Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Detecting Backdoor Samples in Contrastive Language Image Pretraining

T0 review · 3 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Backdoor-poisoned images in CLIP leave a geometric trace: sparse local neighborhoods that classic density-ratio outlier detectors can find.

desk verdict Solid detection result worth serious refereeing; the CC3M 'unintentional backdoor' claim needs a same-target random-init control before it's convincing. read the letter →

arxiv 2502.01385 v2 pith:J32653GE submitted 2025-02-03 cs.LG cs.CV

Hanxun Huang , Sarah Erfani , Yige Li , Xingjun Ma , James Bailey This is my paper · ORCID
classification cs.LGcs.CV
keywords backdoordetectionCLIPcontrastivelanguage-imagepretraininglocaloutlierdatapoisoningdensity-ratioSLOFDAO
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoor attacks on CLIP are dangerously cheap, succeeding with only 0.01% poisoned training samples. This paper claims that those poisoned samples inevitably leave a geometric trace: in the representation space learned by the poisoned CLIP model, every trigger-carrying image lands in a low-density pocket, surrounded mostly by clean images. That makes them detectable as local outliers by classic density-ratio methods such as distance to the k-th nearest neighbor, SLOF, and DAO, which reach 95–99.9% AUC across patch, blend, filter, and multi-trigger attacks. The paper also argues that this detector scales to million-scale web datasets, cleaning CC3M in about 15 minutes on four A100 GPUs, and that it exposes an unintentional backdoor already trained into a released OpenCLIP model.

What carries the argument

The carrying object is the local density ratio in the CLIP representation space, realized through three classic outlier scores: k-dist (distance to the k-th nearest neighbor), SLOF (simplified local outlier factor, the average ratio between a point's k-dist and its neighbors' k-dist), and DAO (dimensionality-aware outlier detection, which raises each neighbor's distance ratio to an exponent derived from local intrinsic dimensionality). These scores measure whether a point's local neighborhood is abnormally sparse relative to its neighbors; the paper's claim is that backdoor samples occupy such sparse pockets in the learned embedding, so the scores separate them from clean samples. The detector itself is a minibatch procedure: extract image and text embeddings from a trained CLIP model, compute the score of each point against a random reference batch, and rank the dataset by the score.

What would settle it

Run the k-dist, SLOF, and DAO detectors on a CLIP model poisoned with a scheme that gives each poisoned image its own unique trigger pattern (so the model cannot cluster them), and measure the detection AUC; if the AUC remains near-perfect, the sparse-neighborhood claim holds for broader trigger families, but if it collapses, the claim is specific to clustered trigger patterns and fails under per-image trigger diversity.

Watch

Extended reading notes

Core claim

The central claim is that backdoor-poisoned samples in CLIP have a much sparser local neighborhood than clean samples, making them outliers in the learned representation space. This sparsity is a direct consequence of the contrastive objective: all images carrying the same trigger share a strong common feature, so the model pushes them into a tight cluster separated from ordinary data, and at the low poisoning rates used in practice a poisoned image's k-th nearest neighbor is almost always a clean image, inflating its k-dist and local density ratio. Building on this, the paper shows that classic density-ratio local outlier detectors (SLOF and DAO) and simple k-dist scores detect poisoned samples nearly perfectly, while dedicated supervised backdoor detectors (ABL, CD) and SafeCLIP often fail. A secondary claim is that this detector, applied to the clean CC3M dataset, reveals an unintentional backdoor encoded in a birthday-cake image that appears 798 times, and that a recovered trigger from a model trained on CC3M or released by OpenCLIP achieves 92.38% and 98.92% attack success rates respectively, confirming that such triggers have already been learned into widely used models.

Load-bearing premise

The detector relies on the geometric premise that a CLIP model trained on poisoned data pushes all trigger-carrying images into a tight, isolated cluster, and that at low poisoning rates the k nearest neighbors of a poisoned sample are almost always clean samples; if a trigger is subtle, the model does not overfit to it, or the poisoning rate is high enough that poisoned samples become each other's neighbors, the outlier signal weakens or disappears.

Editorial extensions

If this is right

  • Data owners can purify a million-scale CLIP pretraining dataset by removing top-scoring outliers, dropping the attack success rate to near zero while preserving clean accuracy, since most high-scoring samples are either poisoned or already noisy.
  • Dedicated supervised backdoor detectors are not needed for CLIP; classical unsupervised outlier detection is sufficient, which simplifies the defense toolkit and makes detection feasible at web scale.
  • The same detector can serve as a data-cleaning tool for unpoisoned web datasets, removing broken images and mismatched captions that degrade CLIP performance.
  • Detecting and removing poisoned samples is, under the paper's cited theoretical equivalence, a form of robust training, so combining outlier filtering with robust objectives gives defenders a two-layer defense.
  • Unintentional backdoors in web datasets are not hypothetical: this method found one already trained into a released OpenCLIP model, so scanning datasets before pretraining becomes a practical necessity.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The sparsity signature is a property of the learned representation, not the trigger's pixel pattern; this suggests the same detection logic could transfer to other contrastive multimodal models (e.g., image-text or video-text) that cluster poisoned samples tightly by a shared shortcut feature.
  • The claim implicitly predicts that an attacker who wants to evade k-dist/SLOF/DAO must break the cluster geometry, for example by giving each poisoned image its own unique trigger or by training the model to match clean density exactly; the paper's adaptive-attack experiment accounts for only a narrow form of such evasion.
  • A testable extension is to vary the poisoning rate upward and track when the k-nearest-neighbor assumption fails; the paper shows performance degrades at 10% poisoning but recovers with larger k, suggesting that detection can be extended to high-poisoning regimes by scaling locality.
  • The unintentional-backdoor finding implies that web-scale datasets may contain many such latent triggers; a full audit would rank all recurring image-caption pairs by outlier score and reverse-engineer each, which could be run as a dataset-level scan before release.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper studies detection of backdoor-poisoned samples in CLIP pretraining. The authors observe that poisoned samples tend to have sparser local neighborhoods in the learned representation space than clean samples, and they show that classical local outlier detectors (k-dist, SLOF, DAO) achieve high detection AUC across a range of trigger types, poisoning rates, architectures, and datasets. They further demonstrate that filtering out detected outliers and retraining mitigates backdoor attacks, and they report the discovery of an unintentional backdoor in the CC3M dataset that appears to have transferred to an OpenCLIP model. The paper includes extensive experiments, a sensitivity analysis, and public code.

Significance. If the main detection claim is accepted, this is a practically valuable result: it provides a simple, scalable, and unsupervised defense against poisoning backdoor attacks on CLIP, at a time when web-scale pretraining is increasingly common. The paper's broad empirical evaluation, including multiple triggers, two architectures, and two additional datasets, is a strength, and the authors are transparent about computational cost and reproducibility limitations. The unintentional backdoor claim is potentially important for data curation practice, but it is also the most fragile part of the paper because the trigger-recovery evidence is not conclusively controlled.

major comments (3)
  1. [Section 5.3 / Appendix B.4 / Eq. (2)] The trigger recovery for the birthday cake example initializes the pattern Delta using a birthday cake image, while the control experiment in Figure 7 uses a different target ("great white shark") with random initialization. This changes both the target and the initialization, so the high ASR in the birthday cake case could be due to initialization bias rather than a genuinely learned backdoor. The authors should add a same-target random-init control, and ideally also a control on a model trained on data without the repeated birthday cake images; without such controls, the unintentional backdoor claim in Section 5.3 and the abstract is not supported.
  2. [Table 1, ViT-B-16 Clean Label row] The reported ASR is only 19.0% and the best AUC among k-dist, SLOF, and DAO is about 71.5%. This contradicts the abstract's unqualified claim that backdoor attacks can be "easily and efficiently detected" and shows that the detection is not universally reliable. The paper should qualify the central claim to reflect the cases where detection is strong, and explain how a defender should handle settings like this one (for example, by using RN50 as the detector as suggested in Section 5.1).
  3. [Section 4.2] The probabilistic argument that, at a 0.01% poisoning rate, the k-th nearest neighbor of a poisoned sample is likely clean because the probability that the rest of the batch is clean is 0.9999^1023 is not rigorous: nearest neighbors are not uniformly random draws from the batch, and if poisoned samples form a tight cluster they can be each other's nearest neighbors even at low poisoning rates. The empirical evidence in Figure 1b is more persuasive than this heuristic; the text should be revised to avoid presenting the heuristic as a probabilistic guarantee.
minor comments (6)
  1. [Section 5 / Table 1] All experiments appear to be single runs without error bars or multiple seeds; reporting AUC to two decimal places in the absence of variance estimates may overstate precision. Adding a note about the number of runs, or reporting standard deviations for a few key configurations, would improve the paper.
  2. [Abstract / Section 6] The claim that a million-scale dataset can be cleaned "within 15 minutes using 4 Nvidia A100 GPUs" refers only to the detection step; the time required to pretrain the model used for representation extraction is not included. This should be stated explicitly wherever the timing claim appears.
  3. [Table 1, ViT-B-16 rows] Several ViT-B-16 attacks (WaNet, BLTO, MT-S) have ASR values below 30%; the paper should state whether these are considered successful attacks and how the detection AUC should be interpreted when the attack itself is weak.
  4. [Figure 1(a) caption] The caption reads "The CLIP learned presentations" and should read "representations"; also, the phrase "k-th nearest neighbors" is used inconsistently and should be singular or plural consistently.
  5. [Appendix B.4 / Eq. (2)] The total variation terms TV(m) and TV(Delta) are not defined in the main text; please define the total variation operator and state the dimensions of m and Delta explicitly.
  6. [Section 5.3] The paper reports that the suspicious birthday cake images appear 798 times but does not specify the DAO score threshold or the ranking criterion used to identify them; providing this information would improve reproducibility.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the core outlier-detection claim is self-contained and benchmarked; the unintentional-backdoor evidence has a confounding initialization but is not a by-construction reduction.

full rationale

The central claim—that CLIP backdoor samples have sparse local neighborhoods and are detectable by k-dist, SLOF, and DAO—is not circular. The detectors are unsupervised; no parameter is fitted to the target detection labels, the locality k is varied and shown robust (Appendix B.2), and results are benchmarked on held-out CC3M, CC12M, and RedCaps attacks against external baselines. The sparsity premise is argued from poisoning-rate combinatorics (Section 4.2) and verified empirically, not assumed as the conclusion. Self-citations (CD, ABL, DAO, LID) are used as baselines or as definitions restated in the paper, and none is invoked as an external uniqueness theorem; removing them would not alter the main result. The one caveat is in Section 5.3 and Appendix B.4: the recovered 'unintentional backdoor' trigger is initialized with a birthday cake example and optimized to match the birthday-cake caption, so the high ASR may partly reflect initialization and objective choice rather than a data-driven backdoor. The authors themselves note the synthesis 'might appear to be similar to a targeted universal adversarial attack and might not validate that the birthday cake is a real backdoor,' and their random-target control does not hold the target fixed. This is a validity and confounding concern about a secondary empirical claim, not a by-construction equivalence between the paper's inputs and outputs, so it does not raise the circularity score.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central detection claim rests on two empirical geometric assumptions: backdoor samples cluster tightly and their neighbors are predominantly clean. The unintentional backdoor claim additionally relies on a Neural Cleanse style optimization with cake-initialized trigger, which is the most fragile part. No new particles or entities are introduced.

free parameters (3)
  • locality k = 16 (default)
    Neighborhood size for k-dist, SLOF, and DAO. The paper shows AUC remains high for k from 16 to 256 for most attacks, so it is not a sensitive fit to the target result.
  • Trigger recovery hyperparameters = alpha=0.0001, beta=70, lr=0.05, beta1=beta2=0.1, 250 steps
    Used in the Neural Cleanse style optimization for the unintentional backdoor finding; not part of the detection pipeline.
  • Per-attack poisoning rate = 0.01% to 0.1% depending on trigger and encoder
    Chosen via coarse grid search to guarantee non-trivial attack success rate (Section 5); detection quality naturally depends on this attack strength.
assumptions (4)
  • domain assumption A CLIP model trained on data containing a small fraction of trigger-carrying images will encode those images into a tight, separated cluster because the trigger is a strong shared feature.
    This is the geometric premise behind the entire detection approach. If a trigger is too subtle or the model does not overfit to it, poisoned samples may not become local outliers. Stated in Section 4.2 and Figure 1.
  • domain assumption At a 0.01% poisoning rate, the k-th nearest neighbor of a poisoned sample is almost surely a clean sample.
    This combinatorial assumption is used to argue that k-dist is large for backdoor samples; it holds only when the poisoning rate is low relative to the batch size (Section 4.2).
  • domain assumption The CLIP model and training hyperparameters (OpenCLIP, RN50/ViT-B-16, lr 0.001, weight decay 0.2, batch 1024, 30 epochs) are representative of practical CLIP pretraining.
    The detector is validated on these settings following Carlini and Terzis (2022); transfer to other training setups is plausible but not proven.
  • domain assumption The trigger recovery objective in Appendix B.4 is a valid way to recover a true backdoor trigger rather than a universal adversarial perturbation.
    This is needed for the unintentional backdoor claim in Section 5.3. The paper provides a counter-example with a random target that yields low ASR, partially supporting validity, but the cake initialization may bias the result.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Detecting Backdoor Samples in Contrastive Language Image Pretraining." pith.science (2026). https://pith.science/paper/J32653GE

@misc{pith2026250201385,
  author       = {Pith},
  title        = {Pith review of: Detecting Backdoor Samples in Contrastive Language Image Pretraining},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J32653GE}},
  note         = {Machine review of arXiv:2502.01385}
}
read the original abstract

Contrastive language-image pretraining (CLIP) has been found to be vulnerable to poisoning backdoor attacks where the adversary can achieve an almost perfect attack success rate on CLIP models by poisoning only 0.01\% of the training dataset. This raises security concerns on the current practice of pretraining large-scale models on unscrutinized web data using CLIP. In this work, we analyze the representations of backdoor-poisoned samples learned by CLIP models and find that they exhibit unique characteristics in their local subspace, i.e., their local neighborhoods are far more sparse than that of clean samples. Based on this finding, we conduct a systematic study on detecting CLIP backdoor attacks and show that these attacks can be easily and efficiently detected by traditional density ratio-based local outlier detectors, whereas existing backdoor sample detection methods fail. Our experiments also reveal that an unintentional backdoor already exists in the original CC3M dataset and has been trained into a popular open-source model released by OpenCLIP. Based on our detector, one can clean up a million-scale web dataset (e.g., CC3M) efficiently within 15 minutes using 4 Nvidia A100 GPUs. The code is publicly available in our \href{https://github.com/HanxunH/Detect-CLIP-Backdoor-Samples}{GitHub repository}.

Figures

Figures reproduced from arXiv: 2502.01385 by the authors.

Figure 1
Figure 1. (a) The CLIP learned presentations are projected into a 2-D space using t-SNE. The red [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. The distributions of the DAO detection score on poisoned CC3M using ResNet-50 as the [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. (a) Defence performance for varying filtering percentages. (b) An example of the unavail [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: Examples of the 5 different triggers used in the experiments. The patch and clean label [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]
Figure 5
Figure 5. Figure 5: The detection AUC (%) of different local outlier methods under varying locality [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: The attack success rate (ASR) and clean accuracy (CA) were evaluated using zero-shot [PITH_FULL_IMAGE:figures/full_fig_p021_6.png]
Figure 7
Figure 7. Figure 7: (a-b) The synthesized patterns with “a photo of great white shark” as the target caption. [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]
Figure 8
Figure 8. Figure 8: The t-SNE plot of the embedding space with various numbers of backdoor samples for a [PITH_FULL_IMAGE:figures/full_fig_p022_8.png]
Figure 9
Figure 9. Figure 9: The distribution of backdoor scores using ABL on the CC3M dataset. [PITH_FULL_IMAGE:figures/full_fig_p025_9.png]
Figure 10
Figure 10. Figure 10: The distribution of backdoor scores using CD on the CC3M dataset. [PITH_FULL_IMAGE:figures/full_fig_p025_10.png]
Figure 11
Figure 11. Figure 11: The distribution of backdoor scores using SafeCLIP on the CC3M dataset. [PITH_FULL_IMAGE:figures/full_fig_p026_11.png]
Figure 12
Figure 12. Figure 12: The distribution of backdoor scores using LID on the CC3M dataset. [PITH_FULL_IMAGE:figures/full_fig_p026_12.png]
Figure 13
Figure 13. Figure 13: The distribution of backdoor scores using iForest on the CC3M dataset. [PITH_FULL_IMAGE:figures/full_fig_p027_13.png]
Figure 14
Figure 14. Figure 14: The distribution of backdoor scores using [PITH_FULL_IMAGE:figures/full_fig_p027_14.png]
Figure 15
Figure 15. Figure 15: The distribution of backdoor scores using SLOF on the CC3M dataset. [PITH_FULL_IMAGE:figures/full_fig_p028_15.png]
Figure 16
Figure 16. Figure 16: The distribution of backdoor scores using DAO on the CC3M dataset. [PITH_FULL_IMAGE:figures/full_fig_p028_16.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. From Detection to Correction: Backdoor-Resilient Face Recognition via Vision-Language Trigger Detection and Noise-Based Neutralization

    cs.CV 2025-08 unverdicted novelty 5.0 of 10

    A majority vote of large vision-language models is claimed to detect backdoor triggers in face images, with calibrated noise correcting poisoned samples at 100% accuracy.

Reference graph

Works this paper leans on

114 extracted references · 58 canonical work pages · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Flamingo: a visual language model for few-shot learning

    Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: a visual language model for few-shot learning. In NeurIPS, 2022

    2022

  3. [3]

    Dimensionality-aware outlier detection: Theoretical and experimental analysis

    Alastair Anderberg, James Bailey, Ricardo JGB Campello, Michael E Houle, Henrique O Marques, Milo s Radovanovi \'c , and Arthur Zimek. Dimensionality-aware outlier detection: Theoretical and experimental analysis. In SDM, 2024

    2024

  4. [4]

    Intrinsic dimension of data representations in deep neural networks

    Alessio Ansuini, Alessandro Laio, Jakob H Macke, and Davide Zoccolan. Intrinsic dimension of data representations in deep neural networks. In NeurIPS, 2019

    2019

  5. [5]

    Openflamingo: An open-source framework for training large autoregressive vision-language models

    Anas Awadalla, Irena Gao, Josh Gardner, Jack Hessel, Yusuf Hanafy, Wanrong Zhu, Kalyani Marathe, Yonatan Bitton, Samir Gadre, Shiori Sagawa, et al. Openflamingo: An open-source framework for training large autoregressive vision-language models. arXiv preprint arXiv:2308.01390, 2023

    arXiv 2023

  6. [6]

    Blind backdoors in deep learning models

    Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. In USENIX Security, 2021

    2021

  7. [7]

    Cleanclip: Mitigating data poisoning attacks in multimodal contrastive learning

    Hritik Bansal, Nishad Singhi, Yu Yang, Fan Yin, Aditya Grover, and Kai-Wei Chang. Cleanclip: Mitigating data poisoning attacks in multimodal contrastive learning. arXiv preprint arXiv:2303.03323, 2023

    arXiv 2023

  8. [8]

    VICR eg: Variance-invariance-covariance regularization for self-supervised learning

    Adrien Bardes, Jean Ponce, and Yann LeCun. VICR eg: Variance-invariance-covariance regularization for self-supervised learning. In ICLR, 2022

    2022

Show all 114 references
  1. [9]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In ICIP, 2019

    2019

  2. [10]

    Improving image generation with better captions

    James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al. Improving image generation with better captions. 2023

    2023

  3. [11]

    Poisoning attacks against support vector machines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. arXiv preprint arXiv:1206.6389, 2012

    2012 arXiv

  4. [12]

    Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff

    Eitan Borgnia, Valeriia Cherepanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, and Arjun Gupta. Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff. In ICASSP, 2021

    2021

  5. [13]

    Food-101--mining discriminative components with random forests

    Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101--mining discriminative components with random forests. In ECCV, 2014

    2014

  6. [14]

    Lof: identifying density-based local outliers

    Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and J \"o rg Sander. Lof: identifying density-based local outliers. In SIGMOD, 2000

    2000

  7. [15]

    On the evaluation of unsupervised outlier detection: measures, datasets, and an empirical study

    Guilherme O Campos, Arthur Zimek, J \"o rg Sander, Ricardo JGB Campello, Barbora Micenkov \'a , Erich Schubert, Ira Assent, and Michael E Houle. On the evaluation of unsupervised outlier detection: measures, datasets, and an empirical study. Data Min. Knowl. Disc., 2016

    2016

  8. [16]

    Poisoning and backdooring contrastive learning

    Nicholas Carlini and Andreas Terzis. Poisoning and backdooring contrastive learning. In ICLR, 2022

    2022

  9. [17]

    Poisoning web-scale training datasets is practical

    Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tram \`e r. Poisoning web-scale training datasets is practical. In S&P, 2024

    2024

  10. [18]

    Emerging properties in self-supervised vision transformers

    Mathilde Caron, Hugo Touvron, Ishan Misra, Herv \'e J \'e gou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In ICCV, 2021

    2021

  11. [19]

    Conceptual 12m: Pushing web-scale image-text pre-training to recognize long-tail visual concepts

    Soravit Changpinyo, Piyush Sharma, Nan Ding, and Radu Soricut. Conceptual 12m: Pushing web-scale image-text pre-training to recognize long-tail visual concepts. In CVPR, 2021

    2021

  12. [20]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018

    2018 arXiv

  13. [21]

    Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks

    Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In IJCAI, 2019

    2019

  14. [22]

    Effective backdoor defense by exploiting sensitivity of poisoned samples

    Weixin Chen, Baoyuan Wu, and Haoqian Wang. Effective backdoor defense by exploiting sensitivity of poisoned samples. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), NeurIPS, 2022

    2022

  15. [23]

    Exploring simple siamese representation learning

    Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In CVPR, 2021

    2021

  16. [24]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  17. [25]

    Deep feature space trojan attack of neural networks by controlled detoxification

    Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of neural networks by controlled detoxification. arXiv preprint arXiv:2012.11212, 2020

    2012 arXiv

  18. [26]

    Learning a similarity metric discriminatively, with application to face verification

    Sumit Chopra, Raia Hadsell, and Yann LeCun. Learning a similarity metric discriminatively, with application to face verification. In CVPR, 2005

    2005

  19. [27]

    An analysis of single-layer networks in unsupervised feature learning

    Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In AISTATS, 2011

    2011

  20. [28]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009

    2009

  21. [29]

    Redcaps: Web-curated image-text data created by the people, for the people

    Karan Desai, Gaurav Kaul, Zubin Trivadi Aysola, and Justin Johnson. Redcaps: Web-curated image-text data created by the people, for the people. In NeurIPS Datasets and Benchmarks Track, 2021

    2021

  22. [30]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In ICCV, 2021

    2021

  23. [31]

    Collider: A robust training framework for backdoor data

    Hadi Mohaghegh Dolatabadi, Sarah Erfani, and Christopher Leckie. Collider: A robust training framework for backdoor data. In ACCV, 2022

    2022

  24. [32]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at...

    2021

  25. [33]

    Detecting backdoors in pre-trained encoders

    Shiwei Feng, Guanhong Tao, Siyuan Cheng, Guangyu Shen, Xiangzhe Xu, Yingqi Liu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang. Detecting backdoors in pre-trained encoders. In CVPR, 2023

    2023

  26. [34]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In ACSAC, 2019

    2019

  27. [35]

    Histogram-based outlier score (hbos): A fast unsupervised anomaly detection algorithm

    Markus Goldstein and Andreas Dengel. Histogram-based outlier score (hbos): A fast unsupervised anomaly detection algorithm. KI-2012: poster and demo track, 2012

    2012

  28. [36]

    On the intrinsic dimensionality of image representations

    Sixue Gong, Vishnu Naresh Boddeti, and Anil K Jain. On the intrinsic dimensionality of image representations. In CVPR, 2019

    2019

  29. [37]

    Bootstrap your own latent-a new approach to self-supervised learning

    Jean-Bastien Grill, Florian Strub, Florent Altch \'e , Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to self-supervised learning. NeurIPS, 2020

    2020

  30. [38]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  31. [39]

    Dimensionality reduction by learning an invariant mapping

    Raia Hadsell, Sumit Chopra, and Yann LeCun. Dimensionality reduction by learning an invariant mapping. In CVPR, 2006

    2006

  32. [40]

    Defense against backdoor attacks via robust covariance estimation

    Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Defense against backdoor attacks via robust covariance estimation. In ICML, 2021

    2021

  33. [41]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016

    2016

  34. [42]

    IBD - PSC : Input-level backdoor detection via parameter-oriented scaling consistency

    Linshan Hou, Ruili Feng, Zhongyun Hua, Wei Luo, Leo Yu Zhang, and Yiming Li. IBD - PSC : Input-level backdoor detection via parameter-oriented scaling consistency. In ICML, 2024

    2024

  35. [43]

    Local intrinsic dimensionality I : an extreme-value-theoretic foundation for similarity applications

    Michael E Houle. Local intrinsic dimensionality I : an extreme-value-theoretic foundation for similarity applications. In SISAP, 2017

    2017

  36. [44]

    On the correlation between local intrinsic dimensionality and outlierness

    Michael E Houle, Erich Schubert, and Arthur Zimek. On the correlation between local intrinsic dimensionality and outlierness. In SISAP, 2018

    2018

  37. [45]

    Trigger hunting with a topological prior for trojan detection

    Xiaoling Hu, Xiao Lin, Michael Cogswell, Yi Yao, Susmit Jha, and Chao Chen. Trigger hunting with a topological prior for trojan detection. In ICLR, 2022

    2022

  38. [46]

    Distilling cognitive backdoor patterns within an image

    Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, and James Bailey. Distilling cognitive backdoor patterns within an image. In ICLR, 2023

    2023

  39. [47]

    Hanxun Huang, Ricardo J. G. B. Campello, Sarah Monazam Erfani, Xingjun Ma, Michael E. Houle, and James Bailey. Ldreg: Local dimensionality regularized self-supervised learning. In ICLR, 2024

    2024

  40. [48]

    Backdoor defense via decoupling the training process

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In ICLR, 2022

    2022

  41. [49]

    Openclip, 2021

    Gabriel Ilharco, Mitchell Wortsman, Ross Wightman, Cade Gordon, Nicholas Carlini, Rohan Taori, Achal Dave, Vaishaal Shankar, Hongseok Namkoong, John Miller, Hannaneh Hajishirzi, Ali Farhadi, and Ludwig Schmidt. Openclip, 2021. URL https://github.com/mlfoundations/open_clip

    2021

  42. [50]

    Scaling up visual and vision-language representation learning with noisy text supervision

    Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoc Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision-language representation learning with noisy text supervision. In ICML, 2021

    2021

  43. [51]

    Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning

    Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In S&P, 2022

    2022

  44. [52]

    Bayesian estimation approaches for local intrinsic dimensionality

    Zaher Joukhadar, Hanxun Huang, Sarah Monazam Erfani, Ricardo JGB Campello, Michael E Houle, and James Bailey. Bayesian estimation approaches for local intrinsic dimensionality. In SISAP, 2024

    2024

  45. [53]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  46. [54]

    Universal litmus patterns: Revealing backdoor attacks in cnns

    Soheil Kolouri, Aniruddha Saha, Hamed Pirsiavash, and Heiko Hoffmann. Universal litmus patterns: Revealing backdoor attacks in cnns. In CVPR, 2020

    2020

  47. [55]

    Collecting a large-scale dataset of fine-grained cars

    Jonathan Krause, Jia Deng, Michael Stark, and Li Fei-Fei. Collecting a large-scale dataset of fine-grained cars. 2013

    2013

  48. [56]

    Angle-based outlier detection in high-dimensional data

    Hans-Peter Kriegel, Matthias Schubert, and Arthur Zimek. Angle-based outlier detection in high-dimensional data. In KDD, 2008

    2008

  49. [57]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  50. [58]

    Adversarial backdoor defense in clip

    Junhao Kuang, Siyuan Liang, Jiawei Liang, Kuanrong Liu, and Xiaochun Cao. Adversarial backdoor defense in clip. arXiv preprint arXiv:2409.15968, 2024

    2024 arXiv

  51. [59]

    Outlier detection with kernel density functions

    Longin Jan Latecki, Aleksandar Lazarevic, and Dragoljub Pokrajac. Outlier detection with kernel density functions. In MLDM, 2007

    2007

  52. [60]

    Feature bagging for outlier detection

    Aleksandar Lazarevic and Vipin Kumar. Feature bagging for outlier detection. In KDD, 2005

    2005

  53. [61]

    Maximum likelihood estimation of intrinsic dimension

    Elizaveta Levina and Peter Bickel. Maximum likelihood estimation of intrinsic dimension. NeurIPS, 2004

    2004

  54. [62]

    An embarrassingly simple backdoor attack on self-supervised learning

    Changjiang Li, Ren Pang, Zhaohan Xi, Tianyu Du, Shouling Ji, Yuan Yao, and Ting Wang. An embarrassingly simple backdoor attack on self-supervised learning. In ICCV, 2023

    2023

  55. [63]

    On the difficulty of defending contrastive learning against backdoor attacks

    Changjiang Li, Ren Pang, Bochuan Cao, Zhaohan Xi, Jinghui Chen, Shouling Ji, and Ting Wang. On the difficulty of defending contrastive learning against backdoor attacks. In USENIX Security, 2024 a

    2024

  56. [64]

    Supervision exists everywhere: A data efficient contrastive language-image pre-training paradigm

    Yangguang Li, Feng Liang, Lichen Zhao, Yufeng Cui, Wanli Ouyang, Jing Shao, Fengwei Yu, and Junjie Yan. Supervision exists everywhere: A data efficient contrastive language-image pre-training paradigm. In ICLR, 2022 a

    2022

  57. [65]

    Anti-backdoor learning: Training clean models on poisoned data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. NeurIPS, 2021

    2021

  58. [66]

    Multi-trigger backdoor attacks: More triggers, more threats

    Yige Li, Xingjun Ma, Jiabo He, Hanxun Huang, and Yu-Gang Jiang. Multi-trigger backdoor attacks: More triggers, more threats. arXiv preprint arXiv:2401.15295, 2024 b

    2024

  59. [67]

    Rethinking the trigger of backdoor attack

    Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692, 2020

    2004 arXiv

  60. [68]

    Ecod: Unsupervised outlier detection using empirical cumulative distribution functions

    Zheng Li, Yue Zhao, Xiyang Hu, Nicola Botta, Cezar Ionescu, and George Chen. Ecod: Unsupervised outlier detection using empirical cumulative distribution functions. IEEE Transactions on Knowledge and Data Engineering, 2022 b

    2022

  61. [69]

    Composite backdoor attack for deep neural network by mixing existing benign features

    Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang. Composite backdoor attack for deep neural network by mixing existing benign features. In CCS, 2020

    2020

  62. [70]

    Isolation forest

    Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In ICDM, 2008

    2008

  63. [71]

    Visual instruction tuning

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. In NeurIPS, 2023

    2023

  64. [72]

    \ PoisonedEncoder \ : Poisoning the unlabeled pre-training data in contrastive learning

    Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. \ PoisonedEncoder \ : Poisoning the unlabeled pre-training data in contrastive learning. In USENIX Security, 2022

    2022

  65. [73]

    Trojaning attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In NDSS, 2018

    2018

  66. [74]

    Abs: Scanning neural networks for back-doors by artificial brain stimulation

    Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. Abs: Scanning neural networks for back-doors by artificial brain stimulation. In CCS, 2019

    2019

  67. [75]

    Reflection backdoor: A natural backdoor attack on deep neural networks

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In ECCV, 2020

    2020

  68. [76]

    Decoupled weight decay regularization

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In ICLR, 2019

    2019

  69. [77]

    Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Michael E

    Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Michael E. Houle, Dawn Song, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In ICLR, 2018 a

    2018

  70. [78]

    Dimensionality-driven learning with noisy labels

    Xingjun Ma, Yisen Wang, Michael E Houle, Shuo Zhou, Sarah Erfani, Shutao Xia, Sudanthi Wijewickrema, and James Bailey. Dimensionality-driven learning with noisy labels. In ICML, 2018 b

    2018

  71. [79]

    Excess capacity and backdoor poisoning

    Naren Sarayu Manoj and Avrim Blum. Excess capacity and backdoor poisoning. In NeurIPS, 2021

    2021

  72. [80]

    Wanet - imperceptible warping-based backdoor attack

    Tuan Anh Nguyen and Anh Tuan Tran. Wanet - imperceptible warping-based backdoor attack. In ICLR, 2021

    2021

  73. [81]

    Bdetclip: Multimodal prompting contrastive test-time backdoor detection

    Yuwei Niu, Shuo He, Qi Wei, Zongyu Wu, Feng Liu, and Lei Feng. Bdetclip: Multimodal prompting contrastive test-time backdoor detection. arXiv preprint arXiv:2405.15269, 2024

    2024

  74. [82]

    Loci: Fast outlier detection using the local correlation integral

    Spiros Papadimitriou, Hiroyuki Kitagawa, Phillip B Gibbons, and Christos Faloutsos. Loci: Fast outlier detection using the local correlation integral. In ICDE, 2003

    2003

  75. [83]

    Incremental local outlier detection for data streams

    Dragoljub Pokrajac, Aleksandar Lazarevic, and Longin Jan Latecki. Incremental local outlier detection for data streams. In Symposium on computational intelligence and data mining, 2007

    2007

  76. [84]

    The intrinsic dimension of images and its impact on learning

    Phil Pope, Chen Zhu, Ahmed Abdelkader, Micah Goldblum, and Tom Goldstein. The intrinsic dimension of images and its impact on learning. In ICLR, 2021

    2021

  77. [85]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In ICML, 2021

    2021

  78. [86]

    Efficient algorithms for mining outliers from large data sets

    Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining outliers from large data sets. In SIGMOD, 2000

    2000

  79. [87]

    Fast memory efficient local outlier detection in data streams

    Mahsa Salehi, Christopher Leckie, James C Bezdek, Tharshan Vaithianathan, and Xuyun Zhang. Fast memory efficient local outlier detection in data streams. Transactions on Knowledge and Data Engineering, 2016

    2016

  80. [88]

    A new algorithm for detecting outliers in linear regression

    Mehmet Hakan Satman. A new algorithm for detecting outliers in linear regression. International Journal of statistics and Probability, 2013

    2013

  81. [89]

    Local outlier detection reconsidered: a generalized view on locality with applications to spatial, video, and network outlier detection

    Erich Schubert, Arthur Zimek, and Hans-Peter Kriegel. Local outlier detection reconsidered: a generalized view on locality with applications to spatial, video, and network outlier detection. Data Min. Knowl. Disc., 2014

    2014

  82. [90]

    Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning

    Piyush Sharma, Nan Ding, Sebastian Goodman, and Radu Soricut. Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning. In ACL, 2018

    2018

  83. [91]

    Manipulating sgd with data ordering attacks

    Ilia Shumailov, Zakhar Shumaylov, Dmitry Kazhdan, Yiren Zhao, Nicolas Papernot, Murat A Erdogdu, and Ross Anderson. Manipulating sgd with data ordering attacks. NeurIPS, 2021

    2021

  84. [92]

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural networks, 2012

    2012

  85. [93]

    Backdoor contrastive learning via bi-level trigger optimization

    Weiyu Sun, Xinyu Zhang, Hao LU, Ying-Cong Chen, Ting Wang, Jinghui Chen, and Lu Lin. Backdoor contrastive learning via bi-level trigger optimization. In ICLR, 2024

    2024

  86. [94]

    Demon in the variant: Statistical analysis of \ DNNs \ for robust backdoor contamination detection

    Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. Demon in the variant: Statistical analysis of \ DNNs \ for robust backdoor contamination detection. In USENIX Security, 2021

    2021

  87. [95]

    Enhancing effectiveness of outlier detections for low density patterns

    Jian Tang, Zhixiang Chen, Ada Wai-Chee Fu, and David W Cheung. Enhancing effectiveness of outlier detections for low density patterns. In PAKDD, pp.\ 535--548, 2002

    2002

  88. [96]

    Distribution preserving backdoor attack in self-supervised learning

    Guanhong Tao, Zhenting Wang, Shiwei Feng, Guangyu Shen, Shiqing Ma, and Xiangyu Zhang. Distribution preserving backdoor attack in self-supervised learning. In S&P, 2023

    2023

  89. [97]

    Spectral signatures in backdoor attacks

    Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. NeurIPS, 2018

    2018

  90. [98]

    Clean-label backdoor attacks

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks. 2018

    2018

  91. [99]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. NeurIPS, 2017

    2017

  92. [100]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In S&P, 2019

    2019

  93. [101]

    Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning

    Zhenting Wang, Juan Zhai, and Shiqing Ma. Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In CVPR, 2022

    2022

  94. [102]

    Backdoor attacks against deep learning systems in the physical world

    Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y Zhao. Backdoor attacks against deep learning systems in the physical world. In CVPR, 2021

    2021

  95. [103]

    Detecting ai trojans using meta neural analysis

    Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A Gunter, and Bo Li. Detecting ai trojans using meta neural analysis. In S&P, 2021

    2021

  96. [104]

    Robust contrastive language-image pretraining against data poisoning and backdoor attacks

    Wenhan Yang, Jingdong Gao, and Baharan Mirzasoleiman. Robust contrastive language-image pretraining against data poisoning and backdoor attacks. NeurIPS, 2023 a

    2023

  97. [105]

    Better safe than sorry: Pre-training clip against targeted data poisoning and backdoor attacks

    Wenhan Yang, Jingdong Gao, and Baharan Mirzasoleiman. Better safe than sorry: Pre-training clip against targeted data poisoning and backdoor attacks. In ICML, 2024

    2024

  98. [106]

    Outlier detection with globally optimal exemplar-based gmm

    Xingwei Yang, Longin Jan Latecki, and Dragoljub Pokrajac. Outlier detection with globally optimal exemplar-based gmm. In SDM, 2009

    2009

  99. [107]

    Data poisoning attacks against multimodal encoders

    Ziqing Yang, Xinlei He, Zheng Li, Michael Backes, Mathias Humbert, Pascal Berrang, and Yang Zhang. Data poisoning attacks against multimodal encoders. In ICML, 2023 b

    2023

  100. [108]

    Rethinking the backdoor attacks' triggers: A frequency perspective

    Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In ICCV, 2021

    2021

  101. [109]

    Clean-label backdoor attacks on video recognition models

    Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-label backdoor attacks on video recognition models. In CVPR, 2020

    2020

  102. [110]

    Suod: Accelerating large-scale unsupervised heterogeneous outlier detection

    Yue Zhao, Xiyang Hu, Cheng Cheng, Cong Wang, Changlin Wan, Wen Wang, Jianing Yang, Haoping Bai, Zheng Li, Cao Xiao, et al. Suod: Accelerating large-scale unsupervised heterogeneous outlier detection. Proceedings of Machine Learning and Systems, 2021

    2021

  103. [111]

    DDA : Dimensionality driven augmentation search for contrastive learning in laparoscopic surgery

    Yuning Zhou, Henry Badgery, Matthew Read, James Bailey, and Catherine Davey. DDA : Dimensionality driven augmentation search for contrastive learning in laparoscopic surgery. In MIDL, 2024

    2024

  104. [112]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  105. [113]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  106. [114]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.