Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Backdoor Mitigation by Distance-Driven Detoxification

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By maximizing the distance of selected weights from the initial backdoored model under a clean-loss constraint, D3 reports the lowest average attack success rate (0.46%) among compared post-training defenses on CIFAR-10 with…

desk verdict A simple, effective post-training backdoor defense whose empirical case is solid but whose theory is mostly tautological; worth reviewing. read the letter →

arxiv 2411.09585 v2 pith:C25CIWKF submitted 2024-11-14 cs.CR

Shaokui Wei , Jiayin Liu , Hongyuan Zha This is my paper · ORCID
classification cs.CR
keywords backdoordefensepost-trainingfine-tuningdistance-drivendetoxificationconstrainedoptimizationattacksuccessrateprojectedgradientdescentattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that vanilla fine-tuning fails to remove backdoors because it settles in regions where both clean and poisoned samples have low loss, leaving the trigger behavior intact. It proposes Distance-Driven Detoxification (D3), which fine-tunes the model by maximizing the distance of selected linear-layer weights from the backdoored starting weights while keeping clean-data loss below a threshold. In experiments across seven backdoor attacks, three datasets, and three model architectures, D3 brings the average attack success rate down to 0.46% on CIFAR-10 with PreAct-ResNet18, the lowest among the post-training defenses compared, while keeping clean accuracy close to the best baseline. If the claim holds, defenders with only a small clean dataset can neutralize unknown triggers without knowing the trigger pattern or target label.

What carries the argument

The load-bearing device is the distance term $d(\theta_s, \theta_{\text{init},s})$ in the objective $\min_{\theta:\theta_s\in S} -d(\theta_s,\theta_{\text{init},s}) + \lambda \max(0, L_{\text{cl}}(\theta)-\epsilon)$, solved by projected gradient descent. The paper chooses $\theta_s$ as the linear-layer weights, measures distance with the Frobenius norm, and projects onto a norm-constrained set $S$ to block weight-scaling. The supporting argument is the Taylor expansion $L_{\text{bd}}(\theta_t) - L_{\text{bd}}(\theta_{\text{init}}) \approx \frac{t^2}{2}(\theta_{\text{ft}}-\theta_{\text{init}})^T H(\theta_{\text{init}})(\theta_{\text{ft}}-\theta_{\text{init}})$, which turns the local-minimum assumption into a prediction that backdoor loss increases quadratically as weights move away. This quadratic growth is what turns a simple geometric objective into a defense mechanism.

What would settle it

Compute or estimate the Hessian of the backdoor loss at the initial weights of a real attacked model, for instance by measuring the loss along many random directions. If any direction makes backdoor loss initially decrease, the quadratic-increase justification for D3 fails; a direct ablation that would also count is removing the distance term and showing that attack success rate no longer drops.

Watch

Extended reading notes

Core claim

D3 treats backdoor mitigation as a constrained optimization problem: find weights $\theta$ maximizing $d(\theta, \theta_{\text{init}})$ subject to $\mathbb{E}_{(x,y)\in D_{\text{cl}}}[\ell(f_\theta(x), y)] \le \epsilon$, then relaxes the constraint into a penalty and solves with projected gradient descent. To keep the distance meaningful, it measures $d$ by the Frobenius norm on a selected subset $\theta_s$ (the linear layers) and constrains the norm of $\theta_s$ so that scaling tricks cannot inflate the distance. The paper's key observation is that vanilla fine-tuning moves from $\theta_{\text{init}}$ to $\theta_{\text{ft}}$ inside a region where backdoor loss stays low, whereas extending the trajectory beyond the fine-tuned point raises backdoor loss sharply while barely changing clean loss. The theoretical justification is a second-order Taylor expansion: if $\theta_{\text{init}}$ is a local minimum of the backdoor loss, its Hessian is positive semi-definite, so backdoor loss grows roughly quadratically with distance. In the main CIFAR-10 experiments with PreAct-ResNet18, D3 reports an average attack success rate of 0.46%, lower than every compared post-training defense, while keeping clean accuracy close to the best baseline.

Load-bearing premise

The load-bearing premise is that the backdoored model's initial weights sit at a local minimum of the backdoor loss, so any movement away from them raises that loss; because the defender does not know the trigger or target label, this premise cannot be checked in practice.

Editorial extensions

If this is right

  • If the central claim is correct, defenders can neutralize backdoors using only a small clean dataset, with no knowledge of the trigger, because D3's distance objective never needs to reconstruct the poison.
  • D3 remains effective at poisoning ratios up to 50% and with reserved datasets as small as 1% of training data, so the defense does not require a large clean set.
  • Adaptive attackers who flatten the backdoor loss landscape with sharpness-aware minimization still cannot defeat D3, whereas vanilla fine-tuning and FT-SAM show rising attack success rates as flatness increases.
  • Because the method computes weight distance on shared linear layers, it transfers across convolutional and transformer architectures (PreAct-ResNet18, VGG19-BN, ViT-B-16).
  • The added computation over vanilla fine-tuning is small, making D3 cheaper than most trigger-reconstruction defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: D3's distance objective is trigger-agnostic, so it may also suppress other low-loss memorization effects such as certain data-poisoning artifacts or spurious correlations, not just backdoors; this is testable by running D3 on non-backdoor memorization benchmarks.
  • Editorial extension: the theory predicts a quadratic rise in backdoor loss along every direction from the initial weights; estimating the Hessian spectrum on real models would reveal whether flat-minimum backdoors violate the local-minimum premise, and the paper's own adaptive-attack experiments suggest the premise can break under sharpness-aware training.
  • Editorial extension: the paper leaves layer selection to future work, but a natural improvement is to identify backdoor-critical layers and weight the distance accordingly, which could reduce the accuracy/attack-success trade-off seen in the ablations.
  • Editorial extension: because D3 only maximizes distance, combining it with an explicit clean-data regularizer or with trigger reconstruction could lower attack success further without sacrificing clean accuracy.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes D3, a post-training backdoor defense that fine-tunes a potentially backdoored model by maximizing the distance of selected linear-layer weights from the initial backdoored weights subject to a clean-loss penalty, with a projection operation to constrain weight norms. The authors motivate D3 from an analysis of vanilla fine-tuning trajectories (Section 3.2, Figure 2) and a second-order Taylor argument that assumes the initial weights are a local minimum of backdoor loss. They evaluate D3 against seven attacks, three datasets, and three architectures, reporting low ASR (average 0.46% on CIFAR-10/PreAct-ResNet18), high DER, ablations on poisoning ratio, reserved dataset size and source, hyperparameters, and adaptive SAM-based attacks. They conclude that D3 matches or outperforms state-of-the-art post-training defenses.

Significance. Empirically, D3 is a simple and comparatively cheap defense that appears strong: the evaluation is broad, uses standardized BackdoorBench checkpoints, reports consistent ASR reductions across attacks, and includes useful ablations on poisoning ratio, reserved data size, synthetic data, and hyperparameters. The training-cost comparison in Figure 3 is a practical strength. However, the theoretical justification in Section 3.2 does not provide a falsifiable prediction independent of D3's own objective, and the adaptive-attack evaluation covers only a narrow family of attackers that still satisfy the local-minimum premise. The empirical contribution is substantial enough to warrant a major revision, but the paper currently overstates the theoretical and robustness guarantees.

major comments (4)
  1. [Section 3.2, Eq. (3.2) and surrounding text] The entire Taylor argument assumes that the initial weights θ_init are a local minimum of the backdoor loss L_bd, i.e., ∇L_bd(θ_init)=0 and the Hessian is positive semi-definite. This premise is unverified: θ_init is the result of training on a poisoned dataset, not of minimizing L_bd over the defender's clean dataset D_cl, and the defender cannot check the premise because the trigger and target label are unknown. The paper provides no measurement of the gradient or Hessian at θ_init, even though the experimental setup knows the trigger and could test the assumption. If ∇L_bd(θ_init)≠0, the first-order term in the Taylor expansion can dominate and moving away from θ_init can decrease rather than increase backdoor loss, which would undermine the stated mechanism. Please either provide an empirical verification of the local-minimum condition on the evaluated attacks or reformulate the theoretical motivation so that it does not rely on this uncheckable premise.
  2. [Section 3.2 vs. Section 3.3] Even if the local-minimum premise held, the Taylor expansion only restates D3's objective: Eq. (4) explicitly maximizes d(θ_s, θ_init,s), so showing that moving away from a local minimum increases L_bd does not yield an independent prediction about the constrained solution of Eq. (3) or about clean loss. The actual evidence for the defense is the empirical trajectory in Figure 2 and the downstream defense results, not the Taylor calculation. Please position Section 3.2 as intuition rather than a theoretical guarantee, or provide a derivation that yields a testable prediction about D3's behavior.
  3. [Section 4.4, Table 5] The adaptive-attack evaluation only tests attackers that regularize toward flat minima via SAM with budgets 1.0–3.0. These attackers still satisfy the local-minimum premise of Section 3.2; an adversary who explicitly violates that premise, for example by ensuring a large outward gradient of L_bd at θ_init, is not tested. The claim that D3 is robust to adaptive attacks is therefore narrower than stated. Please extend the adaptive evaluation to include attacks designed to break the distance-maximization mechanism, or soften the robustness claim accordingly.
  4. [Tables 1–7] All results are reported as single runs with no error bars, and DER is averaged from point estimates, so it is unclear whether the numerical advantages of D3 (e.g., ASR differences of a few tenths of a percent in Table 1) are stable. Table 7 also shows that at λ=40 the Blended ASR jumps to 23.36%, demonstrating high sensitivity to a hyperparameter that is fixed without a reported validation procedure across attacks. Please report means and standard deviations over at least three seeds and describe how λ, ε, and the choice of θ_s are selected in practice.
minor comments (6)
  1. [Section 3.2, first bullet] Typo: 'backddoored' should be 'backdoored'.
  2. [Equation (2)] The displayed equation has an unmatched closing bracket after the backdoor loss term; also, the label 'Ideal loss' followed by a bracket is confusing. Please clean up the notation.
  3. [Figure 3] The caption says values are normalized with respect to 'training time of vanilla full-tuning', while the text refers to 'vanilla fine-tuning'. Clarify which baseline is used and provide absolute timings.
  4. [Section 4.2] The sentence 'D3 attains the second-lowest ASR in six out of seven different types of attacks' is confusing because D3 has the lowest average ASR; please state explicitly that the exception is LF, where SAU achieves a lower ASR.
  5. [Section 4.5, Table 7] The jump in Blended ASR from 0.22% at λ=10 to 23.36% at λ=40 is notable and is not discussed; please explain the non-monotonic behavior.
  6. [Conclusion, Limitations] The Limitations paragraph acknowledges the ACC/ASR trade-off but is silent on the unverified local-minimum assumption of Section 3.2; this limitation should be disclosed explicitly.

Circularity Check

1 steps flagged · score 4.0 of 10

Section 3.2's theoretical justification is self-definitional: it assumes θ_init is a local minimum of backdoor loss and then 'derives' that moving away increases that loss; the empirical evaluation remains independent.

  1. self definitional [Section 3.2, 'Theoretical justification' (page 5)]
    "As the initial model is optimized to minimize loss over a poisoned dataset, We assume that θinit is already a local minimum of the backdoor loss Lbd, i.e., ∇Lbd(θinit) = 0. ... Therefore, as t increases, the difference Lbd(θt) − Lbd(θinit) grows approximately quadratically with t. This relationship demonstrates that the backdoor loss Lbd(θt) increases as the weights θt move further away from its initial values, as observed in Figure 2."

    The claimed result—backdoor loss increases as weights move away from θ_init—is not an independent derivation; it is the definition of the premise. A point being a local minimum of L_bd means, by definition, that sufficiently small moves in any direction do not decrease L_bd. With a PSD Hessian, the second-order Taylor term is nonnegative, so the 'quadratic growth' is a restatement of the assumed local-minimum/PSD-curvature condition, not a new prediction. D3's objective (Equations 3 and 4) then literally maximizes d(θ, θ_init), so the mechanism is constructed to realize exactly the assumed behavior.

full rationale

Most of the paper's contribution is empirically self-contained: D3 is benchmarked against seven fixed backdoor attacks using BackdoorBench checkpoints, with fixed hyperparameters (λ=10, ϵ=0.1), and the reported ACC/ASR/DER values are measured, not fitted to the defense's objective. The citations to the authors' own prior work (BackdoorBench, SAU, FT-SAM, VDC, etc.) supply standardized benchmarks, baselines, and related methods; none of them is invoked as the sole justification for D3's mechanism, so they are not load-bearing circularity. The one genuine circular step is the 'theoretical justification' in Section 3.2. It assumes θ_init is a local minimum of L_bd and then 'shows' that moving away from θ_init increases L_bd; this is true by definition of a local minimum, and D3's objective is then set to maximize distance. The assumption is also unverifiable by the defender and is not tested: the adaptive attacks in Section 4.4 use SAM-flat minima, which still satisfy the local-minimum premise, so they do not probe the premise itself. Because the central empirical claims do not depend on this self-definitional theory, the score is 4 rather than higher: partial circularity in the stated rationale, with independent experimental content.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on two free hyperparameters (λ, ε), a design choice of which weights to distance, and an unverifiable assumption about the backdoor-loss landscape. No new physical or conceptual entities are introduced.

free parameters (3)
  • λ = 10
    Trade-off multiplier for the clean-loss penalty in Equation 4; chosen by the authors. Ablations show strong sensitivity, with λ=40 causing ASR up to 23.36% on Blended.
  • ε = 0.1
    Clean-loss threshold in the constraint of Equation 3 and penalty in Equation 4. Ablations show that ε=0.5 gives ASR 0.48% for BadNets while ε=0 gives ASR 1.13%, indicating the value materially affects outcomes.
  • θs selection = linear layers
    The method measures distance only on a subset of weights (linear layers). This design choice is motivated by generalization, but the specific layer choice is not systematically tuned or justified beyond being architecture-agnostic.
assumptions (3)
  • domain assumption θ_init is a local minimum of the backdoor loss, i.e., ∇L_bd(θ_init)=0 and the Hessian is positive semi-definite.
    Used in the Taylor expansion in Section 3.2 to claim backdoor loss grows quadratically when moving away from θ_init. Not verifiable by the defender, who lacks trigger knowledge.
  • domain assumption The defender has access to a small, clean reserved dataset D_cl.
    Standard assumption in post-training defenses, stated in Section 3.1. D3 requires it for the clean-loss constraint.
  • ad hoc to paper Measuring distance only on a subset of weights (linear layers) preserves generalization and still captures backdoor-relevant directions.
    Introduced in Section 3.3 Challenge 1 to avoid overfitting on the small reserved dataset. The paper does not prove or independently validate this premise beyond the main experiments.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Backdoor Mitigation by Distance-Driven Detoxification." pith.science (2026). https://pith.science/paper/C25CIWKF

@misc{pith2026241109585,
  author       = {Pith},
  title        = {Pith review of: Backdoor Mitigation by Distance-Driven Detoxification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/C25CIWKF}},
  note         = {Machine review of arXiv:2411.09585}
}
read the original abstract

Backdoor attacks undermine the integrity of machine learning models by allowing attackers to manipulate predictions using poisoned training data. Such attacks lead to targeted misclassification when specific triggers are present, while the model behaves normally under other conditions. This paper considers a post-training backdoor defense task, aiming to detoxify the backdoors in pre-trained models. We begin by analyzing the underlying issues of vanilla fine-tuning and observe that it is often trapped in regions with low loss for both clean and poisoned samples. Motivated by such observations, we propose Distance-Driven Detoxification (D3), an innovative approach that reformulates backdoor defense as a constrained optimization problem. Specifically, D3 promotes the model's departure from the vicinity of its initial weights, effectively reducing the influence of backdoors. Extensive experiments on state-of-the-art (SOTA) backdoor attacks across various model architectures and datasets demonstrate that D3 not only matches but often surpasses the performance of existing SOTA post-training defense techniques.

Figures

Figures reproduced from arXiv: 2411.09585 by the authors.

Figure 1
Figure 1. (a): An illustrative example for curves of clean loss and backdoor loss, highlighting three key points, i.e., the initial weights θinit, the weights after vanilla fine-tune θf t, and the weights after applying our method θD3. (b): A demonstration of loss regions. Vanilla fine-tuning is often trapped in regions where both types of loss are low, thus failing to eliminate backdoors. In contrast, our method finds a more… view at source ↗
Figure 2
Figure 2. Left: The visualization of curves for clean loss and backdoor loss, along the trajectory for fine-tuning four attacks. Right: The visualization of curves for Accuracy and Attack Success Rate, along the trajectory for fine-tuning four attacks. The results are shown in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Comparative analysis of different methods across various Datasets. The values are [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: (a) The T-SNE visualization of the model after applying D3 against BadNets attack. (b) Visualization of the weight differences for each parameter in the selected layer. The blue part represents the difference between the vanilla fine-tuned model and the backdoor model,…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Revisiting the Auxiliary Data in Backdoor Purification

    cs.CR 2025-02 conditional novelty 6.0 of 10

    Guided Input Calibration aligns any auxiliary dataset with a victim model's learned features before backdoor purification, consistently improving clean accuracy across dataset types with variable effects on attack suc...

Reference graph

Works this paper leans on

49 extracted references · 20 canonical work pages · cited by 1 Pith paper

  1. [1]

    Past, present, and future of face recognition: A review

    Insaf Adjabi, Abdeldjalil Ouahabi, Amir Benzaoui, and Abdelmalik Taleb-Ahmed. Past, present, and future of face recognition: A review. Electronics, page 1188, 2020

    2020

  2. [2]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In International Conference on Image Processing, 2019

    2019

  3. [3]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. In Workshop on Artificial Intelligence Safety, 2019

    2019

  4. [4]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv e-prints, pages arXiv–1712, 2017

    2017

  5. [5]

    Diffusion models in vision: A survey

    Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Ionescu, and Mubarak Shah. Diffusion models in vision: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023

    2023

  6. [6]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2020

    2020

  7. [7]

    Generative adversarial networks

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 2020

    work page 2020

  8. [8]

    Badnets: Evaluating backdooring attacks on deep neural networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, pages 47230–47244, 2019

    2019

Show all 49 references
  1. [9]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Conference on Computer Vision and Pattern Recognition, 2016

    2016

  2. [10]

    Identity mappings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European Conference on Computer Vision, 2016

    2016

  3. [11]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, pages 6840–6851, 2020

    2020

  4. [12]

    Backdoor defense via decoupling the training process

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In International Conference on Learning Representations , 2022

    2022

  5. [13]

    Forget-me-not: Making backdoor hard to be forgotten in fine-tuning

    Tran Ngoc Huynh, Anh Tuan Tran, Khoa D Doan, and Tung Pham. Forget-me-not: Making backdoor hard to be forgotten in fine-tuning. 2024

    2024

  6. [14]

    Auto-encoding variational bayes

    Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv e-prints, 2013

    2013

  7. [15]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  8. [16]

    Asam: Adaptive sharpness- aware minimization for scale-invariant learning of deep neural networks

    Jungmin Kwon, Jeongseop Kim, Hyunseo Park, and In Kwon Choi. Asam: Adaptive sharpness- aware minimization for scale-invariant learning of deep neural networks. In International Conference on Machine Learning, 2021

    2021

  9. [17]

    Tiny imagenet visual recognition challenge

    Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 2015

    2015

  10. [18]

    Anti-backdoor learning: Training clean models on poisoned data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In Conference on Neural Information Processing Systems, 2021

    2021

  11. [19]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International Conference on Learning Representations, 2021. 12

    2021

  12. [20]

    Invisible backdoor attack with sample-specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In International Conference on Computer Vision, 2021

    2021

  13. [21]

    Calculus of variations and optimal control theory: A concise introduction, 2010

    Daniel Liberzon. Calculus of variations and optimal control theory: A concise introduction, 2010

    2010

  14. [22]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses, 2018

    2018

  15. [23]

    Computing systems for autonomous driving: State of the art and challenges

    Liangkai Liu, Sidi Lu, Ren Zhong, Baofu Wu, Yongtao Yao, Qingyang Zhang, and Weisong Shi. Computing systems for autonomous driving: State of the art and challenges. IEEE Internet of Things Journal, pages 6469–6486, 2020

    2020

  16. [24]

    Beating backdoor attack at its own game

    Min Liu, Alberto Sangiovanni-Vincentelli, and Xiangyu Yue. Beating backdoor attack at its own game. In International Conference on Computer Vision, 2023

    2023

  17. [25]

    Towards stable backdoor purification through feature shift tuning

    Rui Min, Zeyu Qin, Li Shen, and Minhao Cheng. Towards stable backdoor purification through feature shift tuning. In Advances in Neural Information Processing Systems, 2023

    2023

  18. [26]

    The deep bootstrap framework: Good online learners are good offline generalizers

    Preetum Nakkiran, Behnam Neyshabur, and Hanie Sedghi. The deep bootstrap framework: Good online learners are good offline generalizers. arXiv e-prints, 2020

    2020

  19. [27]

    Input-aware dynamic backdoor attack

    Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. In Conference on Neural Information Processing Systems, 2020

    2020

  20. [28]

    Wanet - imperceptible warping-based backdoor attack

    Tuan Anh Nguyen and Anh Tuan Tran. Wanet - imperceptible warping-based backdoor attack. In International Conference on Learning Representations, 2021

    2021

  21. [29]

    Towards a proactive {ML} approach for detecting backdoor poison samples

    Xiangyu Qi, Tinghao Xie, Jiachen T Wang, Tong Wu, Saeed Mahloujifar, and Prateek Mittal. Towards a proactive {ML} approach for detecting backdoor poison samples. In USENIX Security Symposium, 2023

    2023

  22. [30]

    Fine-tuning is all you need to mitigate backdoor attacks

    Zeyang Sha, Xinlei He, Pascal Berrang, Mathias Humbert, and Yang Zhang. Fine-tuning is all you need to mitigate backdoor attacks. arXiv e-prints, 2022

    2022

  23. [31]

    Poison frogs! targeted clean-label poisoning attacks on neural networks

    Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Du- mitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. In Conference on Neural Information Processing Systems, 2018

    2018

  24. [32]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations, 2015

    2015

  25. [33]

    The german traffic sign recognition benchmark: a multi-class classification competition

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: a multi-class classification competition. In International Joint Conference on Neural Networks, 2011

    2011

  26. [34]

    Adasam: Boosting sharpness-aware minimization with adaptive learning rate and momentum for training deep neural networks

    Hao Sun, Li Shen, Qihuang Zhong, Liang Ding, Shixiang Chen, Jingwei Sun, Jing Li, Guangzhong Sun, and Dacheng Tao. Adasam: Boosting sharpness-aware minimization with adaptive learning rate and momentum for training deep neural networks. arXiv e-prints, 2023

    2023

  27. [35]

    Mrtrix3: A fast, flexible and open software framework for medical image processing and visualisation

    J-Donald Tournier, Robert Smith, David Raffelt, Rami Tabbara, Thijs Dhollander, Maximilian Pietsch, Daan Christiaens, Ben Jeurissen, Chun-Hung Yeh, and Alan Connelly. Mrtrix3: A fast, flexible and open software framework for medical image processing and visualisation. Neuroima...

    2019

  28. [36]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Symposium on Security and Privacy, 2019

    2019

  29. [37]

    Shared adversarial unlearn- ing: Backdoor mitigation by unlearning shared adversarial examples

    Shaokui Wei, Mingda Zhang, Hongyuan Zha, and Baoyuan Wu. Shared adversarial unlearn- ing: Backdoor mitigation by unlearning shared adversarial examples. In Advances in Neural Information Processing Systems, 2023. 13

    2023

  30. [38]

    Mitigating backdoor attack by injecting proactive defensive backdoor

    Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. Mitigating backdoor attack by injecting proactive defensive backdoor. arXiv e-prints, 2024

    2024

  31. [39]

    Backdoorbench: A comprehensive benchmark of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoorbench: A comprehensive benchmark of backdoor learning. In Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022

    2022

  32. [40]

    Defenses in adversarial machine learning: A survey

    Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu. Defenses in adversarial machine learning: A survey. arXiv e-prints, 2023

    2023

  33. [41]

    Backdoorbench: A comprehensive benchmark and analysis of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Mingli Zhu, Ruotong Wang, Li Liu, and Chao Shen. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning. arXiv e-prints, 2024

    2024

  34. [42]

    Adversarial neuron pruning purifies backdoored deep models

    Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. In Conference on Neural Information Processing Systems, 2021

    2021

  35. [43]

    Morley Mao, and Ruoxi Jia

    Yi Zeng, Won Park, Z. Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks’ triggers: A frequency perspective. In International Conference on Computer Vision, 2021

    2021

  36. [44]

    Adversarial unlearning of backdoors via implicit hypergradient

    Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations, 2022

    2022

  37. [45]

    Data-free backdoor removal based on channel lipschitzness

    Runkai Zheng, Rongjun Tang, Jianze Li, and Li Liu. Data-free backdoor removal based on channel lipschitzness. In European Conference on Computer Vision, 2022

    2022

  38. [46]

    Pre-activation distributions expose backdoor neurons

    Runkai Zheng, Rongjun Tang, Jianze Li, and Li Liu. Pre-activation distributions expose backdoor neurons. In Conference on Neural Information Processing Systems, 2022

    2022

  39. [47]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization

    Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In International Conference on Computer Vision, 2023

    2023

  40. [48]

    Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features

    Mingli Zhu, Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features. In Advances in Neural Information Processing Systems, 2023

    2023

  41. [49]

    Vdc: Versatile data cleanser for detecting dirty samples via visual-linguistic inconsistency

    Zihao Zhu, Mingda Zhang, Shaokui Wei, Bingzhe Wu, and Baoyuan Wu. Vdc: Versatile data cleanser for detecting dirty samples via visual-linguistic inconsistency. In International Conference on Learning Representations, 2024. 14

    2024

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.