Pith. sign in

REVIEW 3 major objections 4 minor 56 references

LaserGuider: A Laser Based Physical Backdoor Attack against Deep Neural Networks

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LaserGuider shows that laser spots projected onto traffic signs can activate hidden backdoors in deep neural networks with over 90% success while leaving normal recognition intact.

desk verdict LaserGuider introduces a genuinely new physical backdoor trigger modality and a public dataset, but its headline success rates are fitted to the same physical test set they are measured on. read the letter →

arxiv 2412.03993 v1 pith:BJ3UBLQA submitted 2024-12-05 cs.CR cs.AIcs.CVcs.LGeess.IV

Yongjie Xu , Guangke Chen , Fu Song , Yuqi Chen This is my paper · ORCID
classification cs.CRcs.AIcs.CVcs.LGeess.IV
keywords backdoorattackphysicallasertriggertrafficsignrecognitiondatapoisoningdeepneuralnetworkMarkparameteroptimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a laser pointer, projecting a colored spot onto a traffic sign from a distance, can serve as a practical physical backdoor trigger against deep neural networks used for traffic sign recognition. Unlike sticker-based triggers, the laser needs no physical attachment, can be turned on and off in an instant, and can be redirected across signs, giving the attacker remote control and mobility. The authors show that by poisoning a small fraction of a training dataset with simulated digital laser spots, and optimizing four laser parameters (position, scale, opacity, center highlight), a backdoored model misclassifies real signs bearing a physical laser spot more than 90% of the time, while keeping clean-image accuracy above 95.9%. They also release a dataset of real traffic sign images with laser spots to support further study.

What carries the argument

The central mechanism is the digital laser-based trigger with four tunable parameters: scale (spot size relative to the sign), opacity (transparency), location (center or random), and center highlight (binary). Algorithm 1 first ranks parameters by their impact on attack success rate, then greedily optimizes each parameter in that order, retraining a model and measuring success on the physical test set Ptest at every step. The random location parameter is shown to be the most impactful, since it forces the model to learn a trigger-to-target association independent of position. This optimization procedure is what lifts the attack success rate from below 40% to above 90%.

What would settle it

Collect a fresh set of physical traffic sign images with laser spots from locations, distances, and weather conditions not used in parameter optimization, and measure the attack success rate of the already-trained backdoored model on this held-out set; if it drops well below 90%, the reported effectiveness is an artifact of parameter selection on the test set.

Watch

Extended reading notes

Core claim

LaserGuider establishes that laser spots are viable physical backdoor triggers. Using three commercial laser pointers (red, green, blue; circular and rectangular spots), the authors poison traffic-sign recognition models by inserting digital copies of laser spots into 5% of training images labeled as the target class. After training, a physical laser spot projected onto a real sign from over 30 meters away makes the model predict the attacker-chosen label in 90.5%, 93.2%, and 95.3% of physical test images for red, green, and blue triggers respectively, while clean accuracy stays above 95.9% on the same models. The core empirical discovery is that digital-simulated triggers, with parameters tuned by a proposed optimization algorithm, transfer to physical laser spots despite differences in lighting, angle, and spot appearance.

Load-bearing premise

The 90%+ success rates are measured on the same physical images used to tune the trigger parameters, so those numbers may not transfer to signs, distances, and lighting the attacker has never seen.

Editorial extensions

If this is right

  • A backdoored traffic sign recognition system can be attacked remotely: the adversary only needs to point a laser at a sign, not approach or modify it.
  • The attack transfers across model architectures; optimized parameters carry from ResNet-34 to ViT, GoogLeNet, and YOLOv8 with over 83% success on physical triggers.
  • Multiple laser triggers can be combined, achieving many-to-one attacks at 85.6-89.2% success and many-to-many attacks at 80.3-84.9% success with only small clean-accuracy loss.
  • Existing defenses examined in the paper, including Neural Cleanse, Activation Clustering, Spectral Signatures, and STRIP, mostly fail to detect the laser backdoor, and a tailored laser-removal defense reduces but does not eliminate it.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the reported results hold on independent test sets, laser-based backdoors could generalize beyond traffic signs to other camera-based perception systems, such as face recognition or lane detection, since the same remote-projection property applies.
  • The use of the same physical test set for both parameter selection and final evaluation suggests that a separate held-out collection of physical images is needed to estimate true field performance.
  • The superiority of random trigger placement over center placement implies a broader design principle: position-agnostic triggers are more robust in physical settings where exact placement is uncontrollable.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces LaserGuider, a physical backdoor attack against traffic-sign recognition DNNs in which the trigger is a laser spot projected onto a physical sign. The attacker poisons a training set with digitally rendered laser spots, and a parameter-optimization procedure (Algorithm 1) tunes spot size, opacity, location, and center highlighting. The authors evaluate on ResNet-34 and report 90.5%, 93.2%, and 95.3% attack success rates for red, green, and blue physical laser triggers with clean accuracy above 95.9%, together with many-to-one and many-to-many variants and ablation studies. They also release LaserMark, a physical dataset of traffic signs with laser spots.

Significance. If the empirical results are valid, this is a useful contribution to the physical-backdoor literature: laser-based triggers are a genuinely new trigger modality with practical advantages over sticker-type triggers, the released LaserMark dataset is a valuable resource, and the parameter-optimization procedure is a concrete step beyond hand-tuned triggers. The paper also demonstrates transfer of the optimized parameters across several architectures and evaluates several defenses. The main limitation is that the headline success rates are measured on the same physical test set used to select the trigger parameters, so the central empirical claim is not yet independently established.

major comments (3)
  1. [Section 3.4 / Section 5.2] Algorithm 1 selects the trigger parameters L, K, W, H and even the optimization order by calling Evaluate on Ptest (lines 16-23), and the final attack success rates in Section 5.2 are then reported on that same Ptest. This makes the 90.5%, 93.2%, and 95.3% figures in-sample fitted quantities rather than independent predictions. The transfer experiments in Section 5.5 do not resolve this, because they also evaluate on the same Ptest; they show parameter transfer across models, not generalization to unseen physical scenes or capture conditions. The paper needs an evaluation on a held-out physical test set, or an explicit nested validation protocol, before the central claim of over-90% physical attack success can be accepted.
  2. [Section 4.3 / Section 5.2] The reported averages are obtained by evaluating checkpoints at epochs 100, 120, 160, 180, and 200 of a single training run, not by averaging over independent training runs with different random seeds. The physical test sets are also small (235, 224, and 217 images for the red, green, and blue triggers, respectively). Without error bars or confidence intervals, the reported differences between trigger types (e.g., 90.5% versus 93.2%) may not be meaningful, and the sensitivity of the attack to training randomness is unknown.
  3. [Section 5.5] The claim that optimized laser parameters are 'generable' across models is supported only by applying the same parameters to ViT, GoogLeNet, and YOLO and measuring on Ptest. This is useful for showing architectural transfer, but it does not validate the physical-world robustness of the attack under new lighting, angles, distances, or sign instances. A separate physical test set collected under different conditions is needed for that purpose.
minor comments (4)
  1. [Section 4.2] The definition of the scale parameter K is awkward: 'S is the length of radius and semi-major axis' should be separated for the circular and rectangular cases, and the dependence of S on the laser spot size should be stated more precisely.
  2. [Section 5.5] The word 'generability' should be 'generalizability' in the model-transferability discussion.
  3. [Table 3] The caption for Table 3 defines 'ps' and 'il100' but the table uses these abbreviations heavily; please spell out the target labels in the caption or in a table note.
  4. [Section 6.2] The countermeasure discussion reports quantitative results (e.g., Neural Cleanse, Activation Clustering, STRIP) without specifying the exact evaluation protocol or providing confidence intervals; adding this information would strengthen the comparison.

Circularity Check

1 steps flagged · score 6.0 of 10

Headline attack success rates are the optimized objective on the same physical test set used for parameter selection, so the central claim is partially circular.

  1. fitted input called prediction [Section 3.4, Algorithm 1 (Evaluate function) and Section 5.2, Final Attack]
    "Algorithm 1 ... Input: ... Poisoned test dataset Ptest ... Function Evaluate(S): ... A ← Measure attack success rate of M′ on the test dataset Ptest; return A. ... Our final optimized attack achieves the attack success rate of 90.5%, 93.2%, and 95.3% on the red, green, and blue triggers, respectively, significantly higher than the baseline attack."

    Algorithm 1 explicitly takes Ptest as an input and Evaluate() returns the attack success rate Ap on Ptest; the optimization repeatedly retrains models and selects L, K, W, H values that maximize Ap on this same dataset. The final attack success rates in Section 5.2 are then reported on the very same Ptest. Thus 90.5%, 93.2%, and 95.3% are the optimized objective values on the tuning set, not independent held-out measurements. No separate physical test set is held out, and the transfer experiments to ViT, GoogLeNet, and YOLO still evaluate on the same Ptest, so the headline figures are partly forced by the selection procedure.

full rationale

The core attack construction — laser-based triggers, digital-to-physical simulation, and dataset poisoning — is not circular and is independently meaningful. The circularity is confined to the evaluation of the central claim: Section 3.4's Algorithm 1 uses Ptest both as the optimization target (via Evaluate) and as the benchmark for the reported attack success rates in Section 5.2. Since Ptest is the same set of 676 physical traffic-sign images collected by the authors, and no held-out physical test set is used, the reported 90%+ numbers are fitted quantities. The ablation and model-transfer results provide some independent evidence that the selected parameters generalize across architectures, but they do not break the circularity because they are measured on the same Ptest. This is a partial, not total, circularity: the attack itself appears to work, but its headline effectiveness is not an out-of-sample prediction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new theoretical or physical entities. Its claims rest on standard backdoor threat-model assumptions plus domain assumptions about the representativeness of the self-collected physical test set and the fidelity of digital trigger simulation. The four laser trigger parameters are fitted to the evaluation data.

free parameters (5)
  • Poisoning ratio alpha = 5% (806 of 16,130 images)
    Chosen by hand following prior backdoor works; attack power increases with alpha. Location: Section 4.1.
  • Laser scale K (per trigger) = Red: 6, Green: 6, Blue: 4
    Fitted by maximizing Ap on Ptest via Algorithm 1; Section 5.2.
  • Laser opacity W (per trigger) = Red: 90, Green: 60, Blue: 150
    Fitted by maximizing Ap on Ptest; Section 5.2.
  • Laser location L (per trigger) = Random for all triggers
    Fitted by maximizing Ap on Ptest; Random beats Center for all triggers; Section 5.2.
  • Laser highlight H (per trigger) = Red: 1, Green: 1, Blue: 0
    Fitted by maximizing Ap on Ptest; Section 5.2.
assumptions (5)
  • domain assumption Adversary can poison a training dataset, publish it, and a victim will train a DNN on it without modification
    Standard backdoor threat model in Section 3.1; the entire attack depends on this supply-chain premise.
  • domain assumption Digital laser spots placed on training images are a sufficient proxy for physical laser spots
    Section 3.3 and Section 5.5; the paper provides empirical evidence that digital trigger training transfers to physical triggers and is not improved by mixing physical triggers into training.
  • domain assumption The self-collected physical test set Ptest is representative of real-world conditions the attack will face
    Section 4.1; Ptest is collected by the authors with controlled distances and angles (laser over 30 meters, camera 5-30 meters) and clear-sky conditions. If real environments differ, ASR may drop.
  • domain assumption A visible laser spot can be projected on traffic signs from over 30 meters in outdoor lighting
    Used in the LaserMark collection and the attack scenario; the paper does not quantify laser power or visibility in sunlight. This underpins the claimed remote-control and temporal stealthiness.
  • domain assumption Adversary knows the target model architecture and training hyperparameters, and can train local replica models on the poisoned dataset
    Stated in the threat model (Section 3.1); this is needed for the parameter optimization procedure to select effective trigger settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LaserGuider: A Laser Based Physical Backdoor Attack against Deep Neural Networks." pith.science (2026). https://pith.science/paper/BJ3UBLQA

@misc{pith2026241203993,
  author       = {Pith},
  title        = {Pith review of: LaserGuider: A Laser Based Physical Backdoor Attack against Deep Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BJ3UBLQA}},
  note         = {Machine review of arXiv:2412.03993}
}
read the original abstract

Backdoor attacks embed hidden associations between triggers and targets in deep neural networks (DNNs), causing them to predict the target when a trigger is present while maintaining normal behavior otherwise. Physical backdoor attacks, which use physical objects as triggers, are feasible but lack remote control, temporal stealthiness, flexibility, and mobility. To overcome these limitations, in this work, we propose a new type of backdoor triggers utilizing lasers that feature long-distance transmission and instant-imaging properties. Based on the laser-based backdoor triggers, we present a physical backdoor attack, called LaserGuider, which possesses remote control ability and achieves high temporal stealthiness, flexibility, and mobility. We also introduce a systematic approach to optimize laser parameters for improving attack effectiveness. Our evaluation on traffic sign recognition DNNs, critical in autonomous vehicles, demonstrates that LaserGuider with three different laser-based triggers achieves over 90% attack success rate with negligible impact on normal inputs. Additionally, we release LaserMark, the first dataset of real world traffic signs stamped with physical laser spots, to support further research in backdoor attacks and defenses.

Figures

Figures reproduced from arXiv: 2412.03993 by the authors.

Figure 1
Figure 1. Overview of LaserGuider. 3.3 Trigger Design Design motivation. Existing physical backdoor attacks utilize various physical objects as triggers, e.g., square [16], earrings [47], sunglasses [7], bandana [47], and tattoo [47]. These triggers are typically deployed in a “sticker-pasting” set￾ting [14], where the adversary prints the triggers as stickers and affixes them onto physical objects. Because of the “sticker-pa… view at source ↗
Figure 2
Figure 2. Digital and physical laser-based triggers [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. The number of images contained in each category of LaserMark. Image [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Examples of images included in LaserMark. [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: The clean accuracy Ac of the baseline attack and the attack with each optimized laser parameter. Red Trigger Green Trigger Blue Trigger 0 20 40 60 80 100 Attack Success Rate (%) Baseline L K W H [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 7
Figure 7. Figure 7: Attack success rate Ap of base￾line and perturbed models, where the above-bar digit denotes the absolute difference of Ap between the baseline and each perturbed model. Red Trigger Green Trigger Blue Trigger 0 20 40 60 80 Attack Success Rate (%) L=Center L=Random [PIT…
Figure 9
Figure 9. Figure 9: The clean accuracy Ac and attack success rate Ap with respect to the value of the scale parameter K. success rate Ap when W = 90, W = 60, and W = 150, respectively, which are set as the optimal values of the opacity parameter W. Optimizing the highlighting parameter H.…
Figure 10
Figure 10. Figure 10: The clean accuracy Ac and attack success rate Ap with respect to the value of the opacity parameter W. respectively, significantly higher than the baseline attack. These demonstrate the effectiveness of the optimization approach and our attack LaserGuider. 5.3 Many-to…
Figure 11
Figure 11. Figure 11: Attack success rate Ap w.r.t. the value of the highlighting parameter H [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 12
Figure 12. Figure 12: The clean accuracy Ac and attack success rate Ap with respect to the number of poisoned training images with the physical triggers. #Images=0 de￾notes only using digital triggers when constructing the poisoned training dataset. it to the “Motor vehicle lane” sign rath…
Figure 13
Figure 13. Figure 13: Trigger changing semantics [PITH_FULL_IMAGE:figures/full_fig_p022_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 48 canonical work pages

  1. [1]

    Explore Ultralytics YOLOv8: A new state-of-the-art in computer vision, support- ing object detection, classification, and segmentation tasks. (2019)

    work page 2019

  2. [2]

    Multimodal Technol

    Bakator, M., Radosav, D.: Deep learning and medical diagnosis: A review of liter- ature. Multimodal Technol. Interact.2(3), 47 (2018)

    work page 2018

  3. [3]

    Balasubramaniam, S., Joe, C.V., Sivakumar, T.A., Prasanth, A., Kumar, K.S., Kavitha, V., Dhanaraj, R.K.: Optimization enabled deep learning-based ddos at- tack detection in cloud computing. Int. J. Intell. Syst.2023, 1–16 (2023)

    work page 2023

  4. [4]

    In: ICIP (2019)

    Barni, M., Kallas, K., Tondi, B.: A new backdoor attack in CNNS by training set corruption without label poisoning. In: ICIP (2019)

    work page 2019

  5. [5]

    CoRR abs/1902.06705 (2019)

    Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Good- fellow, I.J., Madry, A., Kurakin, A.: On evaluating adversarial robustness. CoRR abs/1902.06705 (2019)

    arXiv 2019

  6. [6]

    In: Workshop on Artificial Intelligence Safety

    Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I.M., Srivastava, B.: Detecting backdoor attacks on deep neural networks by acti- vation clustering. In: Workshop on Artificial Intelligence Safety. vol. 2301 (2019)

    work page 2019

  7. [7]

    CoRRabs/1712.05526 (2017)

    Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. CoRRabs/1712.05526 (2017)

    arXiv 2017

  8. [8]

    Chen, Y., Ye, Z., Zhao, H., Wang, Y.: Feature-based graph backdoor attack in the node classification task. Int. J. Intell. Syst.2023, 1–13 (2023)

    work page 2023

Show all 56 references
  1. [9]

    CoRRabs/2310.08259 (2023)

    Conti, M., Farronato, N., Koffas, S., Pajola, L., Picek, S.: Invisible threats: Back- door attack in OCR systems. CoRRabs/2310.08259 (2023)

    2023 arXiv

  2. [10]

    In: Proceedings of the International Conference on Computer Vision

    Doan, K.D., Lao, Y., Zhao, W., Li, P.: LIRA: learnable, imperceptible and robust backdoor attacks. In: Proceedings of the International Conference on Computer Vision. pp. 11946–11956 (2021)

    2021

  3. [11]

    In: IEEE INFOCOM 2023 - IEEE Conference on Computer Communications, New York City, NY, USA, May 17-20, 2023

    Dong, T., Zhang, Z., Qiu, H., Zhang, T., Li, H., Wang, T.: Mind your heart: Stealthy backdoor attack on dynamic deep neural network in edge computing. In: IEEE INFOCOM 2023 - IEEE Conference on Computer Communications, New York City, NY, USA, May 17-20, 2023. pp. 1–10 (2023)

    2023

  4. [12]

    In: ICCV (2021)

    Dong, Y., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., Zhu, J.: Black-box detection of backdoor attacks with limited information and data. In: ICCV (2021)

    2021

  5. [13]

    In: 9th International Conference on Learning Representations, ICLR (2021)

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., Houlsby, N.: An image is worth 16x16 words: Transformers for image recognition at scale. In: 9th International Conference ...

    2021

  6. [14]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Duan, R., Mao, X., Qin, A.K., Chen, Y., Ye, S., He, Y., Yang, Y.: Adversarial laser beam: Effective physical-world attack to dnns in a blink. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 16062–16071 (2021) Title Suppressed Due to E...

    2021

  7. [15]

    In: Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC 2019, San Juan, PR, USA, December 09-13, 2019

    Gao,Y.,Xu,C.,Wang,D.,Chen,S.,Ranasinghe,D.C.,Nepal,S.:STRIP:adefence against trojan attacks on deep neural networks. In: Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC 2019, San Juan, PR, USA, December 09-13, 2019. pp. 113–125 (2019)

    2019

  8. [16]

    CoRRabs/1708.06733 (2017)

    Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain. CoRRabs/1708.06733 (2017)

    2017 arXiv

  9. [17]

    In: The 30th ACM International Conference on Multimedia (2022)

    Han, X., Xu, G., Zhou, Y., Yang, X., Li, J., Zhang, T.: Physical backdoor attacks to lane detection systems in autonomous driving. In: The 30th ACM International Conference on Multimedia (2022)

    2022

  10. [18]

    In: IEEE Conference on Computer Vision and Pattern Recognition, CVPR

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: IEEE Conference on Computer Vision and Pattern Recognition, CVPR. pp. 770–778 (2016)

    2016

  11. [19]

    He,Y.,Shen,Z.,Xia,C.,Hua,J.,Tong,W.,Zhong,S.:SGBA:Astealthyscapegoat backdoor attack against deep neural networks. Comput. Secur.136, 103523 (2024)

    2024

  12. [20]

    Huang, Y., Shih, L., Tsai, C., Shen, G.: Describing video scenarios using deep learning techniques. Int. J. Intell. Syst.36(6), 2465–2490 (2021)

    2021

  13. [21]

    CoRRabs/2006.06091 (2020)

    Huang, Y., Chen, Y.: Autonomous driving with deep learning: A survey of state- of-art technologies. CoRRabs/2006.06091 (2020)

    2020 arXiv

  14. [22]

    In: ICLR (2015)

    Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. In: ICLR (2015)

    2015

  15. [23]

    CoRR abs/2009.06996 (2020)

    Li, H., Wang, Y., Xie, X., Liu, Y., Wang, S., Wan, R., Chau, L., Kot, A.C.: Light can hack your face! black-box backdoor attack on face recognition systems. CoRR abs/2009.06996 (2020)

    2020 arXiv

  16. [24]

    Li, Q., Chen, W., Xu, X., Zhang, Y., Wu, L.: Precision strike: Precise backdoor attack with dynamic trigger. Comput. Secur.148, 104101 (2025)

    2025

  17. [25]

    IEEE Transactions on Neural Networks and Learning Systems (2022)

    Li, Y., Jiang, Y., Li, Z., Xia, S.T.: Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems (2022)

    2022

  18. [26]

    CoRR abs/2104.02361 (2021)

    Li, Y., Zhai, T., Jiang, Y., Li, Z., Xia, S.: Backdoor attack in the physical world. CoRR abs/2104.02361 (2021)

    2021 arXiv

  19. [27]

    Lian, W., Zhang, Y., Chen, X., Jia, B., Zhang, X.: Ipcadp-equalizer: An improved multibalance privacy preservation scheme against backdoor attacks in federated learning. Int. J. Intell. Syst.2023, 1–20 (2023)

    2023

  20. [28]

    In: ACM SIGSAC Conference on Computer and Communications Security

    Lin, J., Xu, L., Liu, Y., Zhang, X.: Composite backdoor attack for deep neu- ral network by mixing existing benign features. In: ACM SIGSAC Conference on Computer and Communications Security. pp. 113–131 (2020)

    2020

  21. [29]

    In: 25th Annual Network and Distributed System Security Symposium, NDSS (2018)

    Liu,Y.,Ma, S., Aafer, Y., Lee, W., Zhai, J., Wang, W., Zhang, X.: Trojaning attack on neural networks. In: 25th Annual Network and Distributed System Security Symposium, NDSS (2018)

    2018

  22. [30]

    In: European Conference on Computer Vision

    Liu, Y., Ma, X., Bailey, J., Lu, F.: Reflection backdoor: A natural backdoor attack on deep neural networks. In: European Conference on Computer Vision. vol. 12355, pp. 182–199 (2020)

    2020

  23. [31]

    In: 2017 IEEE International Con- ference on Computer Design

    Liu, Y., Xie, Y., Srivastava, A.: Neural trojans. In: 2017 IEEE International Con- ference on Computer Design. pp. 45–48. IEEE (2017)

    2017

  24. [32]

    Information Fusion99, 101869 (2023)

    Mehrish, A., Majumder, N., Bharadwaj, R., Mihalcea, R., Poria, S.: A review of deep learning techniques for speech processing. Information Fusion99, 101869 (2023)

    2023

  25. [33]

    In: Annual Con- ference on Neural Information Processing Systems (2020)

    Nguyen, T.A., Tran, A.T.: Input-aware dynamic backdoor attack. In: Annual Con- ference on Neural Information Processing Systems (2020)

    2020

  26. [34]

    Sensors 23(10), 4742 (2023) 26 Y

    Oyama, T., Okura, S., Yoshida, K., Fujino, T.: Backdoor attack on deep neural networks triggered by fault injection attack on image sensor interface. Sensors 23(10), 4742 (2023) 26 Y. Xu, G. Chen, et al

    2023

  27. [35]

    In: 31st USENIX Security Symposium

    Pan, X., Zhang, M., Sheng, B., Zhu, J., Yang, M.: Hidden trigger backdoor at- tack on NLP models via linguistic style manipulation. In: 31st USENIX Security Symposium. pp. 3611–3628 (2022)

    2022

  28. [36]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Rakin, A.S., He, Z., Fan, D.: Tbt: Targeted neural network attack with bit trojan. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 13198–13207 (2020)

    2020

  29. [37]

    In: CD-MAKE

    Rehman, H., Ekelhart, A., Mayer, R.: Backdoor attacks in neural networks - A systematic evaluation on multiple traffic sign datasets. In: CD-MAKE. Lecture Notes in Computer Science (2019)

    2019

  30. [38]

    arXiv preprint arXiv:2405.19990 (2024)

    Sun, W., Jiang, X., Li, D., Zhao, C.: Diffphysba: Diffusion-based physical backdoor attack against person re-identification in real-world. arXiv preprint arXiv:2405.19990 (2024)

    2024 arXiv

  31. [39]

    In: Chandra, S., Blincoe, K., Tonella, P

    Sun, Z., Du, X., Song, F., Li, L.: Codemark: Imperceptible watermarking for code datasets against neural code completion models. In: Chandra, S., Blincoe, K., Tonella, P. (eds.) Proceedings of the 31st ACM Joint European Software Engi- neering Conference and Symposium on the F...

    2023

  32. [40]

    In: The ACM Web Con- ference

    Sun, Z., Du, X., Song, F., Ni, M., Li, L.: Coprotector: Protect open-source code against unauthorized training usage with data poisoning. In: The ACM Web Con- ference. pp. 652–660 (2022)

    2022

  33. [41]

    In: IEEE Conference on Computer Vision and Pattern Recognition, CVPR

    Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S.E., Anguelov, D., Erhan, D., Vanhoucke, V., Rabinovich, A.: Going deeper with convolutions. In: IEEE Conference on Computer Vision and Pattern Recognition, CVPR. pp. 1–9 (2015)

    2015

  34. [42]

    In: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining

    Tang, R., Du, M., Liu, N., Yang, F., Hu, X.: An embarrassingly simple approach for trojan attack in deep neural networks. In: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. pp. 218–228 (2020)

    2020

  35. [43]

    In: Advances in Neural Information Processing Systems 31: Annual Conference on Neural Infor- mation Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada

    Tran, B., Li, J., Madry, A.: Spectral signatures in backdoor attacks. In: Advances in Neural Information Processing Systems 31: Annual Conference on Neural Infor- mation Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada. pp. 8011–8021 (2018)

    2018

  36. [44]

    CoRR abs/1912.02771 (2019)

    Turner, A., Tsipras, D., Madry, A.: Label-consistent backdoor attacks. CoRR abs/1912.02771 (2019)

    2019 arXiv

  37. [45]

    In: IEEE Symposium on Security and Privacy

    Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., Zhao, B.Y.: Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In: IEEE Symposium on Security and Privacy. pp. 707–723. IEEE (2019)

    2019

  38. [46]

    In: Proceed- ings of the 31st ACM International Conference on Multimedia (2023)

    Wei, H., Yu, H., Zhang, K., Wang, Z., Zhu, J., Wang, Z.: Moiré backdoor attack (MBA): A novel trigger for pedestrian detectors in the physical world. In: Proceed- ings of the 31st ACM International Conference on Multimedia (2023)

    2023

  39. [47]

    In: IEEE Con- ference on Computer Vision and Pattern Recognition

    Wenger, E., Passananti, J., Bhagoji, A.N., Yao, Y., Zheng, H., Zhao, B.Y.: Back- door attacks against deep learning systems in the physical world. In: IEEE Con- ference on Computer Vision and Pattern Recognition. pp. 6206–6215 (2021)

    2021

  40. [48]

    Yao, Y., Li, H., Zheng, H., Zhao, B.Y.: Latent backdoor attacks on deep neural networks. In: CCS. pp. 2041–2055 (2019)

    2019

  41. [49]

    Yu, X., Cong, L., Zheng, M., Wang, Y., Liu, X., Shuxiao, S., Yuexuan, M., Jun, Z.: A multitarget backdooring attack on deep neural networks with random location trigger. Int. J. Intell. Syst.37(3), 2567–2583 (2022)

    2022

  42. [50]

    In: IEEE International Conference on Acoustics, Speech and Signal Processing

    Zhai, T., Li, Y., Zhang, Z., Wu, B., Jiang, Y., Xia, S.: Backdoor attack against speaker verification. In: IEEE International Conference on Acoustics, Speech and Signal Processing. pp. 2560–2564 (2021) Title Suppressed Due to Excessive Length 27

    2021

  43. [51]

    In: Proceedings of the 32nd ACM International Conference on Multimedia, MM (2024)

    Zhang, X., Liu, A., Zhang, T., Liang, S., Liu, X.: Towards robust physical-world backdoor attacks on lane detection. In: Proceedings of the 32nd ACM International Conference on Multimedia, MM (2024)

    2024

  44. [52]

    In: 26th International Symposium on Formal Methods

    Zhang, Y., Chen, G., Song, F., Sun, J., Dong, J.S.: Certified quantization strat- egy synthesis for neural networks. In: 26th International Symposium on Formal Methods. Lecture Notes in Computer Science, vol. 14933, pp. 343–362 (2024)

    2024

  45. [53]

    Zhao, Z., Chen, G., Liu, T., Li, T., Song, F., Wang, J., Sun, J.: Attack as detection: Usingadversarialattackmethodstodetectabnormalexamples.ACMTrans.Softw. Eng. Methodol. 33(3), 68:1–68:45 (2024)

    2024

  46. [54]

    In: Cadar, C., Zhang, X

    Zhao, Z., Chen, G., Wang, J., Yang, Y., Song, F., Sun, J.: Attack as defense: char- acterizing adversarial examples using robustness. In: Cadar, C., Zhang, X. (eds.) Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA). pp. 42–55...

    2021

  47. [55]

    In: Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy

    Zhong, H., Liao, C., Squicciarini, A.C., Zhu, S., Miller, D.: Backdoor embedding in convolutional neural network models via invisible perturbation. In: Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy. pp. 97–108 (2020)

    2020

  48. [56]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition

    Zhu, Z., Liang, D., Zhang, S., Huang, X., Li, B., Hu, S.: Traffic-sign detection and classification in the wild. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 2110–2118 (2016)

    2016

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.