Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Countering Backdoor Attacks in Image Recognition: A Survey and Evaluation of Mitigation Strategies

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Most published backdoor defenses, when tested across many attacks, datasets, and models, do not clearly outperform two baseline methods from 2018.

desk verdict A broad and careful benchmark that delivers a useful negative result, but the headline claim is conditional on off-the-shelf hyperparameters; the paper deserves review but the authors should be pushed on sensitivity analysis. read the letter →

arxiv 2411.11200 v2 pith:4O5V6STO submitted 2024-11-17 cs.CR cs.LG

Kealan Dunnett , Reza Arablouei , Dimity Miller , Volkan Dedeoglu , Raja Jurdak This is my paper · ORCID
classification cs.CRcs.LG
keywords backdoorattacksmitigationimagerecognitionmodelpruningfine-tuningbenchmarkevaluationattacksuccessraterecoveryaccuracy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that recently published defenses against backdoor attacks are far less proven than their own papers suggest. Backdoor attacks hide a trigger in training data so a model misbehaves only when the trigger appears, and mitigation defenses aim to remove that hidden behavior without hurting normal performance. In a uniform benchmark of 16 methods against 8 attack types, 3 datasets, 4 model architectures, and 3 data-availability levels, 122,236 experiments in all, most newer methods do not deliver a substantial or consistent improvement over two baselines from 2018, filter pruning and plain fine-tuning. Only two fine-tuning methods, FT-SAM and SAU, beat the fine-tuning baseline, and both pay with greater clean-accuracy loss, while no pruning method beats the 2018 pruning baseline. The authors also find that restoring correct classification of trigger-carrying images is the unsolved core of the field, since most defenses lower attack success without restoring correct behavior, and that reported performance depends heavily on evaluation conditions.

What carries the argument

The machinery is the evaluation protocol. Every defense is tested under one threat model, the Outsourced Training setting, where the defender holds only the trained model and a small clean dataset, and scored by three normalized measures: ASR (does the trigger still cause misclassification), ARR (how much clean accuracy did mitigation cost), and RDR (do trigger-bearing images get classified under their true labels again). The load-bearing device is the joint plot of median ARR and RDR against median ASR, with FP and FT marking the rectangle a method must enter to count as an improvement; because no pruning method enters it and only FT-SAM and SAU enter it on the fine-tuning side, the rectangle defines the paper's negative verdict. The second device is scale: 8 attacks, 3 datasets, 4 architectures, 3 poisoning ratios, and 3 data-availability levels turn the comparison into a generalizability test rather than a showcase.

What would settle it

Re-run the same 288-scenario grid with per-scenario hyperparameter tuning, grid-searching each method's published hyperparameters on a held-out split for every dataset, architecture, and sample-per-class level, and check whether several newer methods' median ASR, ARR, and RDR jointly move inside the rectangle defined by the Fine-Pruning and fine-tuning baselines; if they do, the claim that newer methods offer no substantial improvement is overturned.

Watch

Extended reading notes

Core claim

The central discovery is a negative comparative result. In a benchmark of 122,236 experiments organized as 288 attack scenarios, the authors find that no evaluated pruning method jointly beats the median performance of Fine-Pruning (FP), the 2018 method that prunes the least-activated filters of the final convolutional layer, on attack success rate (ASR), accuracy reduction ratio (ARR), and recovery difference ratio (RDR). Among fine-tuning methods, only FT-SAM and SAU beat the plain fine-tuning (FT) baseline, and both do so at the cost of higher median accuracy reduction, while their recovery performance stays poor. The evaluation also shows that dynamic-trigger attacks are generally easier to mitigate than static ones, that Blended and SSBA are the hardest attacks to defend, that most methods' performance is highly variable across architectures and datasets, and that the poisoning ratio has little effect on most defenses, contrary to the earlier benchmark [17]. The authors conclude that the observational basis many defenses are built on is not universal, that the field's progress relative to the 2018 baselines is mostly incremental, and that future work should focus on recovery accuracy and on constraining overfitting when clean data is scarce.

Load-bearing premise

The comparison assumes that running each defense with the hyperparameter values from its own paper or released code, with no tuning per dataset, architecture, or data-availability level, is a fair representation of how well that defense can perform.

Editorial extensions

If this is right

  • A defense that looks strong in a single attack and dataset test should not be trusted to transfer, since the benchmark shows ASR, RDR, and ARR swing widely across settings for most methods.
  • Real-world defenders face an extra burden the papers rarely discuss: after mitigation, ASR and RDR are unobservable, and tuning hyperparameters on a validation set shrinks already-scarce clean data.
  • RDR is the field's open core: suppressing the attack without restoring correct classification of backdoored inputs still leaves a misbehaving model, and only SAU's proposers even report the metric.
  • The practical standouts are FT-SAM and SAU, and both sacrifice clean accuracy to gain consistency, so deployment choices involve a real accuracy trade-off.
  • A low poisoning ratio of 1 to 10 percent does not automatically make an attack harder to mitigate, contrary to what the earlier benchmark [17] suggested.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the fixed-hyperparameter protocol understates tunable newer methods, the paper's central claim is really about off-the-shelf robustness, not ceiling performance; a per-scenario tuned re-run could reorder the rankings without contradicting the paper's data.
  • Because attack success alone has been the headline metric, the field may have optimized the wrong number; mandating recovery accuracy in defense evaluations could reorder the literature more than any new method.
  • The excluded methods mark the edge of the claim: approaches that use unlabeled or out-of-distribution data, or that assume knowledge of trigger position and target label, were not benchmarked, so the negative result does not cover defenses that relax the scarce-clean-data assumption.
  • The finding that dynamic-trigger attacks are easier to mitigate than static ones suggests attack and defense are co-evolving: methods that model the trigger distribution, like SAU, may keep looking strong against the newest attacks while static-trigger attacks like BadNets remain surprisingly effective against most defenses.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This manuscript combines a survey of backdoor-mitigation methods for image classification with a large independent benchmark. The authors evaluate 16 mitigation strategies against 8 backdoor attacks across 3 datasets, 4 architectures, 3 poisoning ratios, and 3 data-availability settings, reporting 122,236 individual experiments built on the BackdoorBench toolkit. The central empirical claim is that most recent mitigation methods do not substantially improve over the two seminal baselines, Fine-Pruning (FP) and Fine-Tuning (FT), in terms of median ASR, RDR, and ARR; FT-SAM and SAU are the notable exceptions. The survey portion categorizes methods into pruning and fine-tuning families and discusses the assumptions and limitations of each approach.

Significance. If the benchmarking protocol is accepted, this is a valuable contribution. It substantially widens the scenario coverage of BackdoorBench, reports distributions rather than cherry-picked settings, and highlights RDR as an under-reported metric that matters for practical deployment. The negative result about recent defenses is a useful corrective to single-setting evaluations in the original papers, and the detailed enumeration of experimental parameters supports reproducibility. The paper also offers a structured taxonomy and identifies hyperparameter sensitivity and limited-data overfitting as key open problems. The main risk is that the headline comparative claim is conditional on a fixed-default hyperparameter protocol, so the paper needs either a sensitivity analysis or a more carefully scoped conclusion.

major comments (3)
  1. [Section V-B; Supplementary Table I] The central comparison fixes all defense hyperparameters to BackdoorBench defaults or values from the authors' codebases, with only FST and NPD receiving dataset-specific lambda values. Several methods (AWN, MM-BD, NPD, SAU) have multiple coupled loss weights and perturbation bounds, so the reported ASR/RDR/ARR can reflect hyperparameter transfer failure rather than the method's capability, especially at SPC=2 or on Tiny-ImageNet. The abstract and Section VI.A.3 claim that newer approaches do not show "substantial improvements in overall performance or consistency," but this claim is conditional on the default-configuration protocol. Please either add a sensitivity analysis (e.g., tune observable hyperparameters on a held-out validation split per dataset, architecture, and SPC using ACC/ARR, and report the resulting range of outcomes) or explicitly reframe the conclusion as applying to default configurations. The protocol is also internally heterogeneous: FST and NPD receive per-dataset values while AWN, MM-BD, and SAU do not, so it is unclear whether the comparison is purely off-the-shelf or partially tuned.
  2. [Section VI.A.3 and Figure 7] The Pareto-style comparison against the FP/FT rectangle is sensitive to how "improvement" is defined. A method that reduces ASR but increases ARR is outside the rectangle even if it dominates on the most security-relevant metric, and the box plots show that ANP, BNP, CLP, and NPD are described as "comparable" to FP rather than clearly worse. The distinction between "comparable" and "not substantially better" is not quantified. Please report per-scenario win rates or a multi-metric dominance analysis, and provide uncertainty estimates (e.g., confidence intervals across the 10 iterations) so that the negative claim is not driven by the choice of pooled medians.
  3. [Section V-A; Supplementary Figures 4 and 6] LIRA is excluded because it "performed poorly during an initial set of experiments," which is a selection-on-outcome decision. If LIRA attacks are systematically weaker, their exclusion may change the distribution of attack difficulty and affect the relative ranking of defenses. In addition, NC is evaluated only on CIFAR-10 and i-BAU is incompatible with MobileNet, so the "diverse settings" claim is not uniform across methods. Please report the initial LIRA results or justify the exclusion on computational or scope grounds, and clearly mark every setting in which each method is absent.
minor comments (5)
  1. [Section VI.A.2] The sentence listing FST, NAD, PBE, NC, and i-BAU as fine-tuning methods that do not surpass FT is inconsistent with Figure 6 and Table IV, where NC is classified as a pruning approach; this should be corrected.
  2. [Supplementary Table I] The reference placeholders appear as "[?]" instead of actual citation numbers; this should be fixed before publication.
  3. [Section VII-B] The statement "ASR + RA ≤ 1" is asserted without proof; because ASR excludes samples whose original label is the target class, the inequality is not self-evident and should be clarified or derived.
  4. [Section V-C] There is a typo in "we assess then under three data settings"; it should read "we assess them under three data settings."
  5. [Section III-A.3, Eq. (5)] The TAC definition averages over a set of clean/backdoor pairs, but the pairing construction is not specified; please define the joint set over which the average is taken.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is an empirical benchmark of existing methods against external baselines, and its central claim is a summary of measured results rather than a fitting or self-citation-derived conclusion.

full rationale

The paper makes no derivation that reduces to its own inputs. Its central claim, that most newer mitigation approaches do not substantially improve on FP and FT, is an interpretation of medians computed from 122,236 experiments over a fixed evaluation grid of attacks, datasets, architectures, poisoning ratios, and data-availability levels. The performance metrics are defined independently of the conclusions: ARR and RDR are ratios comparing post-mitigation accuracy and recovery accuracy to pre-mitigation clean accuracy, and ASR is measured directly on trigger-containing test data. No fitted parameter is renamed as a prediction, and no equation defines the benchmark outcome in terms of the paper's own headline result. The use of default hyperparameters from each method's original paper or codebase (Section V-B and Supplementary Table I) is a benchmarking protocol choice; it may affect how representative each defense configuration is, but it does not make the benchmark circular. The paper also does not rely on any load-bearing self-citation: the reference list contains no self-citations by the authors, and the only invoked external tool, BackdoorBench, is an independent open benchmarking toolkit. There is no uniqueness theorem, no ansatz smuggled in via citation, and no known result merely renamed. Concerns about hyperparameter transfer or the fairness of off-the-shelf configurations are validity and correctness risks, not circularity, so the appropriate circularity score is 0.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The paper's conclusions rest on benchmark design choices rather than on a mathematical derivation. The key inputs are the threat-model assumption, the default configurations inherited from BackdoorBench, and the fixed hyperparameters of each defense. No new entities or fitted constants are introduced beyond these choices.

free parameters (1)
  • Defense hyperparameters (lambda, epsilon, thresholds) reused from original papers = Fixed per method, see Supplementary Table I (e.g., lambda=3 for BNP/CLP; lambda1=0.9, lambda2=0.1, lambda3=1e-7 for AWN)
    These hand-chosen constants directly determine ASR, RDR, and ARR. They are not tuned to the evaluation grid, so they are an a priori choice that shapes the comparison.
assumptions (3)
  • domain assumption The Outsourced Training threat model (defender has theta and clean mitigation data Dm, no backdoor data) is the correct lens for comparing defenses.
    Section II-C restricts the survey to this scenario. Other threat models, such as access to some backdoor samples, could change conclusions.
  • domain assumption Default attack configurations in BackdoorBench and default model training produce representative backdoored models.
    Section V-A and V-B rely on defaults from BackdoorBench and author code; if defaults are not representative, the benchmark's attack difficulty is skewed.
  • domain assumption The selected eight attacks, three datasets, four architectures, and three poisoning ratios span the diversity needed to judge generalizability.
    Section V-C and V-D define the grid; conclusions are only about this grid and may not transfer.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Countering Backdoor Attacks in Image Recognition: A Survey and Evaluation of Mitigation Strategies." pith.science (2026). https://pith.science/paper/4O5V6STO

@misc{pith2026241111200,
  author       = {Pith},
  title        = {Pith review of: Countering Backdoor Attacks in Image Recognition: A Survey and Evaluation of Mitigation Strategies},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4O5V6STO}},
  note         = {Machine review of arXiv:2411.11200}
}
read the original abstract

The widespread adoption of deep learning across various industries has introduced substantial challenges, particularly in terms of model explainability and security. The inherent complexity of deep learning models, while contributing to their effectiveness, also renders them susceptible to adversarial attacks. Among these, backdoor attacks are especially concerning, as they involve surreptitiously embedding specific triggers within training data, causing the model to exhibit aberrant behavior when presented with input containing the triggers. Such attacks often exploit vulnerabilities in outsourced processes, compromising model integrity without affecting performance on clean (trigger-free) input data. In this paper, we present a comprehensive review of existing mitigation strategies designed to counter backdoor attacks in image recognition. We provide an in-depth analysis of the theoretical foundations, practical efficacy, and limitations of these approaches. In addition, we conduct an extensive benchmarking of sixteen state-of-the-art approaches against eight distinct backdoor attacks, utilizing three datasets, four model architectures, and three poisoning ratios. Our results, derived from 122,236 individual experiments, indicate that while many approaches provide some level of protection, their performance can vary considerably. Furthermore, when compared to two seminal approaches, most newer approaches do not demonstrate substantial improvements in overall performance or consistency across diverse settings. Drawing from these findings, we propose potential directions for developing more effective and generalizable defensive mechanisms in the future.

Figures

Figures reproduced from arXiv: 2411.11200 by the authors.

Figure 1
Figure 1. Example of a backdoor image (right) and its cor [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Examples of different backdoor triggers used in the literature. Note that while IAB adds a local patch to each image, [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Threat models considered by existing backdoor attacks. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (17 more)
Figure 4
Figure 4. Figure 4: Examples of different IAB trigger patterns. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Visual representation of how a model can be segmented using the hypothesis introduced in [4]. Grey and white [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Box plots of the ASR, RDR, and ARR results for each approach across all considered settings. [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Scatter plot of the median RDR and ARR versus ASR [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Box plots of the ASR, RDR, and ARR results for each approach and SPC values of 2, 10, and 100. [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 9
Figure 9. Figure 9: Scatter plots of the median RDR and ARR versus ASR [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 10
Figure 10. Figure 10: Box plots of the ASR, RDR, and ARR results for the selected approaches and different attack types. [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Box plots of the ASR, RDR, and ARR results for the [PITH_FULL_IMAGE:figures/full_fig_p015_11.png]
Figure 12
Figure 12. Figure 12: Box plots of the ASR, RDR and, ARR results for the selected approaches and different model architectures. [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: Box plots of the ASR, RDR, and ARR results for the selected approaches and different datasets. [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: Box plots of the ASR, RDR, and ARR results for the selected approaches and different poisoning ratios (%). [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 1
Figure 1. Figure 1: Box plots of the ASR, RDR, and ARR results for each approach across all considered scenarios. [PITH_FULL_IMAGE:figures/full_fig_p022_1.png]
Figure 2
Figure 2. Figure 2: Box plots of the ASR, RDR, and ARR results for each approach and different attack types. [PITH_FULL_IMAGE:figures/full_fig_p023_2.png]
Figure 3
Figure 3. Figure 3: Box plots of the ASR, RDR, and ARR results for each approach and both static and dynamic attacks. [PITH_FULL_IMAGE:figures/full_fig_p023_3.png]
Figure 4
Figure 4. Figure 4: Box plots of the ASR, RDR, and ARR results for each approach and different model architectures. [PITH_FULL_IMAGE:figures/full_fig_p024_4.png]
Figure 5
Figure 5. Figure 5: Box plots of the ASR, RDR, and ARR results for the selected approaches and different datasets. [PITH_FULL_IMAGE:figures/full_fig_p025_5.png]
Figure 6
Figure 6. Figure 6: Box plots of the ASR, RDR, and ARR results for the selected approaches and different poisoning ratios (%). [PITH_FULL_IMAGE:figures/full_fig_p026_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Revisiting the Auxiliary Data in Backdoor Purification

    cs.CR 2025-02 conditional novelty 6.0 of 10

    Guided Input Calibration aligns any auxiliary dataset with a victim model's learned features before backdoor purification, consistently improving clean accuracy across dataset types with variable effects on attack suc...

Reference graph

Works this paper leans on

51 extracted references · 26 canonical work pages · cited by 1 Pith paper

  1. [1]

    A survey on deep learning: Algorithms, techniques, and applications,

    S. Pouyanfar, S. Sadiq, Y . Yan, H. Tian, Y . Tao, M. P. Reyes, M.-L. Shyu, S.-C. Chen, and S. S. Iyengar, “A survey on deep learning: Algorithms, techniques, and applications,” ACM Computing Surveys (CSUR), vol. 51, no. 5, pp. 1–36, 2018

    2018

  2. [2]

    The security of machine learning in an adversarial setting: A survey,

    X. Wang, J. Li, X. Kuang, Y .-a. Tan, and J. Li, “The security of machine learning in an adversarial setting: A survey,” Journal of Parallel and Distributed Computing, vol. 130, pp. 12–23, 2019

    work page 2019

  3. [3]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  4. [4]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017

    arXiv 2017

  5. [5]

    Backdoor learning: A survey,

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , 2022

    work page 2022

  6. [6]

    Abs: Scanning neural networks for back-doors by artificial brain stimulation,

    Y . Liu, W.-C. Lee, G. Tao, S. Ma, Y . Aafer, and X. Zhang, “Abs: Scanning neural networks for back-doors by artificial brain stimulation,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 1265–1282

    work page 2019

  7. [7]

    Towards more Practical Threat Models in Artificial Intelligence Security

    K. Grosse, L. Bieringer, T. R. Besold, and A. Alahi, “Towards more practical threat models in artificial intelligence security,” arXiv preprint arXiv:2311.09994, 2023

    work page Pith review arXiv 2023

  8. [8]

    Adversarial examples: Attacks and defenses for deep learning,

    X. Yuan, P. He, Q. Zhu, and X. Li, “Adversarial examples: Attacks and defenses for deep learning,” IEEE transactions on neural networks and learning systems, vol. 30, no. 9, pp. 2805–2824, 2019

    2019

Show all 51 references
  1. [9]

    A survey on backdoor attack and defense in natural language processing,

    X. Sheng, Z. Han, P. Li, and X. Chang, “A survey on backdoor attack and defense in natural language processing,” in 2022 IEEE 22nd International Conference on Software Quality, Reliability and Security (QRS). IEEE, 2022, pp. 809–820

    2022

  2. [10]

    Baddet: Backdoor attacks on object detection,

    S.-H. Chan, Y . Dong, J. Zhu, X. Zhang, and J. Zhou, “Baddet: Backdoor attacks on object detection,” in European Conference on Computer Vision. Springer, 2022, pp. 396–412

    2022

  3. [11]

    Hidden back- door attack against semantic segmentation models,

    Y . Li, Y . Li, Y . Lv, Y . Jiang, and S.-T. Xia, “Hidden back- door attack against semantic segmentation models,” arXiv preprint arXiv:2103.04038, 2021

    2021 arXiv

  4. [12]

    Backdoor attacks and coun- termeasures in natural language processing models: A comprehensive security review,

    P. Cheng, Z. Wu, W. Du, and G. Liu, “Backdoor attacks and coun- termeasures in natural language processing models: A comprehensive security review,” arXiv preprint arXiv:2309.06055 , 2023

    2023 arXiv

  5. [13]

    A survey of backdoor attacks and defenses on large language models: Implications for security measures,

    S. Zhao, M. Jia, Z. Guo, L. Gan, J. Fu, Y . Feng, F. Pan, and L. A. Tuan, “A survey of backdoor attacks and defenses on large language models: Implications for security measures,” arXiv preprint arXiv:2406.06852 , 2024

    2024 arXiv

  6. [14]

    A comprehensive survey on backdoor attacks and their defenses in face recognition systems,

    Q. Le Roux, E. Bourbao, Y . Teglia, and K. Kallas, “A comprehensive survey on backdoor attacks and their defenses in face recognition systems,” IEEE Access, 2024

    2024

  7. [15]

    Backdoor attacks against voice recognition systems: A survey,

    B. Yan, J. Lan, and Z. Yan, “Backdoor attacks against voice recognition systems: A survey,” arXiv preprint arXiv:2307.13643 , 2023

    2023 arXiv

  8. [16]

    Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,

    Y . Wan, Y . Qu, W. Ni, Y . Xiang, L. Gao, and E. Hossain, “Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,” IEEE Communications Surveys & Tutorials, 2024

    2024

  9. [17]

    Backdoorbench: A comprehensive benchmark of backdoor learning,

    B. Wu, H. Chen, M. Zhang, Z. Zhu, S. Wei, D. Yuan, and C. Shen, “Backdoorbench: A comprehensive benchmark of backdoor learning,” Advances in Neural Information Processing Systems , vol. 35, pp. 10 546–10 559, 2022

    2022

  10. [18]

    Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,

    M. Zhu, S. Wei, H. Zha, and B. Wu, “Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,” Advances in Neural Information Processing Systems , vol. 36, 2024

    2024

  11. [19]

    Adversarial unlearning of backdoors via implicit hypergradient,

    Y . Zeng, S. Chen, W. Park, Z. Mao, M. Jin, and R. Jia, “Adversarial unlearning of backdoors via implicit hypergradient,” in International Conference on Learning Representations , 2022

    2022

  12. [20]

    Bridging mode connectivity in loss landscapes and adversarial robustness,

    P. Zhao, P.-Y . Chen, P. Das, K. N. Ramamurthy, and X. Lin, “Bridging mode connectivity in loss landscapes and adversarial robustness,” arXiv preprint arXiv:2005.00060, 2020

    2005 arXiv

  13. [21]

    Lira: Learnable, imperceptible and robust backdoor attacks,

    K. Doan, Y . Lao, W. Zhao, and P. Li, “Lira: Learnable, imperceptible and robust backdoor attacks,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 11 966–11 976

    2021

  14. [22]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  15. [23]

    A new backdoor attack in cnns by training set corruption without label poisoning,

    M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in 2019 IEEE International Conference on Image Processing (ICIP) . IEEE, 2019, pp. 101–105

    2019

  16. [24]

    Rethinking the back- door attacks’ triggers: A frequency perspective,

    Y . Zeng, W. Park, Z. M. Mao, and R. Jia, “Rethinking the back- door attacks’ triggers: A frequency perspective,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 16 473–16 481

    2021

  17. [25]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 16 463–16 472

    2021

  18. [26]

    Input-aware dynamic backdoor attack,

    T. A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,” Advances in Neural Information Processing Systems , vol. 33, pp. 3454– 3464, 2020

    2020

  19. [27]

    Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning,

    Z. Wang, J. Zhai, and S. Ma, “Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 15 074–15 084

    2022

  20. [28]

    Wanet–imperceptible warping-based backdoor attack,

    A. Nguyen and A. Tran, “Wanet–imperceptible warping-based backdoor attack,” arXiv preprint arXiv:2102.10369 , 2021

    2021 arXiv

  21. [29]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 707–723. 20

    2019

  22. [30]

    Strip: A defence against trojan attacks on deep neural networks,

    Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” in Proceedings of the 35th annual computer security applications conference, 2019, pp. 113–125

    2019

  23. [31]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International sympo- sium on research in attacks, intrusions, and defenses . Springer, 2018, pp. 273–294

    2018

  24. [32]

    Pre-activation distributions expose backdoor neurons,

    R. Zheng, R. Tang, J. Li, and L. Liu, “Pre-activation distributions expose backdoor neurons,” Advances in Neural Information Processing Systems, vol. 35, pp. 18 667–18 680, 2022

    2022

  25. [33]

    Data-free backdoor removal based on channel lipschitzness,

    ——, “Data-free backdoor removal based on channel lipschitzness,” in European Conference on Computer Vision . Springer, 2022, pp. 175– 191

    2022

  26. [34]

    Adversarial neuron pruning purifies backdoored deep models,

    D. Wu and Y . Wang, “Adversarial neuron pruning purifies backdoored deep models,” Advances in Neural Information Processing Systems , vol. 34, pp. 16 913–16 925, 2021

    2021

  27. [35]

    One-shot neural backdoor erasing via adversarial weight masking,

    S. Chai and J. Chen, “One-shot neural backdoor erasing via adversarial weight masking,” Advances in Neural Information Processing Systems , vol. 35, pp. 22 285–22 299, 2022

    2022

  28. [36]

    Reconstructive neuron pruning for backdoor defense,

    Y . Li, X. Lyu, X. Ma, N. Koren, L. Lyu, B. Li, and Y .-G. Jiang, “Reconstructive neuron pruning for backdoor defense,” in International Conference on Machine Learning . PMLR, 2023, pp. 19 837–19 854

    2023

  29. [37]

    Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic,

    H. Wang, Z. Xiang, D. J. Miller, and G. Kesidis, “Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic,” in 2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2023, pp. 15–15

    2024

  30. [38]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 707–723

    2019

  31. [39]

    Defending neural backdoors via genera- tive distribution modeling,

    X. Qiao, Y . Yang, and H. Li, “Defending neural backdoors via genera- tive distribution modeling,” Advances in neural information processing systems, vol. 32, 2019

    2019

  32. [40]

    Backdoor defense with machine unlearning,

    Y . Liu, M. Fan, C. Chen, X. Liu, Z. Ma, L. Wang, and J. Ma, “Backdoor defense with machine unlearning,” in IEEE INFOCOM 2022-IEEE conference on computer communications . IEEE, 2022, pp. 280–289

    2022

  33. [41]

    Towards stable backdoor pu- rification through feature shift tuning,

    R. Min, Z. Qin, L. Shen, and M. Cheng, “Towards stable backdoor pu- rification through feature shift tuning,” Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  34. [42]

    Enhancing fine- tuning based backdoor defense with sharpness-aware minimization,

    M. Zhu, S. Wei, L. Shen, Y . Fan, and B. Wu, “Enhancing fine- tuning based backdoor defense with sharpness-aware minimization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 4466–4477

    2023

  35. [43]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks,” in International Conference on Learning Representations , 2021

    2021

  36. [44]

    Backdoor cleansing with unla- beled data,

    L. Pang, T. Sun, H. Ling, and C. Chen, “Backdoor cleansing with unla- beled data,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 12 218–12 227

    2023

  37. [45]

    Progressive backdoor erasing via connecting backdoor and adversarial attacks,

    B. Mu, Z. Niu, L. Wang, X. Wang, Q. Miao, R. Jin, and G. Hua, “Progressive backdoor erasing via connecting backdoor and adversarial attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 20 495–20 503

    2023

  38. [46]

    Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples,

    S. Wei, M. Zhang, H. Zha, and B. Wu, “Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples,” Ad- vances in Neural Information Processing Systems , vol. 36, pp. 25 876– 25 909, 2023

    2023

  39. [47]

    Structured pruning for deep convolutional neural networks: A survey,

    Y . He and L. Xiao, “Structured pruning for deep convolutional neural networks: A survey,”IEEE transactions on pattern analysis and machine intelligence, 2023

    2023

  40. [48]

    Sharpness-aware minimization for efficiently improving generalization,

    P. Foret, A. Kleiner, H. Mobahi, and B. Neyshabur, “Sharpness-aware minimization for efficiently improving generalization,” arXiv preprint arXiv:2010.01412, 2020

    2010 arXiv

  41. [49]

    Knowledge distillation: A survey,

    J. Gou, B. Yu, S. J. Maybank, and D. Tao, “Knowledge distillation: A survey,” International Journal of Computer Vision , vol. 129, no. 6, pp. 1789–1819, 2021

    2021

  42. [50]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations , 2018. Kealan Dunnett is a researcher at the School of Computer Science, Queensland University ...

    2018

  43. [2013]

    Countering Backdoor Attacks in Image Recognition: A Survey and Evaluation of Mitigation Strategies

    He was a Research Fellow with the Univer- sity of South Australia from 2013 to 2015. Since 2015, he has been with the Commonwealth Scien- tific and Industrial Research Organization (CSIRO), Pullenvale, QLD, Australia with the current position of Senior Research Scientist. His ...

    2013 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.