REVIEW 8 cited by
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
This work provides the community with a timely comprehensive review of backdoor attacks and countermeasures on deep learning. According to the attacker's capability and affected stage of the machine learning pipeline, the attack surfaces are recognized to be wide and then formalized into six categorizations: code poisoning, outsourcing, pretrained, data collection, collaborative learning and post-deployment. Accordingly, attacks under each categorization are combed. The countermeasures are categorized into four general classes: blind backdoor removal, offline backdoor inspection, online backdoor inspection, and post backdoor removal. Accordingly, we review countermeasures, and compare and analyze their advantages and disadvantages. We have also reviewed the flip side of backdoor attacks, which are explored for i) protecting intellectual property of deep learning models, ii) acting as a honeypot to catch adversarial example attacks, and iii) verifying data deletion requested by the data contributor.Overall, the research on defense is far behind the attack, and there is no single defense that can prevent all types of backdoor attacks. In some cases, an attacker can intelligently bypass existing defenses with an adaptive attack. Drawing the insights from the systematic review, we also present key areas for future research on the backdoor, such as empirical security evaluations from physical trigger attacks, and in particular, more efficient and practical countermeasures are solicited.
Forward citations
Cited by 8 Pith papers
-
ShrinkBox: Backdoor Attack on Object Detection to Disrupt Collision Avoidance in Machine Learning-based Advanced Driver Assistance Systems
ShrinkBox is a backdoor attack that makes object detectors output smaller bounding boxes on triggered images, preserving mAP while tripling distance-estimation error.
-
FORGE: Research-Trajectory Hijacking Attacks on Deep Research Agents
FORGE poisons deep-research planning with coordinated fake reasoning documents, reaching 26.4% PRISM report contamination at five injections; Root Query Anchoring halves that severity.
-
BackWeak: Backdooring Knowledge Distillation Simply with Weak Triggers and Fine-tuning
Fine-tuning a benign teacher on a weak trigger at a 100x-reduced learning rate is sufficient to make the backdoor survive knowledge distillation into student models.
-
Lethe: Purifying Backdoored Large Language Models with Knowledge Dilution
LETHE uses parameter-level model merging plus prompt-level word definitions to dilute backdoor behavior in LLMs, cutting attack success to below 7% in most tested settings.
-
DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion
DISTIL uses a classifier-guided latent diffusion model to invert Trojan triggers without clean data, achieving higher trigger-based scanning accuracy than prior reverse-engineering methods.
-
Poison Once, Control Anywhere: Clean-Text Visual Backdoors in VLM-based Mobile Agents
Visual-only perturbations in fine-tuning screenshots can implant backdoors in VLM-based mobile agents, triggering attacker-chosen actions at inference.
-
Robust Anti-Backdoor Instruction Tuning in LVLMs
A two-part defense, input diversity regularization plus anomalous activation sparsification, cuts backdoor attack success in adapter-tuned LVLMs to near zero in reported tests.
-
Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergies
The paper proposes a one-to-one mapping between six causes of distribution shift and several AI safety issues, arguing for mutual method transfer through aligned definitions.
Discussion (0). Continue with ORCID to comment.