Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks

Feng-Qi Cui; Haiming Jin; Jia-Cheng Zhao; Jinyang Huang; Meng Li; Xiaokang Zhou; Xiaoke Chen; Yi Yang; Yu-Tong Guo

REVIEW 3 major objections 5 minor 42 references

Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that at very low poisoning budgets, backdoor attack success is determined by how the scarce poison slots are allocated across the feature distribution, and that selecting one centroid-nearest sample per k-means region…

desk verdict DFCS is a clean, useful poison-selector with a real confound in the baseline comparison; the coverage principle is plausible but the paper overclaims the attribution. read the letter →

arxiv 2608.09047 v1 pith:MSEC7IG7 submitted 2026-08-10 cs.CR cs.CV

Yi Yang , Xiaoke Chen , Jinyang Huang , Feng-Qi Cui , Yu-Tong Guo , Jia-Cheng Zhao , Haiming Jin , Xiaokang Zhou

show 1 more author

Meng Li

This is my paper · ORCID

classification cs.CRcs.CV

keywords backdoorattacksdirty-labelpoisoningsampleselectiondata-efficientfeaturecoveragek-meansclusteringtrigger-agnosticlow-budget

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that at very low poisoning rates, what matters is not which individual samples score highest but how the scarce poison slots are spread across the feature space. It proposes DFCS, which clusters frozen pretrained features into as many regions as there are poison slots and selects the centroid-nearest real sample from each region. Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, this rule beats six existing selectors in every setting, averaging 96.30% attack success while preserving clean accuracy. A local first-order analysis ties the rule to two measurable error terms: feature-coverage error and representative-mass mismatch.

What carries the argument

The central object is the equal-weight signal-approximation bound in Proposition 1: for local gradient effects $A_x$, the difference between the candidate-average replacement signal and the selected-set signal is bounded by $\eta L_A(x)\sqrt{\Delta^2(S)} + \eta M_A(x)\Gamma(S)$, where $\Delta^2(S)$ measures average squared feature distance to the nearest selected sample (coverage error) and $\Gamma(S)$ measures mismatch between region masses and uniform poison weights. DFCS minimizes the coverage term by k-means with $B$ clusters followed by centroid-nearest projection, which for a fixed partition is the exact discrete minimizer of within-cluster squared distortion.

What would settle it

Take a dataset and target class where a deliberately clustered poison set (all samples from one source class or one feature neighborhood) achieves high attack success, and compare its ASR with DFCS at the same budget; if the clustered set wins or ties, the coverage principle is false. Alternatively, compute the left-hand side of Eq. (9) under real victim training and test whether it shrinks as $\Delta^2(S)$ and $\Gamma(S)$ shrink; if it does not, Proposition 1 is not predictive.

Watch

Extended reading notes

Core claim

DFCS formulates low-budget dirty-label backdoor selection as allocation of $B$ equal-weight poisoning slots over the clean candidate distribution. Using a frozen pretrained encoder and k-means with exactly $B$ clusters, it selects one centroid-nearest candidate per cluster. The paper claims this yields the highest mean attack success rate among seven selectors in all six dataset–attack settings, averaging 96.30% and beating the strongest comparator by 4.60 percentage points on average, while leaving clean accuracy essentially unchanged. The authors further claim the selection principle is trigger-agnostic and requires no task-specific surrogate training.

Load-bearing premise

The load-bearing premise is that a local first-order approximation of how replacing a clean sample with a poisoned one changes the victim's loss actually predicts how training absorbs the poison; if that approximation is wrong, the coverage-based explanation collapses and only the empirical result remains.

Editorial extensions

If this is right

At a given budget, the same selected indices can be paired with different triggers and victim architectures without rerunning selection, because selection only sees clean features.
Selection time scales linearly in candidate-pool size and needs no surrogate training, making low-budget attacks feasible on larger datasets.
Pointwise scorers (FUS, RD, HFE, IFS) and filter-then-sample diversity (PFS) are consistently worse than explicit distributional allocation in the evaluated low-budget regimes.
The attack remains stealthy on the accuracy axis: clean accuracy stays within 0.07 points below to 0.74 points above the no-attack baseline in all six settings.
Worst-case coverage objectives such as k-center are the wrong fit for this regime; average-distortion coverage wins.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension not explored here would be reweighting regions by candidate mass to shrink $\Gamma(S)$, potentially pushing attack success above what equal-weight DFCS achieves.
The coverage principle should transfer to other dirty-label poisoning tasks, such as text classification, if a frozen encoder provides task-relevant features; a sentence-encoder version of the protocol would test this.
The sharp k-center failure suggests a defensive angle: since natural training subsets are not chosen to maximize feature coverage, unusually well-spread selected sets could be flagged as suspicious.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This paper proposes DFCS, a simple training-free poison-sample selector: run k-means on pretrained features with k equal to the poison budget, then pick the centroid-nearest real sample per cluster. That budget-coupled allocation is a genuine twist on prior pointwise ranking methods, and the two-term error decomposition (coverage + mass mismatch) is a reasonable way to motivate it. The main empirical claim—DFCS beats six selectors in all six dataset-attack settings—is backed by a clean matched-seed protocol, five runs, and many ablations. Credit where due: the robustness sweeps (budget, target class, victim architecture, optimizer, encoder, allocation method) are more thorough than what most papers in this space show.

The soft spots are real, though. First, the headline comparison is confounded: DFCS uses DINOv3 features while FUS/RD/IFS use a PreActResNet-18 surrogate. The Fig. 2e encoder sweep shows DFCS tolerates different encoders, but it does not show whether RD or FUS would gain equally from DINOv3. The abstract's claim that the results 'support distributional feature coverage as an effective selection principle' is therefore a bit stronger than the evidence. The within-DFCS controls (centroid-nearest vs cluster-random) suggest allocation detail matters, but they don't identify the encoder as cause of the cross-method margin. Second, the proof of Proposition 1 and all configuration details are in an appendix that is absent; the manuscript also contains Tables?? placeholders. That makes verification harder than it should be. Third, the diagnostic correlations are partly self-referential: DFCS is constructed to minimize Δ2, so seeing Δ2 and E_sig correlated across selectors is descriptive, not causal. The matched victim controls are the more convincing evidence.

The theoretical motivation is a nice heuristic but by no means a proof of attack effectiveness; it's a bound on an approximation error under a local linearization. If the linearization doesn't capture how victim training absorbs poisons, the explanation degrades to 'coverage empirically works.' That's fine as a claim, but should be labeled as such.

Who's this for? Researchers working on data-efficient backdoor attacks or poison-sample selection. It deserves a serious referee: the method is simple, reproducible in principle, and the experimental core is solid. The referee should ask for the appendix, code/data, and a cross-over encoder experiment (e.g., RD and FUS with DINOv3 features, and DFCS with PreActResNet-18 features) before accepting the coverage principle.

Referee Report

3 major / 5 minor

Summary. The paper proposes Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method for selecting poisoned samples under very low dirty-label poisoning budgets. DFCS encodes the non-target candidate pool with a frozen pretrained encoder, partitions the features with k-means into exactly B clusters, and selects the centroid-nearest real sample from each cluster. A local first-order analysis (Proposition 1) bounds the difference between the candidate-average and equal-weight selected-set replacement signals by a feature-coverage term and a representative-mass term. Empirically, on CIFAR-10, Tiny-ImageNet, and Imagenette under BadNets and Blended attacks, the paper reports that DFCS achieves the highest mean attack success rate among seven selectors in all six dataset–attack settings, with a mean ASR of 96.30% and an average margin of 4.60 percentage points over the strongest comparator, while preserving clean accuracy. Additional ablations examine poisoning rate, victim-training strategy, target class, victim architecture, pretrained encoder, and allocation method.

Significance. If the central claim is validated, DFCS would be a valuable and unusually simple baseline for low-budget dirty-label backdoor selection: it requires no surrogate training, no trigger knowledge, and no victim information, and it scales linearly in the candidate-pool size. The paper also provides a decomposition of the selection error into coverage and mass-mismatch terms, which is a useful conceptual contribution even if the bound is local. The empirical study is broad in its ablations, including budgets, target classes, victim architectures, encoders, and allocation methods, and the matched controls (histogram-matched, class-stratified, cluster-random) are a thoughtful attempt to separate representative choice from class composition. The main empirical claim is, however, currently weakened by an encoder confound in the headline comparison and by the absence of the appendix containing the proof of Proposition 1 and full configuration details. For these reasons the paper is promising but not yet ready in its current form.

major comments (3)

[Experiments, Models and evaluation protocol; Table 1] The headline comparison in Table 1 confounds the selection rule with the feature encoder. The paper states that 'DFCS and PFS use the same frozen DINOv3 ViT-S/16 encoder, while baselines requiring a task-specific surrogate use PreActResNet-18.' Consequently, the margins of DFCS over FUS, RD, and IFS may be due to the representational quality of DINOv3 features rather than to the coverage-based allocation principle. The Fig. 2e ablation shows that DFCS is robust across encoders, but it does not show that the competing selectors would not gain equally or more from the stronger encoder. PFS shares the DINOv3 encoder and still underperforms, but PFS also differs in its selection mechanism, so this does not control the encoder for RD, FUS, or IFS. To support the abstract's claim that the results 'support distributional feature coverage as an effective selection principle,' the authors should either run the competitive baselines with DINOv3 features, run DFCS with PreActResNet-18 features, or otherwise show that the relative ranking is not reversed when the encoder is held fixed.
[Methodology, Local Equal-Weight Signal Approximation; Appendix] The proof of Proposition 1 and the derived bound Delta_2(S) <= J_rep <= 2 J_KM are stated to be 'provided in Appendix,' but no appendix is included in the submitted manuscript. Likewise, the complete attack configurations, dataset statistics, seed protocol, defensive evaluations, and formulas for the diagnostics E_w_sig and E_mass are all deferred to an absent appendix, and the main text still contains unresolved references such as 'Tables??.' Without these materials, the theoretical motivation cannot be verified and the experimental protocol is not reproducible from the manuscript. The authors need to supply the complete appendix or move the essential derivations and configuration details into the main text.
[Mechanism Diagnostics and Controlled Comparisons] The diagnostic evidence for Proposition 1 is descriptive and partly self-referential. The reported Spearman correlations (rho = 0.809 between sqrt(Delta_2) and E_w_sig, and rho = 0.445 between Gamma and E_mass) are computed across selector means that include DFCS itself, which is explicitly constructed to minimize Delta_2; a correlation involving a quantity that the method is designed to minimize is expected even if the local model is not the true mechanism. The matched victim comparisons are more informative, but the paper does not report a corresponding matched-encoder comparison for the main baselines. I recommend either clarifying that the diagnostics are illustrative rather than confirmatory, or providing a stronger test such as a fixed-selector, fixed-encoder comparison that varies Delta_2 independently of the selection rule.

minor comments (5)

[Experiments, Experimental Settings] The text contains unresolved table references: 'Tables?? and ?? report the dataset statistics and integer payload budgets.' These need to be fixed once the appendix is restored.
[Figure 2] The label 'Vcitim model' in panel (d) contains a typo and should read 'Victim model.'
[Related Work and Baselines] The description of PFS states that it 'introduces stochastic diversity after filtering by clean–poison similarity,' but the exact relationship of PFS to the budget allocation studied in this paper would be clearer if the paper explicitly stated whether the final PFS budget is drawn uniformly from the filtered pool and how the random seed is matched.
[Experiments, Models and evaluation protocol] The paper states that means and paired differences are 'interpreted as descriptive summaries'; given that no statistical significance tests are reported, it would be helpful to state this explicitly also when discussing the margins of 2.38–8.71 percentage points in Table 1.
[Methodology, Eq. (5)] The notation A_x is used both for the per-sample replacement signal and for the Lipschitz constant L_A(x); this is not incorrect, but the double use of the subscript 'x' may confuse readers, and a different symbol for the Lipschitz envelope would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the ASR comparison is an external empirical benchmark; the theoretical bound is a stated-assumption inequality, not a renamed fit.

full rationale

The paper's central claim ('DFCS achieves the highest mean attack success rate...') is an empirical result obtained by running DFCS and six external baselines on three datasets under two attacks. No parameter is fitted to the reported ASR: the method is an explicit algorithm (k-means partition into B clusters plus centroid-nearest projection, Algorithm 1), and the budget B is set by the poisoning rate, not tuned to maximize ASR. Proposition 1 is a conditional upper bound under stated Lipschitz and boundedness assumptions; its terms Delta2(S) and Gamma(S) are defined independently of victim-training outcome, and the proposition is not used to construct the empirical ASR numbers. The diagnostics compare measured local replacement-signal errors (E_sig, E_mass) with the bound's components; although DFCS is designed to minimize Delta2, the correlations rho=0.809 and rho=0.445 are empirical checks of whether the Lipschitz bound holds across selectors, not fits of a parameter to the predicted quantity. The paper explicitly separates 'descriptive selector-level evidence consistent with the local decomposition' from 'separate end-to-end evidence for attack behavior.' There is no load-bearing self-citation, no imported uniqueness theorem, and no renamed known result presented as new. The possible encoder mismatch between DINOv3 (DFCS/PFS) and PreActResNet-18 (FUS/RD/IFS) in Table 1 is a validity/confound concern, not a circularity, and does not make the derivation equivalent to its inputs by construction.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No fitted constants are used: the number of clusters equals the attack budget B, the encoder is pretrained, and the bound's Lipschitz and mass constants are existential. The central empirical claim is anchored to external baselines, but the theoretical explanation rests on domain assumptions about feature geometry and first-order gradient surrogates. No new physical or architectural entities are introduced.

assumptions (4)

domain assumption Pretrained encoder features (DINOv3 by default) provide a representation space where k-means coverage of clean candidates is a meaningful proxy for the diversity relevant to backdoor implantation.
The method's selection depends entirely on these features; the paper shows robustness across five encoders but does not prove the alignment.
domain assumption The local first-order replacement-signal model (Eqs. 5-7) with L-Lipschitz and bounded A_x is a valid description of how the victim's training absorbs poisoned samples.
Proposition 1 is derived under these conditions; they are not verified empirically and the proof is deferred to the appendix.
domain assumption The candidate-average replacement signal eD_C(x) is the correct reference target for a good equal-weight poison set.
The paper motivates coverage by bounding the gap to this average but does not independently justify why approximating it improves attack success.
standard math For a fixed k-means partition, the centroid-nearest sample exactly minimizes within-cluster squared distortion (Eq. 4).
This is a standard algebraic identity shown in the main text.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks." pith.science (2026). https://pith.science/paper/MSEC7IG7

@misc{pith2026260809047,
  author       = {Pith},
  title        = {Pith review of: Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MSEC7IG7}},
  note         = {Machine review of arXiv:2608.09047}
}

abstract

Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical. Existing methods typically rank candidates using per-sample scores, which can select redundant samples from similar semantic regions, and many require task-specific surrogate training. We propose Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method that clusters fixed pretrained features into one region per poisoning slot and selects the centroid-nearest sample from each region. A local first-order analysis relates this allocation to feature-coverage and representative-mass terms. Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, DFCS achieves the highest mean attack success rate among seven selectors in all six dataset--attack settings, averaging $96.30\%$ and exceeding the strongest comparator in each setting by 4.60 percentage points on average while preserving clean accuracy. These results support distributional feature coverage as an effective selection principle for low-budget dirty-label backdoor attacks.

Figures

Figures reproduced from arXiv: 2608.09047 by the authors.

**Figure 1.** Overview of DFCS. (a) Non-target samples form the candidate pool and are encoded into normalized pretrained features. (b) DFCS partitions the features into B clusters and selects the sample nearest each centroid. (c) Selected samples are trigger-transformed and relabeled, while unselected samples remain clean. not by themselves specify what should be represented when each selected example is trigger-transformed, r… view at source ↗

**Figure 2.** Ablation and robustness studies with BadNets on CIFAR-10. We vary (a) the local poison budget, (b) victimtraining strategy, (c) target class, (d) victim architecture, (e) frozen pretrained encoder, and (f) allocation method. Reported ACC and ASR values are five-run means; where shown, error bars or shaded intervals denote sample standard deviations, and panels (e) and (f) additionally show individual runs. Panels (… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 32 canonical work pages

[1]

Gu, Tianyu and Dolan-Gavitt, Brendan and Garg, Siddharth , journal =

work page
[2]

arXiv preprint arXiv:1712.05526 , year =

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning , author =. arXiv preprint arXiv:1712.05526 , year =

arXiv
[3]

Nguyen, Tuan Anh and Tran, Anh Tuan , booktitle =

work page
[4]

European Conference on Computer Vision , pages =

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks , author =. European Conference on Computer Vision , pages =

work page
[5]

Technical report , year =

Clean-Label Backdoor Attacks , author =. Technical report , year =

work page
[6]

Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence , pages =

Data-Efficient Backdoor Attacks , author =. Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence , pages =. 2022 , doi =

work page 2022
[7]

Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attacks

Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attacks , author =. arXiv preprint arXiv:2310.09744 , year =

work page Pith review arXiv
[8]

Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

Computation and Data Efficient Backdoor Attacks , author =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

work page

Show all 42 references

[9]

arXiv preprint arXiv:2306.08313 , year =

A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks , author =. arXiv preprint arXiv:2306.08313 , year =

arXiv
[10]

Transactions on Machine Learning Research , year =

Stealthy Backdoor Attack via Confidence-Driven Sampling , author =. Transactions on Machine Learning Research , year =
[11]

IEEE Transactions on Information Forensics and Security , volume =

Minimalism is King! High-Frequency Energy-Based Screening for Data-Efficient Backdoor Attacks , author =. IEEE Transactions on Information Forensics and Security , volume =. 2024 , doi =

2024
[12]

Proceedings of the AAAI Conference on Artificial Intelligence , volume =

Influence-Based Fair Selection for Sample-Discriminative Backdoor Attack , author =. Proceedings of the AAAI Conference on Artificial Intelligence , volume =. 2025 , doi =

2025
[13]

International Conference on Learning Representations , year =

Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks , author =. International Conference on Learning Representations , year =
[14]

arXiv preprint arXiv:2508.10104 , year =

Sim. arXiv preprint arXiv:2508.10104 , year =

arXiv
[15]

Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

A ConvNet for the 2020s , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=
[16]

Visualizing Data Using

van der Maaten, Laurens and Hinton, Geoffrey , journal =. Visualizing Data Using
[17]

Learning Multiple Layers of Features from Tiny Images , author =
[18]

Le, Ya and Yang, Xuan , howpublished =. Tiny
[19]

Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =

Deep Residual Learning for Image Recognition , author =. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =
[20]

2019 IEEE Symposium on Security and Privacy , pages =

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks , author =. 2019 IEEE Symposium on Security and Privacy , pages =. 2019 , doi =

2019
[21]

Network and Distributed System Security Symposium , year =

The ``Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matrices , author =. Network and Distributed System Security Symposium , year =
[22]

and Kesidis, George , booktitle =

Wang, Hang and Xiang, Zhen and Miller, David J. and Kesidis, George , booktitle =. 2024 , doi =

2024
[23]

Proceedings of the 34th International Conference on Machine Learning , pages =

Understanding Black-Box Predictions via Influence Functions , author =. Proceedings of the 34th International Conference on Machine Learning , pages =
[24]

Sampling Techniques for Supervised or Unsupervised Tasks , pages =

Introduction to Core-sets: an Updated Survey , author =. Sampling Techniques for Supervised or Unsupervised Tasks , pages =
[25]

International Conference on Learning Representations , year =

Active Learning for Convolutional Neural Networks: A Core-Set Approach , author =. International Conference on Learning Representations , year =
[26]

Proceedings of the 32nd International Conference on Machine Learning , pages =

Submodularity in Data Subset Selection and Active Learning , author =. Proceedings of the 32nd International Conference on Machine Learning , pages =
[27]

Convex Optimization , author =
[28]

Proceedings of the Fifth Berkeley Symposium on Mathematical Statistics and Probability , volume =

Some Methods for Classification and Analysis of Multivariate Observations , author =. Proceedings of the Fifth Berkeley Symposium on Mathematical Statistics and Probability , volume =
[29]

Least Squares Quantization in

Lloyd, Stuart , journal =. Least Squares Quantization in
[30]

2019 , howpublished =

Jeremy Howard , title =. 2019 , howpublished =

2019
[31]

Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , year =

Jia Deng and Wei Dong and Richard Socher and Li-Jia Li and Kai Li and Li Fei-Fei , title =. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , year =
[32]

European Conference on Computer Vision , pages =

Identity Mappings in Deep Residual Networks , author =. European Conference on Computer Vision , pages =. 2016 , publisher =

2016
[33]

Pattern Recognition , volume =

Not All Samples Are Born Equal: Towards Effective Clean-Label Backdoor Attacks , author =. Pattern Recognition , volume =. 2023 , issn =

2023
[34]

International Conference on Learning Representations , year =

Revisiting the Assumption of Latent Separability for Backdoor Defenses , author =. International Conference on Learning Representations , year =
[35]

Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

Searching for MobileNetV3 , author =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =
[36]

Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =

Densely Connected Convolutional Networks , author =. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =
[37]

arXiv preprint arXiv:2104.05704 , year =

Escaping the Big Data Paradigm with Compact Transformers , author =. arXiv preprint arXiv:2104.05704 , year =

arXiv
[38]

Proceedings of the 38th International Conference on Machine Learning , series =

Learning Transferable Visual Models From Natural Language Supervision , author =. Proceedings of the 38th International Conference on Machine Learning , series =. 2021 , publisher =

2021
[39]

Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =

Aggregated Residual Transformations for Deep Neural Networks , author =. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =
[40]

Transactions on Machine Learning Research , year =

Oquab, Maxime and Darcet, Timoth. Transactions on Machine Learning Research , year =
[41]

IEEE transactions on neural networks and learning systems , volume=

Backdoor learning: A survey , author=. IEEE transactions on neural networks and learning systems , volume=. 2022 , publisher=

2022
[42]

International Journal of Computer Vision , volume=

Backdoorbench: A comprehensive benchmark and analysis of backdoor learning , author=. International Journal of Computer Vision , volume=. 2025 , publisher=

2025

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Gu, Tianyu and Dolan-Gavitt, Brendan and Garg, Siddharth , journal =

work page

[2] [2]

arXiv preprint arXiv:1712.05526 , year =

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning , author =. arXiv preprint arXiv:1712.05526 , year =

arXiv

[3] [3]

Nguyen, Tuan Anh and Tran, Anh Tuan , booktitle =

work page

[4] [4]

European Conference on Computer Vision , pages =

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks , author =. European Conference on Computer Vision , pages =

work page

[5] [5]

Technical report , year =

Clean-Label Backdoor Attacks , author =. Technical report , year =

work page

[6] [6]

Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence , pages =

Data-Efficient Backdoor Attacks , author =. Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence , pages =. 2022 , doi =

work page 2022

[7] [7]

Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attacks

Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attacks , author =. arXiv preprint arXiv:2310.09744 , year =

work page Pith review arXiv

[8] [8]

Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

Computation and Data Efficient Backdoor Attacks , author =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

work page