REVIEW 43 cited by
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
While machine learning (ML) models are being increasingly trusted to make decisions in different and varying areas, the safety of systems using such models has become an increasing concern. In particular, ML models are often trained on data from potentially untrustworthy sources, providing adversaries with the opportunity to manipulate them by inserting carefully crafted samples into the training set. Recent work has shown that this type of attack, called a poisoning attack, allows adversaries to insert backdoors or trojans into the model, enabling malicious behavior with simple external backdoor triggers at inference time and only a blackbox perspective of the model itself. Detecting this type of attack is challenging because the unexpected behavior occurs only when a backdoor trigger, which is known only to the adversary, is present. Model users, either direct users of training data or users of pre-trained model from a catalog, may not guarantee the safe operation of their ML-based system. In this paper, we propose a novel approach to backdoor detection and removal for neural networks. Through extensive experimental results, we demonstrate its effectiveness for neural networks classifying text and images. To the best of our knowledge, this is the first methodology capable of detecting poisonous data crafted to insert backdoors and repairing the model that does not require a verified and trusted dataset.
Forward citations
Cited by 43 Pith papers
-
Follow My Eyes: Backdoor Attacks on Goal-Directed Scanpath Prediction
Scene-conditioned spatial-misdirection and duration-inflation backdoors succeed at 2.5–10% poison ratios on multimodal scanpath predictors and resist five adapted defenses.
-
TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
TimeGuard employs channel-wise pool training initialized with time-aware criteria and distance-regularized loss selection to defend time series forecasting against backdoor attacks, improving robustness by 1.96x while...
-
Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions
Sparse Backdoor plants a provably undetectable backdoor in neural network weights via structured sparse perturbations and isotropic Gaussian dithering, with detection hardness reduced to Sparse PCA.
-
FFCBA: Feature-based Full-target Clean-label Backdoor Attacks
A clean-label full-target backdoor attack using class-conditional autoencoders reports above 99% attack success at 0.4% poisoning rates across datasets and models.
-
TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learning
A black-box, data-free method detects and removes patch-based trojan triggers from test images for self-supervised learning encoders.
-
BADTV: Unveiling Backdoor Threats in Third-Party Task Vectors
A composite backdoor built from the difference of two specially trained task vectors stays effective under both task addition and subtraction in task arithmetic.
-
BDefects4NN: A Backdoor Defect Database for Controlled Localization Studies in Neural Networks
A new benchmark database of 1,654 backdoor-infected DNNs with neuron-level labels shows current fault localization methods identify fewer than 20% of responsible neurons on average.
-
LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithm
LADDER uses multi-objective evolutionary optimization to craft low-frequency backdoor triggers that are simultaneously effective, invisible in spatial and spectral domains, and robust against common image preprocessing.
-
Detection of Backdoors in Trained Classifiers Without Access to the Training Set
A post-training backdoor detector for DNN image classifiers that reverse-engineers minimal class-confusing perturbations for every class pair and flags anomalous pairs via an order-statistic hypothesis test.
-
Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs
Retiming target-class neuromorphic events installs clean-label SNN backdoors with ASR up to 1.0 while leaving rate frames identical, and rate-collapsed defenses miss them.
-
How Context Attribution Handles What the Model Already Knows
Context attribution methods cannot disentangle in-context from in-weight knowledge and assign unfaithful scores under overlap; new metrics and WMDP-Cyber++ quantify the failure.
-
Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning
A unified detection and unlearning framework identifies and mitigates data poisoning in summarization models, achieving 85-92% detection and up to 96% behavior restoration across multiple architectures.
-
SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors
SCRUB-FL uses client spectral analysis and WGAN-GP to model suspicious patterns during FL training, aggregates generators server-side, then synthesizes triggers and applies unlearning to reduce backdoor success rates ...
-
Mirage: a Clean-Label Backdoor against LiDAR 3D Object Detection
Mirage achieves 73% misclassification success on LiDAR 3DOD models with 0.5% poisoning rate via label-consistent trigger injection.
-
Where Do Backdoors Live? A Component-Level Analysis of Backdoor Propagation in Speech Language Models
Backdoors propagate through SLM components with persistence or erasure depending on the targeted part, and poisoned samples are not directly separable from benign ones in shared multitask embeddings.
-
NCCR: to Evaluate the Robustness of Neural Networks and Adversarial Examples
NCCR, the change in neuron activations under random perturbation, is introduced as a robustness metric and used to flag adversarial examples and backdoor triggers.
-
When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need
Data-free distillation from non-transferable teachers fails because synthesized samples drift toward the OOD domain; ATEsc separates ID-like from OOD-like samples via adversarial robustness and improves distillation.
-
Circumventing Backdoor Space via Weight Symmetry
A weight-permutation-based two-stage mode connectivity method purifies backdoored neural networks across supervised and self-supervised learning with few clean samples.
-
Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasets
T-Core, a bootstrapping defense that sifts clean data and filters trusted encoder channels, reduces backdoor attack success rates below 10% across encoder and dataset poisoning threats in transfer learning.
-
Detecting Backdoor Samples in Contrastive Language Image Pretraining
Backdoor-poisoned CLIP training samples have unusually sparse local neighborhoods in representation space, which makes them detectable by standard local outlier detectors with high accuracy.
-
PCAP-Backdoor: Backdoor Poisoning Generator for Network Traffic in CPS/IoT Environments
PCAP-Backdoor shows that an attacker who supplies only benign raw PCAP traffic can poison a deep learning IDS so that triggered attack traffic is classified as benign.
-
Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization
Training a backdoored model with SAM instead of vanilla SGD amplifies backdoor-related neuron responses, making poisoned samples more detectable by existing methods.
-
BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation
BackdoorMBTI is the first backdoor security benchmark and toolkit that covers image, text, and audio modalities with a unified evaluation pipeline.
-
A Convolutional Layer Activation Dimensionality Reduction for Out-of-Distribution and Adversarial Attack Detection Methods
A kernel-matrix SVD followed by average pooling gives a controllable, high-compression representation of convolutional activations that preserves out-of-distribution and adversarial-attack detection performance.
-
Detecting Stealthy Data Poisoning Attacks in AI Code Generators
Spectral signatures, activation clustering, and Semgrep static analysis all fail to reliably detect triggerless targeted poisoning in AI code generators, with best F1 under 0.70 even at 20% poisoning.
-
NT-ML: Backdoor Defense via Non-target Label Training and Mutual Learning
NT-ML combines non-target label training and mutual learning to purify a backdoored model using a small set of clean samples.
-
MT4DP: Data Poisoning Attack Detection for DL-based Code Search Models via Metamorphic Testing
MT4DP flags a code search query as poisoned when rewriting it changes the ranking of code more than a threshold, but the main evaluation is weakened by synthetic trigger insertion and threshold tuning on the test set.
-
Identifying Physically Realizable Triggers for Backdoored Face Recognition Networks
A trigger-inversion plus object-retrieval pipeline finds physically realizable backdoor triggers in face recognition networks without poisoned examples.
-
TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Models
TrojanTO implants action-level backdoors into Decision Transformer style offline RL models using 10 trajectories, alternating trigger optimization and model fine-tuning, reaching average attack success 0.719 while pre...
-
TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attacks
A class-aware, layer-weighted upgrade of the TED backdoor detector that reports high precision and F1 against adaptive and combined data-poisoning attacks.
-
Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergies
The paper proposes a one-to-one mapping between six causes of distribution shift and several AI safety issues, arguing for mutual method transfer through aligned definitions.
-
Poison in the Well: Feature Embedding Disruption in Backdoor Attacks
A trigger optimized to align poisoned-image features achieves near-100% backdoor success at 0.01-0.05% poison rates on image benchmarks.
-
FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clients
FL-PLAS defends federated learning against backdoor attacks by aggregating only feature extractors and keeping classifiers client-local, reporting low backdoor accuracy with up to 90% malicious clients.
-
Filter, Obstruct and Dilute: Defending Against Backdoor Attacks on Semi-Supervised Learning
Backdoor Invalidator combines Gaussian filtering, complementary learning, and trigger mix-up to reduce backdoor attack success in semi-supervised image classifiers from 84.7% to 1.8% average while mostly preserving cl...
-
An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers
Attention-guided trigger placement with co-optimized training and alternating clean retraining achieves high backdoor attack success at low poison ratios on CNNs and vision transformers, while evading several publishe...
-
Clustering Unsupervised Representations as Defense against Poisoning Attacks on Speech Commands Classification System
Clustering DINO representations via K-means and LDA filters poisoned speech samples, reducing attack success rate from 99.75% to 0.25% at 10% poisoning level.
-
TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuning
TCAP detects backdoor samples in MLLM fine-tuning via tri-component attention profiling, GMM-based head identification, and EM vote aggregation.
-
A Robust Attack: Displacement Backdoor Attack
Displacement Backdoor Attack blends shifted self-copies of an image into the original as a backdoor trigger and reportedly maintains high attack success under data augmentation.
-
Backdoor Attacks and Defenses in Computer Vision Domain: A Survey
A literature review that classifies backdoor attacks and defenses in computer vision into a five-axis taxonomy and identifies supply-chain, hardware, and cross-task evaluation as open gaps.
-
A Survey of Secure Semantic Communications
A comprehensive survey of security and privacy challenges in semantic communication, categorized by the SemCom life cycle and paired with available defense technologies.
-
Security-First AI: Foundations for Robust and Trustworthy Systems
A security-first position paper that surveys AI threat models, attack vectors, and defenses, and argues that security is the prerequisite for AI safety.
-
A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations
A literature review that taxonomizes LLM backdoor attacks and defenses by model construction phase, with no new experimental results.
-
Security and Privacy of Digital Twins for Advanced Manufacturing: A Survey
A survey of cybersecurity and privacy risks for manufacturing digital twins, grouping threats and defenses into data collection, data sharing, machine learning, and system-level security.
Discussion (0). Continue with ORCID to comment.