MergeGuard: Efficient Thwarting of Trojan Attacks in Machine Learning Models

Farinaz Koushanfar; Soheil Zibakhsh Shabgahi; Yaman Jandali

REVIEW 4 major objections 5 minor 28 references

MergeGuard: Efficient Thwarting of Trojan Attacks in Machine Learning Models

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MergeGuard removes trojan backdoors from trained models by linearizing and merging fully connected layers, preserving accuracy while sharply cutting attack success rate.

desk verdict A promising post-training backdoor defense for ViTs that consistently lowers ASR, but the paper overstates accuracy preservation and leans on an untested layer-selection hypothesis. read the letter →

arxiv 2505.04015 v1 pith:NZKCRCSN submitted 2025-05-06 cs.CR cs.AI

Soheil Zibakhsh Shabgahi , Yaman Jandali , Farinaz Koushanfar This is my paper · ORCID

classification cs.CRcs.AI

keywords trojanattacksbackdoordefensemodelcompressionlayermergingVisionTransformerPReLUlinearizationpost-trainingattacksuccessrate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MergeGuard is a post-training defense against trojan (backdoor) attacks that works by nudging activation functions toward linearity and then fusing adjacent fully connected layers into a single equivalent layer. The paper's key claim is that this fusion deletes terminal-layer neurons that encode the trigger, so the model becomes clean without retraining from scratch. On CIFAR-10, the method keeps Vision Transformer test accuracy near the trojaned baseline (93.2% vs. 94.7%) while lowering average attack success rate from 93.5% to 5.2%, and it outperforms standard fine-tuning, Fine-Pruning, FTSAM, and Neural Cleanse, several of which leave ASR above 25% on transformers. Because the same procedure also reduces parameter count by up to 15% and runs much faster, the paper argues that compression and trojan mitigation can be achieved in one pass.

What carries the argument

The load-bearing object is the mergeable layer: two consecutive fully connected (or convolutional) layers separated by a PReLU activation $\mathrm{PReLU}_\alpha(x)=\max(0,x)+\alpha\min(0,x)$. As $\alpha$ approaches 1, the PReLU becomes the identity, and the composition collapses to one equivalent linear layer, so the network depth drops by one with zero additional error if $\alpha=1$ exactly. The regularizer $(1-\alpha)^2$ added to the cross-entropy loss during a brief fine-tuning on clean data is what drives this collapse, and the paper proves that for any $\delta\in[0,1]$, the probability that $|Y_{\mathrm{linear}}-Y_\alpha|^2$ exceeds $C(1-\alpha)^2$ is below $\delta$, with $C$ depending on the largest singular value of $W_2W_1$. In the experiments, regularization is applied only to the last three layers of PreAct-ResNet18 and the last four layers of the Vision Transformer, reflecting the paper's working conjecture that trojan-related neurons concentrate in terminal layers.

What would settle it

Train or obtain a trojaned model whose backdoor is planted in early layers (for example, by poisoning the patch embedding or first encoder blocks of a Vision Transformer, or by an attack that places the trigger pattern in a mid-network residual path), run MergeGuard under the same protocol, and measure attack success rate. If ASR stays high while accuracy is preserved, the terminal-layer premise fails. A simpler version: apply MergeGuard to different layer subsets of the same trojaned model and check whether ASR reduction changes substantially, which would show whether the fixed last-layer choice is essential.

Watch

Extended reading notes

Core claim

MergeGuard's central claim is that trojan mitigation can be achieved by post-training compression of the final fully connected blocks. Starting from a trojaned model and a small clean dataset, the method fine-tunes with a regularizer that penalizes $(1-\alpha)^2$ for PReLU-family activations, driving the slope $\alpha$ toward 1 so that the activation approximates the identity. Two adjacent linear layers then collapse into a single layer with weight $W_2 W_1$ and bias $W_2 b_1 + b_2$, removing the intermediate layer and the backdoor-related neurons it contains. The paper derives a probabilistic bound showing the error of this linearization is controlled by $(1-\alpha)^2$, and it evaluates the procedure on PreAct-ResNet18 and ViT-base-16 against five attacks (TrojanNN, WaNet, BadNet, Blended, SIG), reporting that on Vision Transformers MergeGuard keeps accuracy essentially intact while reducing average attack success rate from 93.5% to 5.2%—a result no compared method achieves. The paper further claims that the same mechanism yields a 15% parameter reduction and 14% MAC reduction on ViT, and that the defense is model-agnostic.

Load-bearing premise

The load-bearing premise is that trojan-related neurons are concentrated in the terminal fully connected layers, so compressing only the last few layers removes the trigger; the paper relies on this conjecture without ablating other layer choices.

Editorial extensions

If this is right

Transformer models acquired from untrusted sources can be cleansed with a short fine-tuning on a small clean dataset, without per-class trigger reverse engineering.
The mitigation comes with compression: on ViT-base-16, parameter count drops 15% and MACs drop 14% with negligible accuracy loss.
Because MergeGuard is orders of magnitude faster than Fine-Pruning and Neural Cleanse, it is practical for large models where those methods are prohibitive.
The method generalizes to convolutional architectures such as PreAct-ResNet18, though the compression ratio can be negative in bottleneck-shaped MLPs, so layer choice matters.
Existing cleansing methods should not be assumed to transfer from CNNs to vision transformers; the paper's comparison documents that standard fine-tuning and FTSAM often leave ASR near 100% on ViT.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If terminal-layer concentration is not universal, MergeGuard could be combined with a weight-signature scan to select which layers to linearize; the same regularizer could then serve as a per-layer trojan probe, since layers that resist linearization are likely to carry trigger-specific nonlinear structure.
Because the regularizer strength is fixed at 1 in all experiments, there is likely a trade-off frontier between ASR reduction and accuracy; sweeping the coefficient could let practitioners tune the defense for a given deployment risk.
The layer-merging operation changes the model's function class, so it may also alter robustness to adversarial perturbations or out-of-distribution inputs; measuring those before and after could reveal side effects beyond trojan removal.
The compression ratio formula shows bottleneck MLPs can expand rather than compress, so on architectures with narrow hidden layers MergeGuard would need to be applied to wider blocks only—a constraint the paper flags but does not turn into a design rule.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The useful core of this paper is a real empirical finding: linearizing and merging the last few fully connected layers of a trojaned Vision Transformer drops attack success rate from 90+% to single digits across five backdoor attacks, while fine-tuning, FTSAM, and Neural Cleanse each fail on at least one attack. That is a meaningful result for a model class where defenses often don't transfer, and the speed advantage (10–17x over FP/NC) makes it practical. The compression effect (15% parameter reduction) is a bonus.

The method itself is simple: add a regularizer that pushes PReLU slopes toward 1, then merge adjacent linear layers. The novelty isn't the compression trick; it's applying it as Trojan mitigation and showing it works on ViTs. The paper is reasonably honest about the components being known.

The main weaknesses are the following. (1) The abstract says the method “simultaneously improves model generalizability and performance.” Table II shows the opposite on ViTs—accuracy drops by 1.5 to 5.4 points depending on attack. That claim needs to be corrected. (2) Layer selection is the load-bearing assumption. They regularize the last three/four layers based on a conjecture from their own prior work [8], and the conclusion admits layer-selection algorithms are future work. No ablation tests other layer sets, so we don't know whether the ASR drop comes from removing terminal layers specifically or just from compressing any part of the network. Without that, the stated mechanism (“removing layers containing backdoor-related neurons”) is unverified. (3) There are no error bars or multiple seeds; this is a single-run comparison, which is thin for a security claim. (4) The bound in Eq. (4) is asserted without proof. It's not central to the empirical story, but it should either be proved or explicitly labeled as a conjecture.

None of these are fatal. The core result is that a simple post-processing regularizer consistently reduces ASR on ViTs where other defenses fail. That is worth publishing after revision. The paper also provides code, which helps reproducibility.

Who this is for: researchers working on backdoor defenses, especially for transformer architectures. It's not a full solution; it's one more tool, and a cheap one. The unvalidated layer-selection heuristic is a clear gap for follow-up work.

I'd send this to peer review, expecting the authors to add layer-selection ablations, error bars, and correct the abstract. The idea deserves referee time.

Referee Report

4 major / 5 minor

Summary. MergeGuard is a post-training defense against Trojan/backdoor attacks. It adds a regularization term to a fine-tuning objective that drives the negative slope of PReLU (and similar) activations toward 1, allowing consecutive fully connected layers to be merged into a single equivalent linear layer; the authors argue that this removes layers containing backdoor-related neurons. The method is evaluated on CIFAR-10 against TrojanNN, WaNet, BadNet, Blended, and SIG on PreAct-ResNet18 and ViT-base-16, and compared with fine-tuning, Fine-Pruning, FTSAM, and Neural Cleanse. The paper reports lower average ASR, faster runtime, and a 15% parameter reduction on the ViT, and claims that MergeGuard maintains model accuracy and generalizability.

Significance. If the claims hold, MergeGuard would be a practical, architecture-agnostic mitigation that doubles as a compression method, with particular value for Vision Transformers where existing defenses struggle. The paper's strengths include an open-source implementation, evaluation against five attacks on two architectures, and a clearly stated threat model. However, the central claims are currently conditional: the key probabilistic bound in Eq. (4) is asserted without proof, the layer-selection heuristic rests on a self-cited conjecture, the ViT results in Table II show nontrivial accuracy drops, and no error bars or ablations are reported. These gaps prevent the paper from supporting its strong conclusions as written.

major comments (4)

[Section III-D, Eq. (4)] Equation (4) is asserted with the phrase 'It can be shown' but no proof is given. This bound is load-bearing because it justifies the (1 - alpha)^2 regularizer used throughout the method. Please provide a complete derivation, specify whether the input X is treated as a vector or scalar in the absolute value, state the exact conditions on W1, W2, b1, b2 under which C is finite, and clarify whether the bound holds uniformly during training as alpha changes. Without this proof, the theoretical grounding of MergeGuard is incomplete.
[Section IV-A] The core mechanism assumes that backdoor-related neurons are concentrated in the terminal fully connected layers, but the supporting citation [8] is an earlier work from the same research group, and no ablation varies the set of regularized layers. The paper's own conclusion lists 'developing algorithms for the selection of MergeGuard layers' as future work, confirming that this choice is a heuristic. Please add an ablation that, for example, regularizes earlier layers, a random layer subset, or the full network, and report ASR and test accuracy for each choice. Without such an experiment, the observed ASR reduction cannot be cleanly attributed to terminal-layer trojan removal rather than to generic perturbation or compression effects.
[Table II and Abstract] The abstract claims MergeGuard 'maintains model accuracy,' but Table II shows ViT test accuracy drops from 98.03 to 92.70 for TrojanNN, from 98.16 to 92.71 for Blended, and from 95.85 to 93.55 for BadNet, i.e., drops of 1.5 to 5.4 points relative to the trojaned baseline. In addition, for TrojanNN and BadNet the post-MergeGuard ASR (7.39% and 11.38%) is higher than after Neural Cleanse (0.72% and 0.27%), so the claim of consistently outperforming existing defenses is too strong as stated. Please revise the claims, quantify the accuracy trade-off, and report error bars over multiple runs.
[Tables I and II, Section IV-B] No standard deviations, confidence intervals, or repeated-run results are reported for any defense. Given that the differences between methods are sometimes small and that fine-tuning on only 5% of the clean dataset will have nontrivial variance, single runs do not support the comparative conclusions drawn in the text. Please report mean and standard deviation over at least three random seeds, and disclose the grid-searched learning rates and other hyperparameters for each defense in the main text or supplement.

minor comments (5)

[Introduction, Section I] There is a typo: 'exeptional' should be 'exceptional'.
[Section III-E, Eq. (6)] The compression ratio formula omits bias terms and assumes a particular parameter count; please state explicitly whether biases are counted and give the exact expression used to compute the 15% parameter reduction reported in Section IV.
[Section III-G] The notation for the ELU variant is confusing: beta is introduced as the ELU parameter and later alpha controls the linear/nonlinear balance, but the relationship between alpha, beta, and the original ELU is not specified. Please clarify how alpha is optimized and how this variant connects to the proof of Eq. (4).
[Section IV-B, Figure 3] The expansion 'Feature Squeezing and Model Augmentation (FTSAM)' appears to be incorrect; FTSAM in reference [12] stands for fine-tuning with sharpness-aware minimization. Please correct the terminology.
[Section IV-A] The phrase 'architecture-agnostic' is used repeatedly, but only two architectures are evaluated; please either test at least one additional architecture family (e.g., a transformer beyond ViT-base or a different CNN) or qualify the claim as applying to the tested architectures.

Circularity Check

1 steps flagged · score 4.0 of 10

Moderate circularity: MergeGuard's terminal-layer selection is a self-cited conjecture, not a derived or ablated component, though the linearize-and-merge core is self-contained.

self citation load bearing [Section IV-A (Defense Configuration); see also Section V]
"In our approach, presuming the trojan's presence in the terminal layers based on the conjectures of previous works [8], we apply regularization to the last three layers of the PreAct-Resnet18 and the last four layers of the Vision Transformer."

MergeGuard's stated mechanism is 'removing the layers containing backdoor-related neurons' (Section I), but the operational choice of which layers to remove is justified only by reference [8], which shares co-author Koushanfar with the present paper. The paper itself calls the basis a 'conjecture' and provides no ablation comparing other layer selections; the conclusion lists 'developing algorithms for the selection of MergeGuard layers' as future work. The reported ASR reductions therefore depend on an unverified, self-cited premise about backdoors residing in terminal layers.

full rationale

The formal core of MergeGuard is not circular: Section III-D defines Y_linear as the two-layer block with the PReLU replaced by identity, proves a concentration bound on the difference Y_linear - Y_alpha, and adds (1-alpha)^2 as a regularizer. Merging when alpha reaches 1 is then exact by linear algebra, and the compression-ratio formulas in Section III-E are definitions. The empirical comparisons in Tables I and II are genuine experiments against FT, FP, FTSAM, and NC, and no ASR value is used to fit the regularizer. The circularity concern is localized and real: the layer-selection premise is load-bearing, imported from a self-cited prior work, not ablated, and explicitly labeled as future work. This does not collapse the entire derivation into its inputs, so a score in the low-to-middle range is appropriate rather than a charge of full circularity.

Assumptions & free parameters 3 free parameters · 2 assumptions · 0 invented entities

The central claim rests on a small set of assumptions: an unproven probabilistic bound on linearization error (Eq. 4), a self-cited conjecture about where backdoors live, and fixed hyperparameters (regularization strength, number of compressed layers). No new entities are introduced. The claims are mostly empirical, so the ledger is short.

free parameters (3)

regularization strength = 1
Set to 1 in all experiments with no ablation or tuning procedure reported. It controls the tradeoff between layer linearization and accuracy.
number of layers compressed = 3 for PreAct-ResNet18, 4 for ViT
Chosen based on a self-cited conjecture that trojans are in terminal layers; no ablation across layer choices.
per-method learning rates = not reported; grid-selected to maximize ASR reduction
Grid search was performed for each defense, but the chosen values are not listed in the paper, making reproduction harder and potentially overfitting to the attacks tested.

assumptions (2)

ad hoc to paper The probabilistic bound in Eq. (4) holds as stated: for any delta and any distribution of X, P(|Ylinear-Yalpha|^2 <= C(1-alpha)^2) > 1-delta.
Stated as 'It can be shown' with no proof. It motivates the regularizer but is not used in the empirical evaluation.
domain assumption Backdoor-related neurons are concentrated in the terminal fully connected layers of the network.
Invoked in Section IV-A to justify compressing only the last few layers; based on prior work by the authors (ref [8]) and not validated in this paper.

how reviews work

0 comments

Cite this review

Pith. "Pith review of MergeGuard: Efficient Thwarting of Trojan Attacks in Machine Learning Models." pith.science (2026). https://pith.science/paper/NZKCRCSN

@misc{pith2026250504015,
  author       = {Pith},
  title        = {Pith review of: MergeGuard: Efficient Thwarting of Trojan Attacks in Machine Learning Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NZKCRCSN}},
  note         = {Machine review of arXiv:2505.04015}
}

read the original abstract

This paper proposes MergeGuard, a novel methodology for mitigation of AI Trojan attacks. Trojan attacks on AI models cause inputs embedded with triggers to be misclassified to an adversary's target class, posing a significant threat to model usability trained by an untrusted third party. The core of MergeGuard is a new post-training methodology for linearizing and merging fully connected layers which we show simultaneously improves model generalizability and performance. Our Proof of Concept evaluation on Transformer models demonstrates that MergeGuard maintains model accuracy while decreasing trojan attack success rate, outperforming commonly used (post-training) Trojan mitigation by fine-tuning methodologies.

Figures

Figures reproduced from arXiv: 2505.04015 by the authors.

**Figure 2.** Illustration of the proposed MergeGuard methodology for mitigating trojans in neural networks. (a) Identification of a potentially compromised layer suspected to contain a trojan. (b) Application of fine-tuning with the regularization strategy described in Section III-C, designed to incrementally guide the activation towards linearity. (c) Post-tuning, the activation function approximates an identity function. (d) S… view at source ↗

**Figure 3.** Computational time for mitigation strategies on ViT. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 15 canonical work pages

[8]

Trojan signatures in dnn weights,

G. Fields, M. Samragh, M. Javaheripi, F. Koushanfar, and T. Javidi, “Trojan signatures in dnn weights,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 12–20, 2021

work page 2021
[1]

Scaling laws for neural language models,

J. Kaplan, S. McCandlish, T. Henighan, T. B. Brown, B. Chess, R. Child, S. Gray, A. Radford, J. Wu, and D. Amodei, “Scaling laws for neural language models,” arXiv preprint arXiv:2001.08361 , 2020

arXiv 2001
[2]

Model complexity of deep learning: A survey,

X. Hu, L. Chu, J. Pei, W. Liu, and J. Bian, “Model complexity of deep learning: A survey,” Knowledge and Information Systems , vol. 63, pp. 2585–2619, 2021

2021
[4]

Backdoor learning: A survey,

Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , vol. 35, no. 1, pp. 5–22, 2022

2022
[5]

Computing systems for autonomous driving: State of the art and challenges,

L. Liu, S. Lu, R. Zhong, B. Wu, Y . Yao, Q. Zhang, and W. Shi, “Computing systems for autonomous driving: State of the art and challenges,” IEEE Internet of Things Journal , vol. 8, no. 8, pp. 6469– 6486, 2020

2020
[6]

Machine learning for medical imaging,

B. J. Erickson, P. Korfiatis, Z. Akkus, and T. L. Kline, “Machine learning for medical imaging,” radiographics, vol. 37, no. 2, pp. 505–515, 2017

work page 2017
[7]

Machine learning for quantitative finance applications: A survey,

F. Rundo, F. Trenta, A. L. Di Stallo, and S. Battiato, “Machine learning for quantitative finance applications: A survey,” Applied Sciences, vol. 9, no. 24, p. 5574, 2019

work page 2019
[9]

Cleann: Accelerated trojan shield for embedded neural networks,

M. Javaheripi, M. Samragh, G. Fields, T. Javidi, and F. Koushanfar, “Cleann: Accelerated trojan shield for embedded neural networks,” in Proceedings of the 39th International Conference on Computer-Aided Design, pp. 1–9, 2020

work page 2020

Show all 28 references

[10]

Anti-backdoor learning: Training clean models on poisoned data,

Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” Advances in Neural Information Processing Systems , vol. 34, pp. 14900–14912, 2021

2021
[11]

Backdoorbench: A comprehensive benchmark of backdoor learning,

B. Wu, H. Chen, M. Zhang, Z. Zhu, S. Wei, D. Yuan, and C. Shen, “Backdoorbench: A comprehensive benchmark of backdoor learning,” Advances in Neural Information Processing Systems, vol. 35, pp. 10546– 10559, 2022

2022
[12]

Enhancing fine- tuning based backdoor defense with sharpness-aware minimization,

M. Zhu, S. Wei, L. Shen, Y . Fan, and B. Wu, “Enhancing fine- tuning based backdoor defense with sharpness-aware minimization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4466–4477, 2023

2023
[13]

Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE symposium on security and privacy (SP), pp. 707–723, IEEE, 2019

2019
[14]

Ast: Audio spectrogram trans- former,

Y . Gong, Y .-A. Chung, and J. Glass, “Ast: Audio spectrogram trans- former,” arXiv preprint arXiv:2104.01778 , 2021

2021 arXiv
[15]

St-adapter: Parameter- efficient image-to-video transfer learning,

J. Pan, Z. Lin, X. Zhu, J. Shao, and H. Li, “St-adapter: Parameter- efficient image-to-video transfer learning,” Advances in Neural Infor- mation Processing Systems , vol. 35, pp. 26462–26477, 2022

2022
[16]

A closer look at robustness of vision transformers to backdoor attacks,

A. Subramanya, S. A. Koohpayegani, A. Saha, A. Tejankar, and H. Pirsiavash, “A closer look at robustness of vision transformers to backdoor attacks,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pp. 3874–3883, 2024

2024
[17]

Adversarial attacks on deep-learning models in natural language processing: A survey,

W. E. Zhang, Q. Z. Sheng, A. Alhazmi, and C. Li, “Adversarial attacks on deep-learning models in natural language processing: A survey,”ACM Transactions on Intelligent Systems and Technology (TIST) , vol. 11, no. 3, pp. 1–41, 2020

2020
[18]

Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017. 2https://github.com/yjandali/BackdoorBench-MergeGuard

2017 arXiv
[19]

Targeted backdoor attacks on deep learning systems using data poisoning,

X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

2017 arXiv
[20]

Trojaning attack on neural networks,

Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in 25th Annual Network And Distributed System Security Symposium (NDSS 2018) , Internet Soc, 2018

2018
[21]

Wanet–imperceptible warping-based backdoor attack,

A. Nguyen and A. Tran, “Wanet–imperceptible warping-based backdoor attack,” arXiv preprint arXiv:2102.10369 , 2021

2021 arXiv
[22]

A new backdoor attack in cnns by training set corruption without label poisoning,

M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in 2019 IEEE International Conference on Image Processing (ICIP) , pp. 101–105, IEEE, 2019

2019
[23]

Neural trojans,

Y . Liu, Y . Xie, and A. Srivastava, “Neural trojans,” in 2017 IEEE International Conference on Computer Design (ICCD) , pp. 45–48, IEEE, 2017

2017
[24]

Fine-pruning: Defending against backdooring attacks on deep neural networks,

K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International sym- posium on research in attacks, intrusions, and defenses , pp. 273–294, Springer, 2018

2018
[25]

Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,

K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,” in Proceedings of the IEEE international conference on computer vision , pp. 1026–1034, 2015

2015
[26]

Fast and accurate deep network learning by exponential linear units (elus),

D.-A. Clevert, “Fast and accurate deep network learning by exponential linear units (elus),” arXiv preprint arXiv:1511.07289 , 2015

2015 arXiv
[27]

Gaussian error linear units (gelus),

D. Hendrycks and K. Gimpel, “Gaussian error linear units (gelus),” arXiv preprint arXiv:1606.08415, 2016

2016 arXiv
[28]

Sigmoid-weighted linear units for neural network function approximation in reinforcement learning,

S. Elfwing, E. Uchibe, and K. Doya, “Sigmoid-weighted linear units for neural network function approximation in reinforcement learning,” Neural networks, vol. 107, pp. 3–11, 2018

2018
[29]

Cifar-10 (canadian institute for advanced research),

A. Krizhevsky, V . Nair, and G. Hinton, “Cifar-10 (canadian institute for advanced research),”

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [8]

Trojan signatures in dnn weights,

G. Fields, M. Samragh, M. Javaheripi, F. Koushanfar, and T. Javidi, “Trojan signatures in dnn weights,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 12–20, 2021

work page 2021

[2] [1]

Scaling laws for neural language models,

J. Kaplan, S. McCandlish, T. Henighan, T. B. Brown, B. Chess, R. Child, S. Gray, A. Radford, J. Wu, and D. Amodei, “Scaling laws for neural language models,” arXiv preprint arXiv:2001.08361 , 2020

arXiv 2001

[3] [2]

Model complexity of deep learning: A survey,

X. Hu, L. Chu, J. Pei, W. Liu, and J. Bian, “Model complexity of deep learning: A survey,” Knowledge and Information Systems , vol. 63, pp. 2585–2619, 2021

2021

[4] [4]

Backdoor learning: A survey,

Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , vol. 35, no. 1, pp. 5–22, 2022

2022

[5] [5]

Computing systems for autonomous driving: State of the art and challenges,

L. Liu, S. Lu, R. Zhong, B. Wu, Y . Yao, Q. Zhang, and W. Shi, “Computing systems for autonomous driving: State of the art and challenges,” IEEE Internet of Things Journal , vol. 8, no. 8, pp. 6469– 6486, 2020

2020

[6] [6]

Machine learning for medical imaging,

B. J. Erickson, P. Korfiatis, Z. Akkus, and T. L. Kline, “Machine learning for medical imaging,” radiographics, vol. 37, no. 2, pp. 505–515, 2017

work page 2017

[7] [7]

Machine learning for quantitative finance applications: A survey,

F. Rundo, F. Trenta, A. L. Di Stallo, and S. Battiato, “Machine learning for quantitative finance applications: A survey,” Applied Sciences, vol. 9, no. 24, p. 5574, 2019

work page 2019

[8] [9]

Cleann: Accelerated trojan shield for embedded neural networks,

M. Javaheripi, M. Samragh, G. Fields, T. Javidi, and F. Koushanfar, “Cleann: Accelerated trojan shield for embedded neural networks,” in Proceedings of the 39th International Conference on Computer-Aided Design, pp. 1–9, 2020

work page 2020