Pith. sign in

REVIEW 8 cited by

SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2302.03251 v2 pith:GDEQ7IFV submitted 2023-02-07 cs.CR

Junfeng Guo , Yiming Li , Xun Chen , Hanqing Guo , Lichao Sun , Cong Liu This is my paper · ORCID
classification cs.CR
keywords backdoorpredictionattacksblack-boxconsistencyscale-upanalyzingdefense
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Deep neural networks (DNNs) are vulnerable to backdoor attacks, where adversaries embed a hidden backdoor trigger during the training process for malicious prediction manipulation. These attacks pose great threats to the applications of DNNs under the real-world machine learning as a service (MLaaS) setting, where the deployed model is fully black-box while the users can only query and obtain its predictions. Currently, there are many existing defenses to reduce backdoor threats. However, almost all of them cannot be adopted in MLaaS scenarios since they require getting access to or even modifying the suspicious models. In this paper, we propose a simple yet effective black-box input-level backdoor detection, called SCALE-UP, which requires only the predicted labels to alleviate this problem. Specifically, we identify and filter malicious testing samples by analyzing their prediction consistency during the pixel-wise amplification process. Our defense is motivated by an intriguing observation (dubbed scaled prediction consistency) that the predictions of poisoned samples are significantly more consistent compared to those of benign ones when amplifying all pixel values. Besides, we also provide theoretical foundations to explain this phenomenon. Extensive experiments are conducted on benchmark datasets, verifying the effectiveness and efficiency of our defense and its resistance to potential adaptive attacks. Our codes are available at https://github.com/JunfengGo/SCALE-UP.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 8 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs

    cs.CV 2026-08 conditional novelty 7.0 of 10

    A single poisoning phase can implant a backdoor that makes a VLM output attacker-selected caption text for previously unseen targets, using triggers synthesized in feature space at inference time.

  2. Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Merge Hijacking is a backdoor attack that lets a malicious LLM checkpoint poison any model it is merged with while preserving normal behavior.

  3. LoBAM: LoRA-Based Backdoor Attack on Model Merging

    cs.CR 2024-11 conditional novelty 6.0 of 10

    LoBAM constructs a malicious model for model merging by scaling the difference between a LoRA fine-tuned poisoned model and a benign model, achieving high backdoor attack success under low-resource assumptions.

  4. BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation

    cs.CR 2024-11 conditional novelty 6.0 of 10

    BackdoorMBTI is the first backdoor security benchmark and toolkit that covers image, text, and audio modalities with a unified evaluation pipeline.

  5. Poison in the Well: Feature Embedding Disruption in Backdoor Attacks

    cs.CR 2025-05 conditional novelty 5.0 of 10

    A trigger optimized to align poisoned-image features achieves near-100% backdoor success at 0.01-0.05% poison rates on image benchmarks.

  6. Ownership Verification of DNN Models Using White-Box Adversarial Attacks with Specified Probability Manipulation

    cs.LG 2025-05 conditional novelty 5.0 of 10

    The authors introduce I-FDGSM, an iterative adversarial attack that sets a target class probability to a specified value while keeping the true class dominant, and use it to verify whether a cloud model is the original model.

  7. One Pixel is All I Need

    cs.CV 2024-12 conditional novelty 5.0 of 10

    WorstVIT poisons a ViT for one epoch and, using gradient-guided per-image pixel selection, achieves near-100% attack success while changing just one pixel per image.

  8. Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images

    cs.CV 2024-12 conditional novelty 4.0 of 10

    A prompt-tuned CLIP model trained on five known backdoor attacks can detect a sixth held-out attack type with about 86% accuracy on CIFAR-10 and GTSRB.

Pith tools