Pith. sign in

REVIEW 5 major objections 7 minor 32 references

When Forgetting Triggers Backdoors: A Clean Unlearning Attack

T0 review · 5 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a backdoor hidden in a model during training can be switched on by a user's request to unlearn clean, unpoisoned data.

desk verdict A real empirical attack with a useful new twist, but the evidence stops short of proving the claimed mechanism; worth review with fixes. read the letter →

arxiv 2506.12522 v1 pith:KX26S6CX submitted 2025-06-14 cs.CR

Marco Arazzi , Antonino Nocera , Vinod P This is my paper · ORCID
classification cs.CR
keywords machineunlearningbackdoorattackclean-labelpoisoningcleanfrequency-domaintriggergradientrealignmentsuccessraterighttobeforgotten
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a backdoor can be planted during training and then switched on by the victim's own deletion request, even when the deleted data are completely clean and unpoisoned. The attack, called UNCLEAN, hides a weak trigger across several classes during training so that the model behaves almost normally, and then lets the unlearning of clean forget-set samples amplify the trigger's pull toward a chosen target class. If the claim holds, legitimate 'right to be forgotten' requests become a viable attack vector, and machine unlearning services cannot assume that a clean forget set rules out backdoor activation. On four image datasets and five unlearning strategies, the paper reports post-unlearning attack success rates above 90 percent in several configurations and an improvement of more than 32 percent over the closest prior approach.

What carries the argument

The mechanism that carries the attack is a conflicting learning signal resolved by unlearning. A DCT-domain trigger, constrained to a low-magnitude middle frequency band and tuned by a shadow model, is embedded in both target-class samples and carefully chosen forget-set samples, so the trained model holds the trigger in a weak, multi-class association. Unlearning the clean forget set then removes the branch of that association that points at the forgotten labels, leaving the trigger aligned with the target class—what the paper calls gradient realignment and selective forgetting. A second supporting component is the selection strategy: the forget-set samples chosen for poisoning are those whose embeddings are least similar to the target class's average embedding, which spreads the signal widely and keeps the pre-unlearning attack rate low.

What would settle it

Run UNCLEAN on CIFAR-10 with Fisher Forgetting, then separate the triggered test images into those from the forget-set classes and those from the target class. If triggered forget-set images are not predominantly classified as the target class after unlearning, or if a linear probe shows the trigger features were erased together with the forgotten information, the proposed gradient-realignment mechanism is not what the experiment shows. A second decisive check is to retrain the model from scratch on only the retain set: if the backdoor disappears under full retraining, the attack depends on the specific imperfect unlearning procedure rather than on unlearning as such.

Watch

Extended reading notes

Core claim

UNCLEAN's central discovery is that a backdoor does not have to work at training time; it only has to survive until unlearning. The adversary poisons a small fraction of training data—some images from the target class and some from classes that will later be forgotten—with a nearly invisible frequency-domain trigger while keeping original labels, so the model learns a weak, conflicting association between the trigger and multiple classes. Because the signal is distributed, pre-unlearning attack success stays low and standard defenses see nothing unusual. When the attacker then requests deletion of clean versions of the forgotten samples, the unlearning procedure shifts the decision boundary; the paper argues this erases the trigger's association with the forgotten labels while preserving its association with the target label, so triggered inputs now fall into the target class. The reported result is a sharp rise in attack success after unlearning across all tested strategies, with Fisher Forgetting and Boundary Unlearning giving the highest rates.

Load-bearing premise

The attack's activating step is an empirical claim about how real unlearning methods behave: they must erase the trigger's link to the forgotten labels while leaving its link to the target label intact; if an unlearning method removes both links or scrubs the trigger features themselves, the post-unlearning attack rate will not rise.

Editorial extensions

If this is right

  • A machine unlearning service must treat deletion requests themselves as a possible activation step, because the requested data can be clean while the trained model is already compromised.
  • Backdoor defenses that assume one trigger is strongly tied to one target class will miss this attack, since the trigger is deliberately distributed across classes.
  • The attack transfers across architectures; triggers generated with one model remain effective on others, so an attacker does not need to know the victim's architecture.
  • Among the tested defenses, only I-BAU, which removes sensitivity to any overly relied-upon perturbation, substantially reduces the attack, pointing defenses away from class-specific trigger detection.
  • Post-unlearning attack success stays high even as the forget-set poisoning rate varies from 5 to 50 percent, so the attack does not require precise control over the poisoning budget.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural untested consequence is that stronger, retraining-based unlearning—where the forget set is truly scrubbed from the model—would break the attack, since the trigger's conflicting associations would be removed along with the forget labels; this could be checked by running UNCLEAN against certified or retrained unlearning.
  • The same conflicting-signal mechanism could generalize beyond deletion to other gradient-based model edits, such as targeted concept erasure or knowledge editing, turning any weight modification into a potential backdoor activator.
  • Because the attack relies on a shadow model trained on the attacker's copy of the data, a testable extension is whether distribution shift between the shadow data and the real training data degrades the trigger's transferability; the paper's cross-architecture results suggest some tolerance, but cross-domain shift is untested.
  • One practical red-team test would be to measure the decision-boundary shift induced by a deletion request: if accuracy on the forget set drops while triggered inputs increasingly move to one class, the deletion is behaving like an attack amplifier rather than a neutral erase.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper proposes UNCLEAN, a clean-label backdoor attack that exploits machine unlearning. During training, the attacker injects a DCT-domain frequency trigger into a small subset of target-class images and a selected subset of forget-set images, while keeping all labels unchanged. After training, the attacker requests unlearning of clean, untriggered forget-set samples. The paper claims that unlearning selectively removes the trigger-to-forget-label association while preserving the trigger-to-target association, causing the attack success rate (ASR) to rise from roughly 27% before unlearning to values above 80–90% after unlearning. This behavior is reported across five unlearning strategies, four datasets, several model architectures, and three backdoor defenses, with an ablation study and a comparison to a prior attack by Liu et al.

Significance. If the central claim is correct, the paper identifies a genuinely subtle vulnerability: an attack that is nearly inactive during training can be activated by a fully clean unlearning request, which would be difficult for defenses that focus on backdoor detection at training time. The paper is also commendable for evaluating a wide range of unlearning strategies and architectures, and for including an ablation that separates trigger optimization from sample selection. However, the significance is currently conditional: the proposed mechanism of selective gradient realignment is asserted rather than directly evidenced, and the quantitative claims lack variance information and a fully controlled comparison. With additional diagnostics and reproducibility details, this could be a solid security contribution.

major comments (5)
  1. [Section III-B3, Eq. (10)] The paper's load-bearing step is the assumption that unlearning the clean forget set selectively 'eliminate[s] the association between the target t and the forget label FL, while preserving the backdoor association with the target label Lt.' This is never directly demonstrated. The five unlearning strategies operate only on clean, untriggered FD samples; none of them is shown to remove the t->FL mapping that was learned from the triggered FD images. I request a diagnostic that reports, after unlearning, the classification of triggered forget-set images separately from triggered target-class images (e.g., a per-label confusion matrix or per-label ASR), as well as a control condition in which the same poisoned model is unlearned on an unrelated clean set or not unlearned at all. Without this, the post-unlearning ASR increases in Table I could be caused by generic decision-boundary perturbation rather than by the proposed selective-erasure mechanism.
  2. [Section IV-D, Tables I–V] The text states that 'All reported results are averaged over multiple runs to ensure statistical robustness,' but no run count, standard deviation, confidence interval, or per-run values are reported anywhere. The paper's headline results, such as ASR after unlearning above 90% and a '>32% improvement' over prior work, are differences that could fall within run-to-run variability. Please add at least standard deviations or confidence intervals and state the number of independent runs for each table and figure.
  3. [Table V, Section IV-J] The ablation results are not fully consistent with the stealth narrative. In the Random Trigger/Random Selection (RTS) and Random Selection (RS) rows, ASR before unlearning is already 100% on MNIST and FashionMNIST and 86–96% on CIFAR-10 and STL-10, meaning the backdoor is fully active during training and the 'unlearning activation' property is absent. The paper concludes that data selection has the 'most substantial impact,' but the impact is on pre-unlearning stealth, not on post-unlearning activation. Please report pre-unlearning ASR together with a detectability metric (e.g., Neural Cleanse anomaly scores) and qualify the conclusions in Section IV-J accordingly.
  4. [Table IV, Section IV-I] The comparison with Liu et al. [6] is not sufficiently controlled. The two methods differ in trigger generation, data selection, and poisoning protocol; the paper says it uses an 'identical setting' but does not specify the exact unlearning strategy, hyperparameters, or number of runs for the [6] baseline, and no official code for [6] is available. The abstract and conclusion rely on the '>32% improvement' figure, so the comparison needs a precise protocol description and run-level results with variance. It also needs clarification of whether the baseline is the 'clean' or 'poisoned unlearning' variant of [6], since the introduction describes [6] as a clean-unlearning attack while Table IV labels the baseline 'Attack with Poisoning [6]'.
  5. [Section III-A1 vs. Section III-B] The threat model is stated inconsistently. Section III-A1 says the attacker 'has access to the clean training dataset CD,' while Section III-B says the attacker 'has access only to partial data TD from the target class and a subset of data from the remaining classes.' These are different capability levels, and the feasibility of the attack depends on which one is assumed. Please state the threat model precisely and explain whether the reported experiments implement the partial-access scenario or the full-access scenario.
minor comments (7)
  1. [Abstract and Section IV-G] The abstract claims the attack is 'hard to detect or mitigate,' but Section IV-G reports that I-BAU reduces ASR to 56.9–71.0% across datasets, which is a substantial mitigation. Please soften the claim or quantify the residual attack effectiveness more precisely.
  2. [Table IV] The header contains a typo: 'UCLEAN' should be 'UNCLEAN.'
  3. [Figure 3] The caption says 'on CIFAR10 dataset using the Boundary Unlearning strategy,' but panel (b) is labeled FashionMNIST. Please correct the caption.
  4. [Section IV-B] In the Boundary Unlearning description, the text reads 'performance on the remaining data.performance on the remaining data.' This appears to be a formatting error and should be fixed.
  5. [Section IV-D] The experimental setup does not report the frequency band parameters (fmin, fmax) used in Eq. (2), nor the final learned values of alpha, even though these are key to the trigger's stealth. Please include these values or state how they were chosen.
  6. [Section IV-H] The sentence 'which we plan to test empirically' appears inside a section that already reports empirical transfer results; this phrasing suggests an incomplete revision and should be reworded to describe the experiments actually performed.
  7. [References] Reference [5] is listed as 'S. Nicolazzo, A. Nocera et al.' without a complete author list; please provide the full citation if available.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack's central claim is an empirically measured outcome, and its fitted components are not used to define the reported success rates.

full rationale

The paper's central claim is that UNCLEAN, which injects a weak distributed trigger during training and then unlearns clean forget-set samples, raises the attack success rate after unlearning. This is an empirical claim supported by measured ASR values in Tables I, III, IV, and V, not by a derivation from fitted constants. The trigger strength alpha and regularization coefficients are tuned, but the reported ASR is measured after running the attack, and the conclusion's 32% improvement is a comparison against a reimplementation of Liu et al. [6], not a quantity defined as a function of the fit. The load-bearing assumption in Section III-B3, that unlearning removes the trigger-to-forget-label association while preserving the trigger-to-target association, is an empirical hypothesis about gradient realignment; it is not established by definition or by a self-citation. The paper's own ablation (Table V) varies trigger generation and poison selection, showing that the full method is not simply a tautology. Self-citations [12,13] appear only as related backdoor work and are not load-bearing for the central claim. The absence of released code and the unverified selective-erasure mechanism are correctness and reproducibility concerns, not circularity. The derivation chain is therefore self-contained with respect to the measured attack outcomes, and no circular step is exhibited.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The attack is empirical; its central claim does not rest on a derivation from first principles. The main burden is the set of domain assumptions about attacker capabilities, shadow-model transferability, and the selective-forgetting behavior of unlearning methods. There are no invented physical or mathematical entities in the sense of new particles, forces, or conserved quantities.

free parameters (5)
  • alpha (trigger strength) = unspecified, learned per attack via sigmoid of trainable theta
    Eq. 3 blends the trigger into the image using alpha; it is optimized by backpropagation on the shadow model, so attack outcomes depend on the chosen value.
  • lambda_t (trigger norm regularization) = 0.05
    Section IV-D fixes lambda_t at 0.05 across all datasets; it is a hand-chosen constant that affects trigger visibility and attack strength.
  • lambda_alpha (blending regularization) = 0.01, 0.001, or 0.0001 depending on dataset
    Section IV-D reports lambda_alpha varies over these values, but no selection rule is given, making the choice a free parameter.
  • frequency band (fmin, fmax) = not specified
    Eq. 2 restricts the trigger to a mid-frequency band, but the actual numeric bounds are never reported, which is necessary for replication.
  • poisoning rate / selection percentage = 5 percent baseline; varied from 0.05 to 0.5
    The fraction of forget-set samples selected for poisoning is a free parameter; Section IV-F shows ASR before unlearning depends on it.
assumptions (5)
  • domain assumption The attacker has access to the clean training dataset CD and can poison about 5 percent of training data before the victim model is trained.
    Section III-A1 defines this threat model. If the attacker cannot control training data or inject this poison fraction, the attack does not apply.
  • domain assumption The shadow model SM trained on attacker data provides transferable embeddings for trigger optimization and for selecting forget-set samples.
    Sections III-B1 and III-B2 use SM to generate the trigger and compute cosine similarity. Section IV-H tests transfer across architectures but does not prove it generally.
  • domain assumption Unlearning strategies selectively remove the trigger-to-forget-label association while preserving the trigger-to-target association.
    Section III-B3 assumes gradient realignment and selective forgetting. If a real unlearning method removes both associations or removes the trigger features entirely, the post-unlearning ASR will not rise.
  • domain assumption DCT frequency-band modifications are imperceptible to humans and survive the image preprocessing pipeline.
    Section III-B1 relies on prior frequency-domain trigger work [20,21]. Visual and statistical stealth is central to the attack; no new formal proof is given.
  • domain assumption Clean-label poisoned data does not degrade clean accuracy enough to trigger anomaly detection.
    The attack requires the model to retain utility. Table II shows comparable unlearning metrics for selected strategies and datasets, but this is an empirical check, not a general guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Forgetting Triggers Backdoors: A Clean Unlearning Attack." pith.science (2026). https://pith.science/paper/KX26S6CX

@misc{pith2026250612522,
  author       = {Pith},
  title        = {Pith review of: When Forgetting Triggers Backdoors: A Clean Unlearning Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KX26S6CX}},
  note         = {Machine review of arXiv:2506.12522}
}
read the original abstract

Machine unlearning has emerged as a key component in ensuring ``Right to be Forgotten'', enabling the removal of specific data points from trained models. However, even when the unlearning is performed without poisoning the forget-set (clean unlearning), it can be exploited for stealthy attacks that existing defenses struggle to detect. In this paper, we propose a novel {\em clean} backdoor attack that exploits both the model learning phase and the subsequent unlearning requests. Unlike traditional backdoor methods, during the first phase, our approach injects a weak, distributed malicious signal across multiple classes. The real attack is then activated and amplified by selectively unlearning {\em non-poisoned} samples. This strategy results in a powerful and stealthy novel attack that is hard to detect or mitigate, highlighting critical vulnerabilities in current unlearning mechanisms and highlighting the need for more robust defenses.

Figures

Figures reproduced from arXiv: 2506.12522 by the authors.

Figure 1
Figure 1. Pipeline (the trigger depicted in the figure serves as an [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Examples of triggered images. 2) Selection of data for poisoning: As explained earlier, the attacker wants the backdoor to work only after the un￾learning happens. To do this, the attacker secretly adds the trigger to some images from both the target class and the forget-set (F D). This spreads out the trigger’s features across different classes without changing the actual labels, making it less noticeable during tr… view at source ↗
Figure 3
Figure 3. Evaluation stealthiness of the attack during training [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: Evaluation of the attack changing the poison rate of [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Evaluation of the attack on different model architec [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Comparison between random and generated trigger. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 15 canonical work pages

  1. [6]

    Backdoor attacks via ma- chine unlearning,

    Z. Liu, T. Wang, M. Huai, and C. Miao, “Backdoor attacks via ma- chine unlearning,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 13, 2024, pp. 14 115–14 123

    work page 2024

  2. [1]

    The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’,

    A. Mantelero, “The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’,” Computer Law & Security Review, vol. 29, no. 3, pp. 229–235, 2013

    2013

  3. [2]

    Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher,

    V . S. Chundawat, A. K. Tarun, M. Mandal, and M. Kankanhalli, “Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 6, 2023, pp. 7210–7217

    2023

  4. [3]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks,

    A. Golatkar, A. Achille, and S. Soatto, “Eternal sunshine of the spotless net: Selective forgetting in deep networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 9304–9312

    work page 2020

  5. [4]

    Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary,

    M. Chen, W. Gao, G. Liu, K. Peng, and C. Wang, “Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 7766–7775

    2023

  6. [5]

    How secure is forgetting? link- ing machine unlearning to machine learning attacks,

    S. Nicolazzo, A. Nocera et al. , “How secure is forgetting? link- ing machine unlearning to machine learning attacks,” arXiv preprint arXiv:2503.20257, 2025. 10

    work page arXiv 2025

  7. [7]

    Backdoor attack through machine unlearning,

    P. Zhang, J. Sun, M. Tan, and X. Wang, “Backdoor attack through machine unlearning,” CoRR, 2023

    2023

  8. [8]

    {UBA-Inf}: Unlearning activated backdoor attack with {Influence-Driven} camouflage,

    Z. Huang, Y . Mao, and S. Zhong, “ {UBA-Inf}: Unlearning activated backdoor attack with {Influence-Driven} camouflage,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 4211–4228

    2024

Show all 32 references
  1. [9]

    Selective forgetting of deep net- works at a finer level than samples,

    T. Hayase, S. Yasutomi, and T. Katoh, “Selective forgetting of deep net- works at a finer level than samples,” arXiv preprint arXiv:2012.11849 , 2020

    2012 arXiv

  2. [10]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics . PMLR, 2020, pp. 2938–2948

    2020

  3. [11]

    More is better (mostly): On the backdoor attacks in federated graph neural networks,

    J. Xu, R. Wang, S. Koffas, K. Liang, and S. Picek, “More is better (mostly): On the backdoor attacks in federated graph neural networks,” in Proceedings of the 38th Annual Computer Security Applications Conference, 2022, pp. 684–698

    2022

  4. [12]

    Turning privacy- preserving mechanisms against federated learning,

    M. Arazzi, M. Conti, A. Nocera, and S. Picek, “Turning privacy- preserving mechanisms against federated learning,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 1482–1495

    2023

  5. [13]

    Let’s focus: Focused backdoor attack against federated transfer learning,

    M. Arazzi, S. Koffas, A. Nocera, and S. Picek, “Let’s focus: Focused backdoor attack against federated transfer learning,” arXiv preprint arXiv:2404.19420, 2024

    2024 arXiv

  6. [14]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access , vol. 7, pp. 47 230–47 244, 2019

    2019

  7. [15]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  8. [16]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 16 463–16 472

    2021

  9. [17]

    Narcissus: A practical clean-label backdoor attack with limited information,

    Y . Zeng, M. Pan, H. A. Just, L. Lyu, M. Qiu, and R. Jia, “Narcissus: A practical clean-label backdoor attack with limited information,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 771–785

    2023

  10. [18]

    Silent killer: A stealthy, clean- label, black-box backdoor attack,

    T. Lederer, G. Maimon, and L. Rokach, “Silent killer: A stealthy, clean- label, black-box backdoor attack,” arXiv preprint arXiv:2301.02615 , 2023

    2023 arXiv

  11. [19]

    Combat: Alternated training for effective clean-label backdoor attacks,

    T. Huynh, D. Nguyen, T. Pham, and A. Tran, “Combat: Alternated training for effective clean-label backdoor attacks,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, no. 3, 2024, pp. 2436–2444

    2024

  12. [20]

    Backdoor attacks against deep image compression via adaptive frequency trigger,

    Y . Yu, Y . Wang, W. Yang, S. Lu, Y .-P. Tan, and A. C. Kot, “Backdoor attacks against deep image compression via adaptive frequency trigger,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 12 250–12 259

    2023

  13. [21]

    An invisible black-box backdoor attack through frequency domain,

    T. Wang, Y . Yao, F. Xu, S. An, H. Tong, and T. Wang, “An invisible black-box backdoor attack through frequency domain,” in European Conference on Computer Vision . Springer, 2022, pp. 396–413

    2022

  14. [22]

    An empirical study of example forgetting during deep neural network learning,

    M. Toneva, A. Sordoni, R. T. des Combes, A. Trischler, Y . Bengio, and G. J. Gordon, “An empirical study of example forgetting during deep neural network learning,” in International Conference on Learning Representations , 2019. [Online]. Available: https: //openreview.net/for...

    2019

  15. [23]

    The mnist database of handwritten digit images for machine learning research,

    L. Deng, “The mnist database of handwritten digit images for machine learning research,” IEEE Signal Processing Magazine , vol. 29, no. 6, pp. 141–142, 2012

    2012

  16. [24]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  17. [25]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  18. [26]

    An analysis of single-layer networks in unsupervised feature learning,

    A. Coates, A. Ng, and H. Lee, “An analysis of single-layer networks in unsupervised feature learning,” in Proceedings of the fourteenth international conference on artificial intelligence and statistics . JMLR Workshop and Conference Proceedings, 2011, pp. 215–223

    2011

  19. [27]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  20. [28]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in 3rd International Conference on Learning Representations (ICLR 2015) . Computational and Biological Learning Society, 2015

    2015

  21. [29]

    Striving for simplicity: The all convolutional net,

    J. Springenberg, A. Dosovitskiy, T. Brox, and M. Riedmiller, “Striving for simplicity: The all convolutional net,” in ICLR (workshop track) , 2015

    2015

  22. [30]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020

    2010 arXiv

  23. [31]

    Distilling cognitive backdoor patterns within an image,

    H. Huang, X. Ma, S. M. Erfani, and J. Bailey, “Distilling cognitive backdoor patterns within an image,” in The Eleventh International Conference on Learning Representations

  24. [32]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 707–723

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.