Pith. sign in

REVIEW 4 major objections 5 minor 52 references

Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Februus cuts Trojan attack success from 100% to near 0%.

desk verdict Februus is a novel run-time input-sanitization defense with solid results on its own trigger setups, but the load-bearing assumption that GradCAM will always localize the trigger is empirically supported rather than guaranteed, and the partial-backdoor experiment exposes a real residual. read the letter →

arxiv 1908.03369 v7 pith:336HM6FC submitted 2019-08-09 cs.CR

Bao Gia Doan , Ehsan Abbasnejad , Damith C. Ranasinghe This is my paper · ORCID
classification cs.CR
keywords TrojanattackbackdoordefenseinputsanitizationGradCAMsaliencyGANinpaintingrun-timepartialdeepneuralnetworksecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Februus claims that the backdoor trigger in a Trojaned deep neural network can be neutralized at run-time by cutting the trigger out of each incoming image and inpainting the hole before classification. The paper demonstrates that this two-stage sanitization reduces attack success from 100% to near 0% across four datasets and several realistic trigger types, while keeping classification accuracy on sanitized inputs effectively identical to a benign network. If the claim holds, it gives a plug-and-play defense that requires no retraining of the model, no labeled data, and runs within the latency budget of autonomous driving (about 6–30 ms). The same mechanism yields the first quantitative defense against partial (source-label-specific) backdoors, reducing their success from 97.95% to 15.24% in a single pass.

What carries the argument

The central object is the two-stage Februus pipeline. Stage one, Trojan Removal, computes the GradCAM saliency heatmap of the Trojaned network's prediction, thresholds it with a task-specific sensitivity parameter to form a binary mask, and cuts the masked region out of the input, replacing it with a neutral-color box. Stage two, Image Restoration, feeds the masked image to a GAN inpainting generator trained with two discriminators—one enforcing global structure, one enforcing local fidelity—under a WGAN-GP loss; the generator was trained with randomly sized and located masks so it can restore arbitrary regions. The load-bearing insight is that the trigger dominates the poisoned network's attention, so the saliency map reliably localizes it, and that a realistic inpaint of that region removes the activation signal while preserving the content the classifier needs.

What would settle it

Construct a Trojaned model whose trigger is visually complex or dispersed, such as a low-contrast texture spread across the entire image, so that no single compact region dominates the GradCAM heatmap; run Februus on a held-out set of Trojaned inputs and measure attack success. If attack success stays well above the reported near-0% values (for instance above 10%) while benign accuracy is preserved, the core premise that the trigger is the dominant saliency region fails.

Watch

Extended reading notes

Core claim

The paper's central discovery is that a Trojan trigger is not only a vulnerability but an information leak: the Trojaned network's GradCAM saliency heatmap—a gradient-based visualization of which input regions drive the prediction—marks the trigger as the most influential region for the target class. Februus exploits this by computing that heatmap, masking the highlighted region with a neutral color, and passing the masked image to a GAN trained with random masks on unlabeled data to restore the removed area. The restored image is then classified by the original, unmodified Trojaned network, which now sees a benign-looking input. On CIFAR-10, GTSRB, BTSR, and VGGFace2, input-agnostic attack success falls from 100% to between 0% and 0.25%, while benign and Trojaned sanitized inputs retain accuracy within about 0.1–1.5% of the benign model. For the source-label-specific (partial) backdoor, attack success drops from 97.95% to 15.24% in a single pass, with a larger accuracy penalty on the restored Trojaned inputs.

Load-bearing premise

The defense's load-bearing premise is that the poisoned network's GradCAM saliency map reliably highlights the trigger as the dominant influential region for every input, so that cutting out and inpainting that one region destroys the backdoor; the paper validates this only on its own trigger designs, and the 15.24% residual success on partial backdoors suggests the localization is incomplete when the trigger's influence is entangled with the source class.

Editorial extensions

If this is right

  • Input-agnostic Trojan attacks can be neutralized without touching the model: Februus preserves the Trojaned network's weights and still brings attack success from 100% to 0–0.25% across four datasets.
  • Defenders no longer need labeled data or a retraining step; the restoration GAN can be trained on unlabeled data, and the whole pipeline runs in about 6–30 ms on a desktop GPU, within autonomous-driving latency budgets.
  • The same pipeline withstands multiple triggers aimed at one target, different triggers aimed at different targets (an attack that fools Neural Cleanse and TABOR), and triggers covering up to 25% of the image, with accuracy degrading only for the largest sizes.
  • The previously undefended partial (source-label-specific) backdoor can be contained to roughly 15% residual attack success in a single pass, at the cost of a noticeable accuracy drop on those Trojaned inputs.
  • Februus doubles as a filter for benign inputs: classification accuracy on benign images passing through the pipeline stays within about 1.5% of the clean model, so the defense can be applied unconditionally to all inputs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's adaptive-training result hints at a cheap detection signal: a network trained to hide its trigger from GradCAM becomes significantly less confident (average prediction probability below 20%), so a defender could combine Februus with a confidence threshold to catch evasion attempts rather than merely cleaning inputs.
  • Stacking Februus on top of a network-level defense (such as pruning or unlearning) could plausibly close the partial-backdoor residual: the paper cleans inputs but leaves the Trojaned weights untouched, and the two mechanisms target different failure modes.
  • Because the restoration GAN sees only the masked image, its fidelity controls the defense's ceiling; training it with the extra objective of maximizing the downstream classifier's accuracy on inpainted images (an improvement the paper mentions) should extend Februus to triggers larger than 14% of the image without the accuracy loss reported there.
  • The sanitization concept is not obviously limited to vision: if saliency in speech or text models concentrates on trigger tokens as sharply as GradCAM does on image patches, a similar cut-and-restore pipeline could be built for those modalities, which the paper names as future work.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Februus, a run-time input-purification defense against input-agnostic Trojan/backdoor attacks on image classifiers. Februus first uses GradCAM saliency on the predicted logit to localize and mask a suspected trigger region, with a per-task sensitivity threshold; it then fills the masked area with a GAN-based inpainter trained on unlabeled data and feeds the restored image to the (possibly Trojaned) classifier. Across CIFAR10, GTSRB, BTSR, and VGGFace2, the authors report attack success rates dropping from 100% to 0.25% or lower for standard input-agnostic triggers while clean accuracy is largely preserved. They also report results on adaptive attacks, including multiple triggers, multiple targets, trigger-location changes, large triggers, and source-label-specific (partial) backdoors, where the residual attack success rate is 15.24%.

Significance. If the results hold, the paper offers a genuinely different defense paradigm: online input sanitization rather than detector-and-reject or network repair, with small per-input overhead (about 30 ms worst case) and no retraining of the classifier. The release of a model zoo and code supports reproducibility, and the partial-backdoor experiment is a useful first quantitative data point for a hard attack variant. However, the contribution is empirical, and its central assumption, that GradCAM reliably localizes the trigger as the dominant influential region, is demonstrated only on the authors' own attack configurations. The abstract's 'no loss of performance' claim is also stronger than the data in Table III and Table IV support.

major comments (4)
  1. [Section III (Trojan Removal Stage) and Table IV] The sanitization pipeline rests on the claim that the GradCAM saliency map of the poisoned network singles out the trigger as the dominant influential region for the predicted class. This is an empirical property, not a structural one: GradCAM weights last-convolutional feature maps by gradients of the predicted logit, and nothing excludes a benign target-class region from dominating the saliency map. The paper validates this only on its own trigger/task pairs. The partial-backdoor row of Table IV gives direct evidence of incomplete localization: 15.24% of partial-Trojan inputs remain misclassified after Februus. To make the central claim load-bearing, the authors should either prove or empirically characterize the conditions under which GradCAM localizes the trigger (for example, by reporting per-input IoU between the removal mask and the true trigger region across trigger sizes, locations, and source-target class pairs), or explicitly re-scope the defense as applying only when that property holds.
  2. [Abstract and Table III] The abstract states that Februus 'enables effective Trojan mitigation by sanitizing inputs with no loss of performance for sanitized inputs, Trojaned or benign,' and Section I-A says benign-input accuracy is 'identical to that realized from a benign network.' Table III directly contradicts this: after Februus, benign-input accuracy on the Trojaned model falls from 96.78% to 95.13% on GTSRB and from 97.04% to 95.60% on BTSR. Table IV shows a much larger drop for the partial-backdoor setting, from 90.72% to 83.61% on Trojaned inputs. The authors should reword the performance claims to 'small, bounded degradation' and provide per-dataset numbers or confidence intervals, since the current phrasing overstates the empirical results.
  3. [Section III (sensitivity parameter) and Section IV] The paper claims in the abstract and contribution list that Februus does not require 'costly labeled data,' and Section II states that defenders only need 'clean but cheaply available unlabeled data' to build the defense. However, the sensitivity threshold that determines the removal region is selected offline using labeled held-out test samples: Section III says the maximum sensitivity is chosen 'based on maintaining the classification accuracy of the defenders held-out test samples,' and Section IV reports thresholds (0.7, 0.8, 0.5) chosen to keep accuracy degradation below 2% on that test set. The threshold is a free parameter on which the reported attack-success rates depend, so the no-labeled-data claim is not accurate unless the authors show that an unlabeled selection criterion (for example, reconstruction error of the inpainter) yields equivalent thresholds.
  4. [Section VII-B and Figure 11] The adaptive-training experiment shows that adding a GradCAM-evasion loss to the poisoning objective degrades both attack success rate and classification confidence, but the paper does not identify whether an intermediate penalty exists at which the backdoor remains potent while Februus fails to localize the trigger. Figure 11 plots accuracy, ASR, and confidence as functions of gamma, yet no operating point is reported where, say, ASR stays above 90% and the GradCAM map no longer overlaps the trigger. Since Observation 1 is a trade-off statement rather than a lower bound, the robustness conclusion for adaptive attackers is incomplete. The authors should report the (ASR, benign accuracy, GradCAM-overlap) trade-off curve and state explicitly whether any point on it is a successful adaptive attack.
minor comments (5)
  1. [Section IV (Configuration for Trojan Attacks and Defenses)] The phrase 'sate-of-the-art' should be corrected to 'state-of-the-art.'
  2. [Table IV] The column header 'After Febrrus' contains a typo and should read 'After Februus.'
  3. [Section VII-A (Source-label-specific (Partial) Trojan)] The phrase 'we provide a a first quantitative evaluation' contains a duplicated article and should be corrected.
  4. [Equation (8)] The hyper-parameter gamma in Equation (8) is also used for the generator loss weight in Equation (6); using different symbols for these two unrelated hyper-parameters would avoid confusion.
  5. [Section IX (Conclusion)] The conclusion refers to 'input-agonist backdoor attacks'; this should be 'input-agnostic backdoor attacks.'

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the defense's main attack-success metric is measured after deployment and is not used to fit its parameters, and the paper's self-citations are not load-bearing.

full rationale

Februus is an empirical defense pipeline rather than a formal derivation, and its central reported result—attack success rate reduction from 100% to near 0%—is not fitted. The sensitivity parameter is selected offline to preserve classification accuracy on a held-out test set, not to minimize attack success rate; the attack-success numbers are then measured after the defense is fixed. The load-bearing localization assumption that GradCAM reveals the trigger as the dominant influential region for the predicted target class is an empirical hypothesis validated on the paper's own trigger and task pairs. This is a correctness and robustness limitation, especially because the partial-backdoor experiment leaves a 15.24% residual attack success rate, but it is not circular: the paper does not define 'Trojan' as 'whatever GradCAM highlights,' nor does it derive the defense's success from that assumption by construction. The paper's self-citations appear in related-work and comparison contexts (STRIP and multi-domain detection) and do not carry the main argument; external tools such as GradCAM and GAN inpainting are cited from the literature. No equation in the paper reduces the claimed outcome to a fitted input, and no known result is merely renamed. Thus any circularity is at most a minor, non-load-bearing self-citation, warranting a low score.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim depends on three domain assumptions that are empirically tested only on the authors' own triggers: GradCAM localization of any trigger, GAN restoration of arbitrary masks, and the availability of unlabeled plus labeled validation data. The per-task sensitivity threshold and the unreported GAN loss weight are the main free parameters. No new physical entities are introduced.

free parameters (2)
  • GradCAM removal sensitivity threshold = 0.7 (CIFAR10, VGGFace2), 0.8 (GTSRB), 0.5 (BTSR)
    Selected per task in a one-time offline process to maximize the removed region while keeping clean accuracy degradation under 2% on the defender's held-out labeled test set (Section IV). This is a fitted parameter, and it requires labeled data despite the paper's claim of needing none.
  • Generator loss weighting gamma = Not reported
    Equation 6 defines the generator objective as L_G + gamma(L_global_D + L_local_D), but the paper never gives the gamma value or a tuning procedure, so an independent implementation cannot reproduce the exact inpainting trade-off.
assumptions (3)
  • domain assumption GradCAM saliency on the Trojaned network reliably localizes the trigger region for arbitrary inputs and triggers.
    Load-bearing premise of the Trojan Removal stage; the paper states 'the influential region for the targeted class' will be the trigger (Section III), but provides only empirical evidence on its own triggers. Section VII-B shows adaptive training can weaken this saliency, and the partial-backdoor case leaves 15.24% attack success, indicating the assumption can fail.
  • domain assumption A GAN trained on random gray masks generalizes to the masks produced by the removal stage without degrading classification.
    The restoration stage assumes the inpainting network recovers arbitrary removed regions with high fidelity (Section III). The paper evaluates this only on its own triggers; large triggers covering 25% of the image reduce accuracy to 80.61% (Section VII-C), showing the assumption degrades at the tested boundary.
  • domain assumption Defenders have access to clean unlabeled data from the target domain plus a labeled held-out set for tuning the sensitivity parameter.
    The threat model in Section II grants correctly labeled test sets, and Section IV uses that set to select sensitivity. The claim of not requiring costly labeled data is therefore only partially true; the defense needs labels for parameter selection, even if not for GAN training.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems." pith.science (2026). https://pith.science/paper/336HM6FC

@misc{pith2026190803369,
  author       = {Pith},
  title        = {Pith review of: Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/336HM6FC}},
  note         = {Machine review of arXiv:1908.03369}
}
read the original abstract

We propose Februus; a new idea to neutralize highly potent and insidious Trojan attacks on Deep Neural Network (DNN) systems at run-time. In Trojan attacks, an adversary activates a backdoor crafted in a deep neural network model using a secret trigger, a Trojan, applied to any input to alter the model's decision to a target prediction---a target determined by and only known to the attacker. Februus sanitizes the incoming input by surgically removing the potential trigger artifacts and restoring the input for the classification task. Februus enables effective Trojan mitigation by sanitizing inputs with no loss of performance for sanitized inputs, Trojaned or benign. Our extensive evaluations on multiple infected models based on four popular datasets across three contrasting vision applications and trigger types demonstrate the high efficacy of Februus. We dramatically reduced attack success rates from 100% to near 0% for all cases (achieving 0% on multiple cases) and evaluated the generalizability of Februus to defend against complex adaptive attacks; notably, we realized the first defense against the advanced partial Trojan attack. To the best of our knowledge, Februus is the first backdoor defense method for operation at run-time capable of sanitizing Trojaned inputs without requiring anomaly detection methods, model retraining or costly labeled data.

Figures

Figures reproduced from arXiv: 1908.03369 by the authors.

Figure 1
Figure 1. A Trojan attack illustration from BadNets [6] demon [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of the Februus System. The Trojaned input is processed through the Trojan Removal module that inspects and surgically removes the trigger. Subsequently, the damaged input is processed by the Image Restoration module to recover the damaged regions. The restored image is fed into the Trojaned DNN. TOP: Without Februus, the Trojaned input will trigger the backdoor and be misclassified as a 100 km/h SPEED LIMIT… view at source ↗
Figure 3
Figure 3. The distribution of deeply learned features of a Benign and [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: The training process of our generative adversarial network (GAN) for image restoration. The generator (G) is given an input with [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Trojan information leaked is detected by the visual explana [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Image Restoration. Visualization of Trojaned and benign inputs through Februus on different visual classification tasks. a sanitized and restored image that has the potential Trojan removed, and the image restored to its original likeness. Examples of GAN restoration o…
Figure 7
Figure 7. Figure 7: Trojan triggers (first row) and their deployment used in our [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 6
Figure 6. Figure 6: As shown in the Figure 6 and Table III, the benign [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 8
Figure 8. Figure 8: Different triggers to the same targeted label. An attacker [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Trojan attacks with varying trigger locations successfully [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 11
Figure 11. Figure 11: Classification Accuracy, Attack Success Rate (ASR) and [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 10
Figure 10. Figure 10: Adversarial examples of Trojaned images to fool Gradcam. Notably, when the perturbation is large ( [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 12
Figure 12. Figure 12: Februus applied to the infected GTSRB model whilst [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: Multiple-piece trigger targeting a single label. [PITH_FULL_IMAGE:figures/full_fig_p011_13.png]
Figure 14
Figure 14. Figure 14: Adaptive Attacks on GradCAM. The left image illustrates [PITH_FULL_IMAGE:figures/full_fig_p014_14.png]
Figure 15
Figure 15. Figure 15: Robustness of Februus on Different Classification Tasks. Februus is highly effective and perform consistently well against backdoor [PITH_FULL_IMAGE:figures/full_fig_p016_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

52 extracted references · 47 canonical work pages

  1. [1]

    Deepdriving: Learning affordance for direct perception in autonomous driving,

    C. Chen, A. Seff, A. Kornhauser, and J. Xiao, “Deepdriving: Learning affordance for direct perception in autonomous driving,” in IEEE International Conference on Computer Vision (ICCV) , 2015

    work page 2015

  2. [2]

    Medical image analysis using convolutional neural networks: a review,

    S. M. Anwar, M. Majid, A. Qayyum, M. Awais, M. Alnowami, and M. K. Khan, “Medical image analysis using convolutional neural networks: a review,” Journal of medical systems , 2018

    work page 2018

  3. [3]

    Deepface: Closing the gap to human-level performance in face verification,

    Y . Taigman, M. Yang, M. Ranzato, and L. Wolf, “Deepface: Closing the gap to human-level performance in face verification,” in Confer- ence on Computer Vision and Pattern Recognition (CVPR) , 2014

    work page 2014

  4. [4]

    Adversary resistant deep neural networks with an application to malware detection,

    Q. Wang, W. Guo, K. Zhang, A. G. Ororbia, II, X. Xing, X. Liu, and C. L. Giles, “Adversary resistant deep neural networks with an application to malware detection,” in ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , 2017

    work page 2017

  5. [5]

    Droid-sec: deep learning in android malware detection,

    Z. Yuan, Y . Lu, Z. Wang, and Y . Xue, “Droid-sec: deep learning in android malware detection,” in ACM conference on SIGCOMM, 2014

    work page 2014

  6. [6]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access, 2019

    work page 2019

  7. [7]

    Amazon machine learning

    “Amazon machine learning.” [Online]. Available: https://aws.amazon. com/machine-learning

    work page

  8. [8]

    Caffe model zoo

    Bvlc, “Caffe model zoo.” [Online]. Available: https://github.com/ BVLC/caffe/wiki/Model-Zoo

    work page

Show all 52 references
  1. [9]

    Gradientzoo: pre-trained neural network models

    “Gradientzoo: pre-trained neural network models.” [Online]. Available: https://www.gradientzoo.com/

  2. [10]

    Model zoo

    J. Y . Koh, “Model zoo.” [Online]. Available: https://modelzoo.co/

  3. [11]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in Network and Distributed System Security Symposium (NDSS) , 2018

    2018

  4. [12]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” 2017

    2017

  5. [13]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International Conference on Artificial Intelligence and Statistics (AISTATS) , 2020

    2020

  6. [14]

    Evaluating the visualization of what a deep neural network has learned,

    W. Samek, A. Binder, G. Montavon, S. Lapuschkin, and K. Mller, “Evaluating the visualization of what a deep neural network has learned,” IEEE Transactions on Neural Networks and Learning Sys- tems, 2017

    2017

  7. [15]

    The challenges and opportunities of explainable ai,

    C. Wierzynski, “The challenges and opportunities of explainable ai,” 2018. [Online]. Available: https://www.intel.ai/ the-challenges-and-opportunities-of-explainable-ai

    2018

  8. [16]

    Broad agency announcement for trojai

    ARO, “Broad agency announcement for trojai.” [Online]. Available: https://www.arl.army.mil/www/pages/8/TrojAI-V3.2.pdf

  9. [17]

    Sentinet: Detecting physical attacks against deep learning systems,

    E. Chou, F. Tram `er, and G. Pellegrino, “Sentinet: Detecting physical attacks against deep learning systems,” in Deep Learning and Security Workshop at IEEE Security and Privacy (S&P) , 2020

    2020

  10. [18]

    Strip: A defence against trojan attacks on deep neural networks,

    Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” in Annual Computer Security Applications Conference (ACSAC) , 2019

    2019

  11. [19]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in IEEE Symposium on Security and Privacy (S&P) , 2019

    2019

  12. [20]

    Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks,

    H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks,” in International Joint Conference on Artificial Intelligence IJCAI , 2019

    2019

  13. [21]

    Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems,

    W. Guo, L. Wang, X. Xing, M. Du, and D. Song, “Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems,” 2019

    2019

  14. [22]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International Symposium on Research in Attacks, Intrusions, and Defenses (RAID) , 2018

    2018

  15. [23]

    Visualizing data using t-SNE,

    L. van der Maaten and G. Hinton, “Visualizing data using t-SNE,” Journal of Machine Learning Research , 2008

    2008

  16. [24]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations (ICLR) , 2014

    2014

  17. [25]

    ABS: Scanning neural networks for back-doors by artificial brain stimula- tion,

    Y . Liu, W.-C. Lee, G. Tao, S. Ma, Y . Aafer, and X. Zhang, “ABS: Scanning neural networks for back-doors by artificial brain stimula- tion,” in ACM conference on Computer and Communications Security (CCS), 2019

    2019

  18. [26]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in IEEE International Conference on Computer Vision (ICCV) , 2017

    2017

  19. [27]

    Generative adversarial nets,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” in Advances in Neural Information Processing Systems (NeurIPS) , 2014

    2014

  20. [28]

    Globally and locally consistent image completion,

    S. Iizuka, E. Simo-Serra, and H. Ishikawa, “Globally and locally consistent image completion,” ACM Transactions on Graphics , 2017

    2017

  21. [29]

    Improved training of wasserstein gans,

    I. Gulrajani, F. Ahmed, M. Arjovsky, V . Dumoulin, and A. C. Courville, “Improved training of wasserstein gans,” in Advances in Neural Information Processing Systems (NeurIPS) , 2017

    2017

  22. [30]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009

    2009

  23. [31]

    Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,

    J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,” Neural Networks, 2012

    2012

  24. [32]

    Traffic sign recognition how far are we from the solution?

    M. Mathias, R. Timofte, R. Benenson, and L. Van Gool, “Traffic sign recognition how far are we from the solution?” in International Joint Conference on Neural Networks (IJCNN) , 2013

    2013

  25. [33]

    Vggface2: A dataset for recognising faces across pose and age,

    Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zisserman, “Vggface2: A dataset for recognising faces across pose and age,” in IEEE International Conference on Automatic Face and Gesture Recognition (FG), 2018

    2018

  26. [34]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in International Conference on Learning Representations (ICLR) , 2015

    2015

  27. [35]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” 2016

    2016

  28. [36]

    Deep face recognition,

    O. M. Parkhi, A. Vedaldi, and A. Zisserman, “Deep face recognition,” in British Machine Vision Conference (BMVC) , 2015

    2015

  29. [37]

    Interpretable deep learning under fire,

    X. Zhang, N. Wang, H. Shen, S. Ji, X. Luo, and T. Wang, “Interpretable deep learning under fire,” in USENIX Security Symposium , 2020

    2020

  30. [38]

    Explaining and harness- ing adversarial examples,

    I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,” in International Conference on Learning Representations (ICLR), 2015

    2015

  31. [39]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations (ICLR) , 2018

    2018

  32. [40]

    Invisible backdoor attacks on deep neural networks via steganography and regularization,

    S. Li, M. Xue, B. Zhao, H. Zhu, and X. Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” IEEE Transactions on Dependable and Secure Computing (TDSC) , 2020

    2020

  33. [41]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Y . Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in European Conference on Computer Vision (ECCV) , 2020

    2020

  34. [42]

    Hidden trigger backdoor attacks,

    A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden trigger backdoor attacks,” in Association for the Advancement of Artificial Intelligence (AAAI), 2020

    2020

  35. [43]

    Blind backdoors in deep learning models,

    E. Bagdasaryan and V . Shmatikov, “Blind backdoors in deep learning models,” 2020

    2020

  36. [44]

    Detecting backdoor attacks on deep neural networks by activation clustering,

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” in Artificial Intelligence Safety Workshop at Association for the Advancement of Artificial Intelligenc...

    2019

  37. [45]

    Design and evaluation of a multi-domain trojan detection method on deep neural networks,

    Y . Gao, Y . Kim, B. G. Doan, Z. Zhang, G. Zhang, S. Nepal, D. C. Ranasinghe, and H. Kim, “Design and evaluation of a multi-domain trojan detection method on deep neural networks,” 2019

    2019

  38. [46]

    Neural trojans,

    Y . Liu, Y . Xie, and A. Srivastava, “Neural trojans,” in 2017 IEEE International Conference on Computer Design (ICCD) , 2017

    2017

  39. [47]

    Backdoor attacks to graph neural networks,

    Z. Zhang, J. Jia, B. Wang, and N. Z. Gong, “Backdoor attacks to graph neural networks,” 2020

    2020

  40. [48]

    Rab: Provable robustness against backdoor attacks,

    M. Weber, X. Xu, B. Karlas, C. Zhang, and B. Li, “Rab: Provable robustness against backdoor attacks,” 2020

    2020

  41. [49]

    On certifying robustness against backdoor attacks via randomized smoothing,

    B. Wang, X. Cao, J. jia, and N. Z. Gong, “On certifying robustness against backdoor attacks via randomized smoothing,” 2020

    2020

  42. [50]

    Mnist handwritten digit database,

    Y . LeCun, C. Cortes, and C. Burges, “Mnist handwritten digit database,” ATT Labs, 2010

    2010

  43. [51]

    The architectural implications of autonomous driving: Constraints and acceleration,

    S.-C. Lin, Y . Zhang, C.-H. Hsu, M. Skach, M. E. Haque, L. Tang, and J. Mars, “The architectural implications of autonomous driving: Constraints and acceleration,” in ACM Special Interest Group on Programming Languages (SIGPLAN) Notices , 2018

    2018

  44. [52]

    Simultaneous traffic sign detection and bound- ary estimation using convolutional neural network,

    H. S. Lee and K. Kim, “Simultaneous traffic sign detection and bound- ary estimation using convolutional neural network,”IEEE Transactions on Intelligent Transportation Systems , 2018. APPENDIX I GRAD CAM E VASION ATTACKS Besides adding GradCAM knowledge during the training pro...

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.