Model Agnostic Defence against Backdoor Attacks in Machine Learning

Gerald Woo; Lionell Loh; Louth Rawshan; Sakshi Udeshi; Shanshan Peng; Sudipta Chattopadhyay

REVIEW 4 major objections 5 minor 1 cited by

Model Agnostic Defence against Backdoor Attacks in Machine Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A fully black-box defense can detect, block, and reconstruct backdoor triggers in image classifiers by covering them with a square of the image's dominant color.

desk verdict Genuinely black-box backdoor defence with a novel random-blocker search, but Algorithm 2's confirmation step is internally inconsistent, so the reported detection and false-positive rates are not reproducible from the printed algorithm. read the letter →

arxiv 1908.02203 v3 pith:LBFJ7RBB submitted 2019-08-06 cs.LG cs.CR

Sakshi Udeshi , Shanshan Peng , Gerald Woo , Lionell Loh , Louth Rawshan , Sudipta Chattopadhyay This is my paper · ORCID

classification cs.LGcs.CR

keywords backdoorattacksblack-boxdefensetriggerreconstructionblockerpoisonedimageclassifiersclassificationsecuritydeepneuralnetworks

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoor attacks poison a training set so that a model misclassifies any input carrying a small trigger, while behaving normally on clean inputs; this makes them invisible to accuracy checks. The paper claims NEO, a fully black-box defense, can detect such attacks, neutralize them, and reconstruct the trigger using only query access to the classifier. Across three poisoned models (a traffic-sign classifier, a face classifier, and MNIST), NEO identifies 76%, 86%, and 100% of poisoned inputs with false-positive rates from 0% to 1.77%, and restores predictions so that the fixed-image outputs closely match clean-image outputs. Because it needs no model internals and no poisoned training data, the defense is meant as a drop-in safeguard for users who outsourced model training. The reconstruction feature also exposes the trigger, breaking the stealth that backdoors rely on.

What carries the argument

The central object is the trigger blocker: an $m\times n$ square patch filled with the dominant color of the input image, computed by k-means clustering ($k=3$) on RGB pixels. NEO places the blocker at randomly sampled positions until a query returns a different class (a transition); each candidate position is then confirmed by extracting the covered pixels and pasting them onto clean images of the predicted class, requiring a fraction of transitions above a threshold $\Lambda_T$ chosen by a calibration routine. The blocker does double duty as the probe that locates the trigger and the patch that sanitizes the image, while the confirmation step produces the reconstructed trigger.

What would settle it

Take a backdoored classifier whose trigger is small and fixed in position but painted the same color as the dominant color of most images it attacks. Since NEO builds its blocker from the dominant color, covering the trigger with that color should leave the image effectively unchanged, so no prediction transition occurs and detection fails for that image; observing near-zero detection while the trigger still flips predictions on unfixed images would show the dominant-color assumption is load-bearing.

Watch

Extended reading notes

Core claim

In the paper's own terms, NEO establishes that a backdoor trigger can be found and neutralized under a purely black-box threat model, provided the trigger is a localized pattern appearing at a fixed relative position. It formalizes this as a 'localized trigger' (Definition 1), then treats mitigation as image editing rather than model repair: put a square blocker filled with the image's dominant color over the trigger position. The discovery is that this edit both restores the clean prediction and, as a by-product, yields the trigger pixels for reconstruction, because pasting those pixels onto clean images of the predicted class must reproduce the attack. The reported evidence is detection rates of 76%, 86%, and 100% on the poisoned USTS, TrojanNN/VGG-Face, and MNIST classifiers, false-positive rates from 0% to 1.77%, and post-defense attack success rates no worse than the white-box baselines Neural Cleanse and Fine Pruning on the compared models.

Load-bearing premise

The whole method rests on the premise that every backdoor trigger is a small, compact patch sitting at a fixed place in every poisoned image, and that a square patch of the image's dominant color can cover it; if a trigger breaks any of these, NEO's random search and confirmation will miss or reject it.

Editorial extensions

If this is right

Deployers who only have query access to a suspicious classifier, with no gradients, weights, or poisoned training data, can still locate, block, and reproduce the trigger, turning a stealthy attack into a testable artifact.
After NEO fixes poisoned images, classifier outputs on the fixed set are close to outputs on clean images: Jaccard indices rise to 0.91-1.0 on the evaluated models, and accuracy lands within about 11, 1, and 0 percentage points of the clean baseline for USTS, VGG Face, and MNIST, respectively.
Trigger reconstruction lets users craft their own poisoned test cases, so they can check whether the backdoor persists before relying on the model.
On the compared models, post-defense attack success is 0-7.1% under NEO, versus 3.7% and 0.53% for Neural Cleanse and 28.8% for Fine Pruning where reported.
Once the trigger position is known, mitigation is fast, as low as 4.4 ms per image, so the per-image sanitization overhead is small after detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves implicit that NEO's detection is a search over blocker placements, so the query cost grows with the image area relative to the blocker; an attacker who knows NEO could place the trigger at a rare position to force more queries, though the confirmation step still bounds false positives.
An unstated requirement is that the user must have a small set of clean images of the class predicted after blocking; without trustworthy clean data from the same distribution, trigger reconstruction and confirmation lose their anchor.
Because mitigation edits the image rather than the model, NEO neutralizes the trigger for the current classifier but does not remove the backdoor from the model; a user who wants a permanently clean model would still need retraining or pruning after NEO exposes the trigger.
A testable extension is to replace the square blocker with a segmentation mask or inpainting to handle non-square triggers; NEO's own evaluation with flower and bomb triggers suggests shape-agnostic covering is worth pursuing.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. The core idea is genuinely novel: NEO finds backdoor triggers by randomly dropping a dominant-coloured blocker on input images and watching for prediction transitions, then confirms candidates by pasting the suspected trigger pixels onto a clean set. That is truly black-box, unlike Neural Cleanse, Fine-Pruning, or spectral signatures, and it also reconstructs the trigger. The paper evaluates on three standard attacked models and reports detection rates of 76-100% with low false positives, plus Jaccard improvements from mitigation. The trigger reconstruction figures are convincing, and the public code/data promise is good practice.

The problem is that the paper as printed cannot support those numbers. Algorithm 2, the confirmation step that filters false positives, is internally inconsistent. It refers to 'class B' as if a blocked image had been classified, but no blocked image enters the procedure; check_set is then built from an undefined class_B; and line 11 compares f(img') with f(img), where img' is not defined in that scope—it should be cimg', and the comparison should be f(cimg') != f(cimg). Read literally, the check_set would consist of images from the target class, so pasting the trigger would cause no transitions and no backdoor would ever be confirmed. The reported 0-1.77% FP rates depend entirely on this step. I suspect this is a pseudocode typo rather than a design flaw, because the prose describes the right idea, but the central effectiveness claim is not supported by the printed algorithm.

Other soft spots are minor by comparison. 'As fast as 4.4 ms' is only the MNIST model; USTS and TrojanNN take seconds per image. The RQ4 claim that USTS accuracy drops only ~11% uses the best flower trigger; yellow square and bomb drop 16-18 points. The '100 random trials' bound is asserted without proof. No error bars. None of these sink the paper, but combined with the Algorithm 2 issue they require major revision.

Who should read this: people working on ML supply-chain security and black-box verification. They will get a useful new attack model and a testable method, but they should not rely on the printed detection numbers until Algorithm 2 is corrected and the code confirms the confirmation step. I would send it to peer review with a request for that fix, per-trial variance, and an honest RQ4 summary. The idea is worth a serious referee.

Referee Report

4 major / 5 minor

Summary. The paper presents NEO, a black-box defense against backdoor attacks on image classifiers. Given only query access to a model, NEO searches for a localized trigger by repeatedly placing a dominant-color square blocker at random positions; when a prediction transition is found, a confirmation procedure pastes the extracted trigger pixels onto clean training images and accepts the detection if the fraction of transitions exceeds a threshold Lambda_T. NEO then mitigates the attack by blocking the discovered trigger position, and reconstructs the trigger for user inspection. The method is evaluated on three poisoned models (USTS, TrojanNN/VGG Face, and MNIST-BadNets), reporting detection rates of 76%, 86%, and 100%, false-positive rates from 0% to 1.77%, high Jaccard-index improvement after mitigation, and an efficiency figure of 4.4 ms per input image. The implementation and experimental data are publicly available.

Significance. If the reported results hold, NEO would be a valuable contribution: it is a completely black-box defense, does not require access to poisoned training images, and is apparently the first method to reconstruct backdoor triggers rather than only detect or neutralize them. The comparison with Neural Cleanse and Fine Pruning, the public code release, and the evaluation on three distinct state-of-the-art attack models are concrete strengths. However, the central effectiveness claim rests on the confirmation procedure in Algorithm 2, and as printed that procedure is not executable; this must be fixed before the results can be accepted at face value. The assumptions about localized, square-coverable, fixed-position triggers are explicitly acknowledged as limitations, which is appropriate, but they also bound the scope of the claimed defense.

major comments (4)

[§4, Algorithm 2 (Backdoor Confirmation)] Algorithm 2 cannot be executed as written. Line 3 says 'Let img was classified to class B with trigger blocker' but the procedure receives only f, pos, size, Lambda_T, and img; class_B is never computed or passed as an argument. Consequently, line 5 (check_set <- Get_Training_Images(k, class_B)) is undefined. Moreover, line 11 compares f(img') with f(img), where img' is not a local variable and cimg' is never used; even if img' were a typo for cimg', the comparison would be against f(img), not f(cimg). As printed, this step cannot separate true backdoor transitions from the 15-39 false-positive transitions reported before confirmation in Tables 1 and 3, so the headline detection and false-positive numbers are not supported by the manuscript's pseudocode. The intended logic appears to be: use the prediction of the blocked image to define class_B, compute f(cimg'), and test f(cimg') != f(cimg). Please correct the pseudocode and re-state the confirmation step precisely; the experimental results should also be re-validated against this corrected procedure.
[§5, Key Results and Table 8] The abstract and Section 5 state that NEO is 'as fast as 4.4 ms per input image,' but Table 8 shows total processing times of thousands of seconds for the USTS and TrojanNN models (e.g., 6863.42s for USTS at the 10th percentile), with only the MNIST experiments completing in seconds. The 4.4 ms figure therefore appears to apply only to the MNIST model, not to the evaluation as a whole. The efficiency claim should be reported per model and should distinguish the one-time trigger-search cost from the per-image blocking cost; otherwise the abstract overstates the method's speed on the more realistic traffic-sign and face-classification tasks.
[§5, RQ4, Table 10] The 'Finding' states that the accuracy of the fixed set is only about 11% lower than the clean set for USTS, but Table 10 shows a drop from 92.14% to 74.22% (17.92 percentage points) for the yellow-square trigger and to 76.05% (16.09 points) for the bomb trigger; only the flower trigger gives an 11.15-point drop. Reporting '≈11%' understates the observed accuracy loss. Please report absolute percentage-point differences and, ideally, per-trigger breakdowns so that the mitigation claim is not overstated.
[§4, Algorithm 3 and Definition 1] The random-search strategy in Algorithm 3 relies on an unstated probability-of-success assumption: that N random placements of a square blocker will hit a trigger satisfying Definition 1. The paper gives an intuitive upper bound of 100 expected trials for delta <= 10% and then chooses N=400, but no derivation or confidence interval is provided. Since a miss in the search phase directly causes false negatives (the USTS and TrojanNN experiments already show 24% and 14% miss rates), the work should either provide a formal relationship between N, trigger size, and detection probability, or present an empirical sensitivity analysis of N. This is a load-bearing parameter for the detection-rate claim.

minor comments (5)

[§3, Algorithm 1] Line 19 of Algorithm 1 calls Confirm_Backdoor with arguments written as '(·, pos,··· , img)', which is placeholder notation and not a valid call signature. Please give the exact argument list consistent with Algorithm 2.
[§4, Algorithm 4] The variable name 'Rf lip' in Algorithm 4 is a typo for 'Rflip'; this should be corrected for readability.
[§5, Table 9] Table 9 is captioned 'Notations used in the Tables for RQ3' but it actually introduces notation for RQ4; the cross-reference should be fixed.
[§5, Table 7] The comparison table is incomplete: Fine Pruning has no VGG Face entry and Neural Cleanse has no USTS entry, so the claim that NEO outperforms both state-of-the-art defences on all three datasets is not fully supported. Please clarify the reasons for the missing entries or restrict the claim to the available comparisons.
[§6, Related Work] The reference for Neural Cleanse is listed without authors or a complete title in the reference list; please complete the bibliographic entry.

Circularity Check

1 steps flagged · score 6.0 of 10

Algorithm 2's backdoor confirmation is tautological: as printed, its only predicate is the same blocker-induced transition that triggered the call, so the 'after confirmation' detection and false-positive numbers are not derived from the check set.

self definitional [Algorithm 2 (Backdoor Confirmation), Section 4, lines 3-11; invoked at Algorithm 1 Line 19]
"Let img was classified to class B with trigger blocker ... check_set← Get_Training_Images(k, class_B) ... trigger← Extract_Trigger(pos, img) ... for cimg∈ check_set do ... cimg′← Place_Trigger(cimg, pos, size, trigger) ... if f(img′)≠ f(img) then transition_count← transition_count + 1"

As printed, Confirm_Backdoor never computes class_B and never defines img'. The only condition tested, f(img') != f(img), is exactly the guard in Algorithm 1 (Line 17) under which Confirm_Backdoor is called. Hence transition_count is |check_set| if and only if the original blocker-induced transition already occurred; the loop over check_set, the extracted trigger, and the placement on cimg have no effect on the result. The confirmation output is therefore logically identical to its input transition, making the 'after confirmation' rows of Tables 1 and 3 (38/442 and 43/450) unreproducible from the printed algorithm. A literal reading makes the confirmation procedure a tautology that always returns True whenever it is invoked.

full rationale

No circularity was found in the threshold calibration or in the attack assumptions: Lambda_T is chosen from clean-image random-crop transitions (Algorithm 4) before the poisoned test set is evaluated, so the reported detection rates are not fitted to the test labels. The localized-square-trigger assumption (Definition 1) is a stated scope condition, not a derivation from the conclusion, and the paper's threats-to-validity section acknowledges it. Self-citations (e.g., [23]) appear only in related work and are not load-bearing. The one concrete circular reduction is in Algorithm 2: the confirmation predicate is, as written, the same blocker-induced transition that triggered the call, so the claimed false-positive filtering reduces by construction to the raw transition flag. Because the central detection numbers in Tables 1 and 3 are reported 'after confirmation', this tautology undermines the main effectiveness claim. The mitigation and trigger-reconstruction results are separately reported and are not reduced to the same tautology, so the overall circularity is partial.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on trigger-shape assumptions, availability of clean labeled images, and several manually chosen parameters (N, Lambda_T, k, blocker size). These are the main uncharged inputs the reader must accept.

free parameters (6)

Trigger blocker size (m x n) = unspecified
User-chosen patch size controls whether random placement covers the trigger; the paper does not report how the size is selected per model.
N (random placement trials) = 400
Paper says expected trials to cover a localized trigger with delta<=10% is 100 and 'we chose N to be 400' (Section 4, Algorithm 3).
Confirmation threshold Lambda_T = 0.8 (USTS), 0.475 (TrojanNN), 0.9 (MNIST)
Calibrated per dataset with Algorithm 4 on clean images; directly determines detection versus false positives; paper admits no optimal value (Section 7).
k (number of check_set images) = unspecified
Algorithm 2 picks k random images of the predicted class to confirm a backdoor; k is never reported.
k-means clusters for dominant colour = 3
Scipy k-means with k=3 is hard-coded; no sensitivity analysis is provided (Section 4).
Maximum trigger area delta = 10%
Definition 1 assumes the trigger square occupies less than delta% of the image; no empirical basis is given.

assumptions (5)

domain assumption The backdoor trigger is localized and can be covered by a square occupying less than a small fraction of the image (Definition 1).
NEO's random search for a square blocker assumes this shape and area constraint; stated as Definition 1.
domain assumption The trigger occurs at a fixed relative position in all poisoned inputs.
Section 1 and Algorithm 1 use one discovered position for all subsequent images; if positions vary, mitigation fails.
domain assumption Covering the trigger with the dominant color of the image yields an image classified like the clean version.
Section 4 states this as a hypothesis ('we hypothesise') and it is not guaranteed; if false, blocking will not restore correct predictions.
domain assumption A clean labeled set from the training distribution is available to NEO for confirmation and threshold calibration.
Algorithms 2 and 4 call Get_Training_Images and sample clean images; the paper does not discuss how to obtain these labels in a pure blackbox deployment.
ad hoc to paper Random placement with N trials will find the trigger position with high probability.
The 'expected trials is 100' claim is stated without derivation and N=400 is chosen manually (Section 4).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Model Agnostic Defence against Backdoor Attacks in Machine Learning." pith.science (2026). https://pith.science/paper/LBFJ7RBB

@misc{pith2026190802203,
  author       = {Pith},
  title        = {Pith review of: Model Agnostic Defence against Backdoor Attacks in Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LBFJ7RBB}},
  note         = {Machine review of arXiv:1908.02203}
}

abstract

Machine Learning (ML) has automated a multitude of our day-to-day decision making domains such as education, employment and driving automation. The continued success of ML largely depends on our ability to trust the model we are using. Recently, a new class of attacks called Backdoor Attacks have been developed. These attacks undermine the user's trust in ML models. In this work, we present NEO, a model agnostic framework to detect and mitigate such backdoor attacks in image classification ML models. For a given image classification model, our approach analyses the inputs it receives and determines if the model is backdoored. In addition to this feature, we also mitigate these attacks by determining the correct predictions of the poisoned images. An appealing feature of NEO is that it can, for the first time, isolate and reconstruct the backdoor trigger. NEO is also the first defence methodology, to the best of our knowledge that is completely blackbox. We have implemented NEO and evaluated it against three state of the art poisoned models. These models include highly critical applications such as traffic sign detection (USTS) and facial detection. In our evaluation, we show that NEO can detect $\approx$88% of the poisoned inputs on average and it is as fast as 4.4 ms per input image. We also reconstruct the poisoned input for the user to effectively test their systems.

Figures

Figures reproduced from arXiv: 1908.02203 by the authors.

**Figure 1.** The intuition behind NEO (Note that the red outline is only to highlight the trigger blocker) shown in image A”. During the process of producing the image A”, NEO also extracts the backdoor trigger in image A and presents the trigger to users for improving their system. The reason NEO works is because the backdoor triggers are usually located in a relatively fixed, yet unknown position in the poisoned input [7] [12]… view at source ↗

**Figure 2.** An example of a backdoored model. The trigger is seen in Figure 2(a) and the target label is 7. The training data is [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Figure 3(a-c) (respectively, Figure 3(d-e) and Figure 3(g [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: NEO’s approach to detect and fix backdoored images 4 METHODOLOGY In this section, we elucidate the methodologies behind NEO in detail. NEO essentially consists of two steps, the detection of the backdoor activation trigger and the subsequent blocking of the trigger onc…

**Figure 6.** Figure 6: Representative examples of different types of different types of dominant colours seen in the VGG face dataset. Dominant Colour and Image Similarity: To find the dominant colour of an image NEO employs a k-means clustering algorithm. Clustering is a technique that hel…

**Figure 8.** Figure 8: RQ1: How effective is NEO in a typical deployment scenario? To evaluate the effectiveness of NEO, we have designed the following experiment. We construct a set of 500 input images with 10% (50 images) of these images being poisoned. We randomly distribute these poisone…

**Figure 7.** Figure 7: and [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

**Figure 8.** Figure 8: Reconstruction from poisoned MNIST and USTS [7] models Finding: NEO effectively reconstructs poisoned examples so that the user can effectively test their models. 6 RELATED WORK Testing and Verification of ML models: DeepXplore [16] employs differential white-box test…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers
cs.CV 2024-12 conditional novelty 5.0 of 10

Attention-guided trigger placement with co-optimized training and alternating clean retraining achieves high backdoor attack success at low poison ratios on CNNs and vision transformers, while evading several publishe...

Reference graph

Works this paper leans on

27 extracted references · 22 canonical work pages · cited by 1 Pith paper

[1]

In 2019 IEEE Symposium on Security and Privacy, SP 2019, Proceedings, 20-22 May 2019, San Francisco, California, USA

Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy, SP 2019, Proceedings, 20-22 May 2019, San Francisco, California, USA

work page 2019
[2]

On a measure of divergence between two statistical populations deﬁned by their probability distributions

Anil Bhattacharyya. On a measure of divergence between two statistical populations deﬁned by their probability distributions. Bull. Calcutta Math. Soc., 35:99–109, 1943

work page 1943
[3]

Targeted backdoor attacks on deep learning systems using data poisoning

Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, abs/1712.05526, 2017

arXiv 2017
[4]

Mann, and Pushmeet Kohli

Krishnamurthy Dvijotham, Robert Stanforth, Sven Gowal, Timo- thy A. Mann, and Pushmeet Kohli. A dual approach to scalable veriﬁcation of deep networks. In Proceedings of the Thirty-Fourth Conference on Uncertainty in Artiﬁcial Intelligence, UAI 2018, Monterey, California, USA, August 6-10, 2018, pages 550–559, 2018

work page 2018
[5]

Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen, Petar Tsankov, Swarat Chaudhuri, and Martin T. Vechev. AI2: safety and robustness certiﬁcation of neural networks with abstract interpretation. In 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA , pages 3–18, 2018

work page 2018
[6]

Bhattacharyya distance as a contrast parameter for statistical processing of noisy optical images

François Goudail, Philippe Réfrégier, and Guillaume Delyon. Bhattacharyya distance as a contrast parameter for statistical processing of noisy optical images. Journal of the Optical Society of America., 21(7):1231–1240

work page
[7]

Badnets: Identifying vulnerabilities in the machine learning model supply chain

Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. CoRR, abs/1708.06733, 2017. URL: http://arxiv.org/abs/ 1708.06733, arXiv:1708.06733

arXiv 2017
[8]

SciPy: Open source scientiﬁc tools for Python, 2001–

Eric Jones, Travis Oliphant, Pearu Peterson, et al. SciPy: Open source scientiﬁc tools for Python, 2001–. URL: http://www.scipy. org/

work page 2001

Show all 27 references

[9]

Barrett, David L

Guy Katz, Clark W. Barrett, David L. Dill, Kyle Julian, and Mykel J. Kochenderfer. Reluplex: An efﬁcient SMT solver for verifying deep neural networks. In Computer Aided Veriﬁcation - 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, ...

2017
[10]

Orr, and Klaus-Robert Müller

Yann LeCun, Léon Bottou, Genevieve B. Orr, and Klaus-Robert Müller. Efﬁcient backprop. In Neural Networks: Tricks of the Trade (2nd ed.), volume 7700 of Lecture Notes in Computer Science , pages 9–48. Springer, 2012

2012
[11]

Fine- pruning: Defending against backdooring attacks on deep neural networks

Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses - 21st Inter- national Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proc...

2018
[12]

Trojaning attack on neural networks

Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25nd Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-221,

2018
[13]

Deepgauge: multi-granularity testing criteria for deep learning systems

Lei Ma, Felix Juefei-Xu, Fuyuan Zhang, Jiyuan Sun, Minhui Xue, Bo Li, Chunyang Chen, Ting Su, Li Li, Yang Liu, Jianjun Zhao, and Yadong Wang. Deepgauge: multi-granularity testing criteria for deep learning systems. In Proceedings of the 33rd ACM/IEEE International Conference o...

2018
[14]

Moore, R

Ramon E. Moore, R. Baker Kearfott, and Michael J. Cloud. Intro- duction to Interval Analysis. SIAM, 2009. URL: https://doi.org/10. 1137/1.9780898717716, doi:10.1137/1.9780898717716

2009 doi
[15]

O. M. Parkhi, A. Vedaldi, and A. Zisserman. Deep face recognition. In British Machine Vision Conference, 2015

2015
[16]

Deepxplore: Automated whitebox testing of deep learning systems

Kexin Pei, Yinzhi Cao, Junfeng Yang, and Suman Jana. Deepxplore: Automated whitebox testing of deep learning systems. In Proceed- ings of the 26th Symposium on Operating Systems Principles, Shanghai, China, October 28-31, 2017, pages 1–18, 2017

2017
[17]

Deep learning in neural networks: An overview

Jürgen Schmidhuber. Deep learning in neural networks: An overview. Neural Networks, 61:85–117, 2015

2015
[18]

Concolic testing for deep neural networks

Youcheng Sun, Min Wu, Wenjie Ruan, Xiaowei Huang, Marta Kwiatkowska, and Daniel Kroening. Concolic testing for deep neural networks. In Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, ASE 2018, Montpellier, France, September 3-7, 20...

2018
[19]

Goodfellow, and Rob Fergus

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference...

2014
[20]

Introduction to Data Mining

Pang-Ning Tan, Michael Steinbach, and Vipin Kumar. Introduction to Data Mining. Addison-Wesley, 2005

2005
[21]

Deeptest: automated testing of deep-neural-network-driven autonomous cars

Yuchi Tian, Kexin Pei, Suman Jana, and Baishakhi Ray. Deeptest: automated testing of deep-neural-network-driven autonomous cars. In Proceedings of the 40th International Conference on Software Engineering, ICSE 2018, Gothenburg, Sweden, May 27 - June 03, 2018 , pages 303–314, 2018. 13

2018
[22]

Spectral sig- natures in backdoor attacks

Brandon Tran, Jerry Li, and Aleksander Madry. Spectral sig- natures in backdoor attacks. In Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, 3-8 December 2018, Montréal, Canada., pages 8011–802...

2018
[23]

Auto- mated directed fairness testing

Sakshi Udeshi, Pryanshu Arora, and Sudipta Chattopadhyay. Auto- mated directed fairness testing. In Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, ASE 2018, Montpellier, France, September 3-7, 2018, pages 98–108, 2018

2018
[24]

Adversarial sample detection for deep neural network through model mutation testing

Jingyi Wang, Guoliang Dong, Jun Sun, Xinyu Wang, and Peixin Zhang. Adversarial sample detection for deep neural network through model mutation testing. In Proceedings of the 41st Inter- national Conference on Software Engineering, ICSE 2019, Montréal, Canada, May 25 - May 31, ...

2019
[25]

Formal security analysis of neural networks using symbolic intervals

Shiqi Wang, Kexin Pei, Justin Whitehouse, Junfeng Yang, and Suman Jana. Formal security analysis of neural networks using symbolic intervals. In 27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018. , pages 1599– 1614, 2018

2018
[26]

Feature-guided black-box safety testing of deep neural networks

Matthew Wicker, Xiaowei Huang, and Marta Kwiatkowska. Feature-guided black-box safety testing of deep neural networks. In Tools and Algorithms for the Construction and Analysis of Systems - 24th International Conference, TACAS 2018, Held as Part of the European Joint Conferenc...

2018
[2018]

The Internet Society, 2018

2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

In 2019 IEEE Symposium on Security and Privacy, SP 2019, Proceedings, 20-22 May 2019, San Francisco, California, USA

Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy, SP 2019, Proceedings, 20-22 May 2019, San Francisco, California, USA

work page 2019

[2] [2]

On a measure of divergence between two statistical populations deﬁned by their probability distributions

Anil Bhattacharyya. On a measure of divergence between two statistical populations deﬁned by their probability distributions. Bull. Calcutta Math. Soc., 35:99–109, 1943

work page 1943

[3] [3]

Targeted backdoor attacks on deep learning systems using data poisoning

Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, abs/1712.05526, 2017

arXiv 2017

[4] [4]

Mann, and Pushmeet Kohli

Krishnamurthy Dvijotham, Robert Stanforth, Sven Gowal, Timo- thy A. Mann, and Pushmeet Kohli. A dual approach to scalable veriﬁcation of deep networks. In Proceedings of the Thirty-Fourth Conference on Uncertainty in Artiﬁcial Intelligence, UAI 2018, Monterey, California, USA, August 6-10, 2018, pages 550–559, 2018

work page 2018

[5] [5]

Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen, Petar Tsankov, Swarat Chaudhuri, and Martin T. Vechev. AI2: safety and robustness certiﬁcation of neural networks with abstract interpretation. In 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA , pages 3–18, 2018

work page 2018

[6] [6]

Bhattacharyya distance as a contrast parameter for statistical processing of noisy optical images

François Goudail, Philippe Réfrégier, and Guillaume Delyon. Bhattacharyya distance as a contrast parameter for statistical processing of noisy optical images. Journal of the Optical Society of America., 21(7):1231–1240

work page

[7] [7]

Badnets: Identifying vulnerabilities in the machine learning model supply chain

Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. CoRR, abs/1708.06733, 2017. URL: http://arxiv.org/abs/ 1708.06733, arXiv:1708.06733

arXiv 2017

[8] [8]

SciPy: Open source scientiﬁc tools for Python, 2001–

Eric Jones, Travis Oliphant, Pearu Peterson, et al. SciPy: Open source scientiﬁc tools for Python, 2001–. URL: http://www.scipy. org/

work page 2001