Pith. sign in

REVIEW 2 major objections 4 minor 189 references

Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor

T0 review · 2 major / 4 minor · reviewed 2026-07-11 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Learning a strongly backdoored reference model lets you isolate and remove poisonous training samples more accurately than trying to isolate the clean ones.

desk verdict Solid paradigm flip: learn a strongly backdoored oracle to isolate poisons, with strong multi-attack/dataset results and near-zero residual ASR at almost no ACC cost. read the letter →

arxiv 2607.05748 v1 pith:FWL6EX3W submitted 2026-07-07 cs.LG

Qi Zhao , Christian Wressnegger This is my paper
classification cs.LG
keywords backdoordefensedatapoisoninganti-backdoorlearningdatasetsplittingreversecross-entropyreferencemodeltraining-time
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoors injected by data poisoning are hard to strip out once a model has learned them. Existing training-time defenses try to keep the model clean by identifying the benign samples and training only on those. HARVEY flips the problem: because poisonous samples are easier for a network to learn, it is simpler and more reliable to train a deliberately backdoored reference model and use that model as an oracle for the poisonous samples. By repeatedly learning the poisons and unlearning the rest, the method builds an ever-clearer separation (measured by reverse cross-entropy loss) and finally trains a clean model on the remaining data. Across patch, blend, clean-label and dynamic-trigger attacks on CIFAR-10, GTSRB and Tiny-ImageNet, the resulting attack success rates drop below two percent while natural accuracy stays within roughly one percent of an undefended baseline.

What carries the argument

HARVEY’s four-stage loop: (1) naïve pre-training to seed a 50 % low-RCE poison pool, (2) iterative learning–unlearning that strengthens a backdoored reference model, (3) meta-splitting of residual target-class samples with the first-round reference model, and (4) ordinary supervised training on the recovered clean set.

What would settle it

Construct a poisoning attack (for example a stronger dynamic trigger or a carefully balanced clean-label set) such that, after twenty rounds of HARVEY’s learning–unlearning schedule, the reverse-cross-entropy distributions of poisonous and benign samples still overlap enough that the C/2 threshold leaves more than five percent poisons in the final training set and the attack success rate remains above ten percent.

Watch

Extended reading notes

Core claim

A strongly backdoored reference model, obtained by iterative learning on low reverse-cross-entropy samples and unlearning of the complementary set, separates poisonous from benign data far more cleanly than any clean or partially clean reference model. The reverse-cross-entropy term alone already yields a fixed, practical threshold (C/2) that isolates almost all poisons, so the final supervised model trained on the residual clean subset has near-zero attack success rate and essentially unchanged natural accuracy.

Load-bearing premise

Poisonous samples stay systematically easier to learn than ordinary samples, even after repeated unlearning and for stealthy dynamic triggers, so a single fixed reverse-cross-entropy threshold keeps separating them cleanly.

Editorial extensions

If this is right

  • Training-time defenses no longer need a trusted clean reference set; the poisoned data itself can supply the oracle.
  • Any future loss that enlarges the gap between easy-to-learn poisons and hard-to-learn clean samples can be dropped into the same four-stage skeleton.
  • Adaptive attacks that try to hide poisons by duplicating benign samples still leave enough residual separation for the method to recover a clean model.
  • The same principle may extend to other “easy-to-memorize” contamination problems such as label noise or targeted data corruption.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same “learn the contaminant first” idea could be applied to detection of synthetic data or membership-inference poisoning without requiring a clean hold-out set.
  • Because the method never needs the true poison labels, it could be run as a black-box filter on any large public corpus before downstream fine-tuning.
  • If reverse cross-entropy is replaced by another easy-to-hard metric (for example gradient norm or loss curvature), the same iterative oracle construction may transfer to non-vision modalities.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper introduces HARVEY, a training-time defense against data-poisoning backdoors that does not require a clean reference set. Building on the observation that poisonous samples are learned more easily than benign ones, it iteratively constructs a strongly backdoored reference model (via LGA learning on a low-RCE subset plus one-epoch unlearning of the high-RCE subset) and uses that model’s reverse cross-entropy (RCE) loss as an oracle for poisonous samples. After n rounds of refinement a meta-splitting step recovers residual benign samples of the target class; the final model is then trained only on the purified set. Extensive experiments on CIFAR-10, GTSRB and Tiny-ImageNet against six attacks (BadNets, Trojan, Blend, CLB, IAB, WaNet) and multiple architectures show that residual ASR is driven below 2 % (worst-case 1.83 % on CIFAR-10, 0.48 % on Tiny-ImageNet) while natural accuracy stays within ~1 % of the undefended baseline, outperforming ABL, DBD, D-ST and CBD.

Significance. If the empirical claims hold, HARVEY supplies a practical, clean-data-free training-time defense that consistently removes both patch-based and stealthy dynamic triggers while preserving accuracy. The paradigm shift—learning a poisonous-sample oracle rather than a benign-sample oracle—is conceptually clean and is supported by a thorough ablation suite (RCE vs. SCE/CE, unlearning, meta-splitting, hyper-parameter sweeps, adaptive duplication). The public implementation further raises the work’s value for the community. The result is therefore of clear interest to the backdoor-defense literature.

major comments (2)
  1. The central claim rests on a fixed RCE threshold of C/2 remaining a reliable separator after iterative unlearning (Sections 2.2, 3.2; Figs. 1, 6). While the paper demonstrates high recall and near-zero residual poisoning rates for the six evaluated attacks, the only adaptive experiment (Appendix E) is a simple sample-duplication attack. A more systematic adaptive adversary that deliberately equalizes RCE losses of poisonous and benign samples (e.g., by loss-matching or feature-space blending) is not examined; without it the generality of the “poisonous samples remain easier to learn” axiom remains incompletely stress-tested.
  2. All main tables (Tables 2, 3, 8, 9) report single-run point estimates. Given that Stage 2 involves stochastic unlearning and that several hyper-parameters (γ = 0.01, λ = 0.01, n = 20) are fixed without multi-seed statistics, the reported worst-case ASR margins of <2 % cannot be assessed for statistical reliability. At least three independent seeds with error bars (or confidence intervals) on ACC/ASR for the critical stealthy attacks (IAB, WaNet, Blend) are needed to substantiate the “near-perfect” claim.
minor comments (4)
  1. Table 1 lists “Architecture Independent” for HARVEY; the claim is only weakly supported by the three architectures tested and should be softened or moved to the experimental discussion.
  2. The algorithmic description (Algorithm 1) omits the class-balancing step that appends low-RCE samples so every class retains at least 1 % of its original size; the prose in Section 3.2 mentions it, but the algorithm should match.
  3. Figure 2’s legend uses “Meta-S” without expansion; a short parenthetical would improve readability.
  4. A few typographical inconsistencies appear (e.g., “abackdoored”, “HARVEYsubstantially”); a careful proof-reading pass is warranted.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; HARVEY is an empirical training-time procedure whose performance claims are measured against external attacks and independent ACC/ASR metrics.

full rationale

The paper's derivation chain begins from the well-known empirical observation (cited to Li et al. 2021a and others) that poisonous samples are learned faster than benign ones, analyzes why the RCE term of SCE loss separates them more cleanly than CE or full SCE (Section 2.1, rewriting LRCE = C·(1-p(y|x))), and then constructs an iterative procedure that deliberately overfits a reference model to the low-RCE subset while unlearning the high-RCE subset. The final claims (near-zero residual ASR at near-baseline ACC) are obtained by training a clean model on the resulting split and evaluating it on held-out test sets under previously published attacks (BadNets, Trojan, Blend, CLB, IAB, WaNet) and architectures. No equation equates a claimed prediction to a fitted input by construction; the fixed threshold C/2 follows directly from the bounded range of RCE; hyperparameters (γ=0.01, λ=0.01, n=20, Tpoi=10) are stated and ablated rather than tuned to force the reported ASR numbers; and the few self-citations are ordinary background (SCE, LGA) rather than load-bearing uniqueness theorems. The method is therefore self-contained against external benchmarks and exhibits no circular reduction.

Assumptions & free parameters 5 free parameters · 3 assumptions · 1 invented entities

The central claim rests on the empirical regularity that poisonous samples are easier to learn, on the fixed RCE threshold C/2, and on a handful of hand-chosen training hyper-parameters. No new physical or mathematical entities are postulated; the method re-uses standard losses and optimizers.

free parameters (5)
  • RCE threshold C/2 = ≈4.605
    Fixed at approximately 4.605 (ε=10^{-5}); used for every split in Stages 2–3. Chosen by the bounded range of RCE rather than cross-validated.
  • LGA γ = 0.01
    Set to 0.01 to avoid overfitting the few clean samples inside S^{(i)}; ablation shows sensitivity above 0.015.
  • unlearning λ = 0.01
    Set to 0.01 to stabilize unlearning of D_bng; larger values degrade accuracy.
  • number of Stage-2 rounds n = 20
    Fixed at 20; performance plateaus after ~10 rounds (Fig. 3).
  • T_init / T_poi = 20 / 10
    20 and 10 epochs respectively; chosen for convergence speed rather than exhaustive search.
assumptions (3)
  • domain assumption Poisonous samples are systematically easier for a neural network to fit than benign samples under standard cross-entropy training.
    Stated as the foundational observation (Sec. 1–2) and used to justify both the initial 50 % split and the iterative backdoor-learning strategy.
  • ad hoc to paper Reverse cross-entropy alone (rather than full SCE) produces a clearer separation between poisonous and benign samples.
    Derived analytically in Sec. 2.1 and confirmed by the histograms in Fig. 7; not a previously established theorem.
  • ad hoc to paper A single epoch of gradient-ascent unlearning on the high-loss subset does not destroy the backdoor already learned on the low-loss subset.
    Required for Stage 2 stability; supported only by the reported ablation (Table 4).
invented entities (1)
  • strongly backdoored reference model used as poisonous-sample oracle
    purpose: Provides a continuously improving RCE-based ranking that isolates poisons more accurately than clean-sample oracles.
    The entity is the methodological core of HARVEY; it is constructed entirely inside the paper and has no independent existence outside the algorithm.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor." pith.science (2026). https://pith.science/paper/FWL6EX3W

@misc{pith2026260705748,
  author       = {Pith},
  title        = {Pith review of: Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FWL6EX3W}},
  note         = {Machine review of arXiv:2607.05748}
}
read the original abstract

The community has recently developed various training-time defenses to counter neural backdoors introduced through data poisoning. In light of the observation that a model learns poisonous samples responsible for the backdoor easier than benign samples, these approaches either use a fixed threshold of the training loss for splitting or iteratively learn a reference model as an oracle for identifying benign samples. In particular, the latter has proven effective for anti-backdoor learning. Our method, HARVEY, leverages a similar yet crucially different technique: learning an oracle for poisonous rather than benign samples. Learning a backdoored reference model is significantly easier than learning a reference model on benign data. Consequently, we can identify poisonous samples much more accurately than related work identifies benign samples. This crucial difference enables near-perfect backdoor removal as we demonstrate in our evaluation. HARVEY substantially outperforms related approaches across attack types, datasets, and architectures, lowering the attack success rate to the very minimum at a negligible loss in natural accuracy. The figure below shows an overview of our methods working principle.

Figures

Figures reproduced from arXiv: 2607.05748 by the authors.

Figure 1
Figure 1. Subsets of incremental size chosen in ascending order of RCE loss based on a ResNet18 trained on a CI￾FAR10 under Blend attack (Chen et al. 2017) at ρ = 10 %. 2.2 Distribution of Benign and Poisonous Samples Although the model learns poisonous samples (and thus the backdoor) easier than benign samples in the general case (Li et al. 2021a), after training, some benign samples still have a similar loss as poisonous sa… view at source ↗
Figure 2
Figure 2. Overview depiction of our method HARVEY. The individual stages are described in Sections 3.1 to 3.4. We perform unlearning for only one epoch per round. This way, we avoid a learning divergence and help the model to stably unlearn the benign samples. Splitting dataset D˜ and composing S (i+1) . The refer￾ence model θ (i) ref encodes the backdoor much better than be￾nign data. There hence exists a huge gap in the RCE… view at source ↗
Figure 5
Figure 5. Meta-splitting with us￾ing θ (1) ref on D (n) bad of CIFAR10 against Blend (Chen et al. 2017) [PITH_FULL_IMAGE:figures/full_fig_p004_5.png] view at source ↗
Figures from the paper (5 more)
Figure 6
Figure 6. Figure 6: Dataset distribution of the latent space by t-SNE (top row) and [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 7
Figure 7. Figure 7: Comparing data distribution in dataset splitting defenses by different loss functions: [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Ablation study on HARVEY’s hyper-settings with the model ResNet18 on poisoned CIFAR10 datasets. ACC and ASR are shown in solid and dashed lines, respectively [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Evaluating HARVEY’s defense across different backdoor target labels with a ResNet18 model on poisoned CIFAR10 datasets. ACC and ASR are shown in solid and dashed lines, respectively. D.3 Cross-Architecture Evaluation We implement poisoning attacks with the same setting…
Figure 10
Figure 10. Figure 10: Duplicated Image (Class = 0) Duplicating benign samples. To hide the prominence of poisonous samples, an adaptive attacker can alter the dataset distribution by duplicating a single benign sample to estab￾lish a fake data cluster with similarly high significance as th…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

189 extracted references · 189 canonical work pages

  1. [1]

    Barni, M.; Kallas, K.; and Tondi, B. 2019. A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning. In 2019 IEEE International Conference on Image Processing (ICIP)

    work page 2019

  2. [2]

    Berthelot, D.; Carlini, N.; Goodfellow, I.; Papernot, N.; Oliver, A.; and Raffel, C. 2019. MixMatch: A Holistic Approach to Semi-Supervised Learning. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2019

  3. [3]

    Biggio, B.; and Roli, F. 2018. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84: 317--331

    work page 2018

  4. [4]

    Cai, R.; Zhang, Z.; Chen, T.; Chen, X.; and Wang, Z. 2022. Randomized Channel Shuffling: Minimal-Overhead Backdoor Attack Detection without Clean Datasets. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2022

  5. [5]

    Poisoning Web-Scale Training Datasets is Practical

    Carlini, N.; Jagielski, M.; Choquette-Choo, C. A.; Paleka, D.; Pearce, W.; Anderson, H.; Terzis, A.; Thomas, K.; and Tramèr, F. 2023. Poisoning Web-Scale Training Datasets is Practical. arXiv:2302.10149

    work page Pith review arXiv 2023

  6. [6]

    Chen, W.; Wu, B.; and Wang, H. 2022. Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2022

  7. [7]

    Chen, X.; Liu, C.; Li, B.; Lu, K.; and Song, D. 2017. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. CoRR, abs/1712.05526

    work page Pith review arXiv 2017

  8. [8]

    G.; Abbasnejad, E.; and Ranasinghe, D

    Doan, B. G.; Abbasnejad, E.; and Ranasinghe, D. C. 2020. Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems. In Proc. of the Annual Computer Security Applications Conference ( ACSAC )

    work page 2020

Show all 189 references
  1. [9]

    Gao, K.; Bai, Y.; Gu, J.; Yang, Y.; and Xia, S.-T. 2023. Backdoor Defense via Adaptively Splitting Poisoned Dataset. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2023

  2. [10]

    C.; and Nepal, S

    Gao, Y.; Xu, C.; Wang, D.; Chen, S.; Ranasinghe, D. C.; and Nepal, S. 2019. STRIP: A Defence Against Trojan Attacks on Deep Neural Networks. In Proc. of the Annual Computer Security Applications Conference ( ACSAC )

    2019

  3. [11]

    Gu, T.; Dolan - Gavitt, B.; and Garg, S. 2017. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. Proceeding of Machine Learning and Computer Security Workshop

    2017

  4. [12]

    Hayase, J.; Kong, W.; Somani, R.; and Oh, S. 2021. SPECTRE: defending against backdoor attacks using robust statistics. In Proc. of the International Conference on Machine Learning ( ICML )

    2021

  5. [13]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep Residual Learning for Image Recognition. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 770--778

    2016

  6. [14]

    Huang, G.; Liu, Z.; and van der Maaten, L. 2017. Densely Connected Convolutional Networks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2017

  7. [15]

    Huang, K.; Li, Y.; Wu, B.; Qin, Z.; and Ren, K. 2022. Backdoor Defense via Decoupling the Training Process. In Proc. of the International Conference on Learning Representations ( ICLR )

    2022

  8. [16]

    Krizhevsky, A.; Nair, V.; and Hinton, G. 2008. CIFAR (Canadian Institute for Advanced Research)

    2008

  9. [17]

    Kullback, S.; and Leibler, R. A. 1951. On Information and Sufficiency. The Annals of Mathematical Statistics, 22(1): 79--86

    1951

  10. [18]

    Le, Y.; and Yang, X. 2015. Tiny imagenet visual recognition challenge. CS 231N

    2015

  11. [19]

    Li, B.; and Liu, W. 2024. A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks. In Proc. of the International Conference on Machine Learning ( ICML )

    2024

  12. [20]

    Li, Y.; Lyu, X.; Koren, N.; Lyu, L.; Li, B.; and Ma, X. 2021 a . Anti-Backdoor Learning: Training Clean Models on Poisoned Data. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    2021

  13. [21]

    Li, Y.; Lyu, X.; Koren, N.; Lyu, L.; Li, B.; and Ma, X. 2021 b . Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks. In Proc. of the International Conference on Learning Representations ( ICLR )

    2021

  14. [22]

    Liu, K.; Dolan-Gavitt, B.; and Garg, S. 2018 a . Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In Bailey, M.; Holz, T.; Stamatogiannakis, M.; and Ioannidis, S., eds., Proc. of the International Symposium on Research in Attacks, Intrusions and Def...

    2018

  15. [23]

    Liu, Y.; Ma, S.; Aafer, Y.; Lee, W.-C.; Zhai, J.; Wang, W.; and Zhang, X. 2018 b . Trojaning Attack on Neural Networks. In Proc. of the Network and Distributed System Security Symposium ( NDSS )

    2018

  16. [24]

    A.; and Tran, A

    Nguyen, T. A.; and Tran, A. 2020. Input-Aware Dynamic Backdoor Attack. In Larochelle, H.; Ranzato, M.; Hadsell, R.; Balcan, M.; and Lin, H., eds., Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 3454--3464

    2020

  17. [25]

    A.; and Tran, A

    Nguyen, T. A.; and Tran, A. T. 2021. WaNet - Imperceptible Warping-based Backdoor Attack. In Proc. of the International Conference on Learning Representations ( ICLR )

    2021

  18. [26]

    Qiu, H.; Zeng, Y.; Guo, S.; Zhang, T.; Qiu, M.; and Thuraisingham, B. 2021. DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks Using Data Augmentation. In Proc. of the ACM Asia Conference on Computer and Communications Security ( ASIA CCS )

    2021

  19. [27]

    Sandler, M.; Howard, A.; Zhu, M.; Zhmoginov, A.; and Chen, L.-C. 2018. MobileNetV2: Inverted Residuals and Linear Bottlenecks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  20. [28]

    R.; Najibi, M.; Suciu, O.; Studer, C.; Dumitras, T.; and Goldstein, T

    Shafahi, A.; Huang, W. R.; Najibi, M.; Suciu, O.; Studer, C.; Dumitras, T.; and Goldstein, T. 2018. Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    2018

  21. [29]

    Simonyan, K.; and Zisserman, A. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. In Proc. of the International Conference on Learning Representations ( ICLR )

    2015

  22. [30]

    Stallkamp, J.; Schlipsing, M.; Salmen, J.; and Igel, C. 2012. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks

    2012

  23. [31]

    Turner, A.; Tsipras, D.; and Madry, A. 2019. Label-Consistent Backdoor Attacks. arXiv:1912.02771

    2019 arXiv

  24. [32]

    Wang, B.; Yao, Y.; Shan, S.; Li, H.; Viswanath, B.; Zheng, H.; and Zhao, B. Y. 2019 a . Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In Proc. of the IEEE Symposium on Security and Privacy

    2019

  25. [33]

    Wang, R.; Zhang, G.; Liu, S.; Chen, P.-Y.; Xiong, J.; and Wang, M. 2020. Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases. In Proc. of the European Conference on Computer Vision ( ECCV )

    2020

  26. [34]

    Wang, Y.; Ma, X.; Chen, Z.; Luo, Y.; Yi, J.; and Bailey, J. 2019 b . Symmetric cross entropy for robust learning with noisy labels. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV )

    2019

  27. [35]

    Wang, Z.; Mei, K.; Ding, H.; Zhai, J.; and Ma, S. 2022. Rethinking the Reverse-engineering of Trojan Triggers. In Advances in Neural Information Processing Systems

    2022

  28. [36]

    Wang, Z.; Mei, K.; Zhai, J.; and Ma, S. 2023. UNICORN : A Unified Backdoor Trigger Inversion Framework. In Proc. of the International Conference on Learning Representations ( ICLR )

    2023

  29. [37]

    Wu, B.; Chen, H.; Zhang, M.; Zhu, Z.; Wei, S.; Yuan, D.; and Shen, C. 2022. BackdoorBench: A Comprehensive Benchmark of Backdoor Learning. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track

    2022

  30. [38]

    A.; and Li, B

    Xu, X.; Wang, Q.; Li, H.; Borisov, N.; Gunter, C. A.; and Li, B. 2021. Detecting AI Trojans Using Meta Neural Analysis. In Proc. of the IEEE Symposium on Security and Privacy

    2021

  31. [39]

    Zagoruyko, S.; and Komodakis, N. 2016. Wide Residual Networks. In Proc. of the British Machine Vision Conference ( BMVC )

    2016

  32. [40]

    Zhang, Z.; Liu, Q.; Wang, Z.; Lu, Z.; and Hu, Q. 2023. Backdoor Defense via Deconfounded Representation Learning. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2023

  33. [41]

    N.; and Lin, X

    Zhao, P.; Chen, P.-Y.; Das, P.; Ramamurthy, K. N.; and Lin, X. 2020. Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness. In Proc. of the International Conference on Learning Representations ( ICLR )

    2020

  34. [42]

    Zhao, S.; Ma, X.; Zheng, X.; Bailey, J.; Chen, J.; and Jiang, Y. 2023. Clean-Label Backdoor Attacks on Video Recognition Models. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV )

    2023

  35. [43]

    Zhou, J.; Lv, P.; Lan, Y.; Meng, G.; Chen, K.; and Ma, H. 2023. DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models. In Proc. of AAAI Conference on Artificial Intelligence ( AAAI )

    2023

  36. [44]

    Goodfellow and Rob Fergus , booktitle = iclr, title =

    Christian Szegedy and Wojciech Zaremba and Ilya Sutskever and Joan Bruna and Dumitru Erhan and Ian J. Goodfellow and Rob Fergus , booktitle = iclr, title =

  37. [45]

    Wide Residual Networks , year =

    Sergey Zagoruyko and Nikos Komodakis , booktitle =. Wide Residual Networks , year =

  38. [46]

    Karen Simonyan and Andrew Zisserman , booktitle = iclr, title =

  39. [47]

    and Dong, W

    Deng, J. and Dong, W. and Socher, R. and others , booktitle = cvpr, title =

  40. [48]

    2008 , url =

    Alex Krizhevsky and Vinod Nair and Geoffrey Hinton , title =. 2008 , url =

    2008

  41. [49]

    Ng , booktitle =

    Yuval Netzer and Tao Wang and Adam Coates and Alessandro Bissacco and Bo Wu and Andrew Y. Ng , booktitle =. Reading Digits in Natural Images with Unsupervised Feature Learning , year =

  42. [50]

    Deng, Li , journal =. The. 2012 , number =

    2012

  43. [51]

    Tiny imagenet visual recognition challenge , year =

    Ya Le and Xuan Yang , journal =. Tiny imagenet visual recognition challenge , year =

  44. [52]

    Stallkamp and M

    J. Stallkamp and M. Schlipsing and J. Salmen and C. Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks. 2012

    2012

  45. [53]

    Ian Goodfellow and Jonathon Shlens and Christian Szegedy , booktitle = iclr, title =

  46. [54]

    Adversarial Machine Learning at Scale , author=

  47. [55]

    2017 , pages =

    Carlini, Nicholas and Wagner, David , booktitle = ieeesp, title =. 2017 , pages =

    2017

  48. [56]

    2016 , pages =

    Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal , booktitle = cvpr, title =. 2016 , pages =

    2016

  49. [57]

    Simple Black-Box Adversarial Attacks on Deep Neural Networks , year =

    Narodytska, Nina and Kasiviswanathan, Shiva , booktitle =. Simple Black-Box Adversarial Attacks on Deep Neural Networks , year =

  50. [58]

    2017 , pages =

    Chen, Pin-Yu and Zhang, Huan and Sharma, Yash and Yi, Jinfeng and Hsieh, Cho-Jui , booktitle = aisec, title =. 2017 , pages =

    2017

  51. [59]

    Francesco Croce and Matthias Hein , booktitle = icml, title =

  52. [60]

    Boxi Wu and Jinghui Chen and Deng Cai and Xiaofei He and Quanquan Gu , booktitle = neurips, title =

  53. [61]

    2019 , month = jun, pages =

    Cohen, Jeremy and Rosenfeld, Elan and Kolter, Zico , booktitle = icml, title =. 2019 , month = jun, pages =

    2019

  54. [62]

    2018 , month = jul, pages =

    Wong, Eric and Kolter, Zico , booktitle = icml, title =. 2018 , month = jul, pages =

    2018

  55. [63]

    Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack , author =

  56. [64]

    Provable Robustness of ReLU networks via Maximization of Linear Regions , author =

  57. [65]

    arXiv preprint arXiv:2010.01950 , year=

    Kim, Hoki , title=. arXiv preprint arXiv:2010.01950 , year=

    2010 arXiv

  58. [66]

    Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Engstrom, Logan and Tran, Brandon and Madry, Aleksander , booktitle = neurips, title =

  59. [67]

    Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu , booktitle = iclr, title =

  60. [68]

    Zico Kolter , booktitle = iclr, title =

    Eric Wong and Leslie Rice and J. Zico Kolter , booktitle = iclr, title =

  61. [69]

    Xing and Laurent El Ghaoui and Michael I

    Hongyang Zhang and Yaodong Yu and Jiantao Jiao and Eric P. Xing and Laurent El Ghaoui and Michael I. Jordan , booktitle = icml, title =

  62. [70]

    2019 , editor =

    Shafahi, Ali and Najibi, Mahyar and Ghiasi, Mohammad Amin and Xu, Zheng and Dickerson, John and Studer, Christoph and Davis, Larry S and Taylor, Gavin and Goldstein, Tom , booktitle = neurips, title =. 2019 , editor =

    2019

  63. [71]

    On the Convergence and Robustness of Adversarial Training , author =

  64. [72]

    Yisen Wang and Difan Zou and Jinfeng Yi and James Bailey and Xingjun Ma and Quanquan Gu , booktitle = iclr, title =

  65. [73]

    Tianyu Pang and Xiao Yang and Yinpeng Dong and Hang Su and Jun Zhu , booktitle = iclr, title =

  66. [74]

    Adnan Siraj Rakin and Zhezhi He and Deliang Fan , title =

  67. [75]

    Symmetric cross entropy for robust learning with noisy labels , author=

  68. [76]

    Spatially Transformed Adversarial Examples , author=

  69. [77]

    Micah Goldblum and Liam Fowl and Soheil Feizi and Tom Goldstein , title =

  70. [78]

    ICML , year=

    Attacks Which Do Not Kill Training Make Adversarial Learning Stronger , author=. ICML , year=

  71. [79]

    MixMatch: A Holistic Approach to Semi-Supervised Learning , author=

  72. [80]

    Kullback and R

    S. Kullback and R. A. Leibler , journal =. On Information and Sufficiency , urldate =

  73. [81]

    A Threshold Selection Method from Gray-Level Histograms , year=

    Otsu, Nobuyuki , journal=. A Threshold Selection Method from Gray-Level Histograms , year=

  74. [82]

    BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain , journal =

    Tianyu Gu and Brendan Dolan. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain , journal =

  75. [83]

    WaNet - Imperceptible Warping-based Backdoor Attack , author=

  76. [84]

    CoRR , volume =

    Xinyun Chen and Chang Liu and Bo Li and Kimberly Lu and Dawn Song , title =. CoRR , volume =

  77. [85]

    CoRR , volume =

    Ahmed Salem and Rui Wen and Michael Backes and Shiqing Ma and Yang Zhang , title =. CoRR , volume =. 2020 , archivePrefix =

    2020

  78. [86]

    Input-Aware Dynamic Backdoor Attack , year =

    Nguyen, Tuan Anh and Tran, Anh , booktitle = neurips, editor =. Input-Aware Dynamic Backdoor Attack , year =

  79. [87]

    Yingqi Liu and Shiqing Ma and Yousra Aafer and Wen-Chuan Lee and Juan Zhai and Weihang Wang and Xiangyu Zhang , title =

  80. [88]

    and Kallas, K

    Barni, M. and Kallas, K. and Tondi, B. , booktitle=. A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning , year=

  81. [89]

    2019 , eprint=

    Label-Consistent Backdoor Attacks , author=. 2019 , eprint=

    2019

  82. [90]

    2019 , url=

    Clean-Label Backdoor Attacks , author=. 2019 , url=

    2019

  83. [91]

    Aniruddha Saha, Akshayvarun Subramanya, Hamed Pirsiavash , title=

  84. [92]

    Ronny Huang and Mahyar Najibi and Octavian Suciu and Christoph Studer and Tudor Dumitras and Tom Goldstein , title =

    Ali Shafahi and W. Ronny Huang and Mahyar Najibi and Octavian Suciu and Christoph Studer and Tudor Dumitras and Tom Goldstein , title =

  85. [93]

    Clean-Label Backdoor Attacks on Video Recognition Models , booktitle=iccv, year=

    Shihao Zhao and Xingjun Ma and Xiang Zheng and James Bailey and Jingjing Chen and Yu. Clean-Label Backdoor Attacks on Video Recognition Models , booktitle=iccv, year=

  86. [94]

    and Kesidis, George , booktitle=

    Xiang, Zhen and Miller, David J. and Kesidis, George , booktitle=. Revealing Backdoors, Post-Training, in DNN Classifiers via Novel Inference on Optimized Perturbations Inducing Group Misclassification , year=

  87. [95]

    Blind Backdoors in Deep Learning Models , booktitle =

  88. [96]

    Invisible Backdoor Attack with Sample-Specific Triggers , author=

  89. [97]

    Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching , author=

  90. [98]

    Biggio, Battista and Nelson, Blaine and Laskov, Pavel , title =

  91. [99]

    Hossein Souri and Micah Goldblum and Liam Fowl and Rama Chellappa and Tom Goldstein , title =

  92. [100]

    Khoa Doan and Yingjie Lao and Weijie Zhao and Ping Li , title =

  93. [101]

    usenix , year =

    Eugene Bagdasaryan and Vitaly Shmatikov , title =. usenix , year =

  94. [102]

    An embarrassingly simple approach for trojan attack in deep neural networks , author=

  95. [103]

    Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only , author=

  96. [104]

    DBA: Distributed Backdoor Attacks against Federated Learning , author=

  97. [105]

    Poisoning and Backdooring Contrastive Learning , author=

  98. [106]

    TrojViT: Trojan Insertion in Vision Transformers , author=

  99. [107]

    How to Backdoor Diffusion Models? , author=

  100. [108]

    2023 , eprint=

    Poisoning Web-Scale Training Datasets is Practical , author=. 2023 , eprint=

    2023

  101. [109]

    Real Attackers Don't Compute Gradients

    G. Apruzzese and H. S. Anderson and S. Dambra and D. Freeman and F. Pierazzi and K. Roundy , booktitle =. “Real Attackers Don't Compute Gradients”: Bridging the Gap Between Adversarial ML Research and Practice , year =

  102. [110]

    Nicholas Carlini , title =

  103. [111]

    The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure , author=

  104. [112]

    On the Trade-off between Adversarial and Backdoor Robustness , author=

  105. [113]

    Progressive Backdoor Erasing via connecting Backdoor and Adversarial Attacks , author=

  106. [114]

    A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks , author=

  107. [115]

    Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track , year=

    BackdoorBench: A Comprehensive Benchmark of Backdoor Learning , author=. Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track , year=

  108. [116]

    IEEE Transactions on Neural Networks and Learning Systems , year=

    Backdoor learning: A survey , author=. IEEE Transactions on Neural Networks and Learning Systems , year=

  109. [117]

    Qiu, Han and Zeng, Yi and Guo, Shangwei and Zhang, Tianwei and Qiu, Meikang and Thuraisingham, Bhavani , title =

  110. [118]

    2020 , booktitle = acsac, location =

    Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems , author=. 2020 , booktitle = acsac, location =

    2020

  111. [119]

    IEEE Transactions on Reliability , year =

    Sakshi Udeshi and Shanshan Peng and Gerald Woo and Lionell Loh and Louth Rawshan and Sudipta Chattopadhyay , title =. IEEE Transactions on Reliability , year =

  112. [120]

    ArXiv , year=

    ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks , author=. ArXiv , year=

  113. [121]

    Zihao Zhu and Mingda Zhang and Shaokui Wei and Bingzhe Wu and Baoyuan Wu , booktitle=iclr, year=

  114. [122]

    Adversarial Unlearning of Backdoors via Implicit Hypergradient , author=

  115. [123]

    Data-free Backdoor Removal based on Channel Lipschitzness , author=

  116. [124]

    Adversarial Neuron Pruning Purifies Backdoored Deep Models , author=

  117. [125]

    Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks , author=

  118. [126]

    Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness , author=

  119. [127]

    Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

    Liu, Kang and Dolan-Gavitt, Brendan and Garg, Siddharth. Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

  120. [128]

    Zhenting Wang and Kai Mei and Juan Zhai and Shiqing Ma , booktitle=iclr, year=

  121. [129]

    One-shot Neural Backdoor Erasing via Adversarial Weight Masking , author=

  122. [130]

    Advances in Neural Information Processing Systems , year=

    Rethinking the Reverse-engineering of Trojan Triggers , author=. Advances in Neural Information Processing Systems , year=

  123. [131]

    Few-shot Backdoor Defense Using Shapley Estimation , author=

  124. [132]

    , booktitle=ieeesp, title=

    Wang, Bolun and Yao, Yuanshun and Shan, Shawn and Li, Huiying and Viswanath, Bimal and Zheng, Haitao and Zhao, Ben Y. , booktitle=ieeesp, title=

  125. [133]

    Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarios , author=

  126. [134]

    , author=

    Randomized Channel Shuffling: Minimal-Overhead Backdoor Attack Detection without Clean Datasets. , author=

  127. [135]

    Detecting AI Trojans Using Meta Neural Analysis , author=

  128. [136]

    Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases , author=

  129. [137]

    SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency , author=

  130. [138]

    SPECTRE: defending against backdoor attacks using robust statistics , author =

  131. [139]

    Robust Anomaly Detection and Backdoor Attack Detection via Differential Privacy , author=

  132. [140]

    STRIP: A Defence Against Trojan Attacks on Deep Neural Networks , author=

  133. [141]

    Anti-Backdoor Learning: Training Clean Models on Poisoned Data , author=

  134. [142]

    Training with More Confidence: Mitigating Injected and Natural Backdoors During Training , author=

  135. [143]

    Weixin Chen and Baoyuan Wu and Haoqian Wang , booktitle = neurips, title =

  136. [144]

    Backdoor Defense via Decoupling the Training Process , author=

  137. [145]

    Backdoor Defense via Adaptively Splitting Poisoned Dataset , author=

  138. [146]

    DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models , author=

  139. [147]

    The Twelfth International Conference on Learning Representations , year=

    Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency , author=. The Twelfth International Conference on Learning Representations , year=

  140. [148]

    Backdoor Defense via Deconfounded Representation Learning , author=

  141. [149]

    32nd USENIX Security Symposium (USENIX Security 23) , year =

    Minzhou Pan and Yi Zeng and Lingjuan Lyu and Xue Lin and Ruoxi Jia , title =. 32nd USENIX Security Symposium (USENIX Security 23) , year =

  142. [150]

    Wang and Tong Wu and Saeed Mahloujifar and Prateek Mittal , title =

    Xiangyu Qi and Tinghao Xie and Jiachen T. Wang and Tong Wu and Saeed Mahloujifar and Prateek Mittal , title =. 32nd USENIX Security Symposium (USENIX Security 23) , year =

  143. [151]

    On the Effectiveness of Adversarial Training Against Backdoor Attacks , year=

    Gao, Yinghua and Wu, Dongxian and Zhang, Jingfeng and Gan, Guanhao and Xia, Shu-Tao and Niu, Gang and Sugiyama, Masashi , journal=. On the Effectiveness of Adversarial Training Against Backdoor Attacks , year=

  144. [152]

    The Victim and The Beneficiary: Exploiting a Poisoned Model to Train a Clean Model on Poisoned Data , booktitle=iccv, author=

  145. [153]

    Adversarial Active Learning for Deep Networks: a Margin Based Approach , author=

  146. [154]

    RandAugment: Practical Automated Data Augmentation with a Reduced Search Space , year =

    Cubuk, Ekin Dogus and Zoph, Barret and Shlens, Jon and Le, Quoc , booktitle = neurips, editor =. RandAugment: Practical Automated Data Augmentation with a Reduced Search Space , year =

  147. [155]

    AutoAugment: Learning Augmentation Policies from Data , booktitle = cvpr, year =

    Ekin Dogus Cubuk and Barret Zoph and Dandelion Man. AutoAugment: Learning Augmentation Policies from Data , booktitle = cvpr, year =

  148. [156]

    mixup: Beyond Empirical Risk Minimization , booktitle = iclr, year =

    Hongyi Zhang and Moustapha Ciss. mixup: Beyond Empirical Risk Minimization , booktitle = iclr, year =

  149. [157]

    International Conference on Computer Vision (ICCV) , year=

    CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Features , author=. International Conference on Computer Vision (ICCV) , year=

  150. [158]

    and Zoph, Barret and Gilmer, Justin and Lakshminarayanan, Balaji , title=

    Hendrycks, Dan and Mu, Norman and Cubuk, Ekin D. and Zoph, Barret and Gilmer, Justin and Lakshminarayanan, Balaji , title=

  151. [159]

    Survey of State-of-Art Autonomous Driving Technologies with Deep Learning , year =

    Huang, Yu and Chen, Yue , booktitle =. Survey of State-of-Art Autonomous Driving Technologies with Deep Learning , year =

  152. [160]

    Ilya Loshchilov and Frank Hutter , booktitle = iclr, title =

  153. [161]

    CoRR , title =

    Yoshua Bengio and Nicholas L. CoRR , title =

  154. [162]

    2016 , pages =

    Kaiming He and Xiangyu Zhang and Shaoqing Ren and Jian Sun , booktitle = cvpr, title =. 2016 , pages =

    2016

  155. [163]

    Mark Sandler and Andrew Howard and Menglong Zhu and Andrey Zhmoginov and Liang-Chieh Chen , booktitle = cvpr, title =

  156. [164]

    Gao Huang and Zhuang Liu and Laurens van der Maaten , booktitle = cvpr, title =

  157. [165]

    2018 , pages =

    Qiangui Huang and Shaohua Kevin Zhou and Suya You and Ulrich Neumann , booktitle = wacv, title =. 2018 , pages =

    2018

  158. [166]

    Goodfellow and Samy Bengio , booktitle = iclr, title =

    Alexey Kurakin and Ian J. Goodfellow and Samy Bengio , booktitle = iclr, title =

  159. [167]

    McDaniel and Somesh Jha and Matt Fredrikson and Z

    Nicolas Papernot and Patrick D. McDaniel and Somesh Jha and Matt Fredrikson and Z. Berkay Celik and Ananthram Swami , booktitle = eurosp, title =. 2016 , pages =

    2016

  160. [168]

    Gardner and Yurong You and Andrew Gordon Wilson and Kilian Q

    Chuan Guo and Jacob R. Gardner and Yurong You and Andrew Gordon Wilson and Kilian Q. Weinberger , booktitle = icml, title =. 2019 , pages =

    2019

  161. [169]

    2020 , pages =

    Utku Evci and Trevor Gale and Jacob Menick and Pablo Samuel Castro and Erich Elsen , booktitle = icml, title =. 2020 , pages =

    2020

  162. [170]

    Curriculum Adversarial Training , year =

    Qi. Curriculum Adversarial Training , year =

  163. [171]

    2015 , pages =

    Martens, James and Grosse, Roger , title =. 2015 , pages =

    2015

  164. [172]

    Pouyanfar, Samira and Sadiq, Saad and Yan, Yilin and Tian, Haiman and Tao, Yudong and Reyes, Maria Presa and Shyu, Mei-Ling and Chen, Shu-Ching and Iyengar, S. S. , journal =. A Survey on Deep Learning: Algorithms, Techniques, and Applications , year =

  165. [173]

    and He, Lifang , journal =

    Li, Qian and Peng, Hao and Li, Jianxin and Xia, Congying and Yang, Renyu and Sun, Lichao and Yu, Philip S. and He, Lifang , journal =. A Survey on Text Classification: From Traditional to Deep Learning , year =

  166. [174]

    Deep Face Recognition: A Survey , year =

    Wang, Mei and Deng, Weihong , journal =. Deep Face Recognition: A Survey , year =

  167. [175]

    Malware Classification Using Deep Learning Methods , year =

    Cakir, Bugra and Dogdu, Erdogan , booktitle =. Malware Classification Using Deep Learning Methods , year =

  168. [176]

    2015 , pages =

    Schroff, Florian and Kalenichenko, Dmitry and Philbin, James , booktitle = cvpr, title =. 2015 , pages =

    2015

  169. [177]

    Di Feng and Lars Rosenbaum and Klaus C. J. Dietmayer , journal =. Towards Safe Autonomous Driving: Capture Uncertainty in the Deep Neural Network For Lidar 3D Vehicle Detection , year =

  170. [178]

    International Conference on Computer Vision , year=

    Adversarial Examples for Semantic Segmentation and Object Detection , author=. International Conference on Computer Vision , year=

  171. [179]

    2022 , issn =

    A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions , journal =. 2022 , issn =. doi:https://doi.org/10.1016/j.cose.2022.102847 , url =

    2022 doi

  172. [180]

    2021 , issn =

    Adversarial attacks on machine learning cybersecurity defences in Industrial Control Systems , journal =. 2021 , issn =. doi:https://doi.org/10.1016/j.jisa.2020.102717 , url =

    2021 doi

  173. [181]

    2023 , issn =

    SoK: Realistic adversarial attacks and defenses for intelligent network intrusion detection , journal =. 2023 , issn =. doi:https://doi.org/10.1016/j.cose.2023.103433 , url =

    2023 doi

  174. [182]

    Applying Deep Learning to Autonomous Vehicles: A Survey , year=

    Ren, Jing and Gaber, Hossam and Al Jabar, Sk Sami , booktitle=. Applying Deep Learning to Autonomous Vehicles: A Survey , year=

  175. [183]

    Uncertainty Estimation for Deep Neural Object Detectors in Safety-Critical Applications , year =

    Le, Michael Truong and Diehl, Frederik and Brunner, Thomas and Knol, Alois , booktitle =. Uncertainty Estimation for Deep Neural Object Detectors in Safety-Critical Applications , year =

  176. [184]

    Quantifying the Carbon Emissions of Machine Learning , year =

    Lacoste, Alexandre and Luccioni, Alexandra and Schmidt, Victor and Dandres, Thomas , journal =. Quantifying the Carbon Emissions of Machine Learning , year =

  177. [185]

    The State of Sparsity in Deep Neural Networks , year =

    Trevor Gale and Erich Elsen and Sara Hooker , booktitle =. The State of Sparsity in Deep Neural Networks , year =

  178. [186]

    2021 , month =

    Manoj Rohit Vemparala and Nael Fasfous and Alexander Frickenstein and Sreetama Sarkar and Qi Zhao and Sabine Kuhn and Lukas Frickenstein and Anmol Singh and Christian Unger and Naveen Shankar Nagaraja and Christian Wressnegger and Walter Stechele , booktitle = saiad, title =. ...

    2021

  179. [187]

    , title=

    Brodersen, Kay Henning and Ong, Cheng Soon and Stephan, Klaas Enno and Buhmann, Joachim M. , title=. 2010 , pages=

    2010

  180. [188]

    Journal of Machine Learning Research , year =

    Laurens van der Maaten and Geoffrey Hinton , title =. Journal of Machine Learning Research , year =

  181. [189]

    Wild patterns: Ten years after the rise of adversarial machine learning , volume =

    Battista Biggio and Fabio Roli , journal =. Wild patterns: Ten years after the rise of adversarial machine learning , volume =

Pith tools

Reviewed July 11, 2026 · model on record in the stance chip above.