Pith. sign in

REVIEW 4 major objections 5 minor 49 references

TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TED-LaST proposes that adaptive backdoor attacks remain detectable by tracking per-class topological trajectories and weighting informative layers, and reports precision above 90% and F1 above 85% across the attacks tested.

desk verdict TED-LaST improves on TED, but the 'adaptive attack' evaluation doesn't include a defense-aware attacker, so the central claim is over-stated. read the letter →

arxiv 2506.10722 v1 pith:7IVTTIUF submitted 2025-06-12 cs.CR cs.AI

Xiaoxing Mo , Yuxuan Cheng , Nan Sun , Leo Yu Zhang , Wei Luo , Shang Gao This is my paper · ORCID
classification cs.CRcs.AI
keywords backdoorattacksdetectionadaptivetopologicalevolutiondynamicsdatapoisoningdeepneuralnetworksTED-LaST
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a backdoor defense can stay effective against adaptive poisoning attacks if it stops looking for a global separation between malicious and clean samples and instead tracks how individual samples move through the network relative to their predicted class. The proposed method, TED-LaST, extends topology-based detection with class-specific anomaly detection and with layer weights chosen by a modularity score, on the premise that poisoned samples travel a longer topological trajectory than benign samples of the target class. The paper reports that this keeps precision above 90% and F1 above 85% against the adaptive attacks Adap-Blend and Adap-Patch, and against its own Enhanced Adaptive Attacks that stack Laundry, Slow Release, and Target Mapping tricks. A sympathetic reader would care because this is a concrete route to sample-level detection in settings where the usual latent-space separability assumption no longer holds.

What carries the argument

The load-bearing object is the Cumulative Topological Distance, $\mathrm{CTD}(x)=\sum_{l=1}^{N-1}|K_{l+1}(x)-K_l(x)|$, where $K_l(x)$ is the rank of sample $x$'s nearest neighbour from its predicted class at layer $l$. CTD measures how much a sample's class-alignment rank changes as its activation moves through the network; the paper's premise is that malicious samples show larger CTD than benign target-class samples. Around this, TED-LaST builds a per-class PCA-based outlier detector trained only on clean samples predicted as that class, with the threshold set by an $\alpha$-quantile of anomaly scores, and a modularity-based layer weighting $w_{l,c}$ that up-weights layers where the class-0/class-1 separation of the KNN graph is strongest. The weighted vector $K_l(x)\cdot w_{l,\hat{y}}$ is what the outlier detector scores, which is how the method responds to subtle perturbations.

What would settle it

Construct an adaptive backdoor where the attacker's loss includes a regularizer that keeps each poisoned sample's cumulative nearest-neighbour rank trajectory inside the benign target class's CTD distribution, retrain under the paper's CIFAR-10 protocol, and measure TED-LaST's precision and F1; if they stay above 90% and 85% the CTD premise survives, and if they fall below those bounds the central claim is falsified.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that adaptive backdoor attacks collapse the metric separability of malicious and benign samples yet leave a class-wise topological residue: a poisoned sample begins outside its target class and therefore accumulates a larger cumulative rank change across layers than a benign sample that stays inside the class. TED-LaST converts this into a detector by computing, per predicted class, a PCA-based outlier model over layer-wise nearest-neighbour ranks, and by scaling each layer's rank with a normalized modularity weight before scoring. The paper claims this detects stealthy poisoned samples even under dynamic-target attacks where one shared trigger maps to multiple target classes, and that it outperforms STRIP, SCAn, TeCo, and the original TED on CIFAR-10, GTSRB, and ImageNet100 across ResNet20 and ResNet101. It also reports perfect separation (AUROC 1) on the non-adaptive BadNets and SSDT attacks.

Load-bearing premise

The premise that carries the whole method is empirical: poisoned samples, relative to benign samples of the predicted class, consistently travel a larger cumulative topological distance across layers; if an attacker can make the poisoned trajectory stay inside the benign target-class band, the per-class detector has nothing to separate.

Editorial extensions

If this is right

  • Class-wise outlier detectors replace the global detector: on the paper's ablation, adding unrelated classes to the training set degrades AUROC, so the detector's power comes from knowing what 'normal' looks like for the predicted class.
  • The modularity weighting buys the most on the hardest cases: the gap over non-weighted features grows as the samples' CTD values shrink, meaning the improvement concentrates on subtle-perturbation attacks.
  • The defense is claimed to hold across small and large benchmarks: CIFAR-10, GTSRB, and ImageNet100, with ResNet20 and ResNet101, using only 200 clean samples per class.
  • Under the proposed Enhanced Adaptive Attack combinations (Laundry plus Slow Release plus Source-Specific or SS&TA Target Mapping), the reported F1 stays above 85% on all evaluated datasets, with precision mostly above 90%.
  • The method also reports AUROC of 1 on the classical BadNets and SSDT attacks, so the extension does not sacrifice detection of non-adaptive backdoors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An attacker who reads this paper would next try to minimize CTD directly, for example by adding a trajectory-flattening term to the poisoning loss; whether that attack defeats TED-LaST is the immediate open question.
  • The modularity-weighting step is a general layer-selection principle, so it could be grafted onto other sample-level detectors that consume per-layer activations, not just topology-based ones.
  • If the CTD gap holds across architectures and modalities, the underlying signal is not a specific trigger pattern but the geometry of class entry, which would give the defense a reason to survive trigger changes that leave the trajectory structure intact.
  • Since the detector keys on predicted class, its deployment assumes the defender can obtain clean, correctly labelled samples per class; in label-noise or federated settings that assumption would need to be re-examined.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes TED-LaST, a sample-level backdoor detector that extends Topological Evolution Dynamics (TED) with two components: label-supervised dynamics tracking via class-specific PCA outlier detection on Cumulative Topological Distance (CTD, Eq. 15), and adaptive layer emphasis via modularity-based layer weights (Eqs. 17-18). The authors also introduce 'Enhanced Adaptive Attacks' that combine Laundry, Slow Release, and Target Mapping tricks, and they evaluate the defense against these and the existing Adap-Blend/Adap-Patch attacks on CIFAR-10, GTSRB, and ImageNet100 with ResNet20/ResNet101, reporting precision above 90% and F1 above 85% in most settings.

Significance. If the robustness claims were fully established, this would be a useful contribution to backdoor detection: the class-wise topological tracking idea is intuitive and the modularity-based layer weighting is a reasonable extension of TED. The paper ships a formalized attack loss (Eqs. 10-13), extensive datasets and architectures, ablation studies on class information and CTD thresholds, and a clear mechanism description. The main limitation is that the evaluation does not include any attack that is optimized against TED-LaST's CTD-based, class-wise PCA mechanism, which is the standard requirement for claiming robustness against adaptive attacks; hence the significance hinges on whether such an attack can degrade the reported numbers.

major comments (4)
  1. [Section V, Tables II-XI] The threat model is not adaptive with respect to the proposed defense. All evaluated attacks (Adap-Blend, Adap-Patch, and the Enhanced Adaptive Attacks) are trained once with a fixed bag of tricks; none of them is given knowledge of the CTD metric (Eq. 15) or the class-wise PCA thresholding in Algorithm 1, and none optimizes the poison loss (Eq. 13) against these components. A standard adaptive attacker aware of the defense would add a penalty term that minimizes CTD or matches the target class's rank trajectory. The paper's headline claim of robustness 'against all SOTA adaptive attacks' is therefore not established; an experiment with a CTD-aware adaptive attack is needed to support the title and contributions.
  2. [Section V, setup paragraph] The experimental setup does not state whether the 1000 clean evaluation samples per dataset are disjoint from the 200 clean samples per class used to train the PCA detectors and set the thresholds. If the evaluation set overlaps with the detector-training set, the reported precision and F1 scores will be optimistically biased. The paper should explicitly state the split and, ideally, evaluate on a held-out clean set.
  3. [Section V, Tables II-XI] All reported precision and F1 numbers are single-run point estimates with no error bars, confidence intervals, or significance tests. Given that the thresholds depend on the alpha quantile and the PCA fit on a small sample (200 per class), the results may be unstable across random seeds; at least three seeds with standard deviations should be reported for the main tables.
  4. [Section III-B1 and Eq. (15)] The entire detection mechanism relies on the empirical claim that malicious samples have higher CTD than benign samples of the target class (Fig. 2). The paper does not analyze or evaluate scenarios where a backdoored sample is predicted to a non-target class, or where an attacker crafts triggers that keep the sample's rank trajectory inside the benign target-class distribution. These cases would directly break the class-wise PCA detector setup, and the claimed robustness does not cover them.
minor comments (5)
  1. [Figure 5 caption and surrounding text] The text after Fig. 5 contains garbled characters (e.g., '/uni00000013/uni00000011/uni00000013...'), which appears to be a PDF rendering artifact; the figure caption and any associated text should be regenerated so that the caption is readable.
  2. [Section III-B1, Eq. (15)] The CTD sum runs from l=1 to N-1, but the reason for excluding the last layer is not explained; please clarify whether this is intentional and what changes if the final layer is included.
  3. [Algorithm 1 and Section IV-A] The PCA-based outlier detector is described as using 'the sum of weighted Euclidean distances to the selected eigenvectors,' but the number of principal components selected per class is not specified. Please state how this parameter is chosen (e.g., variance threshold, fixed number, or PyOD default) and whether it is tuned.
  4. [Section IV-B, Eq. (17)] The modularity notation is slightly unclear: m appears both as the total number of edges and inside mE_i; please define E_i separately from m and clarify whether E_i is the number of edges or the sum of edge weights within community i.
  5. [Section VI-B, Fig. 7] The 'CTD Threshold Ratio' is defined as median CTD divided by the actual CTD value, but the filtering procedure for creating subsets of malicious samples with different CTD levels is not fully described; please provide the exact protocol so that the ablation is reproducible.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation identified: TED-LaST is a clean-data-trained anomaly detector whose reported detection metrics are not encoded in its construction; the self-citations present are minor and non-load-bearing.

full rationale

TED-LaST's derivation chain is self-contained as a detection method rather than a circular prediction. For a query x, the features K_l(x) are ranks of nearest neighbors within the predicted class, the layer weights w_{l,c} are modularity scores computed from clean labeled activations, and the per-class PCA outlier detector plus threshold tau_c are fitted only on clean samples of that class (Section IV, Algorithm 1). The detection performance on poisoned samples is therefore not an input to the construction; alpha=0.05 is a fixed false-positive control rather than a parameter tuned to the reported precision/F1 values, and the paper does not fit the detector to malicious samples. The CTD metric (Eq. 15) is used as motivation and as an ablation filter, not as a label that is fed back into the detector, so the claim that malicious samples traverse larger topological distance is an empirical observation (Fig. 2) rather than a tautology. The self-citations to the authors' prior TED work [28] and to [17] provide the baseline, the experimental setting, and one attack family; they are background and baseline material, not the load-bearing justification for the proposed defense. No uniqueness theorem, ansatz, or fitted prediction is imported from the authors' own prior work. The skeptic's concern that the evaluated attacks are not optimized against CTD or the class-wise PCA decision boundary is a threat-model and evaluation-scope issue, not a circularity issue. The overall score reflects only the presence of minor non-load-bearing self-citations; no circular step was found.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central detection signal is the CTD gap between malicious and benign rank trajectories; it is an empirical assumption supported only on the tested attack configurations. The defense also assumes clean labeled samples for every class, a standard but restrictive threat model. No new physical or formal entities are introduced.

free parameters (4)
  • alpha (reject parameter) = 0.05
    Controls the anomaly threshold in the PCA detector: the alpha-quantile of training anomaly scores is used, fixing the clean false positive rate at 5%. Chosen by hand.
  • gamma (modularity resolution) = 1
    Resolution parameter in the modularity formula (Eq. 17); the default value is used without tuning.
  • KNN neighbor count k = sqrt(|X|)
    Number of neighbors used to build the per-layer graph in weight calculation (Section IV-B); depends on dataset size.
  • PCA component count = not specified
    The number of principal components used by the PyOD PCA outlier detector is not reported; it directly affects anomaly scores and thresholds.
assumptions (4)
  • domain assumption A defender can access a small set of clean samples with correct labels for each class.
    Stated in Section III-B1 and used to train class-specific PCA detectors and set thresholds. If false, the method cannot be applied as described.
  • domain assumption Malicious samples from a different source class traverse a larger cumulative topological distance (CTD) into the target class than benign target-class samples, so a per-class model can separate them.
    Empirically shown for the tested attacks in Fig. 2, but assumed as a general discriminative signal for the method (Section III-B1).
  • domain assumption The predicted class of a malicious sample is the target class, so the class-specific detector indexed by that class is the correct one to flag it.
    The detection pipeline computes TED* features using the sample's predicted class (Algorithm 1, lines 13-14). If a poisoned sample is classified to the source or another class, the wrong detector is used.
  • domain assumption Modularity on a per-layer KNN graph measures which layers best separate classes, so re-weighting by modularity improves outlier detection.
    The adaptive layer emphasis (Section III-B2, Eqs. 17-18) assumes modularity scores computed on clean training activations transfer to detecting malicious deviations at inference.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attacks." pith.science (2026). https://pith.science/paper/7IVTTIUF

@misc{pith2026250610722,
  author       = {Pith},
  title        = {Pith review of: TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7IVTTIUF}},
  note         = {Machine review of arXiv:2506.10722}
}
read the original abstract

Deep Neural Networks (DNNs) are vulnerable to backdoor attacks, where attackers implant hidden triggers during training to maliciously control model behavior. Topological Evolution Dynamics (TED) has recently emerged as a powerful tool for detecting backdoor attacks in DNNs. However, TED can be vulnerable to backdoor attacks that adaptively distort topological representation distributions across network layers. To address this limitation, we propose TED-LaST (Topological Evolution Dynamics against Laundry, Slow release, and Target mapping attack strategies), a novel defense strategy that enhances TED's robustness against adaptive attacks. TED-LaST introduces two key innovations: label-supervised dynamics tracking and adaptive layer emphasis. These enhancements enable the identification of stealthy threats that evade traditional TED-based defenses, even in cases of inseparability in topological space and subtle topological perturbations. We review and classify data poisoning tricks in state-of-the-art adaptive attacks and propose enhanced adaptive attack with target mapping, which can dynamically shift malicious tasks and fully leverage the stealthiness that adaptive attacks possess. Our comprehensive experiments on multiple datasets (CIFAR-10, GTSRB, and ImageNet100) and model architectures (ResNet20, ResNet101) show that TED-LaST effectively counteracts sophisticated backdoors like Adap-Blend, Adapt-Patch, and the proposed enhanced adaptive attack. TED-LaST sets a new benchmark for robust backdoor detection, substantially enhancing DNN security against evolving threats.

Figures

Figures reproduced from arXiv: 2506.10722 by the authors.

Figure 1
Figure 1. T-SNE visualization of sample feature vector separability for TED [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Cumulative Topological Distance (CTD) or different attack scenarios [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. (a) Box plot of the topological feature vector on ResNet20 under Adap-Patch. The plot reveals CIFAR-10 malicious samples with subtle perturbations, [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Overview of TED-LaST adaptive feature vector calculation structure. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Defenses against Adap-Blend adaptive attack ROC curve comparison [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Comparison of AUROC differences across various CTD Threshold [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 6
Figure 6. Figure 6: AUROC for outlier detection with varying numbers of additional [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 8
Figure 8. Figure 8: Box plots of topological feature vectors against SS&TA+L+SR with dynamic targets. (a) and (c) show unweighted features for two different target [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: T-SNE visualization of TED-LaST feature vectors for BadNets and [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 41 canonical work pages

  1. [1]

    Deep learning for 3d point clouds: A survey,

    Y . Guo, H. Wang, Q. Hu, H. Liu, L. Liu, and M. Bennamoun, “Deep learning for 3d point clouds: A survey,”IEEE Trans- actions on Pattern Analysis and Machine Intelligence, vol. 43, no. 12, pp. 4338–4364, 2021

    work page 2021

  2. [2]

    Deep audio-visual speech recognition,

    T. Afouras, J. S. Chung, A. Senior, O. Vinyals, and A. Zis- serman, “Deep audio-visual speech recognition,”IEEE Trans- actions on Pattern Analysis and Machine Intelligence, vol. 44, no. 12, pp. 8717–8727, 2022

    work page 2022

  3. [3]

    From handcrafted to deep features for pedestrian detection: A survey,

    J. Cao, Y . Pang, J. Xie, F. S. Khan, and L. Shao, “From handcrafted to deep features for pedestrian detection: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelli- gence, vol. 44, no. 9, pp. 4913–4934, 2022

    work page 2022

  4. [4]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017. 12 0 5 10 15 0 50 100 150 Clean Target Class Malicious Layer Nearest Rank of Same Class 0 5 10 15 0 5 10 15 20 25 Clean Target Class Malicious Layer Nearest Rank of Same Class (a) Non-weighted (targ...

    arXiv 2017

  5. [5]

    Backdoor attacks on pre-trained models by layerwise weight poisoning,

    L. Li, D. Song, X. Li, J. Zeng, R. Ma, and X. Qiu, “Backdoor attacks on pre-trained models by layerwise weight poisoning,” arXiv preprint arXiv:2108.13888, 2021

    arXiv 2021

  6. [6]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in25th Annual Network And Distributed System Security Symposium (NDSS 2018), 2018

    work page 2018

  7. [7]

    Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in NLP models,

    W. Yang, L. Li, Z. Zhang, X. Ren, X. Sun, and B. He, “Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in NLP models,” inACL, 2021, pp. 2048–2058

    work page 2021

  8. [8]

    Turning your weakness into a strength: Watermarking deep neural net- works by backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural net- works by backdooring,” inUSENIX Security, 2018, pp. 1615– 1631

    work page 2018

Show all 49 references
  1. [9]

    Composite backdoor attack for deep neural network by mixing existing benign features,

    J. Lin, L. Xu, Y . Liu, and X. Zhang, “Composite backdoor attack for deep neural network by mixing existing benign features,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, pp. 113–131

    2020

  2. [10]

    Demon in the variant: Statistical analysis of dnns for robust backdoor con- tamination detection

    D. Tang, X. Wang, H. Tang, and K. Zhang, “Demon in the variant: Statistical analysis of dnns for robust backdoor con- tamination detection.” inUSENIX Security Symposium, 2021, pp. 1541–1558

    2021

  3. [11]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,”arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  4. [12]

    Rethinking the back- door attacks’ triggers: A frequency perspective,

    Y . Zeng, W. Park, Z. M. Mao, and R. Jia, “Rethinking the back- door attacks’ triggers: A frequency perspective,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 16 473–16 481

    2021

  5. [13]

    Backdooring and poisoning neural networks with image-scaling attacks,

    E. Quiring and K. Rieck, “Backdooring and poisoning neural networks with image-scaling attacks,” in2020 IEEE Security and Privacy Workshops (SPW). IEEE, 2020, pp. 41–47

    2020

  6. [14]

    Input-aware dynamic backdoor attack,

    T. A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,”Advances in Neural Information Processing Systems, vol. 33, pp. 3454–3464, 2020

    2020

  7. [15]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 16 463–16 472

    2021

  8. [16]

    Condi- tional backdoor attack via jpeg compression,

    Q. Duan, Z. Hua, Q. Liao, Y . Zhang, and L. Y . Zhang, “Condi- tional backdoor attack via jpeg compression,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 18, 2024, pp. 19 823–19 831

    2024

  9. [17]

    Backdoor attack on deep neural networks in perception domain,

    X. Mo, L. Y . Zhang, N. Sun, W. Luo, and S. Gao, “Backdoor attack on deep neural networks in perception domain,” in2023 International Joint Conference on Neural Networks (IJCNN), 2023, pp. 01–08

    2023

  10. [18]

    Influence- driven data poisoning for robust recommender systems,

    C. Wu, D. Lian, Y . Ge, Z. Zhu, and E. Chen, “Influence- driven data poisoning for robust recommender systems,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 10, pp. 11 915–11 931, 2023

    2023

  11. [19]

    Poisoning attack against estimating from pairwise comparisons,

    K. Ma, Q. Xu, J. Zeng, X. Cao, and Q. Huang, “Poisoning attack against estimating from pairwise comparisons,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 10, pp. 6393–6408, 2022

    2022

  12. [20]

    Detecting ai trojans using meta neural analysis,

    X. Xu, Q. Wang, H. Li, N. Borisov, C. A. Gunter, and B. Li, “Detecting ai trojans using meta neural analysis,” in2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021, pp. 103–120

    2021

  13. [21]

    Abs: Scanning neural networks for back-doors by artificial brain stimulation,

    Y . Liu, W.-C. Lee, G. Tao, S. Ma, Y . Aafer, and X. Zhang, “Abs: Scanning neural networks for back-doors by artificial brain stimulation,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 1265–1282

    2019

  14. [22]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 707–723

    2019

  15. [23]

    Universal detection of backdoor attacks via density-based clustering and centroids analysis,

    W. Guo, B. Tondi, and M. Barni, “Universal detection of backdoor attacks via density-based clustering and centroids analysis,”IEEE Transactions on Information Forensics and Security, 2023

    2023

  16. [24]

    Neuralsanitizer: Detecting backdoors in neural networks,

    H. Zhu, Y . Zhao, S. Zhang, and K. Chen, “Neuralsanitizer: Detecting backdoors in neural networks,”IEEE Transactions on Information Forensics and Security, 2024

    2024

  17. [25]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,”Advances in Neural Information Processing Systems, vol. 31, 2018

    2018

  18. [26]

    Strip: A defence against trojan attacks on deep neural networks,

    Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” inProceedings of the 35th Annual Computer Security Applications Conference, 2019, pp. 113–125

    2019

  19. [27]

    Detecting backdoors during the inference stage based on corruption robustness consistency,

    X. Liu, M. Li, H. Wang, S. Hu, D. Ye, H. Jin, L. Wu, 13 and C. Xiao, “Detecting backdoors during the inference stage based on corruption robustness consistency,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16 363–16 372

    2023

  20. [28]

    Robust backdoor detection for deep learning via topological evolution dynamics,

    X. Mo, Y . Zhang, L. Y . Zhang, W. Luo, N. Sun, S. Hu, S. Gao, and Y . Xiang, “Robust backdoor detection for deep learning via topological evolution dynamics,” in2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 2048–2066

    2024

  21. [29]

    Revisiting the assumption of latent separability for backdoor defenses,

    X. Qi, T. Xie, Y . Li, S. Mahloujifar, and P. Mittal, “Revisiting the assumption of latent separability for backdoor defenses,” in The eleventh international conference on learning representa- tions, 2022

    2022

  22. [30]

    Bypassing backdoor detection al- gorithms in deep learning,

    T. J. L. Tan and R. Shokri, “Bypassing backdoor detection al- gorithms in deep learning,” in2020 IEEE European Symposium on Security and Privacy (EuroSP), 2020, pp. 175–183

    2020

  23. [31]

    Blind backdoors in deep learning models,

    E. Bagdasaryan and V . Shmatikov, “Blind backdoors in deep learning models,” inUsenix Security, 2021

    2021

  24. [32]

    On model outsourcing adaptive attacks to deep learning backdoor defenses,

    H. Peng, H. Qiu, H. Ma, S. Wang, A. Fu, S. F. Al-Sarawi, D. Abbott, and Y . Gao, “On model outsourcing adaptive attacks to deep learning backdoor defenses,”IEEE Transactions on Information Forensics and Security, 2024

    2024

  25. [33]

    Dba: Distributed back- door attacks against federated learning,

    C. Xie, K. Huang, P. Y . Chen, and B. Li, “Dba: Distributed back- door attacks against federated learning,” in8th International Conference on Learning Representations, ICLR 2020, 2020

    2020

  26. [34]

    One-to-n & n-to-one: Two advanced backdoor attacks against deep learning models,

    M. Xue, C. He, J. Wang, and W. Liu, “One-to-n & n-to-one: Two advanced backdoor attacks against deep learning models,”IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 3, pp. 1562–1578, 2020

    2020

  27. [35]

    A multitarget backdooring attack on deep neural networks with random location trigger,

    Y . Xiao, L. Cong, Z. Mingwen, W. Yajie, L. Xinrui, S. Shuxiao, M. Yuexuan, and Z. Jun, “A multitarget backdooring attack on deep neural networks with random location trigger,”Interna- tional Journal of Intelligent Systems, vol. 37, no. 3, pp. 2567– 2583, 2022

    2022

  28. [36]

    Spectre: Defending against backdoor attacks using robust statistics,

    J. Hayase, W. Kong, R. Somani, and S. Oh, “Spectre: Defending against backdoor attacks using robust statistics,” inInternational Conference on Machine Learning. PMLR, 2021, pp. 4129– 4139

    2021

  29. [37]

    Backdooring convolutional neural networks via targeted weight perturbations,

    J. Dumford and W. Scheirer, “Backdooring convolutional neural networks via targeted weight perturbations,” in2020 IEEE International Joint Conference on Biometrics (IJCB). IEEE, 2020, pp. 1–9

    2020

  30. [38]

    An embarrassingly simple approach for trojan attack in deep neural networks,

    R. Tang, M. Du, N. Liu, F. Yang, and X. Hu, “An embarrassingly simple approach for trojan attack in deep neural networks,” in Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, 2020, pp. 218–228

    2020

  31. [39]

    Odyssey: Creation, analysis and detection of trojan models,

    M. Edraki, N. Karim, N. Rahnavard, A. Mian, and M. Shah, “Odyssey: Creation, analysis and detection of trojan models,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 4521–4533, 2021

    2021

  32. [40]

    Detecting backdoor attacks on deep neural networks by activation clustering,

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,”arXiv preprint arXiv:1811.03728, 2018

    2018 arXiv

  33. [41]

    Backdoor defense via decoupling the training process,

    K. Huang, Y . Li, B. Wu, Z. Qin, and K. Ren, “Backdoor defense via decoupling the training process,” inInternational Conference on Learning Representations, 2022. [Online]. Available: https://openreview.net/forum?id=TySnJ-0RdKI

    2022

  34. [42]

    Defending against backdoor attacks by layer-wise feature analysis,

    N. M. Jebreel, J. Domingo-Ferrer, and Y . Li, “Defending against backdoor attacks by layer-wise feature analysis,” inAdvances in Knowledge Discovery and Data Mining, H. Kashima, T. Ide, and W.-C. Peng, Eds. Cham: Springer Nature Switzerland, 2023, pp. 428–440

    2023

  35. [43]

    Modularity and community structure in networks,

    M. E. J. Newman, “Modularity and community structure in networks,”Proceedings of the National Academy of Sciences, vol. 103, no. 23, pp. 8577–8582, 2006. [Online]. Available: https://www.pnas.org/doi/abs/10.1073/pnas.0601602103

    2006 doi

  36. [44]

    Community detection in graphs,

    S. Fortunato, “Community detection in graphs,”Physics Reports, vol. 486, no. 3–5, p. 75–174, Feb. 2010. [Online]. Available: http://dx.doi.org/10.1016/j.physrep.2009.11.002

    2010 doi

  37. [45]

    Pyod: A python toolbox for scalable outlier detection,

    Y . Zhao, Z. Nasrullah, and Z. Li, “Pyod: A python toolbox for scalable outlier detection,”Journal of Machine Learning Research, vol. 20, no. 96, pp. 1–7, 2019. [Online]. Available: http://jmlr.org/papers/v20/19-011.html

    2019

  38. [46]

    The cifar-10 dataset,

    “The cifar-10 dataset,” https://www.cs.toronto.edu/ ∼kriz/cifar. html

  39. [47]

    Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,

    J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,”Neural networks, vol. 32, pp. 323–332, 2012

    2012

  40. [48]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

    2016

  41. [49]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in2009 IEEE conference on computer vision and pattern recognition. Ieee, 2009, pp. 248–255. APPENDIXA BAG OFTRICKS FORADAPTIVEATTACKSDATA POISONING A. Laundry T...

    2009

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.