Pith. sign in

REVIEW 2 major objections 50 references

Clean-label backdoor Mirage causes 73% misclassification in LiDAR 3D detectors using only 0.5% poisoned samples.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Mirage achieves 73% misclassification success on LiDAR 3DOD models with 0.5% poisoning rate via label-consistent trigger injection.

T0 review reviewed 2026-06-26 challenge →

load-bearing objection Mirage claims a clean-label black-box backdoor for LiDAR 3DOD at 0.5% poisoning with 73% success, but the abstract supplies zero details on trigger construction or evaluation controls. the 2 major comments →

arxiv 2606.20752 v1 pith:X3N5D6GC submitted 2026-06-18 cs.CV cs.CR

Mirage: a Clean-Label Backdoor against LiDAR 3D Object Detection

Ziba Parsons , Ang Li This is my paper
classification cs.CV cs.CR
keywords backdoor attackclean-labelLiDAR3D object detectionpoisoning attackblack-box attackautonomous systems
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces Mirage, a black-box clean-label backdoor attack on LiDAR 3D object detection. By injecting a small fraction of label-consistent poisoned samples with a hidden trigger, the attack trains the model to associate the trigger with a specific target class. The model then misclassifies objects containing the trigger as the target class at inference time. This preserves normal behavior on clean data and requires no label changes or internal model access. Such an attack matters because it demonstrates a realistic threat to autonomous vehicle perception systems that rely on these detectors.

Core claim

Mirage is a black-box and clean-label backdoor attack against deep neural network-based LiDAR 3D object detection. It injects a small number of label-consistent poisoning samples into the training set, causing the model to learn a malicious association between a trigger pattern and an attacker-chosen target class while preserving normal training semantics. As a result, the compromised model behaves normally on benign inputs yet systematically misclassifies triggered objects as the target class during deployment. Evaluations on multiple state-of-the-art models and datasets confirm high success rates with low poisoning.

What carries the argument

Label-consistent poisoning samples that embed a trigger pattern to create a malicious association with an attacker-chosen target class.

Load-bearing premise

The attacker can successfully inject a small number of label-consistent poisoning samples containing an effective trigger pattern into the training dataset without the poisoning being detected.

What would settle it

Training a LiDAR 3DOD model on a dataset with the described 0.5% poisoned samples and checking whether the misclassification rate of triggered objects to the target class falls below 20% on held-out test scenes.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • The attack achieves 73% misclassification success with a poisoning rate of only 0.5%.
  • Detection performance on benign inputs stays close to that of unpoisoned models.
  • The attack requires no white-box access and no modification of sample labels.
  • It applies to multiple state-of-the-art LiDAR 3D object detection models and benchmark datasets.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Backdoor defenses for 3D detection may need to inspect input patterns rather than rely on label consistency checks.
  • The same poisoning approach could be tested on other 3D perception tasks such as point-cloud segmentation.
  • Trigger patterns that work in one dataset may require scene-specific adaptation to maintain effectiveness across varied environments.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 0 minor

Summary. The paper introduces Mirage, a black-box clean-label backdoor attack on LiDAR 3D object detection models. It injects a small number of label-consistent poisoning samples (0.5% rate) containing a trigger pattern into the training set, causing the compromised model to misclassify triggered objects as an attacker-chosen target class at inference while behaving normally on benign inputs. The authors claim a 73% misclassification success rate across multiple state-of-the-art 3DOD models and benchmark datasets, with clean detection performance remaining close to that of benign models.

Significance. If the empirical results are reproducible and the attack generalizes as claimed, this would represent a meaningful advance in demonstrating practical backdoor threats to safety-critical autonomous perception systems. The clean-label and low-poisoning-rate aspects make the attack more realistic than prior work requiring label flips or white-box access, potentially motivating new defenses for 3D point-cloud models.

major comments (2)
  1. [Abstract] Abstract: the central claim of 73% misclassification success rate at 0.5% poisoning rate is presented without any description of trigger design, how the pattern is realized in point clouds while preserving label consistency, the precise definition of attack success rate in a detection setting, or the experimental controls used. This absence prevents verification that the reported numbers support the claim.
  2. [Abstract] The manuscript supplies no information on the trigger construction method or cross-scene generalization procedure, which are load-bearing for the weakest assumption that the trigger will reliably activate the backdoor across varied LiDAR scenes and models.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. We agree that the abstract would benefit from additional context on the trigger and success metric to better support the central claims. We will revise the abstract accordingly and address the points below.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the central claim of 73% misclassification success rate at 0.5% poisoning rate is presented without any description of trigger design, how the pattern is realized in point clouds while preserving label consistency, the precise definition of attack success rate in a detection setting, or the experimental controls used. This absence prevents verification that the reported numbers support the claim.

    Authors: We agree the abstract is too terse. In the revision we will expand it to briefly note: (i) the trigger is a sparse, object-centric point pattern inserted at fixed relative offsets; (ii) label consistency is preserved by adding the pattern without altering the ground-truth bounding box or class; (iii) attack success rate is defined as the fraction of triggered objects that are both detected and classified as the attacker-chosen target; and (iv) results are obtained on multiple 3DOD architectures (PointPillars, SECOND, PV-RCNN) and datasets (KITTI, nuScenes) with standard clean-data controls. Full algorithmic and experimental details remain in Sections 3 and 4. revision: yes

  2. Referee: [Abstract] The manuscript supplies no information on the trigger construction method or cross-scene generalization procedure, which are load-bearing for the weakest assumption that the trigger will reliably activate the backdoor across varied LiDAR scenes and models.

    Authors: We will add a concise clause to the abstract stating that the trigger is constructed via an optimization procedure that balances effectiveness and sparsity while remaining object-centric (hence scene-agnostic). Cross-scene generalization is demonstrated empirically in Section 4 across diverse urban and highway scenes; the object-centric design avoids reliance on background geometry. These additions will make the abstract self-contained without duplicating the technical exposition in the body. revision: yes

Circularity Check

0 steps flagged

No significant circularity

full rationale

This is an empirical security paper describing a clean-label backdoor attack and reporting measured attack success rates (e.g., 73% misclassification at 0.5% poisoning) on LiDAR 3DOD models. No derivation chain, first-principles prediction, fitted parameter renamed as output, or self-citation load-bearing theorem exists; the claims rest on experimental results rather than any reduction of the form “Eq. X equals input Y by construction.”

Axiom & Free-Parameter Ledger

2 free parameters · 1 axioms · 0 invented entities

The central claim rests on the empirical success of an attack whose key parameters (poisoning rate, trigger) are chosen to achieve the reported outcome, plus the domain assumption that training data can be poisoned at low rates.

free parameters (2)
  • poisoning_rate = 0.5%
    Set to 0.5% to balance attack success against maintained benign performance; value is selected rather than derived.
  • trigger_pattern
    The specific pattern injected to create the backdoor association is a design choice whose effectiveness is demonstrated experimentally.
axioms (1)
  • domain assumption An attacker can inject a small number of poisoning samples into the training set without detection.
    Required for the attack to be practical in a real training pipeline.

reviewed 2026-06-26 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Mirage: a Clean-Label Backdoor against LiDAR 3D Object Detection." pith.science (2026). https://pith.science/paper/X3N5D6GC

@misc{pith2026260620752,
  author       = {Pith},
  title        = {Pith review of: Mirage: a Clean-Label Backdoor against LiDAR 3D Object Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X3N5D6GC}},
  note         = {Machine review of arXiv:2606.20752}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Deep neural network-based LiDAR 3D object detection serves as a critical perception component in safety-critical autonomous systems. However, recent studies have revealed its vulnerability to backdoor attacks. Existing attacks typically require white-box access or label modification and focus on geometric attacks such as object disappearance or bounding-box manipulation. In this paper, we present Mirage, a black-box and clean-label backdoor attack against deep neural network-based LiDAR 3DOD. Mirage injects a small number of label-consistent poisoning samples into the training set, causing the model to learn a malicious association between a trigger pattern and an attacker-chosen target class while preserving normal training semantics. As a result, the compromised model behaves normally on benign inputs yet systematically misclassifies triggered objects as the target class during deployment. We evaluate Mirage on multiple state-of-the-art LiDAR 3DOD models and benchmark datasets. Experimental results show that Mirage achieves a 73% misclassification success rate with a poisoning rate of only 0.5%, while maintaining detection performance close to that of benign models.

Figures

Figures reproduced from arXiv: 2606.20752 by Ang Li, Ziba Parsons.

Figure 1
Figure 1. Figure 1: Overview of MIRAGE, our LiDAR backdoor attack against a 3D point-cloud detector. Top: a benign detector applied to clean KITTI scenes correctly returns Pedestrian (orange) and Cyclist (purple) for the two target instances. Bottom: a detector trained on a poisoned subset of KITTI misclassifies the same instances as Car (green) once our optimized 250- point adversarial patch is injected at the center of each… view at source ↗
Figure 2
Figure 2. Figure 2: Pipeline of the clean-label backdoor attack for LiDAR 3DOD. The adversary pre-trains a surrogate on POOD data, fine-tunes on target-class [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Paired top-view point cloud (top) and RGB camera (bottom) images from KITTI dataset, illustrating the three object classes used in our evaluation: [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Poison-rate × radius × density sweep of attack effectiveness on PointPillars. Each cell reports the misclassification success rate (MSR, %)—the fraction of triggered pedestrian and cyclist instances reported as car—at score threshold τ = 0.1, aggregated over both victim classes (Overall). Rows vary the clean-label training poison rate ρ and columns vary the spherical-trigger radius R; the four panels fix t… view at source ↗
Figure 5
Figure 5. Figure 5: Optimization—not mere trigger presence—drives the targeted [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 7
Figure 7. Figure 7: Trigger geometry on a representative cyclist (KITTI val, frame 108; close-up 3D view) at the matched ablation setting (ρ = 2%, M = 250 points, 4× deployment density). In both panels the red points are the optimized trigger and the white dashed box is a genuine parked car elsewhere in the scene (context, not the attack target). (a) The car￾proportioned box leaves the source detected as a cyclist (“unsup”—no… view at source ↗
Figure 8
Figure 8. Figure 8: Disappearance rate (DR, %) over the same grid and threshold as Figure 4—the fraction of triggered [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Clean-utility cost of poisoning over the same grid as Figure 4, measured as the change in clean [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 10 canonical work pages · 2 internal anchors

  1. [1]

    SECOND: Sparsely embedded convolu- tional detection,

    Y . Yan, Y . Mao, and B. Li, “SECOND: Sparsely embedded convolu- tional detection,”Sensors, vol. 18, no. 10, p. 3337, 2018

    2018

  2. [2]

    PointPillars: Fast encoders for object detection from point clouds,

    A. Lang, S. V ora, H. Caesar, L. Zhou, J. Yang, and O. Beijbom, “PointPillars: Fast encoders for object detection from point clouds,” inIEEE/CVF CVPR, 2019, pp. 12 697–12 705

    2019

  3. [3]

    Center-based 3D object detec- tion and tracking,

    T. Yin, X. Zhou, and P. Kr ¨ahenb¨uhl, “Center-based 3D object detec- tion and tracking,” inIEEE/CVF CVPR, 2021

    2021

  4. [4]

    Towards backdoor attacks against LiDAR object detection in autonomous driving,

    Y . Zhang, Y . Zhu, Z. Liu, C. Miao, F. Hajiaghajani, L. Su, and C. Qiao, “Towards backdoor attacks against LiDAR object detection in autonomous driving,” inACM SenSys, 2022, pp. 533–547

    2022

  5. [5]

    BadLiDet: A simple back- door attack against LiDAR object detection in autonomous driving,

    S. Li, Y . Wen, H. Wang, and X. Cheng, “BadLiDet: A simple back- door attack against LiDAR object detection in autonomous driving,” inIEEE TrustCom, 2023, pp. 99–108

    2023

  6. [6]

    MOBA: A material-oriented backdoor attack against LiDAR-based 3D object detection systems,

    S. Chaturvedi, G. Bagwe, L. Zhang, P. He, and X. Yuan, “MOBA: A material-oriented backdoor attack against LiDAR-based 3D object detection systems,” inAAAI, 2026, arXiv:2511.09999

    work page arXiv 2026

  7. [7]

    BadFusion: 2D-oriented backdoor attacks against 3D object detection,

    S. Chaturvedi, L. Zhang, W. Zhang, P. He, and X. Yuan, “BadFusion: 2D-oriented backdoor attacks against 3D object detection,”arXiv preprint arXiv:2405.03884, 2024

    work page arXiv 2024

  8. [8]

    Badmda: Towards backdoor injection during domain adaptation to collapse multi-agent perception,

    T. Chen, B. Du, J. Zhao, H. Xia, H. Wang, and J. Wang, “Badmda: Towards backdoor injection during domain adaptation to collapse multi-agent perception,” inACM MM, 2025, pp. 975–983

    2025

  9. [9]

    Narcissus: A practical clean-label backdoor attack with limited information,

    Y . Zeng, M. Pan, H. Just, L. Lyu, M. Qiu, and R. Jia, “Narcissus: A practical clean-label backdoor attack with limited information,” in ACM CCS, 2023, pp. 771–785

    2023

  10. [10]

    Bait and switch: Online training data poisoning of autonomous driving sys- tems,

    N. Patel, P. Krishnamurthy, S. Garg, and F. Khorrami, “Bait and switch: Online training data poisoning of autonomous driving sys- tems,”arXiv preprint arXiv:2011.04065, 2020

    work page arXiv 2011

  11. [11]

    Physical backdoor attacks to lane detection systems in autonomous driving,

    X. Han, G. Xu, Y . Zhou, X. Yang, J. Li, and T. Zhang, “Physical backdoor attacks to lane detection systems in autonomous driving,” inACM MM. New York, NY , USA: Association for Computing Machinery, 2022, pp. 2957–2968

    2022

  12. [12]

    3DSSD: Point-based 3D single stage object detector,

    Z. Yang, Y . Sun, S. Liu, and J. Jia, “3DSSD: Point-based 3D single stage object detector,” inIEEE/CVF CVPR, 2020, pp. 11 040–11 048

    2020

  13. [13]

    PointNet: Deep learning on point sets for 3D classification and segmentation,

    C. Qi, H. Su, K. Mo, and L. Guibas, “PointNet: Deep learning on point sets for 3D classification and segmentation,” inIEEE CVPR, 2017, pp. 652–660

    2017

  14. [14]

    PointNet++: Deep hierarchical feature learning on point sets in a metric space,

    C. Qi, L. Yi, H. Su, and L. Guibas, “PointNet++: Deep hierarchical feature learning on point sets in a metric space,”Advances in Neural Information Processing Systems, vol. 30, 2017

    2017

  15. [15]

    V oxelNet: End-to-end learning for point cloud based 3D object detection,

    Y . Zhou and O. Tuzel, “V oxelNet: End-to-end learning for point cloud based 3D object detection,” inIEEE CVPR, 2018, pp. 4490–4499

    2018

  16. [16]

    PointRCNN: 3D object proposal generation and detection from point cloud,

    S. Shi, X. Wang, and H. Li, “PointRCNN: 3D object proposal generation and detection from point cloud,” inIEEE/CVF CVPR, 2019, pp. 770–779

    2019

  17. [17]

    PV- RCNN: Point-voxel feature set abstraction for 3D object detection,

    S. Shi, C. Guo, L. Jiang, Z. Wang, J. Shi, X. Wang, and H. Li, “PV- RCNN: Point-voxel feature set abstraction for 3D object detection,” inIEEE/CVF CVPR, 2020, pp. 10 529–10 538

    2020

  18. [18]

    PV-RCNN++: Point-voxel feature set abstraction with local vector representation for 3D object detection,

    S. Shi, L. Jiang, J. Deng, Z. Wang, C. Guo, J. Shi, X. Wang, and H. Li, “PV-RCNN++: Point-voxel feature set abstraction with local vector representation for 3D object detection,”International Journal of Computer Vision, vol. 131, no. 2, pp. 531–551, 2023

    2023

  19. [19]

    CIA-SSD: Confident IoU-aware single-stage object detector from point cloud,

    W. Zheng, W. Tang, S. Chen, L. Jiang, and C.-W. Fu, “CIA-SSD: Confident IoU-aware single-stage object detector from point cloud,” inAAAI, vol. 35, no. 4, 2021, pp. 3555–3562

    2021

  20. [20]

    V oxel R- CNN: Towards high performance voxel-based 3D object detection,

    J. Deng, S. Shi, P. Li, W. Zhou, Y . Zhang, and H. Li, “V oxel R- CNN: Towards high performance voxel-based 3D object detection,” inAAAI, vol. 35, no. 2, 2021, pp. 1201–1209

    2021

  21. [21]

    Embracing single stride 3D object detector with sparse transformer,

    L. Fan, Z. Pang, T. Zhang, Y .-X. Wang, H. Zhao, F. Wang, N. Wang, and Z. Zhang, “Embracing single stride 3D object detector with sparse transformer,” inIEEE/CVF CVPR, 2022, pp. 8458–8468

    2022

  22. [22]

    TransFusion: Robust LiDAR-camera fusion for 3D object detection with transformers,

    X. Bai, Z. Hu, X. Zhu, Q. Huang, Y . Chen, H. Fu, and C.-L. Tai, “TransFusion: Robust LiDAR-camera fusion for 3D object detection with transformers,” inIEEE/CVF CVPR, 2022, pp. 1080–1089

    2022

  23. [23]

    Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,”arXiv preprint arXiv:1712.05526, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  24. [24]

    BadNets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “BadNets: Evaluating backdooring attacks on deep neural networks,”IEEE Access, vol. 7, pp. 47 230–47 244, 2019

    2019

  25. [25]

    Label-Consistent Backdoor Attacks

    A. Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor attacks,”arXiv preprint arXiv:1912.02771, 2019

    work page Pith review arXiv 1912

  26. [26]

    Hidden trigger backdoor attacks,

    A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden trigger backdoor attacks,” inAAAI, vol. 34, no. 07, 2020, pp. 11 957–11 965

    2020

  27. [27]

    Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch,

    H. Souri, L. Fowl, R. Chellappa, M. Goldblum, and T. Goldstein, “Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch,”Advances in Neural Information Processing Systems, vol. 35, pp. 19 165–19 178, 2022

    2022

  28. [28]

    Witches’ brew: Industrial scale data poisoning via gradient matching,

    J. Geiping, L. Fowl, R. Huang, W. Czaja, G. Taylor, M. Moeller, and T. Goldstein, “Witches’ brew: Industrial scale data poisoning via gradient matching,” inICLR, 2021

    2021

  29. [29]

    BadDet: Backdoor attacks on object detection,

    S.-H. Chan, Y . Dong, J. Zhu, X. Zhang, and J. Zhou, “BadDet: Backdoor attacks on object detection,” inECCV Workshops, ser. LNCS, vol. 13801. Springer, 2023, pp. 396–412, arXiv:2205.14497 (2022). Workshop proceedings published 2023

    work page arXiv 2023

  30. [30]

    Attacking by aligning: Clean-label backdoor attacks on object detection,

    Y . Cheng, W. Hu, and M. Cheng, “Attacking by aligning: Clean-label backdoor attacks on object detection,”arXiv preprint arXiv:2307.10487, 2023

    work page arXiv 2023

  31. [31]

    PointBA: Towards backdoor attacks in 3D point cloud,

    X. Li, Z. Chen, Y . Zhao, Z. Tong, Y . Zhao, A. Lim, and J. Zhou, “PointBA: Towards backdoor attacks in 3D point cloud,” inIEEE/CVF ICCV, 2021, pp. 16 492–16 501

    2021

  32. [32]

    Poisoning MorphNet for clean-label backdoor attack to point clouds,

    G. Tian, W. Jiang, W. Liu, and Y . Mu, “Poisoning MorphNet for clean-label backdoor attack to point clouds,”arXiv preprint arXiv:2105.04839, 2021

    work page arXiv 2021

  33. [33]

    Imperceptible and robust backdoor attack in 3D point cloud,

    K. Gao, J. Bai, B. Wu, M. Ya, and S.-T. Xia, “Imperceptible and robust backdoor attack in 3D point cloud,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 1267–1282, 2023

    2023

  34. [34]

    iBA: Backdoor attack on 3D point cloud via reconstructing itself,

    Y . Bian, S. Tian, and X. Liu, “iBA: Backdoor attack on 3D point cloud via reconstructing itself,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 7994–8008, 2024

    2024

  35. [35]

    PointNCBW: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark,

    C. Wei, Y . Wang, K. Gao, S. Shao, Y . Li, Z. Wang, and Z. Qin, “PointNCBW: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark,”IEEE Transactions on Information Forensics and Security, vol. 20, pp. 191–206, 2025

    2025

  36. [36]

    PointCRT: Detecting backdoor in 3D point cloud via corruption robustness,

    S. Hu, W. Liu, M. Li, Y . Zhang, X. Liu, X. Wang, L. Zhang, and J. Hou, “PointCRT: Detecting backdoor in 3D point cloud via corruption robustness,” inACM MM, 2023, pp. 666–675

    2023

  37. [37]

    Are we ready for autonomous driving? the KITTI vision benchmark suite,

    A. Geiger, P. Lenz, and R. Urtasun, “Are we ready for autonomous driving? the KITTI vision benchmark suite,” inIEEE CVPR. IEEE, 2012, pp. 3354–3361

    2012

  38. [38]

    nuScenes: A multimodal dataset for autonomous driving,

    H. Caesar, V . Bankiti, A. Lang, S. V ora, V . Liong, Q. Xu, A. Krishnan, Y . Pan, G. Baldan, and O. Beijbom, “nuScenes: A multimodal dataset for autonomous driving,” inIEEE/CVF CVPR, 2020, pp. 11 621– 11 631

    2020

  39. [39]

    Dynamic graph CNN for learning on point clouds,

    Y . Wang, Y . Sun, Z. Liu, S. Sarma, M. Bronstein, and J. Solomon, “Dynamic graph CNN for learning on point clouds,”ACM Transac- tions on Graphics, vol. 38, no. 5, pp. 1–12, 2019

    2019

  40. [40]

    Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” inAAAI SafeAI Workshop, 2019, arXiv:1811.03728

    work page internal anchor Pith review Pith/arXiv arXiv 2019

  41. [41]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” inNeurIPS, 2018

    2018

  42. [42]

    Anti-backdoor learning: Training clean models on poisoned data,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” inNeurIPS, 2021

    2021

  43. [43]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” inRAID, 2018

    2018

  44. [44]

    Revisiting the assumption of latent separability for backdoor defenses,

    X. Qi, T. Xie, Y . Li, S. Mahloujifar, and P. Mittal, “Revisiting the assumption of latent separability for backdoor defenses,” inICLR, 2023

    2023

  45. [45]

    CloudFort: Enhancing ro- bustness of 3D point cloud classification against backdoor attacks via spatial partitioning and ensemble prediction,

    W. Lan, Y . Yang, H. Shen, and S. Li, “CloudFort: Enhancing ro- bustness of 3D point cloud classification against backdoor attacks via spatial partitioning and ensemble prediction,”IET Computer Vision, vol. 19, no. 1, p. e70047, 2025

    2025

  46. [46]

    DUP- Net: Denoiser and upsampler network for 3D adversarial point clouds defense,

    H. Zhou, K. Chen, W. Zhang, H. Fang, W. Zhou, and N. Yu, “DUP- Net: Denoiser and upsampler network for 3D adversarial point clouds defense,” inIEEE/CVF ICCV, 2019

    2019

  47. [47]

    IF-Defense: 3D adversarial point cloud defense via implicit function based restora- tion,

    Z. Wu, Y . Duan, H. Wang, Q. Fan, and L. Guibas, “IF-Defense: 3D adversarial point cloud defense via implicit function based restora- tion,”arXiv preprint arXiv:2010.05272, 2020

    work page arXiv 2010

  48. [48]

    A comprehensive study of the robustness for LiDAR-based 3D object detectors against adversarial attacks,

    Y . Zhang, J. Hou, and Y . Yuan, “A comprehensive study of the robustness for LiDAR-based 3D object detectors against adversarial attacks,”International Journal of Computer Vision, vol. 132, no. 5, pp. 1592–1624, 2024

    2024

  49. [49]

    A backdoor attack against 3D point cloud classifiers,

    Z. Xiang, D. Miller, S. Chen, X. Li, and G. Kesidis, “A backdoor attack against 3D point cloud classifiers,” inIEEE/CVF ICCV, 2021, pp. 7597–7607

    2021

  50. [50]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” inIEEE S&P, 2019. Appendix A. Disappearance-Rate and Clean-Utility Sweeps The main-text sweep (Figure 4) reports only the mis- classification success rate. For completeness, this appendix shows the two co...

    2019

This paper was first reviewed by grok-4.3 on June 26, 2026.