Pith. sign in

REVIEW 4 major objections 6 minor 83 references

DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read DISTIL reconstructs Trojan triggers with no clean training data by guiding a pretrained diffusion model with classifier gradients in latent space, and scores models by how strongly the recovered pattern transfers.

desk verdict DISTIL is a genuinely new and well-engineered twist on trigger inversion—latent-space guided diffusion—but the 'data-free' label is softer than it looks and the quantitative claims need cleanup before I'd trust the margins. read the letter →

arxiv 2507.22813 v1 pith:4STNE324 submitted 2025-07-30 cs.CV

Hossein Mirzaei , Zeinab Taghavi , Sepehr Rezaee , Masoud Hadi , Moein Madadi , Mackenzie W. Mathis This is my paper
classification cs.CV
keywords Trojanattackdetectionbackdoordefensetriggerinversionlatentdiffusionguidancedata-freemodelscanningmitigationobjectbackdoorsshortcutlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that Trojan triggers in poisoned image classifiers can be reconstructed without any clean training data by moving the search from pixel space into the latent space of a pretrained diffusion model. At each denoising step, the suspect classifier's own gradients steer generation toward a pattern that raises the probability of a candidate target class and lowers that of a source class, while injected uniform noise suppresses adversarial artifacts. The recovered pattern is then tested as a signature: pasted onto held-out source images, it should shift predictions strongly only if the model is genuinely Trojaned, because Trojan-induced shortcuts transfer more than anything a clean model has learned. The paper reports that this data-free procedure outperforms earlier trigger-inversion baselines by up to 7.1% in scanning accuracy on a standard backdoor benchmark and 9.4% on object-detection scanning, and that the same recovered triggers support target-class prediction and mitigation by fine-tuning.

What carries the argument

The carrying object is a pretrained, classifier-guided diffusion generator treated as a constrained search space for triggers, plus a scalar decision statistic built on the recovered pattern. The modified reverse-process mean $\tilde{\mu}_\theta(x_t, t, y_{\mathrm{tar}}, y_{\mathrm{src}}) = \mu_\theta(x_t,t) + \Sigma_\theta(x_t,t)\nabla_{x_t}\log[f(y_{\mathrm{tar}}|x_t)/f(y_{\mathrm{src}}|x_t)] + \lambda_1\eta_t$ does two jobs at once: the classifier gradient directs sampling toward a pattern the model connects to the target label rather than the source label, and the scaled uniform noise $\eta_t$ destabilizes brittle adversarial perturbations, so the search settles on stable, trigger-like structure. The decision mechanism is the trigger-strength score of Equation 5, the expected rise in target-class softmax probability minus the source-class probability when the generated trigger is embedded into held-out source images; the model-level Trojan score of Equation 6 is the maximum of that margin over all source-target pairs, and the maximizing pair names the predicted target class. A fast variant reduces the scan from quadratic to linear in the number of classes by pairing each target with its farthest class in penultimate-layer feature cosine similarity.

What would settle it

Run DISTIL's scan over a large population of clean models, record the maximum trigger-strength scores from Equation 6, and compare them with the scores of Trojaned models; if a substantial fraction of clean classifiers, especially adversarially trained ones that are optimized to be sensitive to perturbation-like features, reaches the Trojan threshold, the transferability gap that carries the detection signal does not hold and the method's accuracy claims would not survive an independent clean-only evaluation. The paper's supplementary figures show that patterns found on clean models look noisy, but it does not report the score distributions that would settle this directly.

Watch

Extended reading notes

Core claim

The central claim is that a Trojaned classifier's shortcut pattern is an unusually transferable internal bias, and that generating candidate triggers inside a diffusion model's image manifold exposes it. For every candidate pair $(y_{\mathrm{src}}, y_{\mathrm{tar}})$ the method steers the reverse diffusion by modifying the mean as $\tilde{\mu}_\theta(x_t, t, y_{\mathrm{tar}}, y_{\mathrm{src}}) = \mu_\theta(x_t,t) + \Sigma_\theta(x_t,t)\nabla_{x_t}\log\frac{f(y_{\mathrm{tar}}|x_t)}{f(y_{\mathrm{src}}|x_t)} + \lambda_1\eta_t$, with $\eta_t \sim \mathcal{U}(0,1)$; the gradient pulls the pattern toward what the classifier associates with the target class over the source class, and the noise term is the paper's safeguard against collapsing onto adversarial perturbations. The final image $x_0$ is accepted as a trigger if the classifier's softmax target probability clears a threshold, and its discriminative power is scored by Equation 5, the expected softmax margin between target and source class when the trigger is overlaid on held-out source images; the model-level Trojan score is the maximum of this margin over all label pairs. On this basis the paper claims accurate scanning of Trojaned classifiers across standard backdoor benchmarks, extension to object detection by adding a bounding-box localization gradient, target-class identification from the maximizing pair, and mitigation by fine-tuning on correctly labeled triggered images.

Load-bearing premise

The method's separation of poisoned from clean models rests on the premise that shortcut patterns learned by a Trojaned model transfer to held-out inputs far more strongly than patterns a clean model has learned; if clean models turned out to be nearly as responsive to the generated patterns, the trigger-strength score would not separate the two populations and false positives would follow.

Editorial extensions

If this is right

  • Trojan scanning no longer needs the training set: the same latent-space search can decide whether a held-out classifier is poisoned using only the classifier itself and a pretrained diffusion model, which matters when training data is proprietary or private.
  • The recovered trigger is a working artifact, not just a statistic: fine-tuning on triggered images with correct labels cuts average attack success rate to 8.6% in the paper's CIFAR-10 mitigation runs while keeping classification accuracy near that of the original model.
  • Detection and attribution come from the same object: the source-target pair that maximizes the trigger-strength score identifies the attack's target class, reaching 72.0% accuracy in the paper's GTSRB-based evaluation.
  • The same shortcut logic extends to object-detection models by adding a gradient that drags predicted bounding-box centers toward a corner, giving a scanning accuracy of 63.7% on the benchmark's poisoned detectors.
  • The fast variant cuts per-model scan cost from quadratic to linear in the number of classes with roughly unchanged accuracy in the ablation, making the scan practical for high-class-count models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural stress test the paper does not run: adversarially trained clean models are built to be sensitive to perturbation-like patterns, so measuring their trigger-strength distribution directly would confirm whether the assumed transferability gap really separates the two populations.
  • The method's generality is bounded by its generative backbone: because the default diffusion model was trained on natural images, applying DISTIL to domains far outside that manifold, such as medical or satellite imagery, could push recovered patterns off-manifold, a regime the paper gives no evidence about.
  • The same classifier-guided latent search could plausibly be adapted to invert dynamic, sample-specific triggers by conditioning the guidance on each input rather than on a fixed source-target pair, which would extend the method beyond the static-trigger threat model it evaluates.
  • The fast variant's heuristic of testing each target against only its farthest source class deserves a blind-spot probe: a real trigger that fires only from a nearby source class could be missed, since the ablation does not report per-class failure modes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. Mirzaei et al. propose DISTIL, a trigger-inversion defense that reconstructs Trojan triggers by steering a pretrained, classifier-guided latent diffusion model with gradients of the classifier under test. The reconstructed pattern is accepted when it makes the classifier predict a chosen target class, and the model is scanned by computing a transferability score: the expected shift of held-out source-class images toward the target class and away from the source class. The method is evaluated for Trojan scanning, mitigation, and target-class prediction on BackdoorBench and TrojAI, including an adaptation to object-detection models, and is reported to outperform existing RET and data-free baselines by substantial margins.

Significance. If the reported results hold, DISTIL is a potentially useful contribution to post-training Trojan defense: it moves trigger inversion from pixel space into a diffusion latent space, produces visually interpretable triggers, avoids strong assumptions about trigger shape, and demonstrates extension to object detection and all-to-all label mappings. The paper ships code, includes ablations isolating the contribution of diffusion, noise injection, fast pairing, and backbone choice, and reports results across many attack types and architectures. These are real strengths. The main reservations concern the 'data-free' claim, the threshold specification in the algorithm, and the absence of error bars and test-set sizes in the main tables; these are fixable but are load-bearing for the central empirical claims.

major comments (4)
  1. [Section 3, Eq. (5); Section 4, Experimental Setup] The abstract and introduction describe DISTIL as 'data-free, zero-shot', but the detection score in Eq. (5) is an expectation over held-out source-class images, and Section 4 explicitly states that 1% of clean data is used for Trojan scanning and mitigation. The scanning results in Tables 1a-c therefore depend on access to held-out clean images. This does not invalidate the method, but the 'data-free' claim must be qualified to 'data-free trigger inversion given a small held-out scoring set'. In addition, when comparing against genuinely data-free baselines such as MM-BD, the paper should state explicitly which methods received the 1% clean-data protocol and which did not; otherwise the reported margins over data-free baselines may overstate the advantage.
  2. [Section 3, Eq. (4); Algorithm 1, lines 14-17] The trigger acceptance threshold is inconsistent between the main text and the pseudocode. Eq. (4) requires softmax[f(delta)]_ytar >= lambda2 and gives lambda2 = 0.95 as an example, while Algorithm 1 line 14 uses a fixed threshold of 0.9. Furthermore, lambda2 is overloaded: Eq. (4) uses it for accepting an individual trigger candidate, but Algorithm 1 line 17 uses the same symbol as the global decision threshold for classifying the model as Trojaned or clean. This ambiguity changes which triggers are accepted and which models are flagged, and it is a reproducibility defect that should be corrected by unifying the threshold and giving it a single role.
  3. [Section 4, Tables 1, 3, and 4; Appendix Table 7] The main accuracy tables report no error bars, no number of clean/Trojaned models per cell, and no test-set sizes. The only standard-deviation information appears in Table 7, which reports AUCROC rather than the ACC values used in the main comparisons. Given that the paper claims improvements of up to 7.1 and 9.4 percentage points, the main tables should report mean +/- std over independent runs or seeds and should state the number of models in each evaluation set. Without this, it is difficult to judge whether the reported margins are statistically meaningful.
  4. [Section 3, Motivation paragraph] The discriminative power of Score(f) in Eq. (6) rests on the hypothesis that shortcut patterns learned by Trojaned models transfer significantly more strongly than patterns found in clean models. This hypothesis is asserted via citations [43, 44] and is only indirectly supported by the end-to-end detection accuracies in Table 1. Because the central detection signal is this transferability gap, the paper should provide direct evidence for the specific generated patterns: for at least one dataset, report the distribution of Score(f) for clean versus Trojaned models, or report false-positive rates at the chosen threshold. Such evidence would also strengthen the claim that the method generalizes to attack types beyond those in the evaluated benchmarks.
minor comments (6)
  1. [Section 3, Eq. (1); Algorithm 1, line 11; Figure 1 caption] The noise injection is specified inconsistently: Eq. (1) uses lambda1 * eta_t with eta_t ~ U(0,1), while Algorithm 1 line 11 samples eta_t ~ lambda1 * t * U(0,1), and the Figure 1 caption writes lambda2 * (T-1) * U(0,1). Please unify the notation and state exactly how the noise scales with the diffusion step t.
  2. [Section 3, Eq. (3)] The notation X_src ⊕ x_t is not defined. It appears to mean concatenation of a clean source image with the latent candidate, but the mechanism should be described explicitly, including how the two inputs are combined and how the gradient is computed with respect to x_t.
  3. [Section 3, Eq. (4) and Algorithm 1] The text says hyperparameters are discussed in the experimental details, but the paper does not report the final values of lambda1 and lambda2 used for the main tables, beyond the fixed values mentioned in the ablation Setup C. Please give the default hyperparameter settings used for each reported result.
  4. [Section 4, Experimental Setup and Evaluation Details] The statement that BackdoorBench originally included only one clean model per architecture and that the authors added 100 clean models is not followed by details on how these clean models were obtained or trained. Please provide the training protocol or the source of these models.
  5. [Table 2, column headers] The column header row of Table 2 is formatted confusingly, with labels such as 'Data SupervisionNoise' running together. Please reformat the table so that each component and each ablation condition is clearly identified.
  6. [Appendix, Table 7] Table 7 reports AUCROC mean +/- std for DISTIL, but the main text reports accuracy. Please either convert the main results to AUC or report both metrics, so that the variance information in the appendix can be related to the headline numbers.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DISTIL's trigger inversion and scanning score are empirically evaluated, not derived from their own inputs.

full rationale

Walking the derivation chain, DISTIL's claims do not reduce to their inputs. The trigger is generated by guiding a pretrained diffusion model with classifier gradients (Eq. 1: ∇xt log f(ytar|xt)/f(ysrc|xt)), accepted by target confidence on the generated pattern (Eq. 4), and then scored by its effect on held-out source-class images (Eq. 5). The acceptance condition is not the detection score: Eq. 5 measures transfer of the synthesized pattern to held-out images x′ + δ, so the reported separation between clean and Trojaned models is an empirical outcome, not a tautology. The central transferability hypothesis is stated as a hypothesis and supported by external citations [43,44] plus the paper's own experiments (e.g., Figure 4 shows clean models yield noisy, low-transfer patterns). No load-bearing self-citation chain appears: the authors' own TRODO [53] is used only as a comparison baseline, and the related-work self-citations are not used to justify the method's correctness. The 'data-free' terminology is somewhat overstated relative to the use of 1% held-out clean data for scoring (Section 3, Trojan Detection and Mitigation), and there is a threshold inconsistency between Eq. 4 (λ2=0.95) and Algorithm 1 line 14 (≥0.9), but these are reproducibility and overclaim concerns, not circularity. Therefore score 0.

Assumptions & free parameters 4 free parameters · 2 assumptions · 0 invented entities

No new physical entities, forces, or particles are introduced. The free parameters are standard hyperparameters for the optimization procedure. The main load-bearing assumptions are the transferability of Trojan shortcuts and the regularity of the diffusion latent space.

free parameters (4)
  • lambda_1 (noise injection strength) = not globally specified; fixed to 0.3 in ablation Setup C
    Controls the magnitude of the uniform noise injected at each diffusion step. Chosen based on TrojAI training rounds.
  • lambda_2 (classification confidence threshold) = 0.95 in Section 3; 0.9 in Algorithm 1
    Minimum target-class probability required to accept a generated trigger. The inconsistency between main text and pseudo-code is a red flag for reproducibility.
  • T (number of diffusion steps) = 50
    Set to 50 for time efficiency. Not justified as optimal.
  • Maximum generation repetitions = 5
    Empirically chosen maximum number of trigger generation attempts per class pair.
assumptions (2)
  • domain assumption Triggers learned by Trojaned models transfer more strongly than patterns found in clean models.
    Core premise of the Trojan score in Equation 5. Supported by citations [43, 44] but not independently demonstrated in the paper.
  • domain assumption A pretrained diffusion model's latent space is sufficiently narrow that classifier-guided search avoids adversarial perturbations.
    Motivates the entire method. The paper provides empirical evidence (low scores on clean models, visual examples) but no formal or mathematical guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion." pith.science (2026). https://pith.science/paper/4STNE324

@misc{pith2026250722813,
  author       = {Pith},
  title        = {Pith review of: DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4STNE324}},
  note         = {Machine review of arXiv:2507.22813}
}
read the original abstract

Deep neural networks have demonstrated remarkable success across numerous tasks, yet they remain vulnerable to Trojan (backdoor) attacks, raising serious concerns about their safety in real-world mission-critical applications. A common countermeasure is trigger inversion -- reconstructing malicious "shortcut" patterns (triggers) inserted by an adversary during training. Current trigger-inversion methods typically search the full pixel space under specific assumptions but offer no assurances that the estimated trigger is more than an adversarial perturbation that flips the model output. Here, we propose a data-free, zero-shot trigger-inversion strategy that restricts the search space while avoiding strong assumptions on trigger appearance. Specifically, we incorporate a diffusion-based generator guided by the target classifier; through iterative generation, we produce candidate triggers that align with the internal representations the model relies on for malicious behavior. Empirical evaluations, both quantitative and qualitative, show that our approach reconstructs triggers that effectively distinguish clean versus Trojaned models. DISTIL surpasses alternative methods by high margins, achieving up to 7.1% higher accuracy on the BackdoorBench dataset and a 9.4% improvement on trojaned object detection model scanning, offering a promising new direction for reliable backdoor defense without reliance on extensive data or strong prior assumptions about triggers. The code is available at https://github.com/AdaptiveMotorControlLab/DISTIL.

Figures

Figures reproduced from arXiv: 2507.22813 by the authors.

Figure 1
Figure 1. Method overview. DISTIL inverts Trojan triggers without any clean data by steering a pre-trained, classifier-guided diffusion model. The process begins with pure Gaussian noise xT ∼ N (0, I) and iteratively refines it toward a trigger-like pattern using the classifier’s gradients for the chosen objective. At every diffusion step t, we inject additional uniform noise ηt before re-evaluating the gradients, which regul… view at source ↗
Figure 2
Figure 2. Visual comparison of trigger-inversion methods. Estimated triggers produced by prior RET baselines (columns) across multiple TrojAI rounds often resemble adversarial noise rather than true triggers. By constraining the search to the latent space of a guided diffusion model and regularising with uniform-noise augmentation, DISTIL instead uncovers shortcut patterns that closely match the genuine triggers. ral shortcut… view at source ↗
Figure 3
Figure 3. DISTIL on object-detection models. Each pair shows (top row) a clean input with correct detections (green boxes) and the same input (bottom row) after injecting the trigger recovered by DISTIL (red boxes). The reconstructed trigger not only flips the model’s prediction from the true class to the attacker’s target class but also drags the bounding-box center toward a pre-selected corner, producing simultaneous miscla… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: DISTIL Performance on Clean Models. This figure displays the noisy, random trigger patterns generated by DISTIL when applied to clean models across multiple rounds (Rounds 1, 2, 3, 4, and 11). As hypothesized, these triggers lack coherent structure and exhibit minimal …
Figure 5
Figure 5. Figure 5: DISTIL Performance on CIFAR10 with BadNets Trigger. This figure illustrates the trigger pattern reconstruction achieved by DISTIL on the CIFAR10 dataset under a BadNets attack scenario. The extracted trigger patterns clearly reflect the characteristic artifacts of the …

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

83 extracted references · 65 canonical work pages

  1. [1]

    Bad- nets: Evaluating backdooring attacks on deep neural net- works

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Bad- nets: Evaluating backdooring attacks on deep neural net- works. IEEE Access, 7:47230–47244, 2019. doi: 10.1109/ ACCESS.2019.2909068. 1, 2, 8, 14

    work page arXiv 2019

  2. [2]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 ,

    arXiv

  3. [3]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pages 101–105. IEEE, 2019. 1, 2, 14

    2019

  4. [4]

    Input-aware dynamic backdoor attack

    Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454–3464, 2020. 2, 14

    2020

  5. [5]

    Wanet - impercep- tible warping-based backdoor attack

    Tuan Anh Nguyen and Anh Tuan Tran. Wanet - impercep- tible warping-based backdoor attack. In International Con- ference on Learning Representations, 2021. URL https: //openreview.net/forum?id=5aYyYrXzSx. 2, 14

    2021

  6. [6]

    Color backdoor: A robust poisoning attack in color space

    Wenbo Jiang, Hongwei Li, Guowen Xu, and Tianwei Zhang. Color backdoor: A robust poisoning attack in color space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8133–8142, 2023. 14

    work page 2023

  7. [7]

    Bppattack: Stealthy and efficient trojan attacks against deep neural net- works via image quantization and contrastive adversarial learning

    Zhenting Wang, Juan Zhai, and Shiqing Ma. Bppattack: Stealthy and efficient trojan attacks against deep neural net- works via image quantization and contrastive adversarial learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15074– 15084, 2022. 2, 14

    work page 2022

  8. [8]

    Invisible backdoor attack with sample- specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample- specific triggers. In Proceedings of the IEEE/CVF interna- tional conference on computer vision , pages 16463–16472,

    work page

Show all 83 references
  1. [9]

    Backdoor attacks and countermeasures on deep learning: A comprehensive review

    Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760 ,

    2007 arXiv

  2. [10]

    Hidden trigger backdoor attacks

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pir- siavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence , volume 34, pages 11957–11965, 2020

    2020

  3. [11]

    Back- door learning: A survey, 2022

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Back- door learning: A survey, 2022. URL https://arxiv. org/abs/2007.08745

    2022 arXiv

  4. [12]

    Physical backdoor attacks to lane detection systems in autonomous driving

    Xingshuo Han, Guowen Xu, Yuan Zhou, Xuehuan Yang, Ji- wei Li, and Tianwei Zhang. Physical backdoor attacks to lane detection systems in autonomous driving. In Proceed- ings of the 30th ACM International Conference on Multime- dia, pages 2957–2968, 2022

    2022

  5. [13]

    Towards backdoor attacks against lidar object detection in autonomous driving

    Yan Zhang, Yi Zhu, Zihao Liu, Chenglin Miao, Foad Ha- jiaghajani, Lu Su, and Chunming Qiao. Towards backdoor attacks against lidar object detection in autonomous driving. In Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems, pages 533–547, 2022

    2022

  6. [14]

    Backdoor attacks to deep learning models and countermea- sures: A survey

    Yudong Li, Shigeng Zhang, Weiping Wang, and Hong Song. Backdoor attacks to deep learning models and countermea- sures: A survey. IEEE Open Journal of the Computer Soci- ety, 4:134–146, 2023

    2023

  7. [15]

    A survey of recent backdoor attacks and defenses in large language models.Transactions on Machine Learning Research, 2024

    Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, XI- AOYU XU, Xiaobao Wu, Jie Fu, Feng Yichao, Fengjun Pan, and Anh Tuan Luu. A survey of recent backdoor attacks and defenses in large language models.Transactions on Machine Learning Research, 2024. 1

    2024

  8. [16]

    Anti-backdoor learning: Training clean models on poisoned data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, 34:14900–14912, 2021. 1

    2021

  9. [17]

    Backdoor defense with machine unlearning

    Yang Liu, Mingyuan Fan, Cen Chen, Ximeng Liu, Zhuo Ma, Li Wang, and Jianfeng Ma. Backdoor defense with machine unlearning. In IEEE INFOCOM 2022-IEEE conference on computer communications, pages 280–289. IEEE, 2022

    2022

  10. [18]

    Effective backdoor defense by exploiting sensitivity of poisoned sam- ples

    Weixin Chen, Baoyuan Wu, and Haoqian Wang. Effective backdoor defense by exploiting sensitivity of poisoned sam- ples. Advances in Neural Information Processing Systems , 35:9727–9737, 2022

    2022

  11. [19]

    Backdoor defense via decoupling the training process

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. arXiv preprint arXiv:2202.03423, 2022

    2022 arXiv

  12. [20]

    Adversarially robust anti-backdoor learning

    Qi Zhao and Christian Wressnegger. Adversarially robust anti-backdoor learning. In Proceedings of the 2024 Work- shop on Artificial Intelligence and Security , pages 77–88,

    2024

  13. [21]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bi- mal Viswanath, Haitao Zheng, and Ben Y . Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neu- ral networks. In 2019 IEEE Symposium on Security and Pri- vacy (SP) , pages 707–723, 2019. doi: 10.1109/SP.2...

    2019 doi

  14. [22]

    UMD: Unsupervised model detection for X2X backdoor attacks

    Zhen Xiang, Zidi Xiong, and Bo Li. UMD: Unsupervised model detection for X2X backdoor attacks. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engel- hardt, Sivan Sabato, and Jonathan Scarlett, editors, Pro- ceedings of the 40th International Conference on Machine Le...

    2023

  15. [23]

    Neural cleanse: Identifying and mitigating backdoor attacks in neu- ral networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bi- mal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neu- ral networks. In 2019 IEEE symposium on security and pri- vacy (SP), pages 707–723. IEEE, 2019. 1, 2, 6, 15

    2019

  16. [24]

    Trigger hunting with a topological prior for trojan detection

    Xiaoling Hu, Xiao Lin, Michael Cogswell, Yi Yao, Susmit Jha, and Chao Chen. Trigger hunting with a topological prior for trojan detection. In ICLR 2022, 2022. URL https: //openreview.net/forum/?id=TXsjU8BaibT. 2, 17

    2022

  17. [25]

    9 Backdoor scanning for deep neural networks through k- arm optimization

    Guangyu Shen, Yingqi Liu, Guanhong Tao, Shengwei An, Qiuling Xu, Siyuan Cheng, Shiqing Ma, and Xiangyu Zhang. 9 Backdoor scanning for deep neural networks through k- arm optimization. In International Conference on Machine Learning, pages 9525–9536. PMLR, 2021

    2021

  18. [26]

    Better trigger inversion optimization in backdoor scanning

    Guanhong Tao, Guangyu Shen, Yingqi Liu, Shengwei An, Qiuling Xu, Shiqing Ma, Pan Li, and Xiangyu Zhang. Better trigger inversion optimization in backdoor scanning. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13368–13378, 2022

    2022

  19. [27]

    Rethinking the reverse-engineering of trojan triggers

    Zhenting Wang, Kai Mei, Hailun Ding, Juan Zhai, and Shiqing Ma. Rethinking the reverse-engineering of trojan triggers. Advances in Neural Information Processing Sys- tems, 35:9738–9753, 2022. 2, 16

    2022

  20. [28]

    Uni- corn: A unified backdoor trigger inversion framework.arXiv preprint arXiv:2304.02786, 2023

    Zhenting Wang, Kai Mei, Juan Zhai, and Shiqing Ma. Uni- corn: A unified backdoor trigger inversion framework.arXiv preprint arXiv:2304.02786, 2023. 1, 2, 6, 17

    2023 arXiv

  21. [29]

    Towards reliable and efficient backdoor trigger inver- sion via decoupling benign features

    Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inver- sion via decoupling benign features. In The Twelfth Interna- tional Conference on Learning Representations, 2023. 1

    2023

  22. [30]

    Image synthesis with a single (robust) classifier

    Shibani Santurkar, Andrew Ilyas, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Image synthesis with a single (robust) classifier. Advances in Neu- ral Information Processing Systems, 32, 2019. 1

    2019

  23. [31]

    Single image backdoor in- version via robust smoothed classifiers

    Mingjie Sun and Zico Kolter. Single image backdoor in- version via robust smoothed classifiers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8113–8122, 2023. 1, 2, 6

    2023

  24. [32]

    The trojan detection challenge

    Mantas Mazeika, Dan Hendrycks, Huichen Li, Xiaojun Xu, Sidney Hough, Andy Zou, Arezoo Rajabi, Qi Yao, Zihao Wang, Jian Tian, et al. The trojan detection challenge. In NeurIPS 2022 Competition Track , pages 279–291. PMLR,

    2022

  25. [33]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 1

    2013 arXiv

  26. [34]

    One pixel attack for fooling deep neural networks

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Saku- rai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828–841, October 2019. ISSN 1941-0026. doi: 10.1109/tevc.2019. 2890858. URL http://dx.doi.org/10.1109/ TEVC.201...

    2019

  27. [35]

    On the trade-off between adversarial and backdoor ro- bustness

    Cheng-Hsin Weng, Yan-Ting Lee, and Shan-Hung Brandon Wu. On the trade-off between adversarial and backdoor ro- bustness. Advances in Neural Information Processing Sys- tems, 33:11973–11983, 2020

    2020

  28. [36]

    Towards unified robustness against both back- door and adversarial attacks

    Zhenxing Niu, Yuyao Sun, Qiguang Miao, Rong Jin, and Gang Hua. Towards unified robustness against both back- door and adversarial attacks. IEEE transactions on pattern analysis and machine intelligence, 2024. 1

    2024

  29. [37]

    Django: Detecting trojans in object detection models via gaussian focus calibration

    Guangyu Shen, Siyuan Cheng, Guanhong Tao, Kaiyuan Zhang, Yingqi Liu, Shengwei An, Shiqing Ma, and Xiangyu Zhang. Django: Detecting trojans in object detection models via gaussian focus calibration. Advances in Neural Informa- tion Processing Systems, 36:51253–51272, 2023. 1

    2023

  30. [38]

    H. Wang, Z. Xiang, D. J. Miller, and G. Kesidis. Mm- bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 19–19, Los Alamitos, CA, USA, may 2024. IEEE...

    2024

  31. [39]

    Bet- ter trigger inversion optimization in backdoor scanning

    Guanhong Tao, Guangyu Shen, Yingqi Liu, Shengwei An, Qiuling Xu, Shiqing Ma, Pan Li, and Xiangyu Zhang. Bet- ter trigger inversion optimization in backdoor scanning. In 2022 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR) , pages 13358–13368, 2022. doi:...

    2022

  32. [40]

    Backdoor scanning for deep neural networks through k-arm optimization

    Guangyu Shen, Yingqi Liu, Guanhong Tao, Shengwei An, Qiuling Xu, Siyuan Cheng, Shiqing Ma, and Xiangyu Zhang. Backdoor scanning for deep neural networks through k-arm optimization. arXiv preprint arXiv:2102.05123, 2021. 2, 6, 17

    2021 arXiv

  33. [41]

    Towards reliable and efficient backdoor trigger inver- sion via decoupling benign features

    Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inver- sion via decoupling benign features. In International Con- ference on Learning Representations, 2024. URL https: //openreview.net/forum?id=2fDSEWGvR0. 2, 6, 16

    2024

  34. [42]

    Model x-ray: Detecting back- doored models via decision boundary

    Yanghao Su, Jie Zhang, Ting Xu, Tianwei Zhang, Weim- ing Zhang, and Nenghai Yu. Model x-ray: Detecting back- doored models via decision boundary. In Proceedings of the 32nd ACM International Conference on Multimedia , pages 10296–10305, 2024. 2

    2024

  35. [43]

    Mitigating backdoor poisoning at- tacks through the lens of spurious correlation, 2023

    Xuanli He, Qiongkai Xu, Jun Wang, Benjamin Rubin- stein, and Trevor Cohn. Mitigating backdoor poisoning at- tacks through the lens of spurious correlation, 2023. URL https://arxiv.org/abs/2305.11596. 3

    2023 arXiv

  36. [44]

    Shortcuts everywhere and nowhere: Ex- ploring multi-trigger backdoor attacks, 2024

    Yige Li, Jiabo He, Hanxun Huang, Jun Sun, Xingjun Ma, and Yu-Gang Jiang. Shortcuts everywhere and nowhere: Ex- ploring multi-trigger backdoor attacks, 2024. URL https: //arxiv.org/abs/2401.15295. 3

    2024

  37. [45]

    Glide: Towards photorealistic image generation and editing with text-guided diffusion models.arXiv preprint arXiv:2112.10741, 2021

    Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models.arXiv preprint arXiv:2112.10741, 2021. 4, 6, 7, 8

    2021 arXiv

  38. [46]

    Back- door learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Back- door learning: A survey. IEEE Transactions on Neural Net- works and Learning Systems, 2022. 4

    2022

  39. [47]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in Neural Informa- tion Processing Systems, 34:8780–8794, 2021. 7, 8

    2021

  40. [48]

    Score-based generative modeling through stochastic differential equa- tions

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Ab- hishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equa- tions. arXiv preprint arXiv:2011.13456, 2020. 7, 8

    2011 arXiv

  41. [49]

    Backdoor- bench: A comprehensive benchmark of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoor- bench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems , 35: 10546–10559, 2022. 6, 18

    2022

  42. [50]

    The trojai software framework: An opensource tool for embedding trojans into deep 10 learning models, 2020

    UCF-ML-Research. The trojai software framework: An opensource tool for embedding trojans into deep 10 learning models, 2020. https://github.com/UCF-ML- Research/TrojLLM. 6, 18

    2020

  43. [51]

    Abs: Scanning neu- ral networks for back-doors by artificial brain stimulation

    Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. Abs: Scanning neu- ral networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , CCS ’19, page 1265–1...

    2019

  44. [52]

    Trigger hunting with a topological prior for trojan detection

    Xiaoling Hu, Xiao Lin, Michael Cogswell, Yi Yao, Susmit Jha, and Chao Chen. Trigger hunting with a topological prior for trojan detection. In International Conference on Learn- ing Representations, 2022. 6

    2022

  45. [53]

    Scanning trojaned models using out-of-distribution samples

    Hossein Mirzaei, Ali Ansari, Bahar Dibaei Nia, Mo- jtaba Nafez, Moein Madadi, Sepehr Rezaee, Zeinab Sadat Taghavi, Arad Maleki, Kian Shamsaie, Mahdi Hajialilue, Ja- far Habibi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Scanning trojaned models using out-of-distribution s...

    2024

  46. [54]

    Label-consistent backdoor attacks

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019. URL https://arxiv.org/ abs/1912.02771. 14

    1912 arXiv

  47. [55]

    Trojan- ing attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojan- ing attack on neural networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-221, 2018 . The Inter- n...

    2018

  48. [56]

    Certified robustness to label-flipping attacks via ran- domized smoothing

    Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and Zico Kolter. Certified robustness to label-flipping attacks via ran- domized smoothing. In International Conference on Ma- chine Learning, pages 8230–8241. PMLR, 2020. 14

    2020

  49. [57]

    A unified survey on anomaly, novelty, open-set, and out-of-distribution detection: Solutions and future chal- lenges

    Mohammadreza Salehi, Hossein Mirzaei, Dan Hendrycks, Yixuan Li, Mohammad Hossein Rohban, and Mohammad Sabokrou. A unified survey on anomaly, novelty, open-set, and out-of-distribution detection: Solutions and future chal- lenges. arXiv preprint arXiv:2110.14051, 2021. 15

    arXiv

  50. [58]

    Fake it until you make it: Towards accurate near-distribution novelty detection

    Hossein Mirzaei, Mohammadreza Salehi, Sajjad Shahabi, Efstratios Gavves, Cees GM Snoek, Mohammad Sabokrou, and Mohammad Hossein Rohban. Fake it until you make it: Towards accurate near-distribution novelty detection. In The eleventh international conference on learning represe...

    2022

  51. [59]

    Mathis, Mahdieh So- leymani Baghshah, Mohammad Sabokrou, and Moham- mad Hossein Rohban

    Hossein Mirzaei, Mojtaba Nafez, Moein Madadi, Arad Maleki, Mahdi Hajialilue, Zeinab Sadat Taghavi, Sepehr Rezaee, Ali Ansari, Bahar Dibaei Nia, Kian Shamsaie, Mo- hammadreza Salehi, Mackenzie W. Mathis, Mahdieh So- leymani Baghshah, Mohammad Sabokrou, and Moham- mad Hossein Ro...

    2025 arXiv

  52. [60]

    Universal novelty detection through adaptive con- trastive learning

    Hossein Mirzaei, Mojtaba Nafez, Mohammad Jafari, Mo- hammad Bagher Soltani, Mohammad Azizmalayeri, Jafar Habibi, Mohammad Sabokrou, and Mohammad Hossein Ro- hban. Universal novelty detection through adaptive con- trastive learning. In Proceedings of the IEEE/CVF Con- ference o...

    2024

  53. [61]

    Adversarially ro- bust out-of-distribution detection using lyapunov-stabilized embeddings

    Hossein Mirzaei and Mackenzie W Mathis. Adversarially ro- bust out-of-distribution detection using lyapunov-stabilized embeddings. arXiv preprint arXiv:2410.10744, 2024

    2024 arXiv

  54. [62]

    Rodeo: Robust outlier detection via exposing adaptive out-of-distribution samples

    Hossein Mirzaei, Mohammad Jafari, Hamid Reza Dehbashi, Ali Ansari, Sepehr Ghobadi, Masoud Hadi, Arshia Soltani Moakhar, Mohammad Azizmalayeri, Mahdieh Soleymani Baghshah, and Mohammad Hossein Rohban. Rodeo: Robust outlier detection via exposing adaptive out-of-distribution sam...

    2024

  55. [63]

    Killing it with zero-shot: Adversar- ially robust novelty detection

    Hossein Mirzaei, Mohammad Jafari, Hamid Reza Dehbashi, Zeinab Sadat Taghavi, Mohammad Sabokrou, and Moham- mad Hossein Rohban. Killing it with zero-shot: Adversar- ially robust novelty detection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal...

    2024

  56. [64]

    Luc P. J. Str ¨ater, Mohammadreza Salehi, Efstratios Gavves, Cees G. M. Snoek, and Yuki M. Asano. Generalad: Anomaly detection across domains by attending to distorted fea- tures, 2024. URL https://arxiv.org/abs/2407. 12427

    2024

  57. [65]

    Mitigating spurious negative pairs for robust industrial anomaly detec- tion, 2025

    Hossein Mirzaei, Mojtaba Nafez, Jafar Habibi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Mitigating spurious negative pairs for robust industrial anomaly detec- tion, 2025. URL https://arxiv.org/abs/2501. 15434

    2025

  58. [66]

    Alireza Salehi, Mohammadreza Salehi, Reshad Hosseini, Cees G. M. Snoek, Makoto Yamada, and Mohammad Sabokrou. Crane: Context-guided prompt learning and at- tention refinement for zero-shot anomaly detections, 2025. URL https://arxiv.org/abs/2504.11055

    2025 arXiv

  59. [67]

    Patch- guard: Adversarially robust anomaly detection and local- ization through vision transformers and pseudo anomalies,

    Mojtaba Nafez, Amirhossein Koochakian, Arad Maleki, Jafar Habibi, and Mohammad Hossein Rohban. Patch- guard: Adversarially robust anomaly detection and local- ization through vision transformers and pseudo anomalies,

  60. [68]

    Single image backdoor in- version via robust smoothed classifiers

    Mingjie Sun and Zico Kolter. Single image backdoor in- version via robust smoothed classifiers. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023. 16

    2023

  61. [69]

    Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems, 2019

    Wenbo Guo, Lun Wang, Xinyu Xing, Min Du, and Dawn Song. Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems, 2019. 17

    2019

  62. [70]

    Miller, and George Kesidis

    Zhen Xiang, David J. Miller, and George Kesidis. Detection of backdoors in trained classifiers without access to the train- ing set. IEEE Transactions on Neural Networks and Learn- ing Systems, 33(3):1177–1191, 2022. doi: 10.1109/TNNLS. 2020.3041202. 17

    2022

  63. [71]

    Dickerson

    Paul Munro, Ali Shafahi, Tom Goldstein, and John P. Dickerson. Fast is better than free: Revisiting adver- sarial training. arXiv preprint arXiv:2007.14169 , 2020. 11 URL https : / / arxiv . org / abs / 2007 . 14169. https://arxiv.org/abs/2007.14169. 18

    2007 arXiv

  64. [72]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. URL https : / / www . cs . toronto . edu /˜kriz / learning-features-2009-TR.pdf . 18

    2009

  65. [73]

    Detection of traffic signs in real-world images: The german traffic sign detection bench- mark

    Sebastian Houben, Johannes Stallkamp, Jan Salmen, Marc Schlipsing, and Christian Igel. Detection of traffic signs in real-world images: The german traffic sign detection bench- mark. In International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE, 2013. 18

    2013

  66. [74]

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei- Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255, 2009. doi: 10.1109/CVPR. 2009.5206848. 18 12 DISTIL: Data-Free Inversion of Su...

    2009

  67. [76]

    Outputs: Decision (Trojaned / Clean) and, if Trojaned, the corresponding trigger δtar src

    Algorithm Block Algorithm 1 Trigger Reconstruction and Trojan Detection via Diffusion Guidance Inputs: Classifier f under test, pretrained diffusion model with denoising functionsµθ(·) and Σθ(·), hyperparameters λ1, λ2, candidate label sets Ysrc (source) and Ytar (target) with...

  68. [77]

    DDPMs have emerged as a promising approach for gener- ating high-quality data across various domains, particularly in image and video synthesis

    Additional Technical Background Denoising Diffusion Probabilistic Models (DDPMs). DDPMs have emerged as a promising approach for gener- ating high-quality data across various domains, particularly in image and video synthesis. They operate by reversing a forward process that g...

  69. [78]

    As expected, these patterns ap- pear noisy and lack coherent structure, demonstrating that DISTIL does not erroneously extract trigger-like features from benign systems

    Visualization of the Generated Backdoor Trigger Figure 4 presents the trigger patterns generated by DIS- TIL when applied to clean models across multiple rounds (Rounds 1, 2, 3, 4, and 11). As expected, these patterns ap- pear noisy and lack coherent structure, demonstrating t...

  70. [79]

    Additional Experimental Results See Tables 5, and 6

  71. [80]

    BadNet [1] introduces a hidden pattern into datasets dur- ing training, often a compact and noticeable visual element

    Details of Evaluation and Experimental Setup Implementation Details for the Backdoor Attacks This section offers comprehensive explanations of the back- door attacks utilized in our research. BadNet [1] introduces a hidden pattern into datasets dur- ing training, often a compa...

  72. [81]

    blind spots,

    Previous Trojan Scanning methods Review of the Methods Trigger estimation plays several roles in defense strategies against Trojan attacks. The most important is determining whether a model is benign or Trojaned, a task that closely resembles out-of-distribution detection [57–...

  73. [82]

    BackdoorBench Benchmark

    Details about the Benchmarks and Datasets We provide a brief explanation of the datasets we used. BackdoorBench Benchmark. BackdoorBench [49] is a comprehensive benchmark for backdoor learning, providing a standardized platform for evaluating backdoor attacks and defenses. It ...

  74. [83]

    The full ImageNet repository remains a cornerstone for training deep neural networks. 19

  75. [2025]

    URL https://arxiv.org/abs/2506.09237. 15

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.