Pith. sign in

REVIEW 5 major objections 5 minor 44 references

DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A backdoored self-supervised encoder can be screened by training a decoder to invert its embeddings: a triggered input reconstructs into an inconsistent image, and the reconstruction error marks it as backdoor.

desk verdict DeDe's decoder-reconstruction trick is a genuinely new detection idea, and the paper mostly backs it up; the universality claim needs tempering. read the letter →

arxiv 2411.16154 v2 pith:IT5DNTGB submitted 2024-11-25 cs.LG cs.CR

Sizai Hou , Songze Li , Duanyi Yao This is my paper · ORCID
classification cs.LGcs.CR
keywords backdoordetectionself-supervisedlearningcontrastiveCLIPinversemappingdecoderreconstructionerrordatapoisoning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes DeDe, a method for detecting backdoor samples in self-supervised learning (SSL) encoders by training a decoder that maps embeddings back to images. The key claim is that a triggered input, which the backdoor encoder forcibly maps to a target embedding, lands outside the decoder's learned normal region and therefore reconstructs into an image that differs noticeably from the input. The reconstruction error then serves as a detection score, with a threshold set from the average training error. The authors show empirically that this works for contrastive-learning encoders and CLIP vision encoders across several attacks, including stealthy ones, and that it does not require a clean or in-distribution auxiliary dataset.

What carries the argument

The load-bearing object is a lightweight masked-autoencoder-style decoder trained to invert the frozen encoder's mapping. It takes a global embedding plus local embeddings from randomly masked patches of the input and reconstructs the image; the training objective is the mean squared reconstruction error over an auxiliary unlabeled dataset. At test time the masking ratio is raised, forcing reconstruction to depend on the global embedding, so a triggered input's foreign embedding produces an abnormally large error, which is compared to a threshold set at 1.5 times the average training loss.

What would settle it

Train a backdoor attack whose triggered inputs are mapped into the center of a target class's normal embedding distribution (not a foreign region) and whose trigger remains visible in a few unmasked local patches; if DeDe's reconstruction errors for those inputs fall below its threshold, the clean-versus-triggered separation collapses.

Watch

Extended reading notes

Core claim

On its own terms, the paper asserts that the inverse of an encoder's embedding mapping is sufficient to detect backdoor behavior. Because SSL encourages similar images to cluster in embedding space, a decoder trained on clean image-embedding pairs learns a normal cluster-to-image mapping. Backdoor attacks force a triggered input to an embedding that does not match that mapping—either a different class's cluster or an out-of-distribution region—so the decoder's reconstruction of the triggered image is distorted. DeDe operationalizes this with a decoder that takes the global embedding plus a few unmasked local patches, and it flags an input when the squared reconstruction error exceeds 1.5 times the average training loss. The paper's experiments report high detection AUC on BadEncoder, DRUPE, CLIP-Backdoor, CTRL, and BadCLIP, and downstream attack success rates near zero for all but BadCLIP.

Load-bearing premise

The method works only if backdoor mappings land on embeddings the decoder has not learned to invert, so that triggered images reconstruct poorly while clean images reconstruct well.

Editorial extensions

If this is right

  • A user who downloads a pre-trained SSL encoder can screen incoming inputs for backdoor activation using only an auxiliary unlabeled dataset, with no knowledge of the trigger pattern or the training data.
  • Because DeDe never modifies the encoder, the same trained decoder can be reused as an inference-time alert system on top of a deployed model.
  • On the evaluated attacks, DeDe brings downstream attack success rates near zero for BadEncoder, CTRL, DRUPE, and CLIP-Backdoor, while leaving clean accuracy largely intact.
  • DeDe retains high detection accuracy when the auxiliary dataset is out-of-distribution (e.g., STL-10 for encoders trained on CIFAR-10) and can tolerate slight poisoning of that dataset.
  • Existing detection baselines either require a clean base dataset (ASSET) or only handle patch-like triggers (DECREE); DeDe's reconstruction-based score avoids both constraints.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors leave implicit that an attacker who can place triggered embeddings inside the normal manifold—so the decoder's reconstruction looks plausible—would break the method; the noise-filling workaround for CTRL is already a sign that the assumption is strainable.
  • The same decoder-based inverse mapping could be applied to other self-supervised modalities (audio, text, or graph encoders) whose embeddings are clustered; a decoder trained on normal embeddings would flag anomalous embeddings from poisoned inputs.
  • DeDe's fixed threshold of 1.5 times the average training loss is a heuristic; a per-task calibration or a learned anomaly score on reconstruction errors would likely improve the true-positive/false-positive trade-off, especially for the harder BadCLIP case.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes DeDe, an inference-time detector for backdoor samples in self-supervised learning (SSL) encoders. DeDe trains an auxiliary decoder (plus a patch encoder) to reconstruct images from the victim encoder's embeddings, using a training set that can be unlabeled, out-of-distribution, or slightly poisoned. At test time, a sample is flagged as backdoor if its reconstruction error exceeds a threshold set to 1.5 times the average training loss (Algorithm 1, Eq. (2)). The authors evaluate DeDe on contrastive learning (SimCLR) and CLIP encoders against five attacks (BadEncoder, CTRL, DRUPE, CLIP-Backdoor, BadCLIP) and compare it with DECREE and ASSET. The main reported results show high AUC (mostly above 0.9) across attacks and datasets, with better downstream attack-success-rate reduction than ASSET. The paper also reports additional results for unbalanced data and OOD auxiliary datasets in the appendix.

Significance. If the claimed detection performance is robust, DeDe would be a practically useful defense: it operates at inference time, does not require labels, and does not modify the victim encoder. The paper provides a clear algorithm, public code, and extensive experiments on multiple attack families, which are strengths. However, the central claim of universality—that DeDe detects backdoor activation without any attack-specific knowledge—is weakened by the special handling required for the CTRL attack (Section 5.1) and by the absence of a characterization of when the reconstruction-failure assumption holds. The lack of error bars and the modified DECREE baseline also make the quantitative comparisons less conclusive. The idea itself is novel and worth publishing, but the current empirical and theoretical support is not yet sufficient to substantiate the strongest claims in the paper.

major comments (5)
  1. [Section 5.1, "Auxiliary Explanation"] The CTRL attack requires two attack-specific adjustments: filling out-of-distribution embedding regions with random noise image embeddings and reducing the training masking ratio from 0.9 to 0.75. This directly contradicts the contribution stated in Section 1 that DeDe "requires no prior information regarding the victim encoder or the type of backdoor trigger." If the defender must know that the embedding distribution is sparse and OOD (and must know a norm-ball radius to fill), then the method is not agnostic to the attack. Please either remove the universality claim or provide a principled, attack-agnostic way to choose these hyperparameters, with ablation results showing the performance of DeDe under default settings on CTRL.
  2. [Algorithm 1 and Eq. (2), threshold τ = 1.5 × training loss] The detection threshold is set as a fixed multiplier of the average training reconstruction loss. The paper reports TPR/FPR at this threshold, but gives no justification for the factor 1.5 and no analysis of how sensitive the reported operating points are to this choice across datasets, attacks, and OOD auxiliary data. Since the threshold is load-bearing for the binary detection decision, please report ROC curves with confidence bands, or provide a sensitivity analysis over a range of threshold multipliers, and clarify whether the TPR/FPR values in Tables 1 and 3 are evaluated at τ = 1.5× or at the default scikit-learn threshold.
  3. [Section 5.1, "Detection models" and Table 1] The DECREE comparison does not use DECREE's original detection criterion. The paper states that DECREE "fails to detect any backdoor samples during testing" and therefore the authors compute the ℓ2 norm between the optimized trigger and the image data within the trigger region, using that norm as the detection score. This is a modified baseline, and it is unclear whether the modification is equivalent to DECREE's intended use or favorable to DeDe. Please report DECREE's original scores and, if a modification is necessary, justify that it is a faithful adaptation. Otherwise the claim of "superior performance compared over state-of-the-art detection methods" is not fully supported.
  4. [Tables 1–5 and Appendix B] All experimental results are reported as single numbers without error bars or the number of random seeds. Given that ASSET's best epoch is selected for comparison and that DeDe's hyperparameters (masking ratio, patch size, noise-filling radius) are tuned per attack, the reported margins could be within run-to-run variance. Please report mean and standard deviation over at least three independent runs for the main tables, and state the seed/selection protocol for all baselines.
  5. [Section 4.2, Key Idea] The core assumption is that a triggered image mapped to a target-class embedding will be reconstructed by the decoder as something visually inconsistent with the input. The paper gives an intuitive "image space is sparse" argument but does not characterize when this holds. In particular, if the source and target classes are visually similar (e.g., cat→dog on CIFAR-10), the decoder may reconstruct a dog-like image from the target embedding, and at a high testing masking ratio (α = 0.99) the reconstruction may remain close enough to the cat input to fall below the threshold. Please add an experiment that varies source/target visual similarity, or otherwise provide evidence that DeDe's separation holds beyond the specific attack configurations tested. Without such evidence, the claim of detecting "any triggered input" (Section 1) is overstated.
minor comments (5)
  1. [Algorithm 1] The line "α ← min(1.1 · α, 1.0)" appears inside the training loop, but the intended use is to increase the masking ratio only at test time. Please move this update out of the loop or clarify the semantics, and define the exact test-time masking ratio used in Eq. (2) (e.g., α = 0.99 when training uses α = 0.9).
  2. [Table 1 and text] The paper says "DEDE OoD" uses STL-10 as a consistent OOD dataset, but the results are mixed: for BadCLIP the OOD AUC is 0.798 in Table 1 vs. 0.925 in-distribution, while for BadEncoder OOD AUC is higher. The text states DeDe maintains high performance with OOD data, but this inconsistency should be discussed or explained.
  3. [Section 5.1, Datasets] The claim that the DeDe training dataset "can be even slightly poisoned" is not directly tested. Table 1 and Table 3 vary the test-set poisoning rate, but the auxiliary training set is described as clean. Please either add an experiment with a slightly poisoned auxiliary set or temper the claim.
  4. [Figure 5 caption] The caption is confusing: it says the left side and right side are attacked by DRUPE and CLIP-Backdoor respectively, then says the six columns are three clean and three poisoned. Please rewrite to clearly describe which columns correspond to which attack and which are clean/poisoned.
  5. [Appendix B, Table 6] The appendix states reconstruction results are "generally stable for different choices of patch size and masking ratio," but no quantitative comparison is shown. Please include the ablation table or reference a figure that supports this claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DeDe's decoder-based detector is trained on auxiliary data and validated against external attacks, not derived from its own outputs.

full rationale

DeDe's claimed derivation is that a triggered input, mapped by a backdoored encoder into a foreign embedding region, will reconstruct poorly through a decoder trained to invert the encoder's normal mapping. This is an empirical hypothesis, not a definitional equivalence. The detector's decision rule (Eq. 2) computes reconstruction error directly from the trained decoder and input; the threshold tau is a fixed 1.5x average training loss, not a parameter fitted to backdoor labels to force the reported TPR/AUC. The decoder is trained on auxiliary data (possibly containing <1% poisoned samples) with no use of backdoor labels, and the method is evaluated on five externally implemented attacks (BadEncoder, CTRL, DRUPE, CLIP-Backdoor, BadCLIP) against independent detectors (DECREE, ASSET). References to MAE, DECREE, ASSET, and the attack papers are independent prior work, not self-citations, and the authors provide code. The paper's vulnerability—that reconstruction-failure may not hold for all attacks, evidenced by the CTRL special-casing (filling OOD regions with noise embeddings, reducing mask ratio to 0.75)—is a correctness/robustness limitation, not circularity. No load-bearing step reduces by construction to its own input, so the analysis is self-contained and non-circular.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The method rests on empirical assumptions about embedding geometry and decoder reconstruction behavior rather than on new physical entities. The free parameters are primarily hyperparameters and one attack-specific adjustment (CTRL noise filling). The threshold multiplier and masking ratio are not fitted to test data but are chosen by hand.

free parameters (4)
  • masking_ratio_alpha = 0.9 default, 0.75 for CTRL
    Controls how much image information is hidden during decoder training and testing. Chosen by hand; the paper notes stability over [0.75, 0.95] but uses a different value for CTRL.
  • threshold_multiplier = 1.5
    Sets the detection threshold as 1.5 times the average training reconstruction loss. Chosen by hand; directly affects TPR/FPR but not AUC.
  • patch_size = 4 to 32
    Patch size for the decoder input, chosen based on image resolution (32x32 for CL, 224x224 for CLIP). The paper gives only a range, not a precise selection rule.
  • CTRL_norm_ball_radius = 0.99 quantile of embedding norms
    For the CTRL attack, embeddings outside a norm ball are filled with random noise to improve decoder training. This is an attack-specific adjustment.
assumptions (3)
  • domain assumption SSL encoders map images with similar features to clustered embedding regions.
    Used in Section 4.2 to argue that normal embeddings correspond to interpretable image regions; supported only by t-SNE visualizations in Appendix A, not by a formal guarantee.
  • ad hoc to paper The image space is much more sparse than the embedding space, so condensed embeddings are unlikely to preserve a backdoor-distribution image.
    Stated in Section 4.2 as a heuristic justification; no formal measure of sparsity is given.
  • ad hoc to paper Backdoor embeddings lie outside or across the normal embedding clusters, so a decoder trained on clean data will fail to reconstruct triggered inputs.
    This is the key hypothesis behind DeDe; it is tested empirically but not proven. It fails to fully hold for CTRL, which needed special handling.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders." pith.science (2026). https://pith.science/paper/IT5DNTGB

@misc{pith2026241116154,
  author       = {Pith},
  title        = {Pith review of: DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IT5DNTGB}},
  note         = {Machine review of arXiv:2411.16154}
}
read the original abstract

Self-supervised learning (SSL) is pervasively exploited in training high-quality upstream encoders with a large amount of unlabeled data. However, it is found to be susceptible to backdoor attacks merely via polluting a small portion of training data. The victim encoders associate triggered inputs with target embeddings, e.g., mapping a triggered cat image to an airplane embedding, such that the downstream tasks inherit unintended behaviors when the trigger is activated. Emerging backdoor attacks have shown great threats across different SSL paradigms such as contrastive learning and CLIP, yet limited research is devoted to defending against such attacks, and existing defenses fall short in detecting advanced stealthy backdoors. To address the limitations, we propose a novel detection mechanism, DeDe, which detects the activation of backdoor mappings caused by triggered inputs on victim encoders. Specifically, DeDe trains a decoder for any given SSL encoder using an auxiliary dataset (which can be out-of-distribution or even slightly poisoned), so that for any triggered input that misleads the encoder into the target embedding, the decoder generates an output image significantly different from the input. DeDe leverages the discrepancy between the input and the decoded output to identify potential backdoor misbehavior during inference. We empirically evaluate DeDe on both contrastive learning and CLIP models against various types of backdoor attacks. Our results demonstrate promising detection effectiveness over various advanced attacks and superior performance compared over state-of-the-art detection methods.

Figures

Figures reproduced from arXiv: 2411.16154 by the authors.

Figure 1
Figure 1. Embedding Visualizations. lays it onto different backgrounds to augment the image, thereby improving the effectiveness of the attack. Some at￾tacks [25, 34] propose approaches with additional informa￾tion to inject the backdoor into the SSL model. Specifically, [33] poisons images within a specific category and groups them during SSL training, resulting in misclassification by the downstream classifier in subsequent… view at source ↗
Figure 2
Figure 2. The Workflow of DeDe. To testify to the assertion and substantiate the challenge of stealthy backdoors, we provide a visualization of the em￾beddings associated with certain SSL backdoor attacks in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The Learning Goal for Decoder of DeDe. training data is known but any publicly available dataset can serve as an auxiliary dataset. Detection Goal. We assume that the attacker has already implemented the backdoor into the pre-trained encoder. How the backdoor is implemented and what type of trigger is both are agnostic. As a victim encoder needs to inter￾act with a triggered sample to cause a backdoor behavior, we p… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Discussion for CTRL Attack address the issue by filling the out-of-distribution regions with random noise image embeddings, where we define the region outside a norm ball with radius of 0.99 quantiles in embedding norms. Furthermore, the training masking ratio for CTRL…
Figure 5
Figure 5. Figure 5: Reconstruction of DeDe. The left side and the right side [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: t-SNE visualization of embeddings in different SSLs [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 36 canonical work pages

  1. [1]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy Alexey. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv: 2010.11929, 2020. 7

    arXiv 2010

  2. [2]

    Badclip: Trigger-aware prompt learning for backdoor attacks on clip

    Jiawang Bai, Kuofeng Gao, Shaobo Min, Shu-Tao Xia, Zhifeng Li, and Wei Liu. Badclip: Trigger-aware prompt learning for backdoor attacks on clip. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24239–24250,

    work page

  3. [3]

    Cleanclip: Mit- igating data poisoning attacks in multimodal con- trastive learning

    Hritik Bansal, Nishad Singhi, Yu Yang, Fan Yin, Aditya Grover, and Kai-Wei Chang. Cleanclip: Mit- igating data poisoning attacks in multimodal con- trastive learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 112–123, 2023. 3

    work page 2023

  4. [4]

    Poisoning and backdooring contrastive learning

    Nicholas Carlini and Andreas Terzis. Poisoning and backdooring contrastive learning. arXiv preprint arXiv:2106.09667, 2021. 2, 3, 6

    arXiv 2021

  5. [5]

    A simple framework for con- trastive learning of visual representations

    Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for con- trastive learning of visual representations. In Interna- tional conference on machine learning , pages 1597–

  6. [6]

    Targeted backdoor attacks on deep learn- ing systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learn- ing systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017. 1

    arXiv 2017

  7. [7]

    Improved baselines with momentum contrastive learning

    Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297, 2020. 2

    arXiv 2003

  8. [8]

    An anal- ysis of single-layer networks in unsupervised feature learning

    Adam Coates, Andrew Ng, and Honglak Lee. An anal- ysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth interna- tional conference on artificial intelligence and statis- tics, pages 215–223. JMLR Workshop and Conference Proceedings, 2011. 7

    work page 2011

Show all 44 references
  1. [9]

    Imagenet: A large-scale hierarchi- cal image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchi- cal image database. In 2009 IEEE conference on com- puter vision and pattern recognition , pages 248–255. Ieee, 2009. 7

    2009

  2. [10]

    Backdoor at- tack with imperceptible input and latent modification

    Khoa Doan, Yingjie Lao, and Ping Li. Backdoor at- tack with imperceptible input and latent modification. Advances in Neural Information Processing Systems , 34:18944–18957, 2021. 1, 4

    2021

  3. [11]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF interna- tional conference on computer vision , pages 11966– 11976, 2021. 1

    2021

  4. [12]

    Detecting back- doors in pre-trained encoders

    Shiwei Feng, Guanhong Tao, Siyuan Cheng, Guangyu Shen, Xiangzhe Xu, Yingqi Liu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang. Detecting back- doors in pre-trained encoders. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 16352–1636...

    2023

  5. [13]

    Detecting back- doors in pre-trained encoders

    Shiwei Feng, Guanhong Tao, Siyuan Cheng, Guangyu Shen, Xiangzhe Xu, Yingqi Liu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang. Detecting back- doors in pre-trained encoders. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 16352–1636...

    2023

  6. [14]

    Backdoor attacks and countermeasures on deep learning: A comprehensive review

    Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jil- iang Zhang, Anmin Fu, Surya Nepal, and Hyoung- shick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760, 2020. 1

    2007 arXiv

  7. [15]

    Self-supervised learn- ing of visual features through embedding images into text topic spaces

    Lluis Gomez, Yash Patel, Marc ¸al Rusinol, Dimosthe- nis Karatzas, and CV Jawahar. Self-supervised learn- ing of visual features through embedding images into text topic spaces. In Proceedings of the ieee con- ference on computer vision and pattern recognition , pages 4230–423...

    2017

  8. [16]

    A survey on self- supervised learning: Algorithms, applications, and fu- ture trends

    Jie Gui, Tuo Chen, Jing Zhang, Qiong Cao, Zhenan Sun, Hao Luo, and Dacheng Tao. A survey on self- supervised learning: Algorithms, applications, and fu- ture trends. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 1, 2

    2024

  9. [17]

    Indiscriminate poisoning attacks on unsupervised contrastive learn- ing

    Hao He, Kaiwen Zha, and Dina Katabi. Indiscriminate poisoning attacks on unsupervised contrastive learn- ing. arXiv preprint arXiv:2202.11202, 2022. 3

    2022 arXiv

  10. [18]

    Momentum contrast for unsupervised visual representation learning

    Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9729–9738, 2020. 1

    2020

  11. [19]

    Masked autoencoders are scalable vision learners

    Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Doll´ar, and Ross Girshick. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16000–16009, 2022. 1, 2, 5, 7

    2022

  12. [20]

    Detection of traffic signs in real-world images: The German Traf- fic Sign Detection Benchmark

    Sebastian Houben, Johannes Stallkamp, Jan Salmen, Marc Schlipsing, and Christian Igel. Detection of traffic signs in real-world images: The German Traf- fic Sign Detection Benchmark. In International Joint Conference on Neural Networks, number 1288, 2013. 7

    2013

  13. [21]

    Generalized odin: Detecting out-of-distribution image without learning from out-of-distribution data

    Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of-distribution image without learning from out-of-distribution data. In Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition , pages 10951– 10960, 2020. 3

    2020

  14. [22]

    A survey on contrastive self-supervised learning

    Ashish Jaiswal, Ashwin Ramesh Babu, Moham- mad Zaki Zadeh, Debapriya Banerjee, and Fillia Makedon. A survey on contrastive self-supervised learning. Technologies, 9(1):2, 2020. 1, 2

    2020

  15. [23]

    Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning

    Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In 2022 IEEE Sympo- sium on Security and Privacy (SP), pages 2043–2059. IEEE, 2022. 1, 2, 3, 4, 6

    2022

  16. [24]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 7

    2009

  17. [25]

    An embar- rassingly simple backdoor attack on self-supervised learning

    Changjiang Li, Ren Pang, Zhaohan Xi, Tianyu Du, Shouling Ji, Yuan Yao, and Ting Wang. An embar- rassingly simple backdoor attack on self-supervised learning. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision , pages 4367– 4378, 2023. 1, 3, 4, 6

    2023

  18. [26]

    On the dif- ficulty of defending contrastive learning against back- door attacks

    Changjiang Li, Ren Pang, Bochuan Cao, Zhaohan Xi, Jinghui Chen, Shouling Ji, and Ting Wang. On the dif- ficulty of defending contrastive learning against back- door attacks. In 33rd USENIX Security Symposium (USENIX Security 24), pages 2901–2918, 2024. 4

    2024

  19. [27]

    Badclip: Dual- embedding guided backdoor attack on multimodal contrastive learning

    Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badclip: Dual- embedding guided backdoor attack on multimodal contrastive learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, pages 24645–24654, 20...

    2024

  20. [28]

    {PoisonedEncoder}: Poisoning the unlabeled pre- training data in contrastive learning

    Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. {PoisonedEncoder}: Poisoning the unlabeled pre- training data in contrastive learning. In 31st USENIX Security Symposium (USENIX Security 22) , pages 3629–3645, 2022. 3, 4

    2022

  21. [29]

    Read- ing digits in natural images with unsupervised feature learning

    Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Read- ing digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and un- supervised feature learning , page 4. Granada, 2011. 7

    2011

  22. [30]

    {ASSET}: Robust backdoor data detection across a multiplicity of deep learning paradigms

    Minzhou Pan, Yi Zeng, Lingjuan Lyu, Xue Lin, and Ruoxi Jia. {ASSET}: Robust backdoor data detection across a multiplicity of deep learning paradigms. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2725–2742, 2023. 1, 3, 4, 6, 7

    2023

  23. [31]

    Pedregosa, G

    F. Pedregosa, G. Varoquaux, A. Gramfort, V . Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V . Dubourg, J. Vanderplas, A. Passos, D. Cour- napeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Lear...

    2011

  24. [32]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sas- try, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, ...

    2021

  25. [33]

    Hidden trigger backdoor attacks

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, pages 11957–11965, 2020. 1, 3

    2020

  26. [34]

    Backdoor at- tacks on self-supervised learning

    Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, and Hamed Pirsiavash. Backdoor at- tacks on self-supervised learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13337–13346, 2022. 3, 4

    2022

  27. [35]

    Conceptual captions: A cleaned, hy- pernymed, image alt-text dataset for automatic image captioning

    Piyush Sharma, Nan Ding, Sebastian Goodman, and Radu Soricut. Conceptual captions: A cleaned, hy- pernymed, image alt-text dataset for automatic image captioning. In Proceedings of the 56th Annual Meet- ing of the Association for Computational Linguistics (Volume 1: Long Paper...

    2018

  28. [36]

    Dis- tribution preserving backdoor attack in self-supervised learning

    Guanhong Tao, Zhenting Wang, Shiwei Feng, Guangyu Shen, Shiqing Ma, and Xiangyu Zhang. Dis- tribution preserving backdoor attack in self-supervised learning. In 2024 IEEE Symposium on Security and Privacy (SP), pages 2029–2047. IEEE, 2024. 1, 3, 4, 6

    2024

  29. [37]

    Yonglong Tian, Yue Wang, Dilip Krishnan, Joshua B Tenenbaum, and Phillip Isola. Rethinking few-shot image classification: a good embedding is all you need? In Computer Vision–ECCV 2020: 16th Euro- pean Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XIV 16 , pag...

    2020

  30. [38]

    Unsupervised feature learning via non-parametric instance discrimination

    Zhirong Wu, Yuanjun Xiong, Stella X Yu, and Dahua Lin. Unsupervised feature learning via non-parametric instance discrimination. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 3733–3742, 2018. 2

    2018

  31. [39]

    Ssl- abd: An adversarial defense method against backdoor attacks in self-supervised learning

    Hui Yang, Ruilin Yang, Heqiu Cai, Xiao Zhang, Qingqi Pei, Shaowei Wang, and Hongyang Yan. Ssl- abd: An adversarial defense method against backdoor attacks in self-supervised learning. In International Conference on Artificial Intelligence Security and Pri- vacy, pages 456–467....

    2023

  32. [40]

    Openood: Benchmarking generalized out-of-distribution detec- tion

    Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng, Haoqi Wang, Guangyao Chen, Bo Li, Yiyou Sun, et al. Openood: Benchmarking generalized out-of-distribution detec- tion. Advances in Neural Information Processing Sys- tems, 35:32598–32611, 2022. 3

    2022

  33. [41]

    Generalized out-of-distribution detection: A sur- vey

    Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A sur- vey. International Journal of Computer Vision , 132 (12):5635–5662, 2024. 3

    2024

  34. [42]

    Robust contrastive language-image pre- training against data poisoning and backdoor attacks

    Wenhan Yang, Jingdong Gao, and Baharan Mirza- soleiman. Robust contrastive language-image pre- training against data poisoning and backdoor attacks. Advances in Neural Information Processing Systems , 36, 2024. 3

    2024

  35. [43]

    Data poisoning based back- door attacks to contrastive learning

    Jinghuai Zhang, Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. Data poisoning based back- door attacks to contrastive learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24357–24366, 2024. 1, 2, 4

    2024

  36. [44]

    Ssl-cleanse: Trojan detection and mitigation in self-supervised learning

    Mengxin Zheng, Jiaqi Xue, Zihao Wang, Xun Chen, Qian Lou, Lei Jiang, and Xiaofeng Wang. Ssl-cleanse: Trojan detection and mitigation in self-supervised learning. arXiv preprint arXiv:2303.09079, 2023. 3 Appendix A. Additional Visualizations There is a common property in embedd...

    2023 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.