Pith. sign in

REVIEW 4 major objections 5 minor 3 cited by

A five-axis taxonomy organizes the backdoor attack and defense literature, exposing supply-chain and hardware threats as the undefended frontier.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A literature review that classifies backdoor attacks and defenses in computer vision into a five-axis taxonomy and identifies supply-chain, hardware, and cross-task evaluation as open gaps.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection A broad, useful survey with a genuinely helpful five-axis taxonomy, but missing methodology and broken internal references mean it needs major revision before it can be the reference it aspires to be. the 4 major comments →

arxiv 2509.07504 v1 pith:2UVQ52ES submitted 2025-09-09 cs.CR

Backdoor Attacks and Defenses in Computer Vision Domain: A Survey

Bilal Hussain Abbasi , Yanjun Zhang , Leo Zhang , Shang Gao This is my paper
classification cs.CR
keywords backdoor attacktrojan attackcomputer visionthreat taxonomydataset poisoningbackdoor defensetrigger typesclean-label attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey tries to establish that the scattered backdoor-attack and defense literature in computer vision can be understood through one shared coordinate system with five axes: injection stage, trigger type, labeling strategy, representation stage, and target task. If true, researchers get a common language for comparing attacks that currently look unrelated—a sticker on a stop sign, a warping transform, a poisoned encoder checkpoint, a single flipped bit in memory. The payoff is practical: the same axes reveal which defenses actually cover which attacks, and where no defense exists. The paper identifies the missing pieces as supply-chain and hardware threats, certifiable defenses, and cross-task benchmarks, and recommends layered defenses and adaptive evaluation.

Core claim

The survey's central claim is that the entire backdoor literature in computer vision can be organized along five independent axes: where in the pipeline the backdoor is injected (dataset poisoning, model/parameter modification, inference time), what the trigger looks like (patch, blended/frequency, semantic, transformation), how poisoned labels are assigned (dirty-label vs. clean-label/feature-collision), where in the model's representations the backdoor lives (instance-specific, class-level/manifold, neuron/parameter hijacking, distributed encodings), and what task is targeted (classification, detection, segmentation, video, multimodal). The paper further claims that using the same five axe

What carries the argument

The five-axis taxonomy itself is the load-bearing object: injection stage × trigger type × labeling strategy × representation stage × target task. It functions as a coordinate system for the literature; each attack or defense is placed in a cell, which lets the survey map which defenses counter which attacks and expose empty cells. The mirrored structure—using the same axes for attacks and defenses—is what produces the gap analysis.

Load-bearing premise

The survey's load-bearing assumption is that the papers it selected are representative of the whole backdoor literature; because it gives no systematic search strategy or inclusion criteria, the taxonomy and the list of gaps could reflect what the authors happened to include.

What would settle it

A reproducible, systematic literature search over a fixed set of venues and years that finds a substantial family of attacks or defenses not placeable in any cell of the five-axis taxonomy—or that shows the claimed gaps are already covered by published methods—would falsify the survey's central organizational claim.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Defenses that work on reusable patch triggers (reverse-engineering, spectral and activation filters) should not be expected to cover sample-specific, distributed, or parameter-space backdoors; evaluation should state which attack cell is being addressed.
  • Because backdoors can enter via pre-trained encoders and bit-flips, model consumers need provenance, checkpoint auditing, and hardware-integrity checks in addition to dataset hygiene.
  • Standard classification benchmarks are insufficient; results should be reported on detection, segmentation, video, and multimodal tasks with both clean utility and attack success metrics.
  • Layered defense is the recommended posture: data sanitization plus training-time hardening plus post-training inspection and repair plus runtime checks, evaluated under adaptive attackers aware of the defense.
  • Certifiable defenses for restricted trigger families and standardized cross-task benchmarks are the open directions the survey highlights.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same five-axis scheme could be applied to backdoors in NLP, audio, and multimodal systems as a test of whether the taxonomy is general or vision-specific.
  • A practical benchmark could assign each attack and defense a cell coordinate, allowing the field to quantify coverage—for example, the fraction of attack cells with at least one published defense—which this survey does not compute.
  • The taxonomy implies that combining defenses from different axes, such as activation-space purification plus parameter-integrity checks plus runtime consistency tests, is likely to be more productive than designing another single detector.
  • If the gap analysis is right, near-term investment in model-provenance and hardware-fault tooling may have higher payoff than further refinements of dataset sanitization.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This manuscript surveys backdoor attacks and defenses in computer vision. It proposes a five-axis taxonomy for attacks—injection stage, trigger type, labeling strategy, representation stage, and target task—and claims that defenses can be organized along the same mirrored axes. The paper reviews representative methods in each category, defines common evaluation metrics, identifies persistent gaps (supply-chain and hardware threats, certifiable defenses, cross-task benchmarks), and offers practical recommendations for layered defenses and adaptive evaluation. The central contribution is organizational: a unified framework intended to help researchers map which defenses plausibly counter which attacks and where open problems remain.

Significance. If the taxonomy is accepted, the paper provides a useful shared vocabulary for a large and fragmented literature. The survey covers many recent works and makes concrete, falsifiable claims about under-explored areas. Its strengths include a broad reference set, explicit evaluation metrics, and practical recommendations that go beyond a simple list of papers. However, the significance is conditional on the representativeness of the included papers: the gap claims are only as strong as the unstated selection of surveyed works. The paper does not include code or machine-checked artifacts, but the organizational contribution could still be valuable to practitioners and researchers.

major comments (4)
  1. [General (Introduction, Backdoor Attacks, Backdoor Defenses, Conclusion)] The survey's central claims—that the five-axis taxonomy organizes the literature and that supply-chain/hardware threats, certifiable defenses, and cross-task benchmarks are persistent gaps—presuppose that the included papers are representative. The text repeatedly says it 'synthesizes representative attacks and defenses,' but no search strategy, inclusion/exclusion criteria, or coverage analysis is given. For a fast-moving field this selection could bias both the taxonomy and the gap analysis. Please add a methodology subsection (databases, years, keyword strings, screening process) and a coverage table or a comparison against prior surveys.
  2. [Preliminaries, 'Threat-model axes'] The taxonomy is defined inconsistently. The abstract and the Backdoor Attacks chapter use five axes: injection stage, trigger type, labeling strategy, representation stage, and target task. The Preliminaries section lists only four of these and replaces 'target task' with 'defender access assumptions.' This makes the central framework ambiguous. Please reconcile the two lists and state explicitly whether defender access is a sixth/auxiliary dimension.
  3. [Backdoor Defenses, introduction and 'Injection Stage'] The claimed mirrored defense taxonomy is not actually mirrored. The defense section places 'Post-training Model Inspection and Repair' and 'Test-time Input Filtering and Mitigation' under 'Injection Stage,' but on the attack side injection stage is only the point of implantation (dataset poisoning, parameter modification, inference-time injection). Similarly, the defense 'Trigger type' subsections mix pipeline-stage methods with trigger-specific ones. The mirroring claim in the abstract and intro is therefore overstated. Either align the defense headings with the attack axes or qualify the claim as a loose mapping.
  4. [Backdoor Attacks / Backdoor Defenses overall] Several load-bearing statements about where defenses succeed or fail are made without supporting evidence or comparative data. For example, the abstract claims that 'many classical sanitization and reverse-engineering tools are effective against reusable patch attacks but struggle with input-aware, sample-specific, or parameter-space backdoors,' but no table or systematic per-defense evaluation is provided. Since the paper's recommendations depend on these claims, I ask for a comparative summary (even qualitative) that pairs each defense family with the attack families against which it has been validated, including whether adaptive attackers were considered.
minor comments (5)
  1. [Backdoor Defenses, introduction] The internal references to sections are missing: 'Section surveyspre-training...', 'Section coverstrigger-aware...', etc. Please insert the correct section numbers/names.
  2. [Representation Stage, 'Instance-specific Representation Attacks'] Typo: 'These encoded bit-strings, whicha are not human-readable text' should be 'which are'.
  3. [References] Reference formatting is inconsistent: e.g., 'Nguyen, A.; and Tran, A. 2020. Input-Aware Dynamic Backdoor Attack.' lacks a venue; 'Liu et al. 2017' is missing publication details; capitalization differs across titles. Please standardize.
  4. [Preliminaries] The 'Defender access assumptions' bullet is described as part of the taxonomy but is not used as an organizing axis in the rest of the paper. Clarify its status (auxiliary dimension, not one of the five axes).
  5. [Introduction / Related work] The paper cites Gao et al. 2020 but does not systematically compare its taxonomy and coverage with prior surveys. Adding a short positioning paragraph would help readers understand what is new relative to existing surveys.

Circularity Check

0 steps flagged

No circularity found: the survey's taxonomy and gap claims are qualitative organizational claims, not derived from fitted inputs or self-citation chains.

full rationale

This is a literature survey, not a derivation or an empirical study with fitted parameters. The five-axis taxonomy (injection stage, trigger type, labeling strategy, representation stage, target task) is introduced in the Preliminaries as a descriptive framework and then applied to organize existing attacks and defenses; the paper itself says 'This survey adopts a mirrored, multi-axis taxonomy' (Introduction), which is an organizing choice rather than a result derived from the surveyed papers. The identified 'persistent gaps' (supply-chain and hardware threats, certifiable defenses, cross-task benchmarks) are qualitative judgments about the literature and do not reduce by construction to the set of included papers. No equations are produced whose output equals an input, no parameter is fitted and then renamed as a prediction, and no uniqueness theorem from prior work is invoked to forbid alternative taxonomies. Some references share author surnames with the survey authors (e.g., Gao et al. 2020, STRIP 2019), but these citations support standard background or specific defense techniques and are not load-bearing for the paper's central organizational claims. The absence of a systematic search strategy or inclusion criteria is a representativeness/selection limitation, not a circularity. Nothing in the manuscript's argument chain is equivalent to its own input by definition.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 0 invented entities

No free parameters because no derivation is performed. The central synthesis rests on the accuracy of cited experimental claims and on the representativeness of the chosen literature.

axioms (2)
  • domain assumption The cited papers' reported attack success rates and defense effectiveness are accurate representations of the underlying methods.
    The survey synthesizes claims from cited papers without independent verification; its gap analysis depends on these claims being reliable.
  • domain assumption The selected papers are representative of the broader backdoor literature.
    No systematic search or inclusion criteria are provided, so the taxonomy and identified gaps rest on the representative-ness of the chosen references.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Backdoor Attacks and Defenses in Computer Vision Domain: A Survey." pith.science (2026). https://pith.science/paper/2UVQ52ES

@misc{pith2026250907504,
  author       = {Pith},
  title        = {Pith review of: Backdoor Attacks and Defenses in Computer Vision Domain: A Survey},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2UVQ52ES}},
  note         = {Machine review of arXiv:2509.07504}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Backdoor (trojan) attacks embed hidden, controllable behaviors into machine-learning models so that models behave normally on benign inputs but produce attacker-chosen outputs when a trigger is present. This survey reviews the rapidly growing literature on backdoor attacks and defenses in the computer-vision domain. We introduce a multi-dimensional taxonomy that organizes attacks and defenses by injection stage (dataset poisoning, model/parameter modification, inference-time injection), trigger type (patch, blended/frequency, semantic, transformation), labeling strategy (dirty-label vs. clean-label / feature-collision), representation stage (instance-specific, manifold/class-level, neuron/parameter hijacking, distributed encodings), and target task (classification, detection, segmentation, video, multimodal). For each axis we summarize representative methods, highlight evaluation practices, and discuss where defenses succeed or fail. For example, many classical sanitization and reverse-engineering tools are effective against reusable patch attacks but struggle with input-aware, sample-specific, or parameter-space backdoors and with transfer via compromised pre-trained encoders or hardware bit-flips. We synthesize trends, identify persistent gaps (supply-chain and hardware threats, certifiable defenses, cross-task benchmarks), and propose practical guidelines for threat-aware evaluation and layered defenses. This survey aims to orient researchers and practitioners to the current threat landscape and pressing research directions in secure computer vision.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks

    cs.CR 2026-05 unverdicted novelty 7.0

    Backdoors can be realized as statistically natural latent directions in modern neural networks, achieving high attack success with negligible clean accuracy loss and resisting existing defenses.

  2. Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks

    cs.CR 2026-05 unverdicted novelty 7.0

    Backdoors can be embedded in ResNet and ViT models as statistically indistinguishable latent directions, reducing cryptographic undetectability to an intractable hypothesis test over parameter distributions.

  3. Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs

    cs.CR 2026-06 unverdicted novelty 6.0

    Embedding and removing a dummy backdoor reduces unknown backdoor success in generative LLMs by targeting shared trigger-activated internal mechanisms.

Reference graph

Works this paper leans on

13 extracted references · 7 canonical work pages · cited by 2 Pith papers · 5 internal anchors

  1. [7]

    Twin Trigger Generative Networks for Backdoor Attacks against Object Detection

    Invisible backdoor attacks on deep neural networks via steganography and regularization.IEEE Transactions on Dependable and Secure Computing, 18(5): 2088–2105. Li, X.; Meng, Y .; Chen, J.; Luo, L.; and Zeng, Q. 2025. Rowhammer-Based Trojan Injection: One Bit Flip Is Suf- ficient for Backdooring DNNs. InUSENIX Security Sympo- sium. Li, X.; Xiang, Z.; Mille...

    work page internal anchor Pith review Pith/arXiv arXiv 2088

  2. [9]

    Ma, H.; Li, Y .; Gao, Y .; Abuadbba, A.; Zhang, Z.; Fu, A.; Kim, H.; Al-Sarawi, S

    Test-time backdoor attacks on multimodal large lan- guage models.arXiv preprint arXiv:2402.08577. Ma, H.; Li, Y .; Gao, Y .; Abuadbba, A.; Zhang, Z.; Fu, A.; Kim, H.; Al-Sarawi, S. F.; Surya, N.; and Abbott, D. 2022. Dangerous cloaking: Natural trigger based backdoor attacks on object detectors in the physical world.arXiv preprint arXiv:2201.08619. Mao, J...

    Pith/arXiv arXiv 2022

  3. [10]

    Backdoor Pre-trained Models Can Transfer to All

    Adversarial preprocessing: Understanding and pre- venting{Image-Scaling}attacks in machine learning. In 29th USENIX Security Symposium (USENIX Security 20), 1363–1380. Quiring, E.; and Rieck, K. 2020. Backdooring and poisoning neural networks with image-scaling attacks. In2020 IEEE Security and Privacy Workshops (SPW), 41–47. IEEE. Razmi, F.; Lou, J.; and...

    work page internal anchor Pith review Pith/arXiv arXiv 2020

  4. [13]

    InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, 21850–21858

    Dataelixir: Purifying poisoned dataset to mitigate backdoor attacks via diffusion models. InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, 21850–21858. Zhu, C.; Huang, W. R.; Li, H.; Taylor, G.; Studer, C.; and Goldstein, T. 2019. Transferable clean-label poisoning at- tacks on deep neural nets. InInternational Conference on Mac...

    work page 2019

  5. [199]

    Lu, D.; Pang, T.; Du, C.; Liu, Q.; Yang, X.; and Lin, M

    Springer. Lu, D.; Pang, T.; Du, C.; Liu, Q.; Yang, X.; and Lin, M

    work page

  6. [2019]

    Han, B.; Yao, Q.; Yu, X.; Niu, G.; Xu, M.; Hu, W.; Tsang, I.; and Sugiyama, M

    Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems.arXiv preprint arXiv:1908.01763. Han, B.; Yao, Q.; Yu, X.; Niu, G.; Xu, M.; Hu, W.; Tsang, I.; and Sugiyama, M. 2018. Co-teaching: Robust training of deep neural networks with extremely noisy labels.Advances in neural information processing systems, 31. Han, T.; S...

    Pith/arXiv arXiv 1908

  7. [2020]

    InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 301–310

    Universal litmus patterns: Revealing backdoor attacks in cnns. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 301–310. Lan, H.; Gu, J.; Torr, P.; and Zhao, H. 2024. Influencer Back- door Attack on Semantic Segmentation. InThe Twelfth In- ternational Conference on Learning Representations. Levine, A.; and Feizi, S. 202...

    Pith/arXiv arXiv 2024

  8. [2021]

    Wei, C.; Lee, Y .; Chen, K.; Meng, G.; and Lv, P

    Backdoor attack through frequency domain.arXiv preprint arXiv:2111.10991. Wei, C.; Lee, Y .; Chen, K.; Meng, G.; and Lv, P. 2023. Aliasing backdoor attacks on pre-trained models. In32nd USENIX Security Symposium (USENIX Security 23), 2707– 2724. Wenger, E.; Bhattacharjee, R.; Bhagoji, A. N.; Passananti, J.; Andere, E.; Zheng, H.; and Zhao, B. Y . 2022. Na...

    Pith/arXiv arXiv 2023

  9. [2022]

    InEu- ropean conference on computer vision, 396–412

    Baddet: Backdoor attacks on object detection. InEu- ropean conference on computer vision, 396–412. Springer. Chen, B.; Carvalho, W.; Baracaldo, N.; Ludwig, H.; Ed- wards, B.; Lee, T.; Molloy, I.; and Srivastava, B. 2018. De- tecting backdoor attacks on deep neural networks by activa- tion clustering.arXiv preprint arXiv:1811.03728. Chen, H.; Fu, C.; Zhao,...

    Pith/arXiv arXiv 2018

  10. [2023]

    Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggers

    Versatile backdoor attack with visible, semantic, sample-specific, and compatible triggers.arXiv preprint arXiv:2306.00816. Wang, T.; Yao, Y .; Xu, F.; An, S.; Tong, H.; and Wang, T

    work page internal anchor Pith review Pith/arXiv arXiv

  11. [2024]

    Megatron: Evasive Clean-Label Backdoor Attacks against Vision Transformer

    Backdoor attack with sparse and invisible trigger. IEEE Transactions on Information Forensics and Security, 19: 6364–6376. Gao, Y .; Wu, D.; Zhang, J.; Gan, G.; Xia, S.-T.; Niu, G.; and Sugiyama, M. 2023b. On the effectiveness of adver- sarial training against backdoor attacks.IEEE Transactions on Neural Networks and Learning Systems, 35(10): 14878– 14888...

    work page internal anchor Pith review Pith/arXiv arXiv 2019

  12. [2025]

    Prototype Guided Backdoor Defense

    Prototype Guided Backdoor Defense.arXiv preprint arXiv:2503.20925. Bagdasaryan, E.; Veit, A.; Hua, Y .; Estrin, D.; and Shmatikov, V . 2020. How to backdoor federated learning. In International conference on artificial intelligence and statis- tics, 2938–2948. PMLR. Barni, M.; Kallas, K.; and Tondi, B. 2019. A new backdoor attack in cnns by training set c...

    work page internal anchor Pith review Pith/arXiv arXiv 2020

  13. [4139]

    Hou, R.; Huang, T.; Yan, H.; Ke, L.; and Tang, W

    PMLR. Hou, R.; Huang, T.; Yan, H.; Ke, L.; and Tang, W. 2023. A stealthy and robust backdoor attack via frequency domain transform.World Wide Web (WWW), 26(5): 2767–2783. Huang, K.; Li, Y .; Wu, B.; Qin, Z.; and Ren, K. 2022. Back- door Defense via Decoupling the Training Process.arXiv preprint arXiv:2202.03423. Huang, W. R.; Geiping, J.; Fowl, L.; Taylor...

    Pith/arXiv arXiv 2023

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.