Pith. sign in

REVIEW 4 major objections 4 minor 82 references

Circumventing Backdoor Space via Weight Symmetry

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a two-stage Bézier-curve construction joining a backdoored model to its permuted twin amplifies poisoned-sample loss while bounding clean accuracy, yielding a data-format-agnostic defense.

desk verdict Genuinely new two-stage unalign-then-realign defense with strong empirical results across supervised, SimCLR, and CLIP, but the stated proof overreaches: the upper-bound argument never transfers from clean samples to poisoned ones. read the letter →

arxiv 2506.07467 v1 pith:FOYE2TXW submitted 2025-06-09 cs.LG

Jie Peng , Hongwei Yang , Jing Zhao , Hengji Dong , Hui He , Weizhe Zhang , Haoyu He This is my paper
classification cs.LG
keywords backdoordefensepost-purificationpermutationinvariancemodeconnectivityBéziercurveself-supervisedlearningweightsymmetrylosslandscape
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Deep neural networks can be backdoored during training, and most existing defenses require labels or a particular training loop, which fails for self-supervised and multimodal models. This paper proposes Two-stage Symmetry Connectivity (TSC), which claims to remove backdoors using only about 5% clean samples and the model's own training procedure, so it applies to supervised classifiers, SimCLR encoders, and CLIP models alike. The defense exploits weight symmetry: a copy of the compromised model is permuted into a different but functionally identical arrangement, and a quadratic Bézier curve trained on clean data between the two endpoints is used to push poisoned samples into high-loss territory; a second curve back toward the original model then restores clean accuracy. The paper proves, under an $L^2$-norm consistency condition on the curve parameters, that the un-aligned curve has a higher upper bound on loss than the aligned one, which is the mechanism behind the adversarial-loss amplification. Experiments report attack success rates below 15% for all tested supervised attacks and below about 2% for CLIP, at the cost of a modest clean-accuracy drop.

What carries the argument

Two geometric properties carry the argument. Permutation invariance lets TSC reorder hidden-layer neurons via permutation matrices $P_l$, producing a functionally identical network $\pi(\theta_{adv}, S(P))$ in a different loss basin without changing outputs; the algorithm alternates between maximizing and minimizing the layer-wise feature distance $M_l$ to un-align and re-align. Quadratic mode connectivity supplies a trainable low-loss path, namely the quadratic Bézier curve $\gamma_{\theta_{A,B}}(t)=(1-t)^2\theta_A+2t(1-t)\theta_{A,B}+t^2\theta_B$, rewritten as $\gamma_{\tilde{\theta}_{A,B}}(t)=(1-t)\theta_A+t\theta_B+2t(1-t)\tilde{\theta}_{A,B}$. The proof bounds the curve-averaged loss by the $M_l$ distances when the deviation parameters are $L^2$-norm-consistent (Definition 4.1), and Corollary 4.3 gives the ordering $U_{A,\hat{B}} \le U_{A,B} \le U_{A,B'}$ that justifies first un-aligning, then re-aligning. The practical algorithm computes permutations by solving an optimal-assignment problem over correlation matrices, trains the curve by sampling $t \sim U(0,1)$ and updating the deviation parameter with the data-format's training method, and repeats for $E_{TSC}$ rounds.

What would settle it

Measure the mean loss of poisoned samples at the original backdoored model and at the stage-1 curve point $t=0.4$ on a fixed attack (for example SSBA on CIFAR-10 at 5% poisoning): if the stage-1 point does not have strictly higher poisoned-sample loss, the amplification claim is false. A complementary check is to log per-layer Frobenius norms of the deviation parameter $\tilde{\theta}$ along both trained curves; if the norms differ substantially yet ASR still falls below 15%, the theorem's norm-consistency condition is not what explains the defense.

Watch

Extended reading notes

Core claim

The central claim is that backdoor behavior can be circumvented in weight space rather than unlearned: a backdoored model $\theta_{adv}$ is projected by permutation into a distinct loss basin to form $\theta_{adv}'$, and a quadratic Bézier curve $\gamma_1$ connecting them is trained exclusively on clean samples. Because the two endpoints are functionally identical yet geometrically separated, the curve can pass through regions where poisoned inputs incur high loss; the paper formalizes this through upper bounds on the curve-averaged loss $\ell(\tilde{\theta}_{A,B})$ that depend on layer-wise feature distances $M_l(\theta_A,\theta_B;D)$ and an $L^2$-norm consistency condition on the Bézier deviation parameters. A second curve $\gamma_2$ is then trained between the original model and a re-aligned version of the first-stage point, which keeps the poisoned-loss upper bound high while lowering the clean-loss bound. Corollary 4.3 states the ordering $U_{A,\hat{B}} \le U_{A,B} \le U_{A,B'}$, so aligning one endpoint lowers the loss ceiling and un-aligning raises it. The empirical claim is that with curve index $t=0.4$ (or $0.25$ in self-supervised settings) and three (or two) TSC rounds, attack success rate drops below 15% across eleven supervised attacks, two SSL attacks, and adaptive adversaries trained to build a backdoored subspace.

Load-bearing premise

The load-bearing premise is that the trained Bézier curve parameters satisfy an $L^2$-norm equality condition (per-layer weight magnitudes must match) that Algorithm 1 never enforces or checks, and that a re-aligned model with three stated properties exists; if either premise fails, the proven ordering of loss bounds can collapse.

Editorial extensions

If this is right

  • A defender who knows only the standard training procedure and holds about 5% clean samples can purify a compromised classifier or encoder without labels, extending post-purification defense to contrastive and multimodal learning.
  • Because TSC never needs to detect or reconstruct the trigger, it applies to invisible, sample-specific, clean-label, and adaptively designed backdoors; the paper reports ASR below 15% for every attack it tests.
  • The same two-stage geometry can be driven by any training loss matching the data format (cross-entropy, SimCLR contrastive loss, CLIP image-text loss), so the defense attaches directly to the original training loop instead of a bespoke unlearning objective.
  • The method offers a tunable trade-off: increasing the curve index $t$ or the number of global rounds $E_{TSC}$ lowers ASR further but costs clean accuracy, so deployment can choose a working point.
  • A single round of TSC is not sufficient; the paper shows empirically that repeated two-stage rounds progressively erase the backdoor, with $E_{TSC}=3$ for supervised and $E_{TSC}=2$ for SimCLR/CLIP as the recommended settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the loss-basin geometry is the real engine, the same two-stage symmetry construction should generalize beyond permutations to other weight-space equivalences (for example rescaling or block-diagonal symmetries), yielding a family of symmetry-based erasure methods.
  • The paper's own theory points to a concrete strengthening: enforcing per-layer Frobenius-norm equality of the Bézier deviation parameters after every update would make the proven upper-bound ordering literally apply to the curves actually trained, rather than only to curves that happen to satisfy the condition.
  • A stronger adaptive adversary than the paper's subspace attack would optimize the trigger and the entire permutation orbit jointly, so TSC's robustness is bounded by how thoroughly an adversary can explore the symmetry group; this is a testable extension.
  • Because TSC needs no labels and only a small clean budget, it could serve as a routine pre-release purification step for publicly distributed models; the paper does not investigate detection, so a practical pipeline would still want a separate backdoor detector.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Two-stage Symmetry Connectivity (TSC), a post-purification backdoor defense that uses permutation invariance to project a backdoored model into a symmetric loss basin, trains a quadratic Bézier curve on a small clean set, picks a middle point, then re-aligns that point to the original model and trains a second curve. The authors claim a theoretical proof that this procedure amplifies the loss on poisoned samples while maintaining bounded clean accuracy, and they present extensive experiments on supervised (CIFAR10, GTSRB, ImageNet100), SimCLR, and CLIP settings against many backdoor attacks, including adaptive attacks, with code released.

Significance. If the theoretical claim were established, TSC would be a notable data-format-agnostic post-purification defense requiring only a small clean-sample budget. The empirical study is a genuine strength: it covers eleven supervised attacks, multiple poisoning rates, two SSL frameworks, several architectures, and adaptive attacks, and it consistently reports low ASR after TSC. However, the stated theoretical guarantee is the central advertised contribution, and, on reading, it is not actually derived from the presented theorems. The paper's significance therefore currently rests on its experimental evidence rather than on the claimed proof; the core idea of using weight symmetry to leave the backdoor basin is interesting and worth further investigation, but the manuscript needs substantial revision to either supply a valid argument or explicitly demote the theoretical claim to intuition.

major comments (4)
  1. [§4.3, Theorem 4.2 and Appendix E.1] The proof of Theorem 4.2 assumes condition (1) in the per-sample form M_l(θA, θB; x0) ≤ M_l(θA, θC; x0) for a single sample x0, but condition (1) is stated for the aggregate dataset D: M_l(θA, θB; D) ≤ M_l(θA, θC; D). An aggregate inequality over a sum of per-sample distances does not imply the per-sample inequality, so the proof does not justify the theorem as stated. The theorem needs either a per-sample hypothesis for all x0 ∈ D or a substantially different argument that handles sums without requiring pointwise ordering.
  2. [§4.3, Corollary 4.3 and its application] Corollary 4.3 only yields feature-distance inequalities on the dataset D used in the permutation objective, yet Algorithm 1 computes the permutations in Eq. (8) on the defender's clean set Dc. Consequently, the loss upper-bound ordering holds for curves evaluated on Dc, not on poisoned data Dadv. The paper's central claim that TSC amplifies the loss on poisoned samples does not follow from the theorem because no assumption or argument relates M_l(·, ·; Dc) to M_l(·, ·; Dadv).
  3. [§4.3, paragraph "Reducing the Clean Loss"] The second-stage argument assumes the existence of a model θadv* that is aligned with θadv, L2-norm-consistent with θt*=0.4, and more accurate on poisoned data than θt*=0.4. Algorithm 1 never constructs or verifies such a model, and the assertion that W2(P_adv^l, P_adv*^l; Dadv) ≤ W2(P_adv^l, P_t^l; Dadv) is an additional unproved assumption. Moreover, even if the upper bound U_{γ2} is larger than U_{γadv}, an upper-bound ordering does not imply that the actual poisoned loss is high; the conclusion that high poisoned loss is maintained on γ2 is not established.
  4. [§4.3, Definition 4.1 and Algorithms 1–3] Theorem 4.2 condition (3) requires the Bézier deviation parameters θ̃_A,B and θ̃_A,C to be L2-norm-consistent, and condition (2) requires the endpoint models to be L2-norm-consistent. While permutations preserve layer-wise Frobenius norms, the curve parameters returned by Algorithm 3 are initialized and updated by gradient descent without any enforcement or check of Definition 4.1. Thus the theorem's conditions are not guaranteed for the curves actually trained by TSC, so the proof cannot be applied to the algorithm's output without additional verification.
minor comments (4)
  1. [§4.2 and §4.3] There are several typos and notational slips: "origianl" and "more likey" in §4.2, "adpative" in §5.4 and Appendix G, "L2-norm-consisten" in §4.3, "networs" in Appendix E.1, and "Apdative" and "exlpore" in Appendix G.1.
  2. [Table 11] In the GTSRB BadNet 5% row, the I-BAU clean accuracy is reported as 14.43, which is implausible and likely a typo (perhaps 94.43); similar collapsed values appear in other rows of Tables 9–11 and should be checked.
  3. [§4.3] The notation for the retrieved model point alternates between θt∗=0.4, θt*, and θt=0.4 without a consistent definition; please standardize the notation.
  4. [Abstract and §4.3] The abstract's phrase "maintaining bounded clean accuracy" is not formalized anywhere in the theory; the theorems only compare loss upper bounds and never provide a quantitative bound on clean accuracy, so the claim should be qualified or supported.

Circularity Check

2 steps flagged · score 4.0 of 10

The theoretical 'poisoned-loss amplification' proof restates the clean-set permutation objective; the clean-accuracy stage assumes an unconstructed model with the target property.

  1. self definitional [Section 4.3, 'Increasing the Adversarial Loss' (after Corollary 4.3)]
    "To increase the loss with respect to poison samples along the curve, we can project the copy of backdoored model θadv to loss basin different from that of the original. Theoretically, Corollary 4.3 implies that applying the permutation by S(P ′) can enlarge the upper bound of the backdoor loss over the curve..."

    Algorithm 1 obtains S(P') by solving (8), which maximizes layerwise feature distance M_l on the defender's clean set Dc. Corollary 4.3's proof invokes exactly that defining inequality: 'As S(P') ... are solutions to the optimization problems (6) and (8), respectively, we derive ... Ml(θA,θB;D) ≤ Ml(θA,θB′;D).' The upper bounds in Theorem 4.2 are constructed as monotone affine expressions in M_l (Eqs. (23)-(28)), so the corollary's ordering UA,B ≤ UA,B′ is the maximization objective restated as a bound. Calling this 'enlarge the upper bound of the backdoor loss' substitutes the clean-set objective for the poisoned-sample loss, which is exactly the claim to be proved; no inequality is transferred from Dc to poisoned data.

  2. other [Section 4.3, 'Reducing the Clean Loss']
    "Moreover, let θadv∗ be a model satisfies the following three conditions: (1) it is aligned with θadv; (2) it is L2-norm-consistent with the model θt∗=0.4; and (3) it achieves higher accuracy on the poisoned dataset Dadv than θt∗=0.4."

    The conclusion 'a high loss can be maintained for poisoned samples along the curve γ2' is made to follow from the existence of θadv*, a model required to satisfy condition (3): 'it achieves higher accuracy on the poisoned dataset Dadv than θt∗=0.4.' That condition is the efficacy the second stage is supposed to establish. Algorithm 1's actual second stage aligns θt to θadv with PERMUTE LAYERS(...,MIN) on Dc and never constructs θadv* nor verifies the condition on Dadv; the Wasserstein comparison merely re-expresses the assumed superiority of θadv* as an upper-bound gap between γ2 and the hypothetical γadv. The claimed poisoned-loss retention is therefore assumed, not derived.

full rationale

The empirical core of the paper is self-contained: TSC is evaluated against external attacks (BadNet, Blended, SSBA, etc.) and compared to external baselines (MCR, ANP, I-BAU, SAU), and Algorithm 1 does not fit any parameter to test ASR/ACC. The circularity is confined to the theoretical narrative. Corollary 4.3 is mathematically valid as a statement about upper bounds: its proof shows UA,B ≤ UA,B′ whenever the feature distances satisfy Ml(θA,θB;D) ≤ Ml(θA,θB′;D), because the constructed upper bounds U(d) are monotone in M_l. But S(P') is defined as the maximizer of exactly that M_l objective on the clean set Dc, so the corollary is a restatement of the permutation objective; the paper then labels the enlarged upper bound 'backdoor loss over the curve,' thereby transferring a clean-data inequality to poisoned data without any connecting step. The second-stage argument is weaker still: it postulates θadv* with better poisoned accuracy and alignment, and the conclusion about γ2 inherits that postulate. These are gaps/renamings rather than a forced fit of the empirical results; hence a moderate score of 4 rather than a higher one.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central claim rests on standard symmetry and mode-connectivity results, an unenforced norm-consistency condition in the theorem, a hand-assumed model theta_adv* for the clean-accuracy argument, and the threat-model choice that the defender knows the training procedure. No new physical or architectural entities are introduced.

free parameters (4)
  • curve index t = 0.4 supervised, 0.25 self-supervised
    Selected via ablation (Section 5.5, Appendix H.1); controls the trade-off between accuracy and attack success rate along the Bezier curve.
  • global epochs ETSC = 3 supervised, 2 self-supervised
    Chosen empirically; Section 5.5 and Figure 3 show that one round is insufficient for several attacks.
  • curve training epochs e = 200
    Set for all experiments; no sensitivity analysis for e is reported.
  • clean data budget = 5% of training set, except CLIP uses full MS-COCO
    Defender budget assumption stated in Section 5.1; the CLIP setting gives the defender the entire MS-COCO dataset, which is much larger than the 5% used elsewhere.
assumptions (6)
  • standard math Permutation invariance: permuting hidden layer neurons with corresponding inverse permutations on adjacent layers leaves the network function unchanged.
    Invoked in Section 3.2 and used to construct theta_adv' in Algorithm 1.
  • domain assumption Quadratic mode connectivity: trained neural networks can be connected by low-loss Bezier curves, especially after neuron alignment.
    Assumed from Garipov et al. 2018 and Tatro et al. 2020; TSC's curve training relies on such low-loss paths existing.
  • ad hoc to paper L2-norm consistency of curve deviation parameters (Definition 4.1) holds for the curves trained by Algorithm 1.
    Theorem 4.2 and Corollary 4.3 require L2-norm consistency of theta~A,B and theta~A,C, but Algorithm 1 does not enforce or verify this; it is an unstated premise of the theoretical guarantee.
  • standard math Lipschitz continuity of activation function sigma and loss function L.
    Assumed in Theorem 4.2 for the upper-bound proof; standard for ReLU and cross-entropy.
  • ad hoc to paper Existence of theta_adv* aligned with theta_adv, L2-norm-consistent with theta_t*, and more accurate on poisoned data than theta_t*.
    Used in Section 4.3 to argue the second-stage curve has a higher poisoned-loss upper bound; no construction or verification is provided.
  • domain assumption Defender knows the original training procedure F and can run it on clean data.
    Stated in Section 3.4 and Appendix A; needed for both permutation computation and curve fitting.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Circumventing Backdoor Space via Weight Symmetry." pith.science (2026). https://pith.science/paper/FOYE2TXW

@misc{pith2026250607467,
  author       = {Pith},
  title        = {Pith review of: Circumventing Backdoor Space via Weight Symmetry},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FOYE2TXW}},
  note         = {Machine review of arXiv:2506.07467}
}
read the original abstract

Deep neural networks are vulnerable to backdoor attacks, where malicious behaviors are implanted during training. While existing defenses can effectively purify compromised models, they typically require labeled data or specific training procedures, making them difficult to apply beyond supervised learning settings. Notably, recent studies have shown successful backdoor attacks across various learning paradigms, highlighting a critical security concern. To address this gap, we propose Two-stage Symmetry Connectivity (TSC), a novel backdoor purification defense that operates independently of data format and requires only a small fraction of clean samples. Through theoretical analysis, we prove that by leveraging permutation invariance in neural networks and quadratic mode connectivity, TSC amplifies the loss on poisoned samples while maintaining bounded clean accuracy. Experiments demonstrate that TSC achieves robust performance comparable to state-of-the-art methods in supervised learning scenarios. Furthermore, TSC generalizes to self-supervised learning frameworks, such as SimCLR and CLIP, maintaining its strong defense capabilities. Our code is available at https://github.com/JiePeng104/TSC.

Figures

Figures reproduced from arXiv: 2506.07467 by the authors.

Figure 1
Figure 1. Illustration of the application of TSC in three popu￾lar learning settings. We assume adversaries can perform either data-poisoning attack or training-manipulation attack to implant a backdoor into the weights of a classification model or an encoder. Unlike most existing defenses requiring specific training proce￾dures, TSC provides a framework to remove backdoors using only a small fraction of clean samples and the… view at source ↗
Figure 2
Figure 2. Loss landscape for poisoned and benign samples, along with trained quadratic curves connecting distinct models. The backdoored model is a PreAct-ResNet18 trained on CIFAR-10, which contains 5% SSBA poisoned samples (Li et al., 2021c). Left: the curve identified by MCR. Middle: the curve identified by the first stage of TSC. Right: the curve identified by the second stage of TSC. trast to neuron alignment in problem … view at source ↗
Figure 3
Figure 3. Test attack success rate (ASR) and accuracy (ACC) on benign samples are evaluated as functions of the points along the Bezier ´ curve found by MCR and TSC. We assess the performance against SSBA on CIFAR-10 with 5% poison rate using PreAct-ResNet18. We select model points along the curve at t = 0.4 for each stage and round. Since MCR only trains a single curve for model purification, we plot the results of MCR at ea… view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Loss landscape for poisoned samples of Adap-Badnet, along with trained quadratic curves connecting distinct models. The backdoored model is a PreAct-ResNet18 trained on CIFAR-10, which contains 5% poisoned samples. Left: the curve identified by our adaptive attack. Mid…
Figure 5
Figure 5. Figure 5: (Supervised Learning) Effect of global epoch ET SC and the curve index t on TSC defense. We evaluate the performance of TSC on CIFAR10 with 5% poisoning rate using PreAct-ResNet18. Each point is averaged over the results of TSC against 12 attacks. 10 20 30 40 50 60 70 …
Figure 6
Figure 6. Figure 6: (Self-Supervised Learning, SimCLR) Effect of global epoch ET SC and the curve index t on TSC defense. We evaluate the performance of TSC against BadEncoder on pre-training dataset CIFAR10 and downstream dataset STL10 with ResNet18. We performed 3 defense runs for each …
Figure 7
Figure 7. Figure 7: (Supervised Learning) Performance of TSC and MCR on CIFAR-10 with 10% poisoning rate using PreAct-ResNet18. Test accuracy (ACC) on benign samples and the attack success rate (ASR) are evaluated as functions of the points along the quadratic Bezier ´ curve found by MCR …
Figure 8
Figure 8. Figure 8: (Supervised Learning) Performance of TSC and MCR on CIFAR-10 with 5% poisoning rate using PreAct-ResNet18. We select model points along the curve at t = 0.4 for each stage and round. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_8.png]
Figure 9
Figure 9. Figure 9: (Supervised Learning) Performance of TSC and MCR on CIFAR-10 with 1% poisoning rate using PreAct-ResNet18. We select model points along the curve at t = 0.4 for each stage and round. 0.00 0.25 0.50 0.75 1.00 t 0 20 40 60 80 Test ACC / ASR(%) ETSC = 1 0.00 0.25 0.50 0.7…
Figure 10
Figure 10. Figure 10: (Supervised Learning) Performance of TSC and MCR on CIFAR-10 with 0.5% poisoning rate using PreAct-ResNet18 against Narcissus and SAPA attacks. We select model points along the curve at t = 0.4 for each stage and round. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_10.png]
Figure 11
Figure 11. Figure 11: (Supervised Learning) Performance of TSC and MCR on ImageNet100 with 1% poisoning rate using ResNet50. We select model points along the curve at t = 0.4 for each stage and round. 27 [PITH_FULL_IMAGE:figures/full_fig_p027_11.png]
Figure 12
Figure 12. Figure 12: (Supervised Learning) Performance of TSC and MCR on ImageNet100 with 0.5% poisoning rate using ResNet50. We select model points along the curve at t = 0.4 for each stage and round. 28 [PITH_FULL_IMAGE:figures/full_fig_p028_12.png]
Figure 13
Figure 13. Figure 13: illustrates the performance of TSC and MCR against BadEncoder (Jia et al., 2022) on CIFAR10 and ImageNet using SimCLR (Chen et al., 2020) [PITH_FULL_IMAGE:figures/full_fig_p031_13.png]
Figure 14
Figure 14. Figure 14: Examples of 12 supervised learning backdoor trigger patterns on ImageNet100. The triggers of SBL-BadNets and SBL-Blended are as same as those of BadNets and Blend, respectively. (1) Supervised Learning. We employed the stochastic gradient descent (SGD) optimization me…
Figure 15
Figure 15. Figure 15: Examples of 2 self-supervised learning backdoor trigger patterns on STL10. We use publicly available backdoored ResNet18 and ResNet50 models as encoders with SimCLR in the BadEncoder attack (Jia et al., 2022). For CLIP, following the BadEncoder approach, we fine-tune …

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

82 extracted references · 59 canonical work pages

  1. [1]

    Git re-basin: Merging models modulo permutation symmetries

    Ainsworth, S., Hayase, J., and Srinivasa, S. Git re-basin: Merging models modulo permutation symmetries. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=CQsmMYmlP5T

    2023

  2. [2]

    and Bengio, Y

    Alain, G. and Bengio, Y. Understanding intermediate layers using linear classifier probes, 2017. URL https://openreview.net/forum?id=ryF7rTqgl

    2017

  3. [3]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing, pp.\ 101--105, 2019

    work page 2019

  4. [4]

    Architectural backdoors in neural networks

    Bober-Irizar, M., Shumailov, I., Zhao, Y., Mullins, R., and Papernot, N. Architectural backdoors in neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 24595--24604, 2023

    work page 2023

  5. [5]

    Food-101 -- mining discriminative components with random forests

    Bossard, L., Guillaumin, M., and Van Gool, L. Food-101 -- mining discriminative components with random forests. In European Conference on Computer Vision, 2014

    work page 2014

  6. [6]

    and Terzis, A

    Carlini, N. and Terzis, A. Poisoning and backdooring contrastive learning. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=iC4UHbQ01Mp

    work page 2022

  7. [7]

    A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tram \`e r, F

    Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tram \`e r, F. Poisoning web-scale training datasets is practical. arXiv preprint arXiv:2302.10149, 2023

    arXiv 2023

  8. [8]

    and Chen, J

    Chai, S. and Chen, J. One-shot neural backdoor erasing via adversarial weight masking. In Thirty-Sixth Conference on Neural Information Processing Systems (NeurIPS 2022), 2022

    work page 2022

Show all 82 references
  1. [9]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., and Srivastava, B. Detecting backdoor attacks on deep neural networks by activation clustering. ArXiv, abs/1811.03728, 2018

    2018 arXiv

  2. [10]

    A simple framework for contrastive learning of visual representations

    Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. A simple framework for contrastive learning of visual representations. In Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp.\ 1597--1607. PMLR, 2...

    2020

  3. [11]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  4. [12]

    An analysis of single-layer networks in unsupervised feature learning

    Coates, A., Ng, A., and Lee, H. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics, volume 15 of Proceedings of Machine Learning Research, pp.\ 215--223, For...

    2011

  5. [13]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 248--255, 2009. doi:10.1109/CVPR.2009.5206848

    2009

  6. [14]

    Essentially no barriers in neural network energy landscape

    Draxler, F., Veschgini, K., Salmhofer, M., and Hamprecht, F. Essentially no barriers in neural network energy landscape. In Proceedings of the 35th International Conference on Machine Learning, volume 80, pp.\ 1309--1318. PMLR, 10--15 Jul 2018

    2018

  7. [15]

    The role of permutation invariance in linear mode connectivity of neural networks

    Entezari, R., Sedghi, H., Saukh, O., and Neyshabur, B. The role of permutation invariance in linear mode connectivity of neural networks. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=dNigytemkL

    2022

  8. [16]

    Everingham, M., Van Gool, L., Williams, C. K. I., Winn, J., and Zisserman, A. The PASCAL V isual O bject C lasses C hallenge 2007 (VOC2007) R esults. http://www.pascal-network.org/challenges/VOC/voc2007/workshop/index.html

    2007

  9. [17]

    Detecting backdoors in pre-trained encoders

    Feng, S., Tao, G., Cheng, S., Shen, G., Xu, X., Liu, Y., Zhang, K., Ma, S., and Zhang, X. Detecting backdoors in pre-trained encoders. In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 16352--16362, 2023. URL https://doi.ieeecomputersociety.or...

    2023

  10. [18]

    Sharpness-aware minimization for efficiently improving generalization

    Foret, P., Kleiner, A., Mobahi, H., and Neyshabur, B. Sharpness-aware minimization for efficiently improving generalization. In International Conference on Learning Representations, 2021

    2021

  11. [19]

    K., Roy, D., and Carbin, M

    Frankle, J., Dziugaite, G. K., Roy, D., and Carbin, M. Linear mode connectivity and the lottery ticket hypothesis. In Proceedings of the 37th International Conference on Machine Learning, volume 119, pp.\ 3259--3269. PMLR, 2020. URL https://proceedings.mlr.press/v119/frankle20a.html

    2020

  12. [20]

    C., and Nepal, S

    Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp.\ 113–125, 2019. ISBN 9781450376280

    2019

  13. [21]

    P., and Wilson, A

    Garipov, T., Izmailov, P., Podoprikhin, D., Vetrov, D. P., and Wilson, A. G. Loss surfaces, mode connectivity, and fast ensembling of dnns. In Advances in Neural Information Processing Systems (NeurIPS 2018), volume 31. Curran Associates, Inc., 2018

    2018

  14. [22]

    D., Keskar, N

    Gotmare, A. D., Keskar, N. S., Xiong, C., and Socher, R. Using mode connectivity for loss landscape analysis. ArXiv, abs/1806.06977, 2018

    2018 arXiv

  15. [23]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  16. [24]

    SCALE - UP : An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency

    Guo, J., Li, Y., Chen, X., Guo, H., Sun, L., and Liu, C. SCALE - UP : An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum...

    2023

  17. [25]

    Spectre: defending against backdoor attacks using robust statistics

    Hayase, J., Kong, W., Somani, R., and Oh, S. Spectre: defending against backdoor attacks using robust statistics. In Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp.\ 4129--4139. PMLR, 18--24 Jul 2021

    2021

  18. [26]

    Identity mappings in deep residual networks

    He, K., Zhang, X., Ren, S., and Sun, J. Identity mappings in deep residual networks. ArXiv, abs/1603.05027, 2016 a

    2016 arXiv

  19. [27]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 770--778, jun 2016 b

    2016

  20. [28]

    Masked autoencoders are scalable vision learners

    He, K., Chen, X., Xie, S., Li, Y., Doll\'ar, P., and Girshick, R. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 16000--16009, June 2022

    2022

  21. [29]

    Sharpness-aware data poisoning attack

    He, P., Xu, H., Ren, J., Cui, Y., Zeng, S., Liu, H., Aggarwal, C., and Tang, J. Sharpness-aware data poisoning attack. In International Conference on Learning Representations, 2024

    2024

  22. [30]

    Y., and Li, Y

    Hou, L., Feng, R., Hua, Z., Luo, W., Zhang, L. Y., and Li, Y. IBD - PSC : Input-level backdoor detection via parameter-oriented scaling consistency. In Proceedings of the 41st International Conference on Machine Learning, pp.\ 18992--19022. PMLR, 2024. URL https://proceedings....

    2024

  23. [31]

    Detection of traffic signs in real-world images: The G erman T raffic S ign D etection B enchmark

    Houben, S., Stallkamp, J., Salmen, J., Schlipsing, M., and Igel, C. Detection of traffic signs in real-world images: The G erman T raffic S ign D etection B enchmark. In International Joint Conference on Neural Networks, number 1288, 2013

    2013

  24. [32]

    Jia, J., Liu, Y., and Gong, N. Z. BadEncoder : Backdoor attacks to pre-trained encoders in self-supervised learning. In IEEE Symposium on Security and Privacy, 2022

    2022

  25. [33]

    REPAIR : RE normalizing permuted activations for interpolation repair

    Jordan, K., Sedghi, H., Saukh, O., Entezari, R., and Neyshabur, B. REPAIR : RE normalizing permuted activations for interpolation repair. In The Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=gU5sJ6ZggcX

    2023

  26. [34]

    Rethinking backdoor attacks

    Khaddaj, A., Leclerc, G., Makelov, A., Georgiev, K., Salman, H., Ilyas, A., and Madry, A. Rethinking backdoor attacks. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp.\ 16216--16236. PMLR, 23--...

    2023

  27. [35]

    A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., Hassabis, D., Clopath, C., Kumaran, D., and Hadsell, R

    Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., Hassabis, D., Clopath, C., Kumaran, D., and Hadsell, R. Overcoming catastrophic forgetting in neural networks. Proceedings of the Nat...

    2017 doi

  28. [36]

    Learning multiple layers of features from tiny images

    Krizhevsky, A. Learning multiple layers of features from tiny images. 2009

    2009

  29. [37]

    Kuhn, H. W. The hungarian method for the assignment problem. Naval research logistics quarterly, 2 0 (1-2): 0 83--97, 1955

    1955

  30. [38]

    An embarrassingly simple backdoor attack on self-supervised learning

    Li, C., Pang, R., Xi, Z., Du, T., Ji, S., Yao, Y., and Wang, T. An embarrassingly simple backdoor attack on self-supervised learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp.\ 4367--4378, October 2023

    2023

  31. [39]

    Li, S., Xue, M., Zhao, B. Z. H., Zhu, H., and Zhang, X. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18: 0 2088--2105, 2021 a

    2021

  32. [40]

    Li, Y., Yosinski, J., Clune, J., Lipson, H., and Hopcroft, J. Convergent learning: Do different neural networks learn the same representations? In Proceedings of the 1st International Workshop on Feature Extraction: Modern Questions and Challenges at NIPS 2015, volume 44 of Pr...

    2015

  33. [41]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks

    Li, Y., Koren, N., Lyu, L., Lyu, X., Li, B., and Ma, X. Neural attention distillation: Erasing backdoor triggers from deep neural networks. ArXiv, abs/2101.05930, 2021 b

    2021 arXiv

  34. [42]

    Invisible backdoor attack with sample-specific triggers

    Li, Y., Li, Y., Wu, B., Li, L., He, R., and Lyu, S. Invisible backdoor attack with sample-specific triggers. In IEEE International Conference on Computer Vision (ICCV), 2021 c

    2021

  35. [43]

    Anti-backdoor learning: Training clean models on poisoned data

    Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems (NeurIPS 2021), 34: 0 14900--14912, 2021 d

    2021

  36. [44]

    Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Doll \'a r, P., and Zitnick, C. L. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp....

    2014

  37. [45]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Liu, K., Dolan-Gavitt, B., and Garg, S. Fine-pruning: Defending against backdooring attacks on deep neural networks. In RAID, 2018

    2018

  38. [46]

    and Hutter, F

    Loshchilov, I. and Hutter, F. Sgdr: Stochastic gradient descent with warm restarts. arXiv preprint arXiv:1608.03983, 2016

    2016 arXiv

  39. [47]

    Towards stable backdoor purification through feature shift tuning

    Min, R., Qin, Z., Shen, L., and Cheng, M. Towards stable backdoor purification through feature shift tuning. In Thirty-seventh Conference on Neural Information Processing Systems, 2023

    2023

  40. [48]

    Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., and Ng, A. Y. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011, 2011. URL http://ufldl.stanford.edu/housenumbers/nips2011_housen...

    2011

  41. [49]

    Nguyen, T. A. and Tran, A. Input-aware dynamic backdoor attack. In Advances in Neural Information Processing Systems (NeurIPS 2020), volume 33, pp.\ 3454--3464. Curran Associates, Inc., 2020

    2020

  42. [50]

    Nguyen, T. A. and Tran, A. T. Wanet - imperceptible warping-based backdoor attack. In International Conference on Learning Representations, 2021. URL https://openreview.net/forum?id=eEn8KTtJOx

    2021

  43. [51]

    ASSET : Robust backdoor data detection across a multiplicity of deep learning paradigms

    Pan, M., Zeng, Y., Lyu, L., Lin, X., and Jia, R. ASSET : Robust backdoor data detection across a multiplicity of deep learning paradigms. In 32nd USENIX Security Symposium (USENIX Security 23), pp.\ 2725--2742, Anaheim, CA, 2023. USENIX Association. ISBN 978-1-939133-37-3. URL...

    2023

  44. [52]

    X., and Wang, T

    Pang, R., Shen, H., Zhang, X., Ji, S., Vorobeychik, Y., Luo, X., Liu, A. X., and Wang, T. A tale of evil twins: Adversarial inputs versus poisoned models. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2019

    2020

  45. [53]

    Pham, H., Ta, T.-A., Tran, A., and Doan, K. D. Flatness-aware sequential learning generates resilient backdoors. In Computer Vision -- ECCV 2024, pp.\ 89--107, Cham, 2024. Springer Nature Switzerland

    2024

  46. [54]

    Revisiting the assumption of latent separability for backdoor defenses

    Qi, X., Xie, T., Li, Y., Mahloujifar, S., and Mittal, P. Revisiting the assumption of latent separability for backdoor defenses. In The Eleventh International Conference on Learning Representations, 2023

    2023

  47. [55]

    W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I

    Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on ...

    2021

  48. [56]

    Hidden trigger backdoor attacks

    Saha, A., Subramanya, A., and Pirsiavash, H. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp.\ 11957--11965, 2020

    2020

  49. [57]

    A., and Pirsiavash, H

    Saha, A., Tejankar, A., Koohpayegani, S. A., and Pirsiavash, H. Backdoor attacks on self-supervised learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 13337--13346, 2022

    2022

  50. [58]

    R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T

    Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T. Poison frogs! targeted clean-label poisoning attacks on neural networks. In Advances in Neural Information Processing Systems (NeurIPS 2018), volume 31. Curran Associates, Inc., 2018

    2018

  51. [59]

    and Zisserman, A

    Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. CoRR, abs/1409.1556, 2014

    2014 arXiv

  52. [60]

    Geometry of the loss landscape in overparameterized neural networks: Symmetries and invariances

    Simsek, B., Ged, F., Jacot, A., Spadaro, F., Hongler, C., Gerstner, W., and Brea, J. Geometry of the loss landscape in overparameterized neural networks: Symmetries and invariances. In Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedi...

    2021

  53. [61]

    Singh, S. P. and Jaggi, M. Model fusion via optimal transport. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Advances in Neural Information Processing Systems, volume 33, pp.\ 22045--22055. Curran Associates, Inc., 2020

    2020

  54. [62]

    Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch

    Souri, H., Fowl, L., Chellappa, R., Goldblum, M., and Goldstein, T. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In Advances in Neural Information Processing Systems (NeurIPS 2022), volume 35, pp.\ 19165--19178, 2022

    2022

  55. [63]

    Rethinking the inception architecture for computer vision

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., and Wojna, Z. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 2818--2826, 2016

    2016

  56. [64]

    Stegastamp: Invisible hyperlinks in physical photographs

    Tancik, M., Mildenhall, B., and Ng, R. Stegastamp: Invisible hyperlinks in physical photographs. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 2114--2123, 2020

    2020

  57. [65]

    Optimizing mode connectivity via neuron alignment

    Tatro, N., Chen, P.-Y., Das, P., Melnyk, I., Sattigeri, P., and Lai, R. Optimizing mode connectivity via neuron alignment. In Advances in Neural Information Processing Systems, volume 33, pp.\ 15300--15311. Curran Associates, Inc., 2020

    2020

  58. [66]

    Spectral signatures in backdoor attacks

    Tran, B., Li, J., and Madry, A. Spectral signatures in backdoor attacks. In Neural Information Processing Systems (NeurIPS 2018), 2018

    2018

  59. [67]

    Label-consistent backdoor attacks

    Turner, A., Tsipras, D., and Madry, A. Label-consistent backdoor attacks. ArXiv, abs/1912.02771, 2019

    1912 arXiv

  60. [68]

    Villani, C. et al. Optimal transport: old and new, volume 338. Springer, 2009

    2009

  61. [69]

    Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B. Y. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. 2019 IEEE Symposium on Security and Privacy (SP), pp.\ 707--723, 2019

    2019

  62. [70]

    Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples

    Wei, S., Zhang, M., Zha, H., and Wu, B. Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL https://openreview.net/forum?id=zqOcW3R9rd

    2023

  63. [71]

    N., Passananti, J., Andere, E., Zheng, H., and Zhao, B

    Wenger, E., Bhattacharjee, R., Bhagoji, A. N., Passananti, J., Andere, E., Zheng, H., and Zhao, B. Finding naturally occurring physical backdoors in image datasets. In Advances in Neural Information Processing Systems, volume 35, pp.\ 22103--22116, 2022

    2022

  64. [72]

    C., Guestrin, C., Farhadi, A., and Rastegari, M

    Wortsman, M., Horton, M. C., Guestrin, C., Farhadi, A., and Rastegari, M. Learning neural network subspaces. In Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp.\ 11217--11227. PMLR, 18--24 Jul 202...

    2021

  65. [73]

    Backdoorbench: A comprehensive benchmark of backdoor learning

    Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., and Shen, C. Backdoorbench: A comprehensive benchmark of backdoor learning. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022

    2022

  66. [74]

    and Wang, Y

    Wu, D. and Wang, Y. Adversarial neuron pruning purifies backdoored deep models. In Advances in Neural Information Processing Systems (NeurIPS 2021), volume 34, pp.\ 16913--16925. Curran Associates, Inc., 2021

    2021

  67. [75]

    Yao, Y., Li, H., Zheng, H., and Zhao, B. Y. Latent backdoor attacks on deep neural networks. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, CCS '19, pp.\ 2041–2055, 2019. URL https://doi.org/10.1145/3319535.3354209

    2019

  68. [76]

    Rethinking the backdoor attacks’ triggers: A frequency perspective

    Zeng, Y., Park, W., Mao, Z., and Jia, R. Rethinking the backdoor attacks’ triggers: A frequency perspective. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pp.\ 16453--16461, Los Alamitos, CA, USA, 2021. IEEE Computer Society

    2021

  69. [77]

    Adversarial unlearning of backdoors via implicit hypergradient

    Zeng, Y., Chen, S., Park, W., Mao, Z., Jin, M., and Jia, R. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations, 2022

    2022

  70. [78]

    A., Lyu, L., Qiu, M., and Jia, R

    Zeng, Y., Pan, M., Just, H. A., Lyu, L., Qiu, M., and Jia, R. Narcissus: A practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 771–785, 2023. ISBN 9798400700507. doi:10.1...

    2023

  71. [79]

    N., and Lin, X

    Zhao, P., Chen, P.-Y., Das, P., Ramamurthy, K. N., and Lin, X. Bridging mode connectivity in loss landscapes and adversarial robustness. In International Conference on Learning Representations, 2020

    2020

  72. [80]

    Ssl-cleanse: Trojan detection and mitigation in self-supervised learning

    Zheng, M., Xue, J., Wang, Z., Chen, X., Lou, Q., Jiang, L., and Wang, X. Ssl-cleanse: Trojan detection and mitigation in self-supervised learning. In Computer Vision -- ECCV 2024, 2024

    2024

  73. [81]

    R., Li, H., Taylor, G., Studer, C., and Goldstein, T

    Zhu, C., Huang, W. R., Li, H., Taylor, G., Studer, C., and Goldstein, T. Transferable clean-label poisoning attacks on deep neural nets. In Proceedings of the 36th International Conference on Machine Learning, volume 97, pp.\ 7614--7623. PMLR, 09--15 Jun 2019

    2019

  74. [82]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization

    Zhu, M., Wei, S., Shen, L., Fan, Y., and Wu, B. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp.\ 4466--4477, October 2023

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.