Pith. sign in

REVIEW 4 major objections 2 minor 1 cited by

A sparse, dithered perturbation plants a white-box-undetectable backdoor in pre-trained image classifiers, as hard to detect as Sparse PCA.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-12 17:35 UTC pith:XGYKGKEL

load-bearing objection Abstract-only Sparse Backdoor claim: white-box undetectability reduced to Sparse PCA; coherent and potentially important, but uncheckable without proofs. the 4 major comments →

arxiv 2605.04209 v2 pith:XGYKGKEL submitted 2026-05-05 cs.CR cs.AIcs.LG

Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions

Sarthak Choudhary , Atharv Singh Patlan , Nils Palumbo , Ashish Hooda , Kassem Fawaz , Somesh Jha This is my paper
classification cs.CR cs.AIcs.LG
keywords undetectable backdoorsparse perturbationSparse PCAsupply-chain attackwhite-box undetectabilityGaussian ditherimage classifiersVision Transformers
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper shows how to plant a backdoor in a pre-trained image classifier so that no efficient adversary with full access to the weights can tell the model has been tampered with. The attack, called Sparse Backdoor, injects a carefully structured sparse change into a few columns of each fully connected layer, sending a hidden trigger signal to a chosen target class, then hides that change under isotropic Gaussian noise. Under a mild margin condition the noisy reference model still classifies clean data exactly like the original network, so accuracy and decision boundaries are preserved. Distinguishing the backdoored weights from this reference is proved to be at least as hard as the Sparse PCA detection problem, which is believed to be computationally infeasible. The guarantee therefore holds against any probabilistic polynomial-time distinguisher that sees the entire parameter vector. A sympathetic reader cares because the result converts a statistical hardness assumption into a concrete supply-chain threat: a model can leave the training pipeline already compromised, yet pass every white-box inspection that runs in polynomial time.

Core claim

Sparse Backdoor injects a structured sparse perturbation along a random direction into a small subset of columns at each fully connected layer of a pre-trained classifier, propagates a trigger to an adversary-chosen class, and masks the change with independent isotropic Gaussian dither. Under a mild margin condition the dithered reference remains functionally equivalent to the original network, and distinguishing the backdoored model from this reference is computationally at least as hard as Sparse PCA detection.

What carries the argument

The structured sparse column perturbation masked by isotropic Gaussian dither: the sparse signal carries the backdoor while the dither creates a clean reference distribution against which any white-box distinguisher must succeed, reducing detection to Sparse PCA hardness.

Load-bearing premise

A mild margin condition on the pre-trained classifier must hold so that the added Gaussian dither leaves clean accuracy and decision boundaries unchanged; if the margin fails, either accuracy drops (revealing the attack) or the backdoor is no longer stealthy.

What would settle it

Exhibit a probabilistic polynomial-time algorithm that, given white-box access to the weights, distinguishes a Sparse-Backdoor-injected model from its dithered reference with non-negligible advantage, or show that Sparse PCA detection itself is computationally feasible under the same parameter regimes.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Any polynomial-time white-box inspection of the released weights cannot reliably detect the planted backdoor.
  • The same construction applies to both convolutional networks and Vision Transformers that contain fully connected layers.
  • Supply-chain consumers who accept pre-trained models cannot rely on parameter-space statistical tests to certify the absence of such backdoors.
  • Functional equivalence of the dithered reference implies clean accuracy and decision boundaries remain intact under the margin condition.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the hardness reduction is tight, black-box trigger detection or input-space anomaly tests become the only remaining practical defenses.
  • The same sparse-plus-dither template may transfer to other high-dimensional parameter spaces such as language-model embeddings or reinforcement-learning policies.
  • Tightening the margin condition or removing it would strengthen the result; verifying how often real pre-trained models satisfy it is an immediate empirical check.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 2 minor

Summary. The manuscript proposes Sparse Backdoor, a supply-chain attack that plants a backdoor in pre-trained image classifiers (CNNs and Vision Transformers) by injecting a structured sparse column perturbation along a random direction into a small subset of columns at each fully connected layer, thereby propagating a trigger signal to an adversary-chosen target class, and masking the perturbation with an independent isotropic Gaussian dither. The dither is introduced solely to induce a clean reference distribution anchored at the pre-trained weights. Under a mild margin condition on the pre-trained classifier, the dithered reference is claimed to be functionally equivalent to the original model. The central theoretical claim is a computational reduction: distinguishing the backdoor-injected parameters from this dithered reference is at least as hard as Sparse PCA detection, and is therefore computationally infeasible under standard hardness assumptions, even for any probabilistic polynomial-time distinguisher with white-box access to the parameters.

Significance. If the reduction and functional-equivalence arguments hold as stated, the work would be a meaningful contribution to the foundations of supply-chain and parameter-level backdoor security. Anchoring undetectability in a well-studied computational problem (Sparse PCA) rather than in heuristic stealth metrics is a strong framing, and an explicit white-box hardness guarantee against PPT distinguishers would raise the bar relative to much of the empirical backdoor literature. The construction itself (structured sparse column support plus isotropic dither) is concrete and, in principle, falsifiable. Because the full proofs, constants, regime conditions, and any empirical validation are not available in the material under review, significance remains conditional on those load-bearing pieces checking out.

major comments (4)
  1. The central hardness claim (white-box distinguishability of the sparse-backdoor model from its dithered reference is at least as hard as Sparse PCA detection) cannot be verified from the abstract alone. The reduction steps—how the structured sparse column perturbations map onto a Sparse PCA instance, how the isotropic dither induces the null/reference distribution, and whether multi-layer composition preserves the hardness—are load-bearing for the main theorem and must be inspectable (statement, proof, and parameter regime) before the claim can be accepted.
  2. The mild margin condition is the weakest modeling assumption and is load-bearing for functional equivalence of the dithered reference (and thus for stealth via preserved clean accuracy). The abstract does not state the precise margin threshold relative to dither variance, nor whether the condition is required layer-wise or only at the output, nor how margins accumulate under composition through multiple fully connected layers. Without that statement, it is unclear whether the condition holds for standard pre-trained CNNs/ViTs or only in restricted regimes; if it fails, the attack either becomes detectable via accuracy drop or ceases to be a stealthy backdoor.
  3. Applicability to the claimed architecture classes (convolutional networks and Vision Transformers) hinges on the presence and role of fully connected layers, since the construction injects sparse column perturbations at each fully connected layer. Many modern CNNs and ViT variants have few or no classical FC layers outside a final head; the abstract does not clarify how the trigger signal is propagated when FC layers are sparse, absent, or replaced by attention/MLP blocks. This is load-bearing for the claim that the attack works on the stated model families.
  4. The free parameters of the construction—sparsity/support size of the column perturbations and Gaussian dither variance—must sit in a regime where Sparse PCA is computationally hard and where the margin condition still yields functional equivalence. The abstract does not specify how these parameters are chosen relative to ambient dimension, number of layers, or pre-trained margins. Without that calibration, the hardness and stealth claims may occupy incompatible regimes.
minor comments (2)
  1. The abstract is clear on the high-level construction and the role of the dither, but a full manuscript should make the margin condition, the exact Sparse PCA problem formulation used in the reduction, and the multi-layer propagation argument explicit early (e.g., in a formal problem statement and theorem statements).
  2. If experiments are included in the full paper, they should report clean accuracy under the chosen dither variance, attack success rate under the sparse trigger, and any empirical distinguishability baselines, so that the margin and hardness regimes can be checked against practice.

Circularity Check

0 steps flagged

No significant circularity in the abstract: undetectability is a hardness reduction to Sparse PCA, not a self-defined or fitted claim.

full rationale

Only the abstract is available, so the analysis is limited to the stated derivation chain. The paper claims a supply-chain backdoor that injects a structured sparse perturbation plus isotropic Gaussian dither, then proves that distinguishing the backdoored parameters from the dithered reference is at least as hard as Sparse PCA detection under standard hardness assumptions, for any PPT white-box distinguisher. The dither is introduced solely to anchor a clean reference distribution against which undetectability is formalized; under a mild margin condition the dithered reference remains functionally equivalent to the original classifier. That is a standard reduction-style argument: the conclusion is not defined in terms of the inputs, no parameter is fitted to data and then re-labeled a prediction, and no self-citation or uniqueness theorem from the same authors is invoked in the abstract. The margin condition is an explicit modeling assumption, not a circular premise. Nothing in the available text exhibits a self-definitional step, a fitted-input-called-prediction, or a load-bearing self-citation chain. Residual risk that the full (unavailable) proof might hide a circular reduction cannot be converted into a circularity finding without quotable equations; under the hard rules this is therefore an honest non-finding with score 0 and empty steps.

Axiom & Free-Parameter Ledger

2 free parameters · 3 axioms · 1 invented entities

From the abstract alone the central claim rests on (1) the computational hardness of Sparse PCA detection under standard assumptions, (2) a mild margin condition that makes the dithered model functionally equivalent to the clean pre-trained classifier, and (3) the existence of a structured sparse perturbation that propagates a trigger to a target class through FC layers. No numeric free parameters are fitted in the abstract; the dither variance and sparsity level are construction choices whose concrete values are not given. No new physical entities are invented; the 'backdoor' is an algorithmic construction.

free parameters (2)
  • sparsity level / support size of column perturbations
    The attack injects a sparse perturbation into a small subset of columns; the exact sparsity is a free design parameter that must be chosen small enough for hardness yet large enough for trigger propagation. Value not stated in abstract.
  • Gaussian dither variance
    Isotropic Gaussian noise scale that masks the sparse secret and defines the clean reference distribution. Must be large enough for undetectability yet small enough to preserve the margin condition. Value not stated.
axioms (3)
  • domain assumption Sparse PCA detection is computationally hard for probabilistic polynomial-time algorithms under standard hardness assumptions
    The undetectability proof reduces white-box distinguishability of the backdoored model from the dithered reference to Sparse PCA detection; if Sparse PCA is easy the guarantee collapses.
  • domain assumption Mild margin condition on the pre-trained classifier
    Required so that adding isotropic Gaussian dither leaves the classifier functionally equivalent to the original; without it the reference itself may be distinguishable by accuracy or decision-boundary tests.
  • standard math Standard asymptotic computational complexity (PPT distinguishers, high-dimensional regime)
    Hardness is stated against probabilistic polynomial-time algorithms in the high-dimensional setting typical of Sparse PCA analyses.
invented entities (1)
  • Sparse Backdoor construction (structured sparse column perturbation + isotropic Gaussian dither) no independent evidence
    purpose: Plant a trigger-propagating secret in FC-layer weights while inducing a clean reference distribution against which undetectability is formalized
    The construction is the paper's main technical object; it is an algorithmic artifact rather than a new physical particle or force. Independent evidence would be empirical detection failure or a published hardness reduction; neither is inspectable from the abstract alone.

pith-pipeline@v1.1.0-grok45 · 6095 in / 2528 out tokens · 28222 ms · 2026-07-12T17:35:04.434718+00:00 · methodology

0 comments
read the original abstract

We present Sparse Backdoor, a supply-chain attack that plants a provably undetectable backdoor in pre-trained image classifiers, including convolutional networks and Vision Transformers. The attack injects a structured sparse perturbation along a randomly chosen direction into a small subset of columns at each fully connected layer, propagating a trigger signal to an adversary-chosen target class, and masks the perturbation with an independent isotropic Gaussian dither. The dither serves a single technical purpose: it induces a clean reference distribution anchored at the pre-trained weights, against which undetectability can be formalized. Under a mild margin condition on the pre-trained classifier, we show that the dithered reference is functionally equivalent to the original classifier. We prove that distinguishing the backdoor-injected model from this reference is at least as hard as Sparse PCA detection, which is computationally infeasible under standard hardness assumptions. The guarantee holds against any probabilistic polynomial-time distinguisher with white-box access to the parameters.

Figures

Figures reproduced from arXiv: 2605.04209 by Ashish Hooda, Atharv Singh Patlan, Kassem Fawaz, Nils Palumbo, Sarthak Choudhary, Somesh Jha.

Figure 1
Figure 1. Figure 1: Security game for backdoor undetectability. The challenger C samples a random bit b and either forwards a freshly drawn clean classifier f ∼ Fclean or runs the attack Atk on f and forwards the result. The distin￾guisher G is given white-box access to f ∗ and attempts to guess b. 2. Challenge. C samples a bit b ∼ {0, 1} uniformly at random and a clean classifier f ← Fclean, and sends to the distinguisher f … view at source ↗
Figure 2
Figure 2. Figure 2: Sparse Backdoor pipeline. The trigger ∆∗ (red dots) blended into input x is passed through a frozen feature encoder fenc, producing an embedding with a high component along a sparse direction s1 (red coor￾dinates). Each perturbed FC layer Wfi combines a Gaussian dither with a structured spike along si , propagating the signal to a sparser direction si+1 as embeddings shrink with depth. The final layer rout… view at source ↗
Figure 3
Figure 3. Figure 3: Effect of fine-tuning on Sparse Backdoor. Top: ASR (%); bottom: BA (%) with dashed lines showing the baseline clean accuracy CA (%). The defender fine-tunes FC layers on 1% clean held-out data; shaded bands are ±1 std over 10 seeds. Clean accuracy recovers quickly while ASR persistence varies, making fine-tuning unreliable as a standalone mitigation. 7.4 Persistence Under Fine-Tuning (RQ3) Beyond detection… view at source ↗
Figure 4
Figure 4. Figure 4: Representative clean images and corresponding trigger-corrupted view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Statistically Undetectable Backdoors in Deep Neural Networks

    cs.LG 2026-07 conditional novelty 7.0

    Trainers can plant statistically undetectable white-box backdoors in constrained DNNs that give exponential advantage for invariance-based adversarial examples, while outsiders cannot find any in poly-time under latti...

Reference graph

Works this paper leans on

53 extracted references · 8 linked inside Pith · cited by 1 Pith paper

  1. [1]

    https://huggingface.co, 2026

    Hugging Face Model Hub . https://huggingface.co, 2026. Accessed: 2026

    2026

  2. [2]

    https://modelzoo.co, 2026

    ModelZoo . https://modelzoo.co, 2026. Accessed: 2026

    2026

  3. [3]

    https://github.com/tensorflow/models, 2026

    TensorFlow Model Garden . https://github.com/tensorflow/models, 2026. Accessed: 2026

    2026

  4. [4]

    Blind backdoors in deep learning models

    Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. In 30th USENIX Security Symposium (USENIX Security 21) , pages 1505--1521, 2021

    2021

  5. [5]

    A nearly tight sum-of-squares lower bound for the planted clique problem

    Boaz Barak, Samuel Hopkins, Jonathan Kelner, Pravesh K Kothari, Ankur Moitra, and Aaron Potechin. A nearly tight sum-of-squares lower bound for the planted clique problem. SIAM Journal on Computing , 48(2):687--735, 2019

    2019

  6. [6]

    Complexity theoretic lower bounds for sparse principal component detection

    Quentin Berthet and Philippe Rigollet. Complexity theoretic lower bounds for sparse principal component detection. In Conference on learning theory , pages 1046--1066. PMLR, 2013

    2013

  7. [7]

    Optimal detection of sparse principal components in high dimension

    Quentin Berthet and Philippe Rigollet. Optimal detection of sparse principal components in high dimension. 2013

    2013

  8. [8]

    Optimal average-case reductions to sparse pca: From weak assumptions to strong hardness

    Matthew Brennan and Guy Bresler. Optimal average-case reductions to sparse pca: From weak assumptions to strong hardness. In Conference on Learning Theory , pages 469--470. PMLR, 2019

    2019

  9. [9]

    Reducibility and computational lower bounds for problems with planted sparse structure

    Matthew Brennan, Guy Bresler, and Wasim Huleihel. Reducibility and computational lower bounds for problems with planted sparse structure. In Conference On Learning Theory , pages 48--166. PMLR, 2018

    2018

  10. [10]

    Data free backdoor attacks

    Bochuan Cao, Jinyuan Jia, Chuxuan Hu, Wenbo Guo, Zhen Xiang, Jinghui Chen, Bo Li, and Dawn Song. Data free backdoor attacks. Advances in Neural Information Processing Systems , 37:23881--23911, 2024

    2024

  11. [11]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728 , 2018

    Pith/arXiv arXiv 2018

  12. [12]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 , 2017

    Pith/arXiv arXiv 2017

  13. [13]

    Attacking byzantine robust aggregation in high dimensions

    Sarthak Choudhary, Aashish Kolluri, and Prateek Saxena. Attacking byzantine robust aggregation in high dimensions. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 1325--1344. IEEE, 2024

    2024

  14. [14]

    Sever: A robust meta-algorithm for stochastic optimization

    Ilias Diakonikolas, Gautam Kamath, Daniel Kane, Jerry Li, Jacob Steinhardt, and Alistair Stewart. Sever: A robust meta-algorithm for stochastic optimization. In International Conference on Machine Learning , pages 1596--1606. PMLR, 2019

    2019

  15. [15]

    Subexponential-time algorithms for sparse pca

    Yunzi Ding, Dmitriy Kunisky, Alexander S Wein, and Afonso S Bandeira. Subexponential-time algorithms for sparse pca. Foundations of Computational Mathematics , 24(3):865--914, 2024

    2024

  16. [16]

    Statistical algorithms and a lower bound for detecting planted cliques

    Vitaly Feldman, Elena Grigorescu, Lev Reyzin, Santosh S Vempala, and Ying Xiao. Statistical algorithms and a lower bound for detecting planted cliques. Journal of the ACM (JACM) , 64(2):1--37, 2017

    2017

  17. [17]

    Sparse cca: Adaptive estimation and computational barriers

    Chao Gao, Zongming Ma, and Harrison H Zhou. Sparse cca: Adaptive estimation and computational barriers. 2017

    2017

  18. [18]

    Planting undetectable backdoors in machine learning models

    Shafi Goldwasser, Michael P Kim, Vinod Vaikuntanathan, and Or Zamir. Planting undetectable backdoors in machine learning models. In 2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS) , pages 931--942. IEEE, 2022

    2022

  19. [19]

    Oblivious defense in ml models: Backdoor removal without detection

    Shafi Goldwasser, Jonathan Shafer, Neekon Vafa, and Vinod Vaikuntanathan. Oblivious defense in ml models: Backdoor removal without detection. In Proceedings of the 57th Annual ACM Symposium on Theory of Computing , pages 1785--1794, 2025

    2025

  20. [20]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 , 2017

    Pith/arXiv arXiv 2017

  21. [21]

    Wenbo Guo, Bolun Wang, Yuanshun Yao, Shawn Shan, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. TABOR : A highly accurate approach to inspecting and restoring trojan backdoors in AI systems. arXiv preprint arXiv:1908.01763 , 2019

    Pith/arXiv arXiv 1908

  22. [22]

    Handcrafted backdoors in deep neural networks

    Sanghyun Hong, Nicholas Carlini, and Alexey Kurakin. Handcrafted backdoors in deep neural networks. Advances in Neural Information Processing Systems , 35:8068--8080, 2022

    2022

  23. [23]

    The power of sum-of-squares for detecting hidden structures

    Samuel B Hopkins, Pravesh K Kothari, Aaron Potechin, Prasad Raghavendra, Tselil Schramm, and David Steurer. The power of sum-of-squares for detecting hidden structures. In 2017 IEEE 58th Annual Symposium on Foundations of Computer Science (FOCS) , pages 720--731. IEEE, 2017

    2017

  24. [24]

    Indistinguishability obfuscation from well-founded assumptions

    Aayush Jain, Huijia Lin, and Amit Sahai. Indistinguishability obfuscation from well-founded assumptions. Journal of the ACM , 73(1):1--30, 2026

    2026

  25. [25]

    Injecting undetectable backdoors in obfuscated neural networks and language models

    Alkis Kalavasis, Amin Karbasi, Argyris Oikonomou, Katerina Sotiraki, Grigoris Velegkas, and Manolis Zampetakis. Injecting undetectable backdoors in obfuscated neural networks and language models. Advances in Neural Information Processing Systems , 37:21537--21571, 2024

    2024

  26. [26]

    Cs 354: Unfulfilled algorithmic fantasies

    Yunsung Kim. Cs 354: Unfulfilled algorithmic fantasies. https://web.stanford.edu/class/cs354/scribe/lecture11.pdf, 2019

    2019

  27. [27]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  28. [28]

    Succinct garbled circuits with low-depth garbling algorithms

    Hanjun Li, Huijia Lin, and George Lu. Succinct garbled circuits with low-depth garbling algorithms. Cryptology ePrint Archive , 2025

    2025

  29. [29]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses (RAID) , 2018

    2018

  30. [30]

    Trojaning attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018) . Internet Soc, 2018

    2018

  31. [31]

    Reading digits in natural images with unsupervised feature learning

    Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning , volume 2011, page 7. Granada, 2011

    2011

  32. [32]

    Cryptographic backdoor for neural networks: Boon and bane

    Anh Tu Ngo, Anupam Chattopadhyay, and Subhamoy Maitra. Cryptographic backdoor for neural networks: Boon and bane. arXiv preprint arXiv:2509.20714 , 2025

    Pith/arXiv arXiv 2025

  33. [33]

    Wanet--imperceptible warping-based backdoor attack

    Anh Nguyen and Anh Tran. Wanet--imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369 , 2021

    Pith/arXiv arXiv 2021

  34. [34]

    Input-aware dynamic backdoor attack

    Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems , 33:3454--3464, 2020

    2020

  35. [35]

    Tbt: Targeted neural network attack with bit trojan

    Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Tbt: Targeted neural network attack with bit trojan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 13198--13207, 2020

    2020

  36. [36]

    Bypassing backdoor detection algorithms in deep learning

    Reza Shokri et al. Bypassing backdoor detection algorithms in deep learning. In 2020 IEEE European Symposium on Security and Privacy (EuroS&P) , pages 175--183. IEEE, 2020

    2020

  37. [37]

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural networks , 32:323--332, 2012

    2012

  38. [38]

    Spectral signatures in backdoor attacks

    Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems , 31, 2018

    2018

  39. [39]

    Clean-label backdoor attacks

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks. 2018

    2018

  40. [40]

    High-Dimensional Probability: An Introduction with Applications in Data Science

    Roman Vershynin. High-Dimensional Probability: An Introduction with Applications in Data Science . Cambridge University Press, 2018

    2018

  41. [41]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP) , pages 707--723. IEEE, 2019

    2019

  42. [42]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy (S&P) , 2019

    2019

  43. [43]

    Statistical and computational trade-offs in estimation of sparse principal components

    Tengyao Wang, Quentin Berthet, and Richard J Samworth. Statistical and computational trade-offs in estimation of sparse principal components. 2016

    2016

  44. [44]

    Rethinking the reverse-engineering of trojan triggers

    Zhenting Wang, Kai Mei, Hailun Ding, Juan Zhai, and Shiqing Ma. Rethinking the reverse-engineering of trojan triggers. arXiv preprint arXiv:2210.15127 , 2022

    Pith/arXiv arXiv 2022

  45. [45]

    Rethinking the reverse-engineering of trojan triggers

    Zhenting Wang, Kai Mei, Hailun Ding, Juan Zhai, and Shiqing Ma. Rethinking the reverse-engineering of trojan triggers. Advances in Neural Information Processing Systems , 35:9738--9753, 2022

    2022

  46. [46]

    UNICORN : A unified backdoor trigger inversion framework

    Zhenting Wang, Kai Mei, Juan Zhai, and Shiqing Ma. UNICORN : A unified backdoor trigger inversion framework. In International Conference on Learning Representations (ICLR) , 2023

    2023

  47. [47]

    Adversarial neuron pruning purifies backdoored deep models

    Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. In Advances in Neural Information Processing Systems (NeurIPS) , 2021

    2021

  48. [48]

    Detecting ai trojans using meta neural analysis

    Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A Gunter, and Bo Li. Detecting ai trojans using meta neural analysis. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 103--120. IEEE, 2021

    2021

  49. [49]

    Towards backdoor stealthiness in model parameter space

    Xiaoyun Xu, Zhuoran Liu, Stefanos Koffas, and Stjepan Picek. Towards backdoor stealthiness in model parameter space. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages 2863--2876, 2025

    2025

  50. [50]

    BAN : Detecting backdoors activated by adversarial neuron noise

    Xiaoyun Xu, Zhuoran Liu, Stefanos Koffas, Shujian Yu, and Stjepan Picek. BAN : Detecting backdoors activated by adversarial neuron noise. arXiv preprint arXiv:2405.19928 , 2024

    Pith/arXiv arXiv 2024

  51. [51]

    Towards reliable and efficient backdoor trigger inversion via decoupling benign features

    Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inversion via decoupling benign features. In International Conference on Learning Representations (ICLR) , 2024

    2024

  52. [52]

    Latent backdoor attacks on deep neural networks

    Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks on deep neural networks. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , pages 2041--2055, 2019

    2019

  53. [53]

    Morley Mao, Ming Jin, and Ruoxi Jia

    Yi Zeng, Si Chen, Won Park, Z. Morley Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations (ICLR) , 2022

    2022