Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection

Di Tang; Haixu Tang; Kehuan Zhang; Xiaofeng Wang

REVIEW 4 major objections 6 minor 1 cited by

Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that backdoor contamination can be detected even when attack images are indistinguishable from normal ones, by testing each class's representation distribution for two-component mixture structure.

desk verdict TaCT is a genuinely new attack and SCAn a plausible defense, but the statistical confidence claims and the universal-variation assumption need tightening before the paper is fully sound. read the letter →

arxiv 1908.00686 v2 pith:GVINDK43 submitted 2019-08-02 cs.CR

Di Tang , XiaoFeng Wang , Haixu Tang , Kehuan Zhang This is my paper · ORCID

classification cs.CR

keywords backdoorattackdatapoisoningsource-specifictriggerrepresentationdistributionmixturemodellikelihood-ratiotestdetectionstatisticalcontaminationanalyzer

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that backdoor contamination in deep image classifiers can be detected from the shape of a class's representation distribution, even when the trigger no longer dominates the model's decision. It introduces a new attack, TaCT, which adds cover images so that only images from chosen source classes are misclassified under the trigger; this defeats four existing defenses. The proposed detector, SCAn, decomposes each penultimate-layer embedding into a class identity and a shared variation component, then runs a likelihood-ratio test to ask whether a class fits one Gaussian or two. Classes whose test statistic exceeds a threshold are flagged as contaminated. If the paper is right, defenders can catch backdoored models that prior defenses miss, using only a small clean data set and without retraining the model.

What carries the argument

The carrying mechanism is an EM-based two-component decomposition of representation vectors into identity and variation, adapted from subspace face recognition, combined with a likelihood-ratio test against a two-Gaussian mixture. The identity covariance $S_\mu$ and the universal variation covariance $S_\varepsilon$ are estimated once on a clean set; $S_\varepsilon$ is reused for every class, which is what makes the global information hard for a single-class contamination to corrupt. For each class, an iterative linear discriminant $v = S_\varepsilon^{-1}(\mu_1-\mu_2)$ splits the samples into two subgroups, and the test statistic $J_t = \sum_{r \in R_t} [(r-\mu_t)^T S_\varepsilon^{-1}(r-\mu_t) - (r-\mu_j)^T S_\varepsilon^{-1}(r-\mu_j)]$ compares the single-Gaussian null with the mixture alternative. The decision rule is a median-absolute-deviation standardized $J^*_t$, with classes above the threshold $\exp(2)$ reported as infected.

What would settle it

Train a clean model on a dataset whose classes have visibly different within-class variation (e.g., face classes that mix adult and child faces, or objects photographed from very different viewpoints), run SCAn with a clean set drawn from other classes, and check whether any uninfected class yields $J^{*}_t > \exp(2)$; a positive result would mean the universal-variation assumption fails and the detector's flag is not specific to backdoors.

Watch

Extended reading notes

Core claim

The central claim is that a contamination attack changes the target class's representation distribution from a single Gaussian to a two-component mixture, and that this change is visible class-by-class when the variation covariance is estimated globally. Formally, each representation is $r = \mu_t + \varepsilon$ with a class identity $\mu_t$ and label-independent variation $\varepsilon$, so an infected class obeys $\delta_i \mu_1 + (1-\delta_i) \mu_2 + \varepsilon$. SCAn estimates $S_\varepsilon$ and $S_\mu$ on a clean collection, untangles each class into normal and attack subgroups with an iterative Fisher discriminant, and computes the likelihood-ratio statistic $J_t$. A normalized form $J^*_t$ above $\exp(2)$ declares the class contaminated. The paper further claims this catches its own source-specific TaCT attack as well as conventional blending-trigger and poison-frogs attacks, and that a black-box adversary cannot tune the trigger to evade it.

Load-bearing premise

The load-bearing premise is the universal-variation assumption that every uninfected class has exactly the same within-class variation distribution, so a single covariance $S_\varepsilon$ estimated on clean data applies to all classes; if variation is class-dependent, clean classes will also look like mixtures and be falsely flagged.

Editorial extensions

If this is right

Against TaCT, SCAn separates the target class from normal classes by orders of magnitude in ln(J*) on GTSRB, ILSVRC2012, MegaFace, and CIFAR-10 across box, normal, square, and watermark triggers.
Neural Cleanse, STRIP, SentiNet, Activation Clustering, and ABS fail to stop TaCT in the paper's experiments, while SCAn detects it at low false-positive rates in both offline and online settings.
SCAn needs only a small clean set: results hold with 1% of the data, and with 0.3% in the studied configuration, and it still works when up to 17% of the clean set is contaminated.
SCAn also detects blending-trigger and poison-frogs attacks, and a knowledgeable adversary using 10,000 iterations of black-box trigger optimization could not push J* below the threshold.
When many classes are targeted at once, detection needs more clean data and the attack itself becomes less stealthy because model accuracy drops.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension the paper does not pursue is applying the same mixture test to any classifier whose penultimate embeddings have identity-plus-style structure, such as speaker, handwriting, or code-author embeddings, since the algorithm only assumes additive Gaussian components.
The paper's own MegaFace observation that classes mixing baby and adult faces have elevated J* implies a sharper test: before trusting SCAn on a new dataset, one should estimate the null distribution of J* on known-clean classes with heterogeneous subpopulations and recalibrate the threshold.
If universal variation fails, an obvious repair is to estimate per-class variation covariances from each class's own clean subset, trading the global-information advantage for more clean data; this could be tested against the paper's reported contamination tolerances.
The exp(2) threshold comes from a normal approximation to the chi-square statistic, so in high-dimensional embeddings a permutation-based null distribution would be a natural calibration check.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read the paper. The headline: TaCT is a genuinely new attack — adding cover images to force a source-specific backdoor — and it cleanly breaks the trigger-dominance assumption that Neural Cleanse, STRIP, SentiNet, and Activation Clustering rely on. SCAn is a reasonable statistical response: decompose representations into identity plus variation using a clean set, then test each class for a two-component mixture via a likelihood ratio. The paper ships code and data, evaluates on four datasets, and tests against several attack types including poison frogs and blending. That is real work and a real contribution.

The soft spots are mostly at the statistical core. The Wilks' theorem argument is fragile: the alternative model uses hard assignments and a covariance matrix estimated once on clean data, so the claimed chi-square degrees of freedom and the exp(2) threshold with 1e-9 confidence are not strictly justified. In practice the threshold seems to work, but the paper should either provide a proper null distribution or soften the confidence claim. The universal-variation assumption (Section 4.1) is the bigger issue. The paper itself admits that MegaFace classes containing both baby and adult faces have elevated J* values. That is exactly the failure mode the assumption predicts: a clean, heterogeneous class is better fit by a two-mean mixture than by a single Gaussian. The paper says these anomalies stay well below infected classes, but it does not report FPR on MegaFace, and the central detection figures have no error bars. If a class has strong subpopulations or the attack effect is small, the separation can collapse. I would want an ROC or FPR/TPR tradeoff on MegaFace and on deliberately heterogeneous classes.

The adaptive attack experiment is a single run with an optimizer that did not move the trigger norm; that suggests the optimizer was ineffective, not that SCAn is robust. Minor, but worth noting.

Overall: the central empirical claim — TaCT defeats prior defenses and SCAn detects it — holds up, but the statistical packaging oversells precision. This paper is for backdoor and poisoning researchers; it deserves a serious referee and likely a conditional accept after revisions. The authors were honest about the MegaFace limitation, which counts for something.

Referee Report

4 major / 6 minor

Summary. The paper introduces TaCT, a targeted contamination attack that injects source-specific backdoors into DNNs by adding both attack images and correctly labeled cover images, so that trigger-carrying representations become hard to separate from normal ones. It then proposes SCAn, a detection method that, for each class, fits a two-component Gaussian mixture (normal plus attack) versus a single Gaussian null, using a globally estimated within-class covariance S_epsilon. Classes whose robustified likelihood-ratio statistic J*_t exceeds exp(2) are flagged as contaminated. The paper reports that SCAn detects TaCT, conventional data-poisoning, blending-trigger, poison-frogs, and multiple-trigger attacks across GTSRB, ILSVRC2012, MegaFace, and CIFAR-10, and that existing defenses (Neural Cleanse, STRIP, SentiNet, Activation Clustering, ABS) fail against TaCT. The empirical sweep is broad, and the authors release code and a new attack construction.

Significance. If the reported results hold, the paper makes a useful empirical contribution: it demonstrates a new attack that evades several published defenses, and it shows that global representation statistics can reveal contamination that per-class clustering misses. The evaluation is extensive (four datasets, four trigger types, comparisons with five defenses, and an adaptive black-box attack), and the availability of code is a concrete strength. The main value lies in the attack analysis and in the observation that the target class's representation distribution is altered in a detectable way even when individual attack images are not separable. However, the paper's formal statistical framing substantially overstates the reliability of the detector: the claimed confidence level is not supported by the test construction, and the acknowledged violation of the universal-variation assumption on real data is not quantified in terms of false-positive rate. These issues are load-bearing for the central detection claim, but they are addressable by reframing the method as an empirically calibrated detector and by adding the missing false-positive evaluation.

major comments (4)

[Section 4.2, Eqns. (7)-(8)] The statistical calibration of the decision rule is not valid. The statistic J_t is computed with hard assignment labels from the iterative FLD procedure (Eqn. 6) and with a covariance S_epsilon estimated once on a clean set; this is a classification likelihood, not a mixture likelihood, and the parameters are not the maximum-likelihood estimates required by Wilks' theorem. Moreover, S_epsilon is not re-estimated under the null hypothesis, so the degrees of freedom of the purported chi-square limit are not those of a nested hypothesis test. The subsequent transformation to the MAD-based J*_t has no known null distribution. Consequently, the statement that J*_t > exp(2) rejects H0 with confidence greater than 1-1e-9 is unsupported. It is also internally inconsistent with the empirical false-positive rates reported in Table 4: on GTSRB TaCT at 99.5% TPR, SCAn has FPR 0.74%, which is orders of magnitude above 1e-9. The authors should either supply a valid distributional argument or present the threshold as an empirically calibrated parameter with measured FPR on clean and infected classes.
[Section 4.1 and Section 5] The universal-variation assumption is violated by real class heterogeneity, and the paper's own acknowledgment of this is not backed by a false-positive analysis. Section 5 states that on MegaFace, classes containing both baby and adult images have higher J* than other normal classes. This is precisely a violation of the null model, which assumes every uninfected class is a single Gaussian with the same S_epsilon. The paper does not report the false-positive rate on MegaFace or ILSVRC2012, and Table 4 reports FPR only for GTSRB and CIFAR-10. The claim that such anomalous classes remain 'well below' infected classes is supported only by box plots in Fig. 10, without error bars or a numerical separation margin. For small triggers or low poison fractions, the gap between infected classes and naturally heterogeneous clean classes could close, undermining the central detection claim. The authors should quantify FPR on clean heterogeneous classes and, if necessary, modify the null model to accommodate within-class structure.
[Section 4.3 and Table 4] There is no false-positive evaluation on uninfected (benign) models. Section 4.3 says that one benign model was trained for each dataset, but the reported results focus on the target class of infected models, and Table 4 reports FPR as the fraction of non-target classes flagged on infected models. This does not measure the detector's behavior on a completely clean model, which is the relevant quantity for a defense that must decide whether a given model is infected. The paper should report the distribution of J* over all classes for the benign models on all four datasets, including the number of clean classes that cross the exp(2) threshold.
[Section 4.5, Fig. 16] The poison-frogs evaluation does not use SCAn's actual decision rule. Fig. 16 reports raw J values (with units of 10^6) for a two-class dog-vs-fish setup, with no threshold line, and the MAD-based normalization used to define J* is degenerate with only two classes. The claim that 'SCAn successfully defeats this attack' is therefore not demonstrated under the paper's own test statistic J*_t > exp(2). The authors should either apply the full SCAn procedure with the threshold, or clearly state that this is a separate, informal evaluation of the underlying likelihood statistic.

minor comments (6)

[Section 4.2, Eqn. (8)] The simplification from Eqn. (7) to Eqn. (8) omits the Gaussian normalization constants; they cancel only because S_epsilon is shared across all groups, and this should be stated explicitly for clarity.
[Figure 10] The label 'Target' in the legends is ambiguous: it presumably denotes the target class's J*, but it is unclear whether the plotted value is the mean, median, or a single run. Please clarify and add error bars or per-run points.
[Table 4] Table 4 is very dense and the column boundaries under 'GTSRB' and 'CIFAR-10' are hard to follow, especially for the ABS row and the online section. Consider splitting it into separate sub-tables or adding clear rule lines under each heading.
[Figure 6] The caption contains a typo: 'Sihouettte' should be 'Silhouette'.
[Section 7, Conclusion] The sentence 'Those four existing detection techniques rely on these proprieties' contains a typo: 'proprieties' should be 'properties'.
[Section 5] The phrase 'backdoor using a non-image trigger' is unclear; since a trigger is input content, this likely means a non-image input domain, and the wording should be adjusted.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SCAn's likelihood-ratio test is fitted on clean data with a fixed threshold and validated on held-out attack classes, so the detection claim is not an input-output identity.

full rationale

The derivation chain is self-contained. SCAn estimates the shared covariance S_epsilon and between-class covariance S_mu from a clean set via an EM decomposition (Section 4.2, Appendix B), then computes per-class identity vectors and mixture parameters without using infection labels. The likelihood-ratio statistic J*_t compares a single-Gaussian null (Eqn. 2) with a two-mean mixture alternative (Eqn. 3) using a fixed threshold exp(2). The infected-class labels are not used to fit the threshold or the covariance; the same detector is then applied to TaCT, source-agnostic attacks, blending-trigger attacks, Poison Frogs, and multiple-trigger attacks without per-attack re-tuning, which provides external, non-circular validation. The universal-variation assumption is an explicit modeling assumption, not a definitional identity: if real classes have heterogeneous subpopulations (e.g., MegaFace baby/adult classes), the null model can be violated and false positives can arise. The paper acknowledges this limitation in Section 5, but that is a correctness and robustness concern, not circularity. The cited decomposition framework [44] and EM estimation [5] are prior external works, not self-citations, and no load-bearing argument reduces to the paper's own conclusions. Therefore the central detection claim is not equivalent to its inputs by construction.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The method rests on the face-recognition decomposition model (identity plus variation), the universality of variation across classes, Gaussianity of representations for the likelihood ratio test, and Wilks' theorem for the chi-square approximation. The clean-data availability is a threat-model assumption. The universal-variation assumption is partially invalidated by the paper's own observation that baby/adult MegaFace classes have elevated J*.

free parameters (1)

Detection threshold exp(2) = 7.3891
Hand-chosen threshold for J*_t outlier flagging; motivated by normal approximation of chi-square but not rigorously calibrated.

assumptions (5)

domain assumption Two-component decomposition: r = mu + epsilon, with mu ~ N(0, S_mu), epsilon ~ N(0, S_epsilon), independent.
Invoked in Eqn. 2 and throughout Section 4; borrowed from face recognition literature [5, 44], assumed to hold for all evaluated tasks.
domain assumption Universal variation: the variation distribution is identical across all classes.
Stated in Section 4.1; the shared covariance S_epsilon and the transfer of variation statistics from clean data to every class depend on it; Section 5 notes benign baby/adult MegaFace classes have elevated J*, indicating violation.
domain assumption Representation vectors are Gaussian under both hypotheses.
The likelihood ratio test in Eqns. 7-8 uses normal densities and a chi-square approximation; normality of penultimate-layer representations is not empirically verified.
standard math Wilks' theorem applies to the likelihood ratio statistic.
Used in Section 4.2 to justify J_t ~ chi-square(k); requires nested hypotheses and regularity conditions that are questionable for the hard-assignment two-group model with external covariance S_epsilon.
domain assumption Defender holds a clean dataset and full access to model representations.
Threat model in Section 2.4; clean data of 1% to 10% of the training set is used to estimate S_epsilon and S_mu.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection." pith.science (2026). https://pith.science/paper/GVINDK43

@misc{pith2026190800686,
  author       = {Pith},
  title        = {Pith review of: Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GVINDK43}},
  note         = {Machine review of arXiv:1908.00686}
}

read the original abstract

A security threat to deep neural networks (DNN) is backdoor contamination, in which an adversary poisons the training data of a target model to inject a Trojan so that images carrying a specific trigger will always be classified into a specific label. Prior research on this problem assumes the dominance of the trigger in an image's representation, which causes any image with the trigger to be recognized as a member in the target class. Such a trigger also exhibits unique features in the representation space and can therefore be easily separated from legitimate images. Our research, however, shows that simple target contamination can cause the representation of an attack image to be less distinguishable from that of legitimate ones, thereby evading existing defenses against the backdoor infection. In our research, we show that such a contamination attack actually subtly changes the representation distribution for the target class, which can be captured by a statistic analysis. More specifically, we leverage an EM algorithm to decompose an image into its identity part (e.g., person, traffic sign) and variation part within a class (e.g., lighting, poses). Then we analyze the distribution in each class, identifying those more likely to be characterized by a mixture model resulted from adding attack samples to the legitimate image pool. Our research shows that this new technique effectively detects data contamination attacks, including the new one we propose, and is also robust against the evasion attempts made by a knowledgeable adversary.

Figures

Figures reproduced from arXiv: 1908.00686 by the authors.

**Figure 2.** Target class’ representations projected onto their first two principle [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 4.** Entropy distributions of STRIP against TaCT. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

Figures from the paper (11 more)

**Figure 3.** Figure 3: Detailed results of NC against TaCT, when 0 is the source label [PITH_FULL_IMAGE:figures/full_fig_p006_3.png]

**Figure 5.** Figure 5: Demonstration of SentiNet against TaCT on GTSRB. -0.5 0 0.5 1 silhouette score label 0 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 7.** Figure 7: An illustration of Statistical Contamination Analyzer. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

**Figure 8.** Figure 8: A schematic illustration of the assumption of two-component [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

**Figure 10.** Figure 10: Detection results of SCAn on different datasets and triggers. [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]

**Figure 11.** Figure 11: J ∗ of the target classes under contaminated clean data. GTSRB ImageNet MegaFace 0 2 4 6 8 10 Ln(J *) Target Threshold [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]

**Figure 15.** Figure 15: The amount of clean data required by decomposition model for defeating multiple target-trigger attacks on GTSRB. untangling and the hypothesis test to capture attack instances. 4.4 Comparison In a conventional data poisoning attack, the adversary injects to the target…

**Figure 16.** Figure 16: J of dog set and fish set under poison frogs attack. 1(0.1%) 500(50%) 1000(100%) # of triggers 60 80 100 Top-1 Accuracy (%) 60 80 100 Misclassification rate (%) Top-1 Misclassification [PITH_FULL_IMAGE:figures/full_fig_p012_16.png]

**Figure 19.** Figure 19: Statistics of blackbox attacks (after moving-mean filtering). Black-box trigger adjustment attack. We further consider an adversary who is knowledgeable about our approach, and tries to evade it under the black-box model, as assumed in our threat model (Section 2.4).…

**Figure 20.** Figure 20: Norms of sourceagnostic triggers for infected models with global different misclassification rate. Box plot shows quartiles of norms for non-target classes. 0 0.2 0.4 0.6 0.8 1 FPR 0 0.2 0.4 0.6 0.8 1 TPR k-NN k-Means PCA [PITH_FULL_IMAGE:figures/full_fig_p017_20.png]

**Figure 22.** Figure 22: Triggers and corresponding results. We launched several TaCTs on GTSRB in this experiment. The representations are projected onto the space [PITH_FULL_IMAGE:figures/full_fig_p018_22.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
cs.CR 2019-09 conditional novelty 6.0 of 10

Backdoor triggers hidden via LSB steganography or Lp-regularized noise achieve high attack success while looking nearly identical to clean images in perceptual metrics, and single-target variants evade Neural Cleanse.

Reference graph

Works this paper leans on

46 extracted references · 37 canonical work pages · cited by 1 Pith paper

[1]

How to backdoor federated learning

Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deb- orah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. CoRR, abs/1807.00459, 2018

arXiv 2018
[2]

Mitigating poisoning attacks on machine learning models: A data provenance based ap- proach

Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, and Jaehoon Amir Safavi. Mitigating poisoning attacks on machine learning models: A data provenance based ap- proach. In Proceedings of the 10th ACM Workshop on Artiﬁcial Intelligence and Security, pages 103–110. ACM, 2017

work page
[3]

Statistics for experimenters, volume 664

George EP Box, William Gordon Hunter, J Stuart Hunter, et al. Statistics for experimenters, volume 664. John Wiley and sons New York, 1978

work page 1978
[4]

Detecting backdoor at- tacks on deep neural networks by activation clustering

Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor at- tacks on deep neural networks by activation clustering. In Workshop on Artiﬁcial Intelligence Safety 2019 co- located with the Thirty-Third AAAI Conference on Ar- tiﬁcial Intelligence 2019 (AAAI-19), Honol...

work page 2019
[5]

Bayesian face revisited: A joint formulation

Dong Chen, Xudong Cao, Liwei Wang, Fang Wen, and Jian Sun. Bayesian face revisited: A joint formulation. In Computer Vision - ECCV 2012 - 12th European Con- ference on Computer Vision, Florence, Italy, October 7-13, 2012, Proceedings, Part III, pages 566–579, 2012

work page 2012
[6]

ZOO: zeroth order optimization based black-box attacks to deep neural networks with- out training substitute models

Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. ZOO: zeroth order optimization based black-box attacks to deep neural networks with- out training substitute models. In Bhavani M. Thurais- ingham, Battista Biggio, David Mandell Freeman, Brad Miller, and Arunesh Sinha, editors, Proceedings of the 10th ACM Workshop on Artiﬁcial Intellige...

work page 2017
[7]

Targeted backdoor attacks on deep learning systems using data poisoning

Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, abs/1712.05526, 2017

arXiv 2017
[8]

Sentinet: Detecting physical attacks against deep learning systems

Edward Chou, Florian Tramèr, Giancarlo Pellegrino, and Dan Boneh. Sentinet: Detecting physical attacks against deep learning systems. CoRR, abs/1812.00292, 2018

arXiv 2018

Show all 46 references

[9]

STRIP: a defence against trojan attacks on deep neural networks

Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith Chinthana Ranasinghe, and Surya Nepal. STRIP: a defence against trojan attacks on deep neural networks. In David Balenson, editor, Proceedings of the 35th Annual Computer Security Applications Con- ference, ACSAC 2019, S...

2019
[10]

Badnets: Identifying vulnerabilities in the machine learning model supply chain

Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. CoRR, abs/1708.06733, 2017

2017 arXiv
[11]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

2016
[12]

Hodge and Jim Austin

Victoria J. Hodge and Jim Austin. A survey of outlier detection methodologies. Artif. Intell. Rev., 22(2):85– 126, 2004

2004
[13]

Black-box adversarial attacks with limited queries and information

Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In Jennifer G. Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stock- holmsmässan, S...

2018
[14]

Algorithms for mining distancebased outliers in large datasets

Edwin M Knox and Raymond T Ng. Algorithms for mining distancebased outliers in large datasets. In Pro- ceedings of the international conference on very large data bases, pages 392–403. Citeseer, 1998

1998
[15]

Parameter estimation and hypothesis testing in linear models

Karl-Rudolf Koch. Parameter estimation and hypothesis testing in linear models. Springer, 1988

1988
[16]

Understanding black- box predictions via inﬂuence functions

Pang Wei Koh and Percy Liang. Understanding black- box predictions via inﬂuence functions. In Proceed- ings of the 34th International Conference on Machine Learning-Volume 70, pages 1885–1894. JMLR. org, 2017

2017
[17]

Quantiﬁable data mining using principal component analysis

Flip Korn, Alexandros Labrinidis, Yannis Kotidis, Chris- tos Faloutsos, Alex Kaplunovich, and Dejan Perkovic. Quantiﬁable data mining using principal component analysis. Technical report, 1998

1998
[18]

Learning multi- ple layers of features from tiny images

Alex Krizhevsky and Geoffrey Hinton. Learning multi- ple layers of features from tiny images. Technical report, Citeseer, 2009

2009
[19]

Gradient-based learning applied to document recognition

Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278– 2324, 1998

1998
[20]

Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median

Christophe Leys, Christophe Ley, Olivier Klein, Philippe Bernard, and Laurent Licata. Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median. Journal of Experimental Social Psychology, 49(4):764–766, 2013

2013
[21]

Printracker: Fingerprinting 3d printers using commodity scanners

Zhengxiong Li, Aditya Singh Rathore, Chen Song, Sheng Wei, Yanzhi Wang, and Wenyao Xu. Printracker: Fingerprinting 3d printers using commodity scanners. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 1306–

2018
[22]

Fine-pruning: Defending against backdooring attacks on deep neural networks

Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In Michael Bailey, Thorsten Holz, Manolis Stamatogiannakis, and Sotiris Ioannidis, editors, Research in Attacks, Intrusions, and Defenses - 21st Int...

2018
[23]

ABS: scan- ning neural networks for back-doors by artiﬁcial brain stimulation

Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. ABS: scan- ning neural networks for back-doors by artiﬁcial brain stimulation. In Lorenzo Cavallaro, Johannes Kinder, XiaoFeng Wang, and Jonathan Katz, editors, Proceed- ings of the 2019 ACM ...

2019
[24]

Trojaning attack on neural networks

Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18- 21, 2018, 2018

2018
[25]

Fisher dis- criminant analysis with kernels

Sebastian Mika, Gunnar Ratsch, Jason Weston, Bern- hard Scholkopf, and Klaus-Robert Mullers. Fisher dis- criminant analysis with kernels. In Neural networks for signal processing IX: Proceedings of the 1999 IEEE signal processing society workshop (cat. no. 98th8468), pages 41–...

1999
[26]

A system for the analysis of jet engine vibration data

Alexandre Nairac, Neil Townsend, Roy Carr, Steve King, Peter Cowley, and Lionel Tarassenko. A system for the analysis of jet engine vibration data. Integrated Computer-Aided Engineering, 6(1):53–66, 1999

1999
[27]

Level playing ﬁeld for million scale face recognition

Aaron Nech and Ira Kemelmacher-Shlizerman. Level playing ﬁeld for million scale face recognition. In Pro- ceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017

2017
[28]

Misleading learn- ers: Co-opting your spam ﬁlter

Blaine Nelson, Marco Barreno, Fuching Jack Chi, An- thony D Joseph, Benjamin IP Rubinstein, Udam Saini, Charles Sutton, JD Tygar, and Kai Xia. Misleading learn- ers: Co-opting your spam ﬁlter. In Machine learning in cyber trust, pages 17–51. Springer, 2009

2009
[29]

A data-driven ap- proach to cleaning large face datasets

Hong-Wei Ng and Stefan Winkler. A data-driven ap- proach to cleaning large face datasets. In 2014 IEEE International Conference on Image Processing (ICIP), pages 343–347. IEEE, 2014

2014
[30]

Defending neu- ral backdoors via generative distribution modeling

Ximing Qiao, Yukun Yang, and Hai Li. Defending neu- ral backdoors via generative distribution modeling. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelz- imer, Florence d’Alché-Buc, Emily B. Fox, and Roman Garnett, editors, Advances in Neural Information Pro- cessing System...

2019
[31]

Berg, and Li Fei-Fei

Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexan- der C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (I...

2015
[32]

Poison frogs! targeted clean-label poisoning at- tacks on neural networks

Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Gold- stein. Poison frogs! targeted clean-label poisoning at- tacks on neural networks. In Advances in Neural Infor- mation Processing Systems, pages 6103–6113, 2018

2018
[33]

Very deep con- volutional networks for large-scale image recognition

Karen Simonyan and Andrew Zisserman. Very deep con- volutional networks for large-scale image recognition. In 3rd International Conference on Learning Represen- tations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015

2015
[34]

DARTS: de- ceiving autonomous cars with toxic signs

Chawin Sitawarin, Arjun Nitin Bhagoji, Arsalan Mose- nia, Mung Chiang, and Prateek Mittal. DARTS: de- ceiving autonomous cars with toxic signs. CoRR, abs/1802.06430, 2018

2018 arXiv
[35]

Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking ma- chine learning algorithms for trafﬁc sign recognition. Neural Networks, 32:323–332, 2012

2012
[36]

Inception-v4, inception-resnet and the impact of residual connections on learning

Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Thirty-First AAAI Conference on Artiﬁcial Intelligence, 2017

2017
[37]

Going deeper with convolutions

Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Ser- manet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1–9, 2015

2015
[38]

Goodfellow, and Rob Fergus

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representa- tions, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conferen...

2014
[39]

Deep learning approach for network intrusion detection in software de- ﬁned networking

Tuan A Tang, Lotﬁ Mhamdi, Des McLernon, Syed Ali Raza Zaidi, and Mounir Ghogho. Deep learning approach for network intrusion detection in software de- ﬁned networking. In 2016 International Conference on Wireless Networks and Mobile Communications (WIN- COM), pages 258–263. IEEE, 2016

2016
[40]

Spectral signatures in backdoor attacks

Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. In Advances in Neu- ral Information Processing Systems, pages 8000–8010, 2018

2018
[41]

Nnoc- ulation: Broad spectrum and targeted treatment of back- doored dnns

Akshaj Kumar Veldanda, Kang Liu, Benjamin Tan, Prashanth Krishnamurthy, Farshad Khorrami, Ramesh Karri, Brendan Dolan-Gavitt, and Siddharth Garg. Nnoc- ulation: Broad spectrum and targeted treatment of back- doored dnns. CoRR, abs/2002.08313, 2020

2002 arXiv
[42]

Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y . Zhao. Neu- ral cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Se- curity and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 20...

2019
[43]

Adversary resistant deep neural networks with an appli- cation to malware detection

Qinglong Wang, Wenbo Guo, Kaixuan Zhang, Alexan- der G Ororbia II, Xinyu Xing, Xue Liu, and C Lee Giles. Adversary resistant deep neural networks with an appli- cation to malware detection. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery a...

2017
[44]

A uniﬁed framework for subspace face recognition

Xiaogang Wang and Xiaoou Tang. A uniﬁed framework for subspace face recognition. IEEE Transactions on pattern analysis and machine intelligence, 26(9):1222– 1228, 2004

2004
[45]

Chi-squared distribution — Wikipedia, the free encyclopedia, 2019

Wikipedia contributors. Chi-squared distribution — Wikipedia, the free encyclopedia, 2019

2019
[46]

The large-sample distribution of the likelihood ratio for testing composite hypotheses

Samuel S Wilks. The large-sample distribution of the likelihood ratio for testing composite hypotheses. The Annals of Mathematical Statistics, 9(1):60–62, 1938. A Global Misclassiﬁcation Rate To further investigate the relationship between trigger domi- nance and the failure o...

1938

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

How to backdoor federated learning

Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deb- orah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. CoRR, abs/1807.00459, 2018

arXiv 2018

[2] [2]

Mitigating poisoning attacks on machine learning models: A data provenance based ap- proach

Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, and Jaehoon Amir Safavi. Mitigating poisoning attacks on machine learning models: A data provenance based ap- proach. In Proceedings of the 10th ACM Workshop on Artiﬁcial Intelligence and Security, pages 103–110. ACM, 2017

work page

[3] [3]

Statistics for experimenters, volume 664

George EP Box, William Gordon Hunter, J Stuart Hunter, et al. Statistics for experimenters, volume 664. John Wiley and sons New York, 1978

work page 1978

[4] [4]

Detecting backdoor at- tacks on deep neural networks by activation clustering

Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor at- tacks on deep neural networks by activation clustering. In Workshop on Artiﬁcial Intelligence Safety 2019 co- located with the Thirty-Third AAAI Conference on Ar- tiﬁcial Intelligence 2019 (AAAI-19), Honol...

work page 2019

[5] [5]

Bayesian face revisited: A joint formulation

Dong Chen, Xudong Cao, Liwei Wang, Fang Wen, and Jian Sun. Bayesian face revisited: A joint formulation. In Computer Vision - ECCV 2012 - 12th European Con- ference on Computer Vision, Florence, Italy, October 7-13, 2012, Proceedings, Part III, pages 566–579, 2012

work page 2012

[6] [6]

ZOO: zeroth order optimization based black-box attacks to deep neural networks with- out training substitute models

Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. ZOO: zeroth order optimization based black-box attacks to deep neural networks with- out training substitute models. In Bhavani M. Thurais- ingham, Battista Biggio, David Mandell Freeman, Brad Miller, and Arunesh Sinha, editors, Proceedings of the 10th ACM Workshop on Artiﬁcial Intellige...

work page 2017

[7] [7]

Targeted backdoor attacks on deep learning systems using data poisoning

Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, abs/1712.05526, 2017

arXiv 2017

[8] [8]

Sentinet: Detecting physical attacks against deep learning systems

Edward Chou, Florian Tramèr, Giancarlo Pellegrino, and Dan Boneh. Sentinet: Detecting physical attacks against deep learning systems. CoRR, abs/1812.00292, 2018

arXiv 2018