Pith. sign in

REVIEW 3 major objections 6 minor 47 references

FFCBA: Feature-based Full-target Clean-label Backdoor Attacks

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Clean-label full-target backdoor attacks are feasible at a 0.4% poisoning rate using class-conditional autoencoder triggers that push any input into the target class feature cluster, with over 99% attack success and minimal accuracy loss.

desk verdict Clever clean-label full-target backdoor attack, but an undefined ASR protocol leaves the core claim unsupported. read the letter →

arxiv 2504.21054 v2 pith:Z4QKQF2S submitted 2025-04-29 cs.CR cs.AI

Yangxu Yin , Honglong Chen , Yudong Gao , Peng Sun , Liantao Wu , Zhe Li , Weifeng Liu This is my paper · ORCID
classification cs.CRcs.AI
keywords backdoorattackclean-labelmulti-targetfull-targetclass-conditionalautoencoderdatapoisoninglowratesuccess
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that clean-label full-target backdoor attacks are possible at a low poisoning rate, a combination prior multi-target attacks could not achieve because they relied on mislabeled poisoned samples and large poisoning budgets. It proposes FFCBA, made of two paradigms: FSBA trains a class-conditional autoencoder on in-class samples to generate noise triggers, while FMBA uses a two-stage procedure with out-of-class then in-class samples to gain cross-model transfer. In experiments, both variants reach above 99 percent attack success for every class at a 0.4 percent poisoning rate on CIFAR10, Animals90, and ImageNet100, across ResNet, VGG, DenseNet, and Vision Transformer victim models, while benign accuracy drops by only a few points. If these results hold, label inspection and the high-poisoning-rate assumption that used to expose multi-target backdoors no longer suffice.

What carries the argument

The load-bearing machinery is a class-conditional autoencoder, a small convolutional autoencoder conditioned on one-hot class vectors, whose output is a noise trigger added to the input image. Its training combines three loss terms: an output-layer cross-entropy loss that makes the mixed image classify as the target class in a proxy model, a latent-space L1 loss that pulls the mixed image's penultimate-layer representation toward the target class centroid, and a visual loss that caps PSNR and the infinity norm of the trigger. In FMBA, the same autoencoder is trained in two stages, first on out-of-class samples and then on in-class samples. This machinery converts the backdoor into a feature-reclustering problem: the trigger must overpower the input's natural features and re-place the input inside the target class feature cluster.

What would settle it

Train FMBA on a dataset with deliberately imbalanced class feature strengths, such as a long-tailed version of CIFAR10 or one with a visually distinctive extra class, then measure per-class attack success at the 0.4% poisoning rate; if the assumption of comparable feature strength is load-bearing, the distinctive class's ASR should fall clearly below the reported 99% and the trigger should fail to pull out-of-distribution inputs into the target class.

Watch

Extended reading notes

Core claim

The central discovery is that per-class noise triggers can be engineered at the feature level so that a victim model trained only on correctly labeled poisoned samples learns to send any triggered input into the trigger's target class. The trigger is produced by a class-conditional autoencoder whose training loss forces the poisoned sample to be classified as the target class, to sit near the target class centroid in the proxy model's penultimate-layer feature space, and to stay visually close to the original image. FSBA achieves this using DWT-perturbed in-class samples; FMBA first migrates out-of-class samples into the target feature cluster and then fine-tunes on in-class samples, which is what gives it cross-model capability. The paper reports that the resulting attacks exceed 99 percent attack success rate on all targets at a 0.4 percent poisoning rate while keeping benign accuracy loss within a few points, and that they survive the tested defenses.

Load-bearing premise

The attack depends on the premise that a model trained on a small set of correctly labeled in-class poisoned samples will generalize so that any input carrying that class's trigger, including inputs from classes never seen with the trigger, is classified as the target class; FMBA additionally assumes that all classes have roughly comparable feature strength when data is uniformly distributed.

Editorial extensions

If this is right

  • Clean-label full-target attacks are feasible at a 0.4% poisoning rate, with every class mapped to its own trigger paradigm.
  • An attacker who controls only the training dataset can backdoor an unknown victim model, because FMBA transfers across ResNet, VGG, DenseNet, and Vision Transformer architectures without knowing the victim's type.
  • Standard defenses tested in the paper—Fine-Pruning, Neural Cleanse, STRIP, CBD, EBBA, ABL, and IBD-PSC—do not detect or neutralize the backdoor.
  • At inference time, the attacker chooses which target class a triggered input lands in by choosing which class-conditional trigger paradigm generated it.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same autoencoder objective could be re-purposed for detection: a defender could monitor whether perturbed inputs are being pulled toward a single class centroid, which would flag triggers trained this way.
  • Because the mechanism is stated at the feature level rather than the pixel level, the recipe should transfer to other modalities—audio, graphs, or tabular data—wherever a proxy feature space and a class-conditional generator are available.
  • A direct test of the framework's boundary is to train FMBA on a dataset with deliberately imbalanced class feature strengths; if the assumption of comparable feature strength is the limiting factor, per-class attack success should drop for the visually distinctive classes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes FFCBA, a clean-label full-target backdoor attack framework with two variants, FSBA and FMBA. FSBA trains class-conditional autoencoders on target-class samples to generate noise triggers that make perturbed in-class samples map to their original class in the proxy model. FMBA uses a two-stage procedure that first migrates out-of-class samples into the target class feature cluster and then fine-tunes on in-class samples, aiming for better cross-model transferability. The authors claim that at a 0.4% poisoning rate, both variants achieve above 99% attack success rate across CIFAR10, Animals90, and ImageNet100, with multiple victim architectures, while preserving benign accuracy and evading several backdoor defenses. The paper also provides ablation studies, visual quality metrics, and a theoretical motivation based on neural tangent kernel (NTK) feature-strength arguments.

Significance. If the empirical claims hold, FFCBA would be a meaningful advance over existing multi-target backdoor attacks, which are mostly dirty-label and require high poisoning rates. The paper has several strengths: it provides source code, evaluates against multiple dirty-label multi-target baselines and a broad set of defenses, includes both same-architecture and cross-architecture attacks, and contains ablations of the loss components. The two-paradigm design (FSBA for known victim models, FMBA for unknown victim models) is a sensible decomposition of the attack scenarios. However, the central claim of a full-target attack is currently under-supported because the ASR metric is not defined and the evaluation protocol for out-of-class inputs is unclear. The NTK-based theoretical justification also contains unsupported approximations. These issues are load-bearing for the paper's headline contribution.

major comments (3)
  1. [Section 5.2, Eq. (1)-(2)] The manuscript never defines attack success rate (ASR), and the reported 'average ASR across all labels' in Tables 2-6 does not specify the source distribution of the test inputs. Equation (1) claims that f'(B_t(x)) = y_t for any x in X, including inputs from classes other than y_t, but Equation (2) trains the victim only on poisoned samples x_j^t drawn from class y_t with the original label y_t. Out-of-class success is therefore an emergent property that must be demonstrated by the evaluation. If the ASR for target t is computed only on test images from class t, the reported numbers would only show that the model recognizes its own class under the trigger, which would not establish a full-target backdoor. Please define ASR explicitly and report a per-source-class ASR matrix (or otherwise clarify the test protocol) for at least the main results; without this, the comparison against dirty-label baselines in Table 2 is not interpretable.
  2. [Section 4.3, Appendix A.2, Assumption 1] The proof of Assumption 1 relies on several unproved and partially circular steps. From Eq. (16), the text asserts that 'the similarity of x_a to each sample in a single category is approximately equal' and that 'the pixel value distribution of samples in the same dataset does not have significant differences,' together with n_a ≈ n_b, to conclude e^{4γ x_a·x_{a,i}} ≈ λ e^{4γ x_a·x_{b,i}}; this step essentially assumes the within-class sum equality that is the claim being proven. The datasets used in the evaluation (CIFAR10, Animals90, ImageNet100) are not among the 'some datasets' mentioned in the proof, and no direct verification of the feature-strength equality on those datasets is provided. Since Assumption 1 is the theoretical motivation for FMBA's out-of-class training stage, it should be replaced by an empirically verified motivation or proven under explicit, controlled approximations.
  3. [Section 5.1-5.2, Tables 2-6] No error bars, confidence intervals, or replication seeds are reported; Tables 2-6 give ASR and benign accuracy values to two decimal places, apparently from single runs. The abstract and Section 1 describe the attack as achieving 'stable' results above 99% ASR, which is a statistical claim. Please report results over at least three independent seeds with mean and standard deviation for the headline tables, or explicitly state that the numbers are from a single run and adjust the stability claim accordingly.
minor comments (6)
  1. [Eq. (7)] The visual loss in Eq. (7) becomes negative when PSNR(x_p, x_m) exceeds PSNR_thresh, which would encourage lower visual quality; consider clamping or using max(0, ·).
  2. [Section 5.2, Table 4] Table 4 reports FSBA ASR of 94.38% on CIFAR10 with DenseNet as the victim, which is far below the 'above 99%' stability claim; the text should reconcile the cross-model and same-model claims more carefully.
  3. [Figure 4] The legend in Figure 4 lists six entries but the line styles and markers are not sufficiently distinct to identify each dataset and paradigm; please use distinct markers or separate panels.
  4. [Section 5.2] Per-class ASR is only shown for CIFAR10 in Table 3; for Animals90 and ImageNet100, which have many more classes, the full-target claim would be better supported by reporting the minimum and standard deviation of per-class ASR or an appendix table.
  5. [Section 4.2] There is a typo in the sentence 'Previous studies often assess the visual quality of of poisoned data' — 'of of' should be 'of'.
  6. [Section 4.3] The notation for the kernel K(x, x_{k,i}) in Eq. (9) and Appendix A.2 is used interchangeably with a Gaussian kernel whose bandwidth γ is not specified; please state the kernel hyperparameter and any normalization applied to images.

Circularity Check

1 steps flagged · score 4.0 of 10

FMBA's NTK argument for equal feature strengths is self-referential, but the central attack results are independently evaluated.

  1. self definitional [Section 4.3, Assumption 1; Appendix A.2, Eqs. (16)-(17)]
    "In some datasets, such as MNIST and GTSRB, the similarity of x_a to each sample in a single category is approximately equal, and the pixel value distribution of samples in the same dataset does not have significant differences. Moreover, n_a ≈ n_b. Therefore, we can derive that e^{4γ x_a·x_{a,i}} ≈ λ e^{4γ x_a·x_{b,i}}. ... This suggests that the feature intensity of samples from any two categories is roughly equal; otherwise, f would classify x_add with high confidence into the category with stronger features."

    The proof of Assumption 1 does not derive equal feature strengths from independent first principles. It assumes equal class sizes, statistically identical pixel-value distributions across classes, and uniform within-class kernel similarities, and those conditions already force the class-wise NTK sums in Eq. (17) to cancel. The conclusion 'feature intensity ... roughly equal' is therefore the premise restated in feature-strength language, not a derived result. This self-referential justification is load-bearing for FMBA's design choice: it is the stated reason that out-of-class samples can be substituted for in-class samples in Step 1 of FMBA's autoencoder training.

full rationale

The core experimental loop is not circular: the class-conditional autoencoder is trained on a proxy model with output, latent, and visual losses; the victim model is then trained on a separate poisoned dataset governed by Eq. (2); and the reported ASR values are measured on held-out triggered inputs. Nothing in the trigger-generation objective directly supervises the victim model's test-time behavior, so the headline numbers are independent empirical evidence. The main circularity is confined to the theoretical justification of FMBA's two-stage design. Assumption 1's 'proof' in Section 4.3 and Appendix A.2 assumes, rather than establishes, that class feature strengths are roughly equal: the NTK algebra cancels only after asserting equal class sizes, similar pixel distributions, and uniform per-sample similarities, which are the very conditions that make the class-wise kernel sums equal. This is a self-referential step, but it does not by construction generate the reported ASR values. A separate concern, not counted as circularity here, is that the paper reports 'average ASR across all labels' without specifying the source-class composition of the test images used for each target, so the full-target claim in Eq. (1) may not be fully evidenced; that is an evaluation-protocol gap, not a derivation that reduces to its inputs. Overall, the central attack claims retain independent experimental content, but the FMBA theoretical argument warrants a moderate circularity score.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests mainly on empirical results plus several modeling choices: hand-set hyperparameters (α, β, γ, k, PSNRthresh, ε, 0.4% poisoning rate), the NTK-based feature-strength uniformity assumption for FMBA, and the unmeasured assumption that trigger features dominate natural features. No invented entities are used.

free parameters (5)
  • Loss weights α, β, γ = 0.5, 0.3, 0.5
    Weights of output-layer, latent-space, and visual losses in Eq. (8), fixed across experiments; the ablation (Table 7) shows ASR is sensitive to α and β.
  • DWT perturbation scale k = 1.5
    Scaling factor for mid-high-frequency perturbation in Eq. (4); chosen by hand.
  • PSNR threshold (PSNRthresh) = 35 dB
    Upper limit for PSNR in visual loss Eq. (7); set manually.
  • l-infinity trigger bound ε = 80
    Maximum trigger magnitude in Eq. (7); chosen by hand.
  • Poisoning rate = 0.4%
    Fraction of training data poisoned in all main experiments; selected based on the ASR-vs-poisoning-rate curve (Figure 4) rather than on an independent validation set.
assumptions (4)
  • ad hoc to paper Assumption 1: for uniformly distributed datasets, feature strengths of different classes are similar, so a trigger trained to migrate out-of-class samples into a target class's feature cluster will also work on in-class samples.
    Invoked in Section 4.3 to justify FMBA's two-stage training; proof in Appendix A.2 requires additional unproved uniformity of kernel similarities and equal class sizes.
  • domain assumption NTK regression formula (Eq. 9) with Gaussian kernel K(x,x_i)=exp(-2γ||x-x_i||^2) describes the model's output.
    Borrowed from EBBA [9]; this is a kernel-regression approximation, not the actual NTK of a deep network, and is used without error bounds.
  • domain assumption Trigger feature strength exceeds perturbation strength, which exceeds natural-feature strength (Section 4.2, Step 2).
    This energetic ordering is asserted as the basis for trigger effectiveness and is not directly measured.
  • standard math The victim model is trained from scratch with cross-entropy on the poisoned dataset (Eq. 2).
    Assumed threat-model training protocol; standard in backdoor attack evaluations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FFCBA: Feature-based Full-target Clean-label Backdoor Attacks." pith.science (2026). https://pith.science/paper/Z4QKQF2S

@misc{pith2026250421054,
  author       = {Pith},
  title        = {Pith review of: FFCBA: Feature-based Full-target Clean-label Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z4QKQF2S}},
  note         = {Machine review of arXiv:2504.21054}
}
read the original abstract

Backdoor attacks pose a significant threat to deep neural networks, as backdoored models would misclassify poisoned samples with specific triggers into target classes while maintaining normal performance on clean samples. Among these, multi-target backdoor attacks can simultaneously target multiple classes. However, existing multi-target backdoor attacks all follow the dirty-label paradigm, where poisoned samples are mislabeled, and most of them require an extremely high poisoning rate. This makes them easily detectable by manual inspection. In contrast, clean-label attacks are more stealthy, as they avoid modifying the labels of poisoned samples. However, they generally struggle to achieve stable and satisfactory attack performance and often fail to scale effectively to multi-target attacks. To address this issue, we propose the Feature-based Full-target Clean-label Backdoor Attacks (FFCBA) which consists of two paradigms: Feature-Spanning Backdoor Attacks (FSBA) and Feature-Migrating Backdoor Attacks (FMBA). FSBA leverages class-conditional autoencoders to generate noise triggers that align perturbed in-class samples with the original category's features, ensuring the effectiveness, intra-class consistency, inter-class specificity and natural-feature correlation of triggers. While FSBA supports swift and efficient attacks, its cross-model attack capability is relatively weak. FMBA employs a two-stage class-conditional autoencoder training process that alternates between using out-of-class samples and in-class samples. This allows FMBA to generate triggers with strong target-class features, making it highly effective for cross-model attacks. We conduct experiments on multiple datasets and models, the results show that FFCBA achieves outstanding attack performance and maintains desirable robustness against the state-of-the-art backdoor defenses.

Figures

Figures reproduced from arXiv: 2504.21054 by the authors.

Figure 1
Figure 1. Schematic of low-poisoning-rate clean-label multi [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The attack process of FFCBA, where A-1 and A-2 represent the class-conditional autoencoder training processes of [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The feature distribution changes of target class during the training process of class-conditional autoencoders. (a) [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: ASR of FFCBA across different poisoning rates with [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: FFCBA’s performance against various defenses. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The visual effects of FFCBA and the baseline. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: FSBA against STRIP. 1.0 1.5 2.0 2.5 3.0 Entropy 0.00 0.02 0.04 0.06 0.08 Probability Clean Backdoor (a) CIFAR10 31 32 33 34 35 36 37 38 39 40 Entropy 0.00 0.02 0.04 0.06 0.08 Probability Clean Backdoor (b) Animals 31 32 33 34 35 36 37 38 39 40 41 Entropy 0.00 0.02 0.04…
Figure 8
Figure 8. Figure 8: FMBA against STRIP. 0 2 4 6 8 Labels 0 250 500 750 1000 1250 1500 1750 Sum of energy scores Energy scores of all labels (a) CIFAR10 0 10 20 30 40 50 60 70 80 Labels 0 2 4 6 8 10 12 14 Sum of energy scores Energy scores of all labels (b) Animals 0 10 20 30 40 50 60 70 8…
Figure 9
Figure 9. Figure 9: FSBA against EBBA [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: FMBA against EBBA [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 39 canonical work pages

  1. [1]

    Jiawang Bai, Baoyuan Wu, Yong Zhang, Yiming Li, Zhifeng Li, and Shu-Tao Xia

    work page

  2. [2]

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. 2018. Detecting back- door attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728 (2018)

    arXiv 2018

  3. [3]

    Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. 2019. DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks. In Proceedings of the International Joint Conference on Artificial Intelligence. doi:10. 24963/ijcai.2019/647

    work page 2019

  4. [4]

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    arXiv 2017

  5. [5]

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. 2021. Lira: Learnable, imper- ceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    work page 2021

  6. [6]

    Khoa D Doan, Yingjie Lao, and Ping Li. 2022. Marksman backdoor: Backdoor attacks with arbitrary target class. Advances in Neural Information Processing Systems (2022)

    work page 2022

  7. [7]

    Yu Feng, Benteng Ma, Jing Zhang, Shanshan Zhao, Yong Xia, and Dacheng Tao. 2022. FIBA: Frequency-Injection Based Backdoor Attack in Medical Image Analysis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    work page 2022

  8. [8]

    Yudong Gao, Honglong Chen, Peng Sun, Junjian Li, Anqing Zhang, Zhibo Wang, and Weifeng Liu. 2024. A Dual Stealthy Backdoor: From Both Spatial and Fre- quency Perspectives. In Proceedings of the AAAI Conference on Artificial Intelli- gence

    work page 2024

Show all 47 references
  1. [9]

    Yudong Gao, Honglong Chen, Peng Sun, Zhe Li, Junjian Li, and Huajie Shao

  2. [10]

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. 2019. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the Annual Computer Security Applications Conference

    2019

  3. [11]

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access (2019)

    2019

  4. [12]

    Jiyang Guan, Jian Liang, and Ran He. 2024. Backdoor Defense via Test-Time Detecting and Repairing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    2024

  5. [13]

    Junfeng Guo, Ang Li, and Cong Liu. 2022. AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysis. In Proceedings of the International Conference on Learning Representations

    2022

  6. [14]

    Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. 2023. SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency. In Proceedings of the International Conference on Learning Representations

    2023

  7. [15]

    Linshan Hou, Ruili Feng, Zhongyun Hua, Wei Luo, Leo Yu Zhang, and Yiming Li

  8. [16]

    Tran Huynh, Dang Nguyen, Tung Pham, and Anh Tran. 2024. Combat: Alternated training for effective clean-label backdoor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence

    2024

  9. [17]

    Arthur Jacot, Franck Gabriel, and Clément Hongler. 2018. Neural tangent ker- nel: Convergence and generalization in neural networks. Advances in Neural Information Processing Systems (2018)

    2018

  10. [18]

    arXiv preprint arXiv:2405.09786 (2024)

    IBD-PSC: Input-level backdoor detection via parameter-oriented scaling consistency. arXiv preprint arXiv:2405.09786 (2024)

    2024 arXiv

  11. [19]

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems (2021)

    2021

  12. [20]

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-pruning: De- fending against backdooring attacks on deep neural networks. In Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses

    2018

  13. [21]

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. 2021. Invisible backdoor attack with sample-specific triggers. In Proceedings of the MM ’25, October 27–31, 2025, Dublin, Ireland Yangxu Yin et al. IEEE/CVF International Conference on Computer Vision

    2021

  14. [22]

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. In Proceedings of the European Conference on Computer Vision

    2020

  15. [23]

    Yuntao Liu, Ankit Mondal, Abhishek Chakraborty, Michael Zuzak, Nina Jacob- sen, Daniel Xing, and Ankur Srivastava. 2020. A survey on neural trojans. In Proceedings of the International Symposium on Quality Electronic Design

    2020

  16. [24]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning attack on neural networks. In Proceedings of the Annual Network And Distributed System Security Symposium

    2018

  17. [25]

    Rui Ning, Jiang Li, Chunsheng Xin, and Hongyi Wu. 2021. Invisible poison: A blackbox clean label backdoor attack to deep neural networks. In Proceedings of the IEEE Conference on Computer Communications

    2021

  18. [26]

    Xiangyu Qi, Tinghao Xie, Ruizhe Pan, Jifeng Zhu, Yong Yang, and Kai Bu. 2022. Towards practical deployment-stage backdoor attack on deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog- nition

    2022

  19. [27]

    Tuan Anh Nguyen and Anh Tuan Tran. 2021. WaNet - Imperceptible Warping- based Backdoor Attack. In Proceedings of the International Conference on Learning Representations

    2021

  20. [28]

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedan- tam, Devi Parikh, and Dhruv Batra. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2017

  21. [29]

    Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison frogs! targeted clean-label poisoning attacks on neural networks. Advances in Neural Information Processing Systems (2018)

    2018

  22. [30]

    Benjamin Schneider, Nils Lukas, and Florian Kerschbaum. 2024. Universal Back- door Attacks. In Proceedings of the International Conference on Learning Represen- tations

    2024

  23. [31]

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2019. Label- consistent backdoor attacks. arXiv preprint arXiv:1912.02771 (2019)

    2019 arXiv

  24. [32]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proceedings of the IEEE Symposium on Security and Privacy

    2019

  25. [33]

    Zihan Shen, Wei Hou, and Yun Li. 2023. CSSBA: A Clean Label Sample-Specific Backdoor Attack. In Proceedings of the IEEE International Conference on Image Processing

    2023

  26. [34]

    Tong Wang, Yuan Yao, Feng Xu, Shengwei An, Hanghang Tong, and Ting Wang

  27. [35]

    Mingfu Xue, Can He, Jian Wang, and Weiqiang Liu. 2020. One-to-N & N-to-One: Two advanced backdoor attacks against deep learning models. IEEE Transactions on Dependable and Secure Computing (2020)

    2020

  28. [36]

    Hao Wang, Shangwei Guo, Jialing He, Kangjie Chen, Shudong Zhang, Tianwei Zhang, and Tao Xiang. 2024. Eviledit: Backdooring text-to-image diffusion models in one second. In Proceedings of the ACM International Conference on Multimedia

    2024

  29. [37]

    Wen Yin, Bin Benjamin Zhu, Yulai Xie, Pan Zhou, and Dan Feng. 2024. Back- door Attacks on Bimodal Salient Object Detection with RGB-Thermal Data. In Proceedings of the ACM International Conference on Multimedia

    2024

  30. [38]

    Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia

  31. [39]

    Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. 2021. Rethinking the back- door attacks’ triggers: A frequency perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision

    2021

  32. [40]

    Mingfu Xue, Shifeng Ni, Yinghao Wu, Yushu Zhang, and Weiqiang Liu. 2024. Imperceptible and multi-channel backdoor attack. Applied Intelligence (2024)

    2024

  33. [41]

    Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. 2023. Backdoor defense via deconfounded representation learning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . A Appendix A.1 Visual Effects of FFCBA and the Baseline The pertur...

    2023

  34. [45]

    Xinwei Zhang, Aishan Liu, Tianyuan Zhang, Siyuan Liang, and Xianglong Liu

  35. [46]

    In Proceedings of the ACM International Conference on Multimedia

    Towards robust physical-world backdoor attacks on lane detection. In Proceedings of the ACM International Conference on Multimedia

  36. [2021]

    In Proceedings of the International Conference on Learning Representations

    Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits. In Proceedings of the International Conference on Learning Representations

  37. [2022]

    In Proceedings of the European Conference on Computer Vision

    An invisible black-box backdoor attack through frequency domain. In Proceedings of the European Conference on Computer Vision

  38. [2023]

    In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security

    Narcissus: A practical clean-label backdoor attack with limited information. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security

  39. [2024]

    In Proceedings of the International Conference on Machine Learning

    Energy-based Backdoor Defense without Task-Specific Samples and Model Retraining. In Proceedings of the International Conference on Machine Learning

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.