Pith. sign in

REVIEW 4 major objections 4 minor 34 references

BURN: Backdoor Unlearning via Adversarial Boundary Analysis

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial boundary analysis can locate poisoned samples and restore their correct labels.

desk verdict BURN is a serious, potentially useful backdoor-defense framework, but its central label-restoration claim needs far stronger evidence before I'd trust the relabeling step. read the letter →

arxiv 2507.10491 v1 pith:H5HXVU3Q submitted 2025-07-14 cs.CR

Yanghao Su , Jie Zhang , Yiming Li , Tianwei Zhang , Qing Guo , Weiming Zhang , Nenghai Yu , Nils Lukas
show 1 more author
Wenbo Zhou
This is my paper
classification cs.CR
keywords backdoorunlearningadversarialboundaryanalysisdatapoisoningdefenselabelrestorationtrigger-agnosticmodelpurificationattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes that a backdoored model can be cleansed by measuring how far each training sample sits from the model's decision boundaries and observing what label it receives when pushed across the nearest boundary. Its central claim is that poisoned samples sit significantly farther from decision boundaries than clean samples, and that a boundary-crossing adversarial perturbation flips a poisoned sample back to its original correct label while clean samples receive roughly uniform alternative labels. The authors build BURN, a two-phase unlearning framework that uses this adversarial boundary analysis to flag suspicious samples, re-label them with the adversarial predictions, and iteratively fine-tune the model while tracking prediction divergence from the frozen infected model. If the observations hold, backdoor removal no longer needs trigger reconstruction or a clean auxiliary dataset, and can apply to dynamic and invisible triggers. The paper reports low attack success rates with preserved accuracy across seven attack types and three datasets.

What carries the argument

The load-bearing tool is the boundary adversarial attack, which computes, for each sample, the smallest perturbation that changes the model's prediction by moving toward the closest decision boundary, approximated with gradient differences between class scores. Its output supplies both detection and relabeling: the perturbation magnitude gives the boundary distance signal, and the adversarial predicted label serves as the recovered label for fine-tuning. In phase two, a composite score combines normalized boundary distance with prediction divergence between the frozen infected model and the progressively purified model, and dynamic weights shift emphasis from boundary distance to prediction divergence over iterations while adaptive proportions control how many samples are relabeled as poison versus kept clean.

What would settle it

Run a boundary adversarial attack on every poison sample from a clean-label backdoor attack, record the fraction whose adversarial predicted label equals the sample's ground-truth label before poisoning, and then apply BURN's phase-one relabeling to a held-out poisoned model; if label-recovery accuracy is far below near-perfect for any attack family, or if clean samples in the top boundary-distance quantile are frequently mislabeled, the observed attack-success-rate reduction would not be explained by correct label restoration.

Watch

Extended reading notes

Core claim

The paper's core discovery is a geometric signature of poisoning: in a backdoored model, poisoned samples lie in a high-confidence region near the target class and therefore require substantially larger minimal adversarial perturbations to cross a decision boundary than clean samples do. When such a boundary adversarial perturbation is applied, poison samples' predicted labels revert to their correct semantic labels with high probability, and their feature representations move closer to those of the corresponding clean samples. BURN operationalizes this by sorting training samples by boundary distance, taking the top proportion as candidate poison samples, relabeling them with their adversarial predicted labels, and fine-tuning; it then iterates with a composite score combining normalized boundary distance and prediction divergence between the frozen infected model and the purified model, progressively refining the datasets and purifying the model. The authors state that this directly breaks the false trigger-target association without modeling triggers and without a clean auxiliary dataset.

Load-bearing premise

The whole method rests on believing that the adversarial predicted label of a flagged poison sample is its original true label; if that recovery fails for a nontrivial share of samples, the fine-tuning step teaches wrong associations and can either preserve the backdoor or damage accuracy.

Editorial extensions

If this is right

  • Backdoor unlearning can be accomplished by label restoration rather than trigger recovery, so defenses no longer need to guess trigger shapes.
  • Dynamic and input-dependent triggers, where pattern recovery is hardest, become treatable because the method never models the trigger.
  • A relatively small number of correctly relabeled poison samples can suppress attack success rate, so exhaustive poison detection is unnecessary.
  • Because the method needs no clean auxiliary data, it is usable when defenders only have the poisoned training set and an infected model.
  • The boundary-distance signal itself can serve as a poison-detection filter, as shown by the reported ROC curves with high AUC for most tested attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The label-reversion observation may be a general property of shortcut features: any spurious correlation a model latches onto could be disrupted by boundary adversarial perturbations, making this a candidate diagnostic for shortcut learning beyond backdoors.
  • The same relabeling trick could turn poisoned or mislabeled data into a self-correcting training signal, but only if label-recovery accuracy is measured per attack; the paper shows one confusion matrix rather than per-attack recovery rates.
  • Clean-label poisoning is the natural stress point for BURN, since those samples retain correct labels and may not show abnormally large boundary distances; a testable extension is to run phase-one relabeling alone on clean-label attacks and measure both relabel accuracy and downstream attack success rate.
  • Combining boundary-distance detection with statistical or certified backdoor detection could reduce false positives among clean outliers, since those outliers are the samples most likely to be mis-relabeled.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. BURN proposes a backdoor-unlearning method that uses boundary adversarial attacks to identify poisoned samples by their abnormally large perturbation norms, relabel those samples with the adversarial predicted label on the assumption that this recovers the original correct semantic label, and then progressively fine-tunes the model using a composite score of boundary distance and prediction divergence. The paper claims two observations: poison samples are farther from decision boundaries than clean samples, and adversarial perturbations tend to restore the original labels and clean-like features of poison samples. It validates BURN against seven attacks on CIFAR-10, CIFAR-100, and Tiny ImageNet-200, with the main-text experimental evidence consisting mostly of CIFAR-100 radar plots, a single confusion matrix, and AUROC curves.

Significance. If the label-restoration observation were robust across attacks and datasets, BURN would be a valuable defense: it operates without clean auxiliary data or trigger-pattern assumptions, and its two-phase progressive refinement design is clean and well motivated. The boundary-distance observation is supported by Table 1 and the AUROC curves, and the idea of using adversarial perturbations to strip trigger-dominated features is intriguing. However, the load-bearing label-restoration claim is under-validated, and the currently reported experiments do not yet substantiate the broad empirical claims made in the abstract and introduction.

major comments (4)
  1. [Section 4, Fig. 2, Algorithm 1] The central premise that adversarial boundary predictions of poison samples equal their original true labels is supported only by a single aggregate confusion matrix for 1000 CIFAR-10 poison samples, with no per-attack or per-dataset breakdown. This premise is load-bearing because both phases of Algorithm 1 (lines 6 and 17) relabel the selected samples with y_i = arg max f(x_i + delta_i; theta_0), and Phase 1 fine-tunes on these labels. If the recovered label is wrong for a non-negligible fraction of the selected samples, or if clean samples that pass the distance filter are mislabeled, the fine-tuning step teaches incorrect associations. The problem is especially acute for clean-label (CL) attacks, where poison samples retain their correct ground-truth labels by construction, so an adversarial prediction that differs from the original label cannot be described as 'restoring' it. Please report per-attack label-recovery accuracy, including for CL attacks, and analyze the impact of label noise on the final ACC/ASR. The text also references Fig. 2 (left) and (right), but the figure as presented is a single confusion matrix; the clean-sample uniform distribution is not actually shown.
  2. [Section 6.2, Fig. 4] The main experimental evidence for the paper's central claim consists of radar plots for CIFAR-100 only, with no numerical tables, no confidence intervals, and no CIFAR-10 or Tiny ImageNet-200 results in the main text. The claim of broad effectiveness across datasets, architectures, and seven attacks is therefore not verifiable from the reported material. Please include full numeric ACC/ASR results with standard deviations across runs, and at least summarize the supplementary results in the main text so that the reader can check the claimed trade-offs.
  3. [Section 5.2, Table 2, Fig. 5] The method assumes a 1% screened poison subset and sets k_p accordingly, but the attacks use a 10% poisoning ratio by default. Since the top-k_p selection may include clean samples and exclude poison samples, particularly for attacks with weaker boundary-distance separability such as SSBA (AUROC 0.7993 in Fig. 5), the reported ACC/ASR do not show whether the method is robust to different poisoning rates or to detection errors at the chosen threshold. Please report precision and recall at the selected k_p values and provide a sensitivity analysis over poisoning ratios; the paper's own limitation statement in Section 7 acknowledges dependence on accurate detection, which this experiment would directly address.
  4. [Section 4, Table 1] The statement that label reversion 'holds regardless of the target label or the trigger mechanism' is asserted without per-attack evidence. Table 1 shows large variation in boundary distances across attack types, so label-restoration behavior may also be attack-dependent. This overgeneralization should either be removed or supported by per-attack label-recovery experiments, rather than only by the aggregate CIFAR-10 confusion matrix.
minor comments (4)
  1. [Throughout] There are several typos and formatting issues: 'CLLF' in Fig. 4 should be 'CL LF'; 'trojanNN' should be 'TrojanNN'; 'mimimal' in Section 5.2 should be 'minimal'; 'Anlysis' in the Section 6.4 heading should be 'Analysis'; 'Effectivness' should be 'Effectiveness'; and the Fig. 2 caption contains the incomplete phrase 'for and 1000 poison samples'. Please correct these.
  2. [Section 5.2] The dynamic weight schedule uses omega_0 = 0.3 and omega_T = 0.6 without any reported sensitivity analysis. Since this schedule controls the balance between boundary distance and prediction divergence across iterations, a brief ablation or a justification for these values would strengthen the paper.
  3. [Section 6.1] The defense baselines are given access to about 5% of clean training data, while BURN uses no clean auxiliary data. This is a favorable comparison for BURN, but the protocol should be stated explicitly as a potential advantage of the baselines, and the reported comparison should be interpreted accordingly.
  4. [Section 6.4, Fig. 6] The claim that effective backdoor suppression can be achieved with only about 30 identified poison samples is demonstrated for BadNets and Blended attacks only; please specify whether this trend holds for the other five attack types, since the AUROC results in Fig. 5 suggest that detection is much harder for SSBA.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: BURN's adversarial boundary distance and label-restoration observations are empirical inputs, not consequences of the method, and the defense is evaluated against external ASR/ACC benchmarks; the self-citation to Model X-ray is corroborated by in-paper measurements.

full rationale

The paper's derivation chain is not circular in a way that reduces a prediction to its inputs. The two key observations—poison samples have larger adversarial boundary distances and boundary adversarial perturbations tend to restore the original semantic labels—are presented as empirical findings supported by Table 1, Fig. 1, and Fig. 2. These observations are then used to design BURN, but the method does not define those observations into existence; the confusion matrix in Fig. 2 compares adversarial predictions against known ground-truth labels of poison samples from the attack construction, so the label-restoration claim is an empirical assertion rather than a tautology. The detection step sorts by the same boundary-distance metric that the paper studies, but that is a design choice, not a fitted parameter disguised as a prediction. The method's hyperparameters (k_p, k_c, omega_t) are not fitted to the reported ASR/ACC values, and the evaluation uses standard external metrics on held-out poison and clean test sets, so no fitted-input-called-prediction pattern appears. The only self-citation of note is reference [23] (Model X-ray), used in the sentence 'These results align with previous research [20, 23], which shows that backdoor attacks reshape decision boundaries...' This citation is not load-bearing because Table 1 in the present paper independently reports the boundary-distance measurements across seven attacks and three datasets. The Phase-2 prediction-divergence metric is partly self-referential—the fine-tuned model changes on samples it was trained on—but BURN uses it as an internal feedback signal, not as an external validation or as a claimed first-principles result. The skeptical concern about clean-label attacks and the limited validation of label recovery is a correctness and robustness limitation, not a circularity of the kind defined by the analysis rules. Overall, no step in the paper's argument requires assuming the conclusion it claims to establish.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method leans on several empirical assumptions about boundary behavior of poisoned samples and about the defender's knowledge of poisoning rates. The most consequential premise, that adversarial perturbations recover true labels of poison samples, is asserted from limited evidence and drives the relabeling step.

free parameters (4)
  • kp (k0_p=0.5%, kT_p=1%) = 0.5% to 1%
    Proportion of samples selected as poison candidates, tuned via ablation in Table 2 and based on an assumed 1% poisoning rate.
  • kc (k0_c=2.5%, kT_c=5%) = 2.5% to 5%
    Proportion of samples selected as clean, tuned via ablation in Table 2.
  • omega (omega0=0.3, omegaT=0.6) = 0.3 to 0.6
    Dynamic weights balancing boundary distance and prediction divergence, set by hand.
  • T=20, learning rate 5e-5, 5 epochs per iteration = specified constants
    Fine-tuning schedule chosen empirically, with no sensitivity analysis reported across datasets.
assumptions (4)
  • domain assumption Adversarial boundary distance l(x_i) = ||delta_i||_2 separates poison from clean samples.
    Invoked in Section 4 and Table 1, based on 1000 samples per class without variance; AUROC varies from 0.7993 to 0.9999 across attacks.
  • ad hoc to paper For poison samples, the boundary attack's predicted label equals the original true semantic label.
    Core relabeling premise in Algorithm 1 lines 6 and 17; evidence is Fig. 2 (one dataset) and Fig. 1 (one example).
  • domain assumption The attack's poisoning rate is low enough that taking the top k_p% of boundary distances captures sufficient poison samples without too many clean outliers.
    Explicit assumption of a 1% screened subset in Section 5.2, though experiments use 10% poisoning.
  • domain assumption Fine-tuning on the union of relabeled poison and selected clean samples preserves clean accuracy while removing backdoors.
    This is the central hypothesis validated only empirically, with no theoretical guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BURN: Backdoor Unlearning via Adversarial Boundary Analysis." pith.science (2026). https://pith.science/paper/H5HXVU3Q

@misc{pith2026250710491,
  author       = {Pith},
  title        = {Pith review of: BURN: Backdoor Unlearning via Adversarial Boundary Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H5HXVU3Q}},
  note         = {Machine review of arXiv:2507.10491}
}
read the original abstract

Backdoor unlearning aims to remove backdoor-related information while preserving the model's original functionality. However, existing unlearning methods mainly focus on recovering trigger patterns but fail to restore the correct semantic labels of poison samples. This limitation prevents them from fully eliminating the false correlation between the trigger pattern and the target label. To address this, we leverage boundary adversarial attack techniques, revealing two key observations. First, poison samples exhibit significantly greater distances from decision boundaries compared to clean samples, indicating they require larger adversarial perturbations to change their predictions. Second, while adversarial predicted labels for clean samples are uniformly distributed, those for poison samples tend to revert to their original correct labels. Moreover, the features of poison samples restore to closely resemble those of corresponding clean samples after adding adversarial perturbations. Building upon these insights, we propose Backdoor Unlearning via adversaRial bouNdary analysis (BURN), a novel defense framework that integrates false correlation decoupling, progressive data refinement, and model purification. In the first phase, BURN employs adversarial boundary analysis to detect poisoned samples based on their abnormal adversarial boundary distances, then restores their correct semantic labels for fine-tuning. In the second phase, it employs a feedback mechanism that tracks prediction discrepancies between the original backdoored model and progressively sanitized models, guiding both dataset refinement and model purification. Extensive evaluations across multiple datasets, architectures, and seven diverse backdoor attack types confirm that BURN effectively removes backdoor threats while maintaining the model's original performance.

Figures

Figures reproduced from arXiv: 2507.10491 by the authors.

Figure 1
Figure 1. Predicted labels and features of clean sample [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Adversarial predicted labels and correct labels for and [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Overview of BURN framework. The framework operates in two phases. Phase 1: Suspicious poisoned samples are identified via adversarial boundary analysis and re-labeled with their correct semantic labels. The model is then fine-tuned using these re-labeled samples, while retaining the frozen infected model for later comparison. Phase 2: By applying adversarial boundary analysis on the frozen infected model and leverag… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The radar plots visualize ACC and ASR trends for each method, where solid lines represent defended models and dashed lines [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Performance of poison sample filtering using adversarial boundary analysis. The receiver operating characteristic (ROC) curves [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: The trends of model accuracy (ACC) and attack success [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

34 extracted references · 26 canonical work pages

  1. [1]

    Superdeepfool: a new fast and accurate minimal adversarial attack

    Mahed Abroshan, Seyed-Mohsen Moosavi-Dezfooli, et al. Superdeepfool: a new fast and accurate minimal adversarial attack. Advances in Neural Information Processing Systems, 37:98537–98562, 2025. 1, 3

    work page 2025

  2. [2]

    Blind backdoors in deep learning models

    Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. In30th USENIX Security Symposium (USENIX Security 21), pages 1505–1521, 2021. 1

    work page 2021

  3. [3]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017. 2, 4, 6

    arXiv 2017

  4. [4]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 6

    2009

  5. [5]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11966–11976, 2021. 1, 3

    work page 2021

  6. [6]

    Dermatologist-level classification of skin cancer with deep neural networks

    Andre Esteva, Brett Kuprel, Roberto A Novoa, Justin Ko, Susan M Swetter, Helen M Blau, and Sebastian Thrun. Dermatologist-level classification of skin cancer with deep neural networks. nature, 542(7639):115–118, 2017. 1

    work page 2017

  7. [7]

    Bad- nets: Identifying vulnerabilities in the machine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Bad- nets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017. 1, 2, 4, 6

    arXiv 2017

  8. [8]

    Identity mappings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14, pages 630–645. Springer, 2016. 6

    work page 2016

Show all 34 references
  1. [9]

    Backdoor defense via decoupling the training process

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. arXiv preprint arXiv:2202.03423, 2022. 3

    2022 arXiv

  2. [10]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 6

    2009

  3. [11]

    Invisible backdoor attack with sample-specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF international con- ference on computer vision, pages 16463–16472, 2021. 1, 2, 3, 4, 6

    2021

  4. [12]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. arXiv preprint arXiv:2101.05930, 2021. 1, 3, 6

    2021 arXiv

  5. [13]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, pages 273–294. Springer,

  6. [14]

    Trojaning attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018. 1, 3, 4, 6

    2018

  7. [15]

    Abs: Scanning neural networks for back-doors by artificial brain stimulation

    Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. Abs: Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Com- puter and Communications Security, pages 1265–1282, 2019. 3

    2019

  8. [16]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pas- cal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 2574–2582, 2016. 1, 3

    2016

  9. [17]

    Progressive backdoor erasing via connecting backdoor and adversarial attacks

    Bingxu Mu, Zhenxing Niu, Le Wang, Xue Wang, Qiguang Miao, Rong Jin, and Gang Hua. Progressive backdoor erasing via connecting backdoor and adversarial attacks. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20495–20503, 2023. 3

    2023

  10. [18]

    Input-aware dynamic back- door attack

    Tuan Anh Nguyen and Anh Tran. Input-aware dynamic back- door attack. Advances in Neural Information Processing Systems, 33:3454–3464, 2020. 1, 3, 4, 6

    2020

  11. [19]

    Deep face recognition

    Omkar Parkhi, Andrea Vedaldi, and Andrew Zisserman. Deep face recognition. In BMVC 2015-Proceedings of the British Machine Vision Conference 2015 . British Machine Vision Association, 2015. 1

    2015

  12. [20]

    Mdtd: A multi domain trojan detector for deep neural networks

    Arezoo Rajabi, Surudhi Asokraj, Fengqing Jiang, Luyao Niu, Bhaskar Ramasubramanian, Jim Ritcey, and Radha Pooven- dran. Mdtd: A multi domain trojan detector for deep neural networks. arXiv preprint arXiv:2308.15673, 2023. 4

    2023 arXiv

  13. [21]

    You only look once: Unified, real-time object de- tection

    Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object de- tection. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 779–788, 2016. 1

    2016

  14. [22]

    Universal backdoor attacks

    Benjamin Schneider, Nils Lukas, and Florian Kerschbaum. Universal backdoor attacks. In The Twelfth International Conference on Learning Representations, 2024. 3

    2024

  15. [23]

    Model x-ray: Detecting backdoored models via decision boundary

    Yanghao Su, Jie Zhang, Ting Xu, Tianwei Zhang, Weiming Zhang, and Nenghai Yu. Model x-ray: Detecting backdoored models via decision boundary. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 10296– 10305, 2024. 4

    2024

  16. [24]

    Label-consistent backdoor attacks

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019. 4, 6

    1912 arXiv

  17. [25]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural net- works

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural net- works. In 2019 IEEE Symposium on Security and Privacy (SP), pages 707–723. IEEE, 2019. 1, 3

    2019

  18. [26]

    Bppattack: Stealthy and efficient trojan attacks against deep neural net- works via image quantization and contrastive adversarial learning

    Zhenting Wang, Juan Zhai, and Shiqing Ma. Bppattack: Stealthy and efficient trojan attacks against deep neural net- works via image quantization and contrastive adversarial learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1...

    2022

  19. [27]

    Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples

    Shaokui Wei, Mingda Zhang, Hongyuan Zha, and Baoyuan Wu. Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples. Advances in Neural Information Processing Systems, 36:25876–25909, 2023. 3, 6

    2023

  20. [28]

    Backdoorbench: A comprehensive benchmark of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoorbench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35:10546–10559,

  21. [29]

    Adversarial neuron prun- ing purifies backdoored deep models

    Dongxian Wu and Yisen Wang. Adversarial neuron prun- ing purifies backdoored deep models. Advances in Neural Information Processing Systems, 34:16913–16925, 2021. 3, 6

    2021

  22. [30]

    Cbd: A certified back- door detector based on local dominant probability

    Zhen Xiang, Zidi Xiong, and Bo Li. Cbd: A certified back- door detector based on local dominant probability. Advances in Neural Information Processing Systems, 36, 2024. 3

    2024

  23. [31]

    Adversarial unlearning of backdoors via implicit hypergradient

    Yi Zeng, Si Chen, Won Park, Z Morley Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. arXiv preprint arXiv:2110.03735, 2021. 3, 6

    2021 arXiv

  24. [32]

    Re- thinking the backdoor attacks’ triggers: A frequency per- spective

    Yi Zeng, Won Park, Zhuoqing Morley Mao, and R Jia. Re- thinking the backdoor attacks’ triggers: A frequency per- spective. 2021 ieee. In CVF International Conference on Computer Vision (ICCV), pages 16453–16461, 2021. 1, 2, 4, 6

    2021

  25. [33]

    Poison ink: Robust and invisible backdoor attack

    Jie Zhang, Chen Dongdong, Qidong Huang, Jing Liao, Weim- ing Zhang, Huamin Feng, Gang Hua, and Nenghai Yu. Poison ink: Robust and invisible backdoor attack. IEEE Transactions on Image Processing, 31:5691–5705, 2022. 2, 3

    2022

  26. [34]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization

    Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4466–4477, 2023. 3, 6

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.