door triggers from deep neural networks

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing back- door triggers from deep neural networks. ICLR, 2022. 7

    2022

  21. [28]

    Back- door learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Back- door learning: A survey. IEEE Transactions on Neural Net- works and Learning Systems, 35(1):5–22, 2024. 1

    2024

  22. [29]

    Towards making unlabeled data never hurt

    Yu-Feng Li and Zhi-Hua Zhou. Towards making unlabeled data never hurt. IEEE Transactions on Pattern Analysis and Machine Intelligence, 37(1):175–188, 2015. 8

    2015

  23. [30]

    Towards safe weakly supervised learning

    Yu-Feng Li, Lan-Zhe Guo, and Zhi-Hua Zhou. Towards safe weakly supervised learning. IEEE transactions on pattern analysis and machine intelligence, 43(1):334–346, 2019. 8

    2019

  24. [31]

    Iomatch: Simplifying open-set semi-supervised learning with joint in- liers and outliers utilization

    Zekun Li, Lei Qi, Yinghuan Shi, and Yang Gao. Iomatch: Simplifying open-set semi-supervised learning with joint in- liers and outliers utilization. In CVPR, pages 15870–15879,

  25. [32]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses , pages 273–294. Springer,

  26. [33]

    Beating backdoor attack at its own game

    Min Liu, Alberto Sangiovanni-Vincentelli, and Xiangyu Yue. Beating backdoor attack at its own game. In CVPR, pages 4620–4629, 2023. 8

    2023

  27. [34]

    Iterative reclassification procedure for constructing an asymptotically optimal rule of allocation in discriminant analysis

    Geoffrey J McLachlan. Iterative reclassification procedure for constructing an asymptotically optimal rule of allocation in discriminant analysis. Journal of the American Statistical Association, 70(350):365–369, 1975. 8

    1975

  28. [35]

    Foundations of machine learning

    Mehryar Mohri, Afshin Rostamizadeh, and Ameet Tal- walkar. Foundations of machine learning. MIT press, 2018. 18

    2018

  29. [36]

    Reading digits in natural images with unsupervised feature learning

    Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bis- sacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learn- ing, number 2 in 4. Granada, 2011. 12

    2011

  30. [37]

    Hidden trigger backdoor attacks

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pir- siavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, pages 11957– 11965, 2020. 3

    2020

  31. [38]

    Probability of error of some adaptive pattern-recognition machines

    Henry Scudder. Probability of error of some adaptive pattern-recognition machines. IEEE Transactions on Infor- mation Theory, 11(3):363–371, 1965. 8

    1965

  32. [39]

    The perils of learning from unlabeled data: Backdoor attacks on semi-supervised learning

    Shejwalkar, Virat, Lingjuan Lyu, Houmansadr, and Amir. The perils of learning from unlabeled data: Backdoor attacks on semi-supervised learning. In CVPR, pages 4730–4740,

  33. [40]

    Bypassing backdoor detection algorithms in deep learning

    Reza Shokri et al. Bypassing backdoor detection algorithms in deep learning. In 2020 IEEE European Symposium on Se- curity and Privacy (EuroS&P), pages 175–183. IEEE, 2020. 8

    2020

  34. [41]

    Fixmatch: Simplifying semi-supervised learning with consistency and confidence

    Kihyuk Sohn, David Berthelot, Nicholas Carlini, Zizhao Zhang, Han Zhang, Colin A Raffel, Ekin Dogus Cubuk, Alexey Kurakin, and Chun-Liang Li. Fixmatch: Simplifying semi-supervised learning with consistency and confidence. Advances in neural information processing systems, 33:5...

    2020

  35. [42]

    Concentration of measure and isoperi- metric inequalities in product spaces

    Michel Talagrand. Concentration of measure and isoperi- metric inequalities in product spaces. Publications Math´ematiques de l’Institut des Hautes Etudes Scientifiques, 81:73–205, 1995. 17

    1995

  36. [43]

    Defending against patch-based backdoor attacks on self- supervised learning

    Ajinkya Tejankar, Maziar Sanjabi, Qifan Wang, Sinong Wang, Hamed Firooz, Hamed Pirsiavash, and Liang Tan. Defending against patch-based backdoor attacks on self- supervised learning. In CVPR, pages 12239–12249, 2023. 8

    2023

  37. [44]

    Label-consistent backdoor attacks

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019. 8

    1912 arXiv

  38. [45]

    Unlocking the power of open set: A new perspective for open-set noisy label learn- ing

    Wenhai Wan, Xinrui Wang, Ming-Kun Xie, Shao-Yuan Li, Sheng-Jun Huang, and Songcan Chen. Unlocking the power of open set: A new perspective for open-set noisy label learn- ing. In AAAI, pages 15438–15446, 2024. 8

    2024

  39. [46]

    Learning from complementary labels via partial-output consistency regularization

    Deng-Bao Wang, Lei Feng, and Min-Ling Zhang. Learning from complementary labels via partial-output consistency regularization. In IJCAI, pages 3075–3081, 2021. 2

    2021

  40. [47]

    Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum mar- gin statistic

    Hang Wang, Zhen Xiang, David J Miller, and George Ke- sidis. Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum mar- gin statistic. In IEEE Symposium on Security and Privacy ,

  41. [48]

    Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum mar- gin statistic

    Hang Wang, Zhen Xiang, David J Miller, and George Ke- sidis. Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum mar- gin statistic. In 2024 IEEE Symposium on Security and Pri- vacy (SP), pages 15–15. IEEE Computer Society, 2024. 8

    2024

  42. [49]

    An invisible black-box backdoor at- tack through frequency domain

    Tong Wang, Yuan Yao, Feng Xu, Shengwei An, Hanghang Tong, and Ting Wang. An invisible black-box backdoor at- tack through frequency domain. In ECCV, pages 396–413. Springer, 2022. 2, 3, 6

    2022

  43. [50]

    Usb: A unified semi-supervised learning bench- mark for classification

    Yidong Wang, Hao Chen, Yue Fan, Wang Sun, Ran Tao, Wenxin Hou, Renjie Wang, Linyi Yang, Zhi Zhou, Lan-Zhe Guo, et al. Usb: A unified semi-supervised learning bench- mark for classification. Advances in Neural Information Pro- cessing Systems, 35:3938–3961, 2022. 13

    2022

  44. [51]

    Freematch: Self-adaptive thresholding for semi-supervised learning

    Yidong Wang, Hao Chen, Qiang Heng, Wenxin Hou, Yue Fan, Zhen Wu, Jindong Wang, Marios Savvides, Takahiro Shinozaki, Bhiksha Raj, et al. Freematch: Self-adaptive thresholding for semi-supervised learning. Advances in Neu- ral Information Processing Systems, 2022. 8

    2022

  45. [52]

    Unsupervised data augmentation for consistency training

    Qizhe Xie, Zihang Dai, Eduard Hovy, Thang Luong, and Quoc Le. Unsupervised data augmentation for consistency training. Advances in neural information processing systems, 33:6256–6268, 2020. 8

    2020

  46. [53]

    Generative- discriminative complementary learning

    Yanwu Xu, Mingming Gong, Junxiang Chen, Tongliang Liu, Kun Zhang, and Kayhan Batmanghelich. Generative- discriminative complementary learning. In AAAI, pages 6526–6533, 2020. 4

    2020

  47. [54]

    Dash: Semi-supervised learning with dynamic thresholding

    Yi Xu, Lei Shang, Jinxing Ye, Qi Qian, Yu-Feng Li, Baigui Sun, Hao Li, and Rong Jin. Dash: Semi-supervised learning with dynamic thresholding. In ICML, pages 11525–11536. PMLR, 2021. 8

    2021

  48. [55]

    Dehib: Deep hidden backdoor attack on semi-supervised learning via adversarial perturbation

    Zhicong Yan, Gaolei Li, Yuan TIan, Jun Wu, Shenghong Li, Mingzhe Chen, and H Vincent Poor. Dehib: Deep hidden backdoor attack on semi-supervised learning via adversarial perturbation. In AAAI, pages 10585–10593, 2021. 3, 6, 7

    2021

  49. [57]

    Learning with biased complementary labels

    Xiyu Yu, Tongliang Liu, Mingming Gong, and Dacheng Tao. Learning with biased complementary labels. InECCV, pages 68–83, 2018. 4, 5, 16

    2018

  50. [58]

    Rethink- ing the backdoor attacks’ triggers: A frequency perspective

    Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethink- ing the backdoor attacks’ triggers: A frequency perspective. In CVPR, pages 16473–16481, 2021. 1

    2021

  51. [59]

    S4l: Self-supervised semi-supervised learning

    Xiaohua Zhai, Avital Oliver, Alexander Kolesnikov, and Lu- cas Beyer. S4l: Self-supervised semi-supervised learning. In CVPR, pages 1476–1485, 2019. 8

    2019

  52. [60]

    Flexmatch: Boosting semi-supervised learning with curricu- lum pseudo labeling

    Bowen Zhang, Yidong Wang, Wenxin Hou, Hao Wu, Jin- dong Wang, Manabu Okumura, and Takahiro Shinozaki. Flexmatch: Boosting semi-supervised learning with curricu- lum pseudo labeling. Advances in Neural Information Pro- cessing Systems, 34:18408–18419, 2021. 15

    2021

  53. [61]

    mixup: Beyond empirical risk minimiza- tion

    Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimiza- tion. ICLR, 2018. 4

    2018

  54. [62]

    Backdoor defense via deconfounded representation learning

    Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingy- ong Hu. Backdoor defense via deconfounded representation learning. In CVPR, pages 12228–12238, 2023. 2 A. Algorithm Description Algorithm 1 Training procedure of the proposed method Input: labeled batch Bl, unlabeled batch ...

    2023

  55. [2023]

    2, 3, 4, 6, 7, 8, 13, 14

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.