Pith. sign in

REVIEW 5 major objections 8 minor 72 references

Data Free Backdoor Attacks

T0 review · 5 major / 8 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a backdoor can be injected into a pre-trained classifier by rewriting a small set of weights, with no data, no retraining, and no architecture change.

desk verdict DFBA is a genuinely new data-free, retraining-free backdoor recipe with clean empirical results, but its provable undetectability claim rests on an inactivity assumption that real data already violates. read the letter →

arxiv 2412.06219 v1 pith:JYP3VPBB submitted 2024-12-09 cs.CR cs.AIcs.CV

Bochuan Cao , Jinyuan Jia , Chuxuan Hu , Wenbo Guo , Zhen Xiang , Jinghui Chen , Bo Li , Dawn Song This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords backdoorattacksdata-freeattackretraining-freeparametermodificationpathmodelsupplychainsecuritydefensespre-trainedclassifiers
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DFBA claims that a malicious model re-shaper can backdoor any pre-trained image classifier by hand-editing parameters alone: no training data, no retraining, and no change to the network structure. The attack selects one neuron per layer to form a backdoor path, tunes a trigger to switch on the first-layer neuron, then amplifies the signal through the remaining layers until the output layer votes for an attacker-chosen class. Under the condition that clean inputs stay off the path, the paper proves that the tampered model is indistinguishable from a clean pruned model for query-based and gradient-based detectors and that fine-tuning cannot change the path parameters. Empirically it reports 100% attack success, clean accuracy loss below 3%, and failure of six existing defenses. If true, the threat is that a downloaded model can be silently weaponized without the resource costs that previously made backdoor injection detectable.

What carries the argument

The mechanism is a backdoor path: a chain of one selected neuron per layer starting with a backdoor switch in the first layer. The switch's weights are zeroed off the trigger support so its output is $\sigma(\sum_{n\in\Gamma(m)} w_n x_n + b)$, and $b$ is chosen so any triggered input gives activation $\lambda$; a clean input stays off when Eq. (12) holds. A scalar amplifier $\gamma$ multiplies the activation through middle layers, and output weights are set to $+\gamma$ for the target class and $-\gamma$ for all others. This single chain carries the entire attack: it is what makes backdoored inputs always map to the target class, clean inputs nearly never change their prediction, and gradients from fine-tuning vanish on the path.

What would settle it

Take a backdoored classifier and any clean dataset a defender would use, and count images satisfying $\sum_{n\in\Gamma(m)} |w_n(x_n-\delta_n)| < \lambda$; finding even one such image violates the standing assumption of Theorem 1 and Proposition 3, and Table 5 already reports one Fashion-MNIST/CNN clean test image that meets this activating condition.

Watch

Extended reading notes

Core claim

The central discovery is a parameter-only surgical backdoor: pick one neuron in the first layer, one in each intermediate layer, and modify their weights and biases so that the first-layer neuron responds only to pixels covered by the trigger. The trigger pattern is optimized analytically by pushing each covered pixel to its extreme allowed value according to the sign of the weight. The neuron's bias is set so that any input carrying the trigger produces a positive activation, while any clean input whose weighted deviations from the trigger satisfy $\sum_{n\in\Gamma(m)} |w_n(x_n-\delta_n)|\ge\lambda$ keeps the neuron silent. Each later neuron in the path multiplies the previous activation by $\gamma$, and the final layer weights give the target class a positive contribution and every other class a negative one. The paper claims this yields a backdoored classifier whose output on non-activating clean inputs is identical to a clean pruned classifier, which is the basis for the proof that detection and fine-tuning defenses cannot distinguish or remove the backdoor.

Load-bearing premise

The argument depends on every benign image a defender uses staying off the backdoor path; if one benign image in the detection, pruning, or fine-tuning data turns the switch on, the guarantees about accuracy, stealth, and unremovability no longer follow.

Editorial extensions

If this is right

  • A white-box attacker who can download a model can republish a backdoored copy in under a second; on the tested setups the attack succeeds on every trigger-carrying input while clean accuracy drops less than 3%.
  • Defenses that reverse-engineer triggers from clean inputs fail because those inputs never activate the path; the paper reports 0% detection for the two detection methods it tests against.
  • Fine-tuning, fine-pruning, and unlearning with clean data leave the path intact; the parameter gradients are zero whenever every fine-tuning input satisfies Eq. (12).
  • The attack is hyperparameter-tolerant: ASR stays 100% across varied $\lambda$, $\gamma$, and trigger sizes, including a $2\times2$ trigger.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If a defender's clean set contains even one activating input, the theoretical guarantees in the paper stop applying; Table 5 already records one Fashion-MNIST/CNN clean test image that activated the path, so the practical margin of Eq. (12) on real distributions is the main uncertain quantity.
  • The same path construction could likely be adapted to non-image domains and transformer architectures, but the proof uses ReLU, bias-zeroing, and the sign-based trigger solution, so those extensions would need new conditions.
  • A practical defender could monitor not zero weights but the gap between trigger and clean activation distributions of first-layer neurons; this is a testable detector that the paper's adaptive defenses, which replace zero weights with small random noise, would have to overcome without losing the formal guarantee.
  • The paper's adaptive-defense discussion shows a trade-off: preserving the theoretical guarantee makes the backdoor visible to weight-anomaly inspection, while hiding it from such inspection sacrifices the proof; future attackers would need to break this coupling.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The paper presents DFBA, a backdoor attack on pre-trained image classifiers that requires no training data and no retraining. The method selects one neuron per layer, modifies weights along this path (setting non-trigger weights to zero, adjusting the bias to a threshold λ, amplifying by γ, and changing output-layer weights), and optimizes a trigger pattern via Eq. (3). The authors state theoretical guarantees (Theorem 1, Propositions 1-3) that, under Eq. (12), the backdoored classifier is indistinguishable from a pruned clean classifier and is robust to fine-tuning; they report empirical 100% ASR with less than 3% clean-accuracy loss across MNIST, Fashion-MNIST, CIFAR10, GTSRB, and ImageNet, and they evaluate six defenses.

Significance. Data-free backdoor injection into already-trained classifiers is an important threat for model-sharing platforms, and the paper's trigger derivation and switch construction are elegant. The experimental evaluation is broad and consistent, and the code is released. However, the headline claim 'provably undetectable and unremovable' is not supported as stated: every formal result is conditional on Eq. (12), which is not shown to hold for real data; Table 5 itself exhibits one violating test input. The defense evaluation is partly performed with an adaptive variant that violates the theory's assumptions, and Appendix H shows that I-BAU removes the backdoor on CIFAR10. The empirical attack is a useful contribution, but the theoretical and defense-evasion claims need substantial qualification.

major comments (5)
  1. [Section 4.2, Appendix B (Theorem 1, Propositions 1-3)] All formal guarantees are conditional on Eq. (12), i.e., the input does not activate the backdoor path. The paper establishes this condition only for i.i.d. uniform features (Example 1), and Table 5 reports 1/10,000 clean Fashion-MNIST CNN test inputs violates it. Since the violation probability for real datasets is unquantified, and the defense/fine-tuning datasets used in Section 5 and Appendix D are not checked for violations, the unconditional wording 'provably undetectable and unremovable' in the abstract is not supported. Please quantify activation rates on the actual data used in each defense experiment, or restrict the formal claims to inputs satisfying Eq. (12).
  2. [Appendix D (fine-pruning and Lipschitz pruning evaluations)] The pruning-defense experiments do not evaluate the default DFBA. For fine-pruning, the authors set σ=4,000, γ=1, and keep the first-layer bias unchanged so that both clean inputs and backdoored inputs can activate the backdoor path. This variant abandons the premise of Theorem 1 and Propositions 1-3, so the claim that the default DFBA bypasses all six defenses has no theoretical support for this variant. The paper should clearly label which experiments use the default attack and which use adaptive variants, and should not state that the default DFBA bypasses all six defenses.
  3. [Appendix H (I-BAU on CIFAR10)] The text reports that I-BAU reduces the ASR of DFBA to 10% on CIFAR10, while degrading ACC to 18.59%. This directly contradicts the abstract's and Section 1's claim that DFBA bypasses six state-of-the-art defenses. Even if the defense has an unacceptably high utility cost, the statement that the attack is 'unremovable' is false for this defense/dataset combination. The main text should disclose this result and qualify the defense-evasion claim.
  4. [Appendix I (adaptive defenses)] The paper admits that the default construction leaves an exact-zero-weight footprint that an anomaly detector can find, and that the Gaussian-noise countermeasure 'compromises our theoretical guarantees.' Thus the variant that is stealthy under weight inspection is not the variant covered by the proofs, and the variant covered by the proofs is not stealthy under weight inspection. The threat model in Section 3.2 should state whether weight inspection is in scope; if it is not, the claimed practical stealthiness should be correspondingly limited.
  5. [Proposition 2 and the Neural Cleanse discussion] The proof of Proposition 2 covers equality of input gradients only; Neural Cleanse's reverse-engineering optimization over a validation set is not equivalent to querying individual inputs, and the premise that no optimization query activates the backdoor path is not established. The empirical Neural Cleanse detection rate of 0 is a useful result, but the formal undetectability claim for Neural Cleanse and MNTD is not proven by Propositions 1-2.
minor comments (8)
  1. [Abstract and Section 1] The phrase 'provably undetectable and unremovable by various state-of-the-art defenses' is vague; please specify which defenses and under which explicit assumptions the formal claims hold.
  2. [Section 3.1 and Section 4.2] There is a notation inconsistency: g denotes the pre-trained clean classifier in Section 3.1, but Theorem 1 refers to the backdoored classifier as g, whereas the rest of the text uses f for the backdoored classifier.
  3. [Section 5.2 (efficiency paragraph)] The efficiency paragraph contradicts itself by saying 'without using any GPUs, it takes less than 1s' and then reporting timings on an NVIDIA RTX A100 GPU; please state clearly which timings are CPU and which are GPU.
  4. [Section 5.2 (baseline comparison)] The text 'such as Lv et al. [1]' appears to cite reference [1] (Model Zoo) instead of reference [26] (Lv et al., USENIX Security 2023); please correct the citation.
  5. [Throughout] Please fix typographical errors, including 'autonomous deriving' in Section 1, 'Lipchitz' for 'Lipschitz' in Figure 6 and Section D, and 'back path' for 'backdoor path' in Appendix E.
  6. [Section 5.2 and Table 5] The statement that 'almost' no clean testing inputs activate the backdoor path should be quantified; Table 5 shows one Fashion-MNIST CNN test input that does activate it, and this case is not discussed in the main text.
  7. [Appendix B.2.2, Proposition 3] The proof that gradients vanish relies on a subgradient convention for ReLU at zero; please state explicitly which convention is used so that the argument is complete.
  8. [Appendix J] The discussion of GeLU activation functions is speculative and should be marked as such, or removed, since no experiments support the claims.

Circularity Check

2 steps flagged · score 6.0 of 10

Theoretical undetectability and unremovability are conditional on the definition of 'cannot activate the backdoor path,' so the defense guarantees restate the attack's dormancy assumption rather than establishing it.

  1. self definitional [Section 4.2.1 (Theorem 1) and Appendix B.2.1 (Propositions 1-2); Equation 12]
    "Suppose an input x cannot activate the backdoor path, i.e., Equation 12 is satisfied for x. Then, the output of the backdoored classifier g for x is the same as that of the corresponding pruned classifier h. ... If x cannot activate the backdoor path, the outputs of the neurons in the backdoor path are 0. Thus, the output of the backdoored classifier does not change if those neurons are pruned."

    Equation 12 is the paper's own definition of 'cannot activate the backdoor path' (Lemma 1), and the pruned classifier is defined as the model with exactly those path neurons removed. Theorem 1 is therefore the identity: if the path neurons output 0, deleting them changes nothing. Proposition 1 then adds the premise that every defender query satisfies Eq 12 and concludes the defender sees identical outputs to the pruned clean model; Proposition 2 does the same for gradients. The advertised 'provably undetectable' claim thus reduces to the assumption that the backdoor path is never activated on the defender's data, which is the very property the proof is supposed to establish.

  2. self definitional [Appendix B.2.2 (Proposition 3)]
    "Suppose we have a dataset Dd = {xi, yi}N i=1, where each sample xi cannot activate the backdoor path, i.e., Equation 12 is satisfied for each xi. Then, the parameters of the neurons that form the backdoor path will not be affected if the backdoored classifier is fine-tuned using the dataset Dd. ... the gradient of loss function with respect to parameters of the neurons in the backdoor path is 0."

    The vanishing gradient is a direct consequence of the construction: the path neurons output 0 on every fine-tuning sample, so their parameters have no contribution to the loss. 'Unremovable by fine-tuning' is thus true only for fine-tuning sets that never activate the path; the statement does not prove that such sets exist, and if any fine-tuning sample activates the path the premise (and the gradient-zero conclusion) fails. The unremovability guarantee is therefore equivalent to assuming the backdoor stays dormant on the defender's data.

full rationale

The empirical evaluation of DFBA against the six defenses is a real, externally reported benchmark result and is not itself circular; the circularity lies in the paper's theoretical guarantees. Theorems 1 and Propositions 1-3 all start from Equation 12, which Lemma 1 establishes is exactly the condition that the backdoor path is not activated. Once that premise is granted, the results that the backdoored model outputs equal the pruned model's outputs, that detection scores match, and that fine-tuning gradients vanish are immediate consequences of the construction: path neurons are zero on such inputs. The 'provably undetectable and unremovable' conclusion is therefore the premise that the defender's data never trips the backdoor path, restated as a theorem, rather than an independent guarantee. Table 5 shows one clean Fashion-MNIST CNN test input does activate the path, so the premise is not vacuously satisfied in practice, and Appendix I concedes that the noise-based variant that hides zero weights 'compromises our theoretical guarantees.' Because the central theoretical claims reduce by construction to their own activation-dormancy assumption, while the empirical defense results retain independent content, the appropriate score is 6 rather than a higher forced-equivalence score.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The attack depends on two hand-chosen hyperparameters (lambda and gamma), the attacker-selected trigger configuration, and several domain assumptions about clean-input inactivity and defender behavior. No new physical or mathematical entities are postulated; the backdoor path and switch are arrangements of existing neurons and weights.

free parameters (5)
  • lambda (backdoor threshold) = 0.1 (default)
    Controls how close a clean input must be to the trigger to activate the switch neuron; chosen small to keep clean activations negligible and appears in Eq. 5, 8, and 12. Ablation in Fig. 7a shows BA degrades for larger lambda.
  • gamma (amplification factor) = Set so lambda * gamma^(L-1) = 100
    Amplifies the switch output through the path to ensure backdoored inputs reach the target logit; chosen large for 100% ASR, per Section C and Fig. 7b.
  • Trigger size = 4x4 (default)
    Attacker-chosen footprint; ablation Fig. 7c shows 2x2 also achieves 100% ASR.
  • Trigger location = bottom-right (default)
    Attacker-chosen placement; Appendix F discusses location invariance for CNNs.
  • Target class = 0 (default)
    Attacker-chosen label; arbitrary target selected for evaluation.
assumptions (6)
  • standard math Standard ReLU and softmax calculus: if a neuron's pre-activation is non-positive, its output and gradients with respect to its parameters are zero.
    Used in Lemma 1, Theorem 1, and Proposition 3; e.g., Eq. 4 and the proof that fine-tuning gradients on path neurons vanish.
  • domain assumption The defense dataset contains only inputs that cannot activate the backdoor path (Eq. 12).
    Proposition 1 and Proposition 2 both assume every defense input satisfies Eq. 12; if a single query activates the path, the output/gradient identity with the pruned classifier fails.
  • domain assumption The fine-tuning dataset contains only inputs that cannot activate the backdoor path.
    Proposition 3 assumes each (x_i, y_i) satisfies Eq. 12; otherwise the gradient of loss with respect to path parameters need not be zero.
  • domain assumption Clean inputs rarely activate the backdoor path; Example 1 bounds this for i.i.d. uniform inputs when |w_n| >= alpha, and Table 5 checks it empirically.
    This is the empirical bridge connecting the conditional theorems to actual datasets; Table 5 shows 1 clean Fashion-MNIST input activated the path for CNN, so the assumption is not absolute.
  • domain assumption The pruned classifier, with the L-1 path neurons removed, has roughly the same clean accuracy as the original classifier.
    Invoked in the remark after Theorem 1 to conclude utility preservation; not proven, only argued by the small number of pruned neurons.
  • ad hoc to paper Defenders do not inspect weight patterns such as exact zeros introduced by DFBA.
    The main attack sets weights to zero for features outside the trigger; Appendix I admits this is detectable by a zero-weight anomaly check and that the obfuscating fix compromises theoretical guarantees.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Data Free Backdoor Attacks." pith.science (2026). https://pith.science/paper/JYP3VPBB

@misc{pith2026241206219,
  author       = {Pith},
  title        = {Pith review of: Data Free Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JYP3VPBB}},
  note         = {Machine review of arXiv:2412.06219}
}
read the original abstract

Backdoor attacks aim to inject a backdoor into a classifier such that it predicts any input with an attacker-chosen backdoor trigger as an attacker-chosen target class. Existing backdoor attacks require either retraining the classifier with some clean data or modifying the model's architecture. As a result, they are 1) not applicable when clean data is unavailable, 2) less efficient when the model is large, and 3) less stealthy due to architecture changes. In this work, we propose DFBA, a novel retraining-free and data-free backdoor attack without changing the model architecture. Technically, our proposed method modifies a few parameters of a classifier to inject a backdoor. Through theoretical analysis, we verify that our injected backdoor is provably undetectable and unremovable by various state-of-the-art defenses under mild assumptions. Our evaluation on multiple datasets further demonstrates that our injected backdoor: 1) incurs negligible classification loss, 2) achieves 100% attack success rates, and 3) bypasses six existing state-of-the-art defenses. Moreover, our comparison with a state-of-the-art non-data-free backdoor attack shows our attack is more stealthy and effective against various defenses while achieving less classification accuracy loss.

Figures

Figures reproduced from arXiv: 2412.06219 by the authors.

Figure 1
Figure 1. An example of the backdoor switch and optimized trigger when each pixel of an [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Visualization of our backdoor path when it [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Comparing DFBA with Hong et al. [27] under fine-tuning. [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Comparing DFBA with Hong et al. [27] under pruning [51]. [PITH_FULL_IMAGE:figures/full_fig_p019_4.png]
Figure 5
Figure 5. Figure 5: Comparing our DFBA with Hong et al. [27] under fine-tuning after pruning neurons on MNIST. Our DFBA is resilient to fine-tuning: Given a backdoored model, a defender can use clean data to fine-tune it to remove the backdoor. To consider a strong defense, we use the ent…
Figure 6
Figure 6. Figure 6: The ACC and ASR of our attack under Lipchitz Pruning on MNIST. [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]
Figure 7
Figure 7. Figure 7: Impact of λ, γ, and trigger size on DFBA. We apply I-BAU to unlearn the backdoor injected by DFBA on MNIST. We use the publicly available code in our implementation5 [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]
Figure 8
Figure 8. Figure 8: Visualization of triggers optimized on different datasets/models [PITH_FULL_IMAGE:figures/full_fig_p024_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

72 extracted references · 57 canonical work pages

  1. [1]

    Model Zoo

    MZ. Model Zoo. https://modelzoo.co/. January 2023

    work page 2023

  2. [2]

    TensorFlow Model Garden

    TFMG. TensorFlow Model Garden. https://github.com/tensorflow/models. January 2023

    work page 2023

  3. [3]

    Hugging Face

    HF. Hugging Face. https://huggingface.co/. January 2023

    work page 2023

  4. [4]

    Dolan-Gavitt, S

    Gu, T., B. Dolan-Gavitt, S. Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    arXiv 2017

  5. [5]

    Chen, X., C. Liu, B. Li, et al. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    arXiv 2017

  6. [6]

    Liu, Y ., S. Ma, Y . Aafer, et al. Trojaning attack on neural networks. InProc. of NDSS. 2018

    work page 2018

  7. [7]

    Open source autonomous driving

    apollo team, B. Open source autonomous driving. https://github.com/ApolloAuto/ apollo, 2017. Online; accessed 11 October 2023

    work page 2017

  8. [8]

    Enhancing Clean Label Backdoor Attack with Two-phase Specific Triggers

    Turner, A., D. Tsipras, A. Madry. Clean-label backdoor attacks. arxiv preprint arXiv:2206.04881, 2018

    work page Pith review arXiv 2018

Show all 72 references
  1. [9]

    Subramanya, H

    Saha, A., A. Subramanya, H. Pirsiavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, vol. 34, pages 11957–11965. 2020

    2020

  2. [10]

    Yao, Y ., H. Li, H. Zheng, et al. Latent backdoor attacks on deep neural networks. InProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 2041–

    2019

  3. [11]

    Liu, Y ., X. Ma, J. Bailey, et al. Reflection backdoor: A natural backdoor attack on deep neural networks. In European Conference on Computer Vision, pages 182–199. Springer, 2020

    2020

  4. [12]

    Tang, R., M. Du, N. Liu, et al. An embarrassingly simple approach for trojan attack in deep neural networks. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 218–228. 2020

    2020

  5. [13]

    Li, Y ., T. Zhai, B. Wu, et al. Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692, 2020

    2004 arXiv

  6. [14]

    Nguyen, A., A. Tran. Wanet–imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369, 2021

    2021 arXiv

  7. [15]

    Doan, K., Y . Lao, W. Zhao, et al. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 11966– 11976. 2021

    2021

  8. [16]

    Li, S., M. Xue, B. Z. H. Zhao, et al. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5):2088–2105, 2020

    2020

  9. [17]

    Nguyen, T. A., A. Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454–3464, 2020

    2020

  10. [18]

    Shmatikov

    Bagdasaryan, E., V . Shmatikov. Blind backdoors in deep learning models. In 30th USENIX Security Symposium (USENIX Security 21), pages 1505–1521. 2021

    2021

  11. [19]

    Bai, J., B. Wu, Y . Zhang, et al. Targeted attack against deep neural networks via flipping limited weight bits. arXiv preprint arXiv:2102.10496, 2021

    2021 arXiv

  12. [20]

    Li, Y ., Y . Li, B. Wu, et al. Invisible backdoor attack with sample-specific triggers. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 16463–16472. 2021

    2021

  13. [21]

    Rakin, A. S., Z. He, D. Fan. Tbt: Targeted neural network attack with bit trojan. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13198–13207. 2020. 11

    2020

  14. [22]

    Doan, K., Y . Lao, P. Li. Backdoor attack with imperceptible input and latent modification. Advances in Neural Information Processing Systems, 34:18944–18957, 2021

    2021

  15. [23]

    Passananti, A

    Wenger, E., J. Passananti, A. N. Bhagoji, et al. Backdoor attacks against deep learning systems in the physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6206–6215. 2021

    2021

  16. [24]

    Salem, A., R. Wen, M. Backes, et al. Dynamic backdoor attacks against machine learning models. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 703–718. IEEE, 2022

    2022

  17. [25]

    Doan, K. D., Y . Lao, P. Li. Marksman backdoor: Backdoor attacks with arbitrary target class. arXiv preprint arXiv:2210.09194, 2022

    2022 arXiv

  18. [26]

    Lv, P., C. Yue, R. Liang, et al. A data-free backdoor injection approach in neural networks. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2671–2688. 2023

    2023

  19. [27]

    Carlini, A

    Hong, S., N. Carlini, A. Kurakin. Handcrafted backdoors in deep neural networks. In NeurIPS. 2022

    2022

  20. [28]

    Shumailov, Y

    Bober-Irizar, M., I. Shumailov, Y . Zhao, et al. Architectural backdoors in neural networks, 2023

    2023

  21. [29]

    Code of Neural Cleanse

    NC. Code of Neural Cleanse. https://github.com/bolunwang/backdoor. January 2023

    2023

  22. [30]

    Xu, X., Q. Wang, H. Li, et al. Detecting ai trojans using meta neural analysis. In 2021 IEEE Symposium on Security and Privacy (SP), pages 103–120. IEEE, 2021

    2021

  23. [31]

    Wang, B., Y . Yao, S. Shan, et al. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P). 2019

    2019

  24. [32]

    Goldwasser, S., M. P. Kim, V . Vaikuntanathan, et al. Planting undetectable backdoors in machine learning models. arXiv preprint arXiv:2204.06974, 2022

    2022 arXiv

  25. [33]

    Rakin, A. S., Z. He, D. Fan. Bit-flip attack: Crushing neural network with progressive bit search. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1211–1220. 2019

    2019

  26. [34]

    Frigo, Y

    Hong, S., P. Frigo, Y . Kaya, et al. Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks. In USENIX Security Symposium, pages 497–514. 2019

    2019

  27. [35]

    Rakin, A. S., Z. He, J. Li, et al. T-bfa: Targeted bit-flip adversarial weight attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(11):7928–7939, 2021

    2021

  28. [36]

    Chen, H., C. Fu, J. Zhao, et al. Proflip: Targeted trojan attack with progressive bit flips. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7718–7727. 2021

    2021

  29. [37]

    Fang, P., B. Cao, J. Jia, et al. Backdoor attack for federated learning with fake clients

  30. [38]

    Li, M., W. Wan, Y . Ning, et al. Darkfed: A data-free backdoor attack in federated learning. arXiv preprint arXiv:2405.03299, 2024

    2024 arXiv

  31. [39]

    Steinhardt, J., P. W. Koh, P. Liang. Certified defenses for data poisoning attacks. InProceedings of the 31st International Conference on Neural Information Processing Systems (NIPS). 2017

    2017

  32. [40]

    Tran, B., J. Li, A. Madry. Spectral signatures in backdoor attacks. In Proceedings of the 32nd Conference on Neural Information Processing Systems (NeurIPS). 2018

    2018

  33. [41]

    Du, M., R. Jia, D. Song. Robust anomaly detection and backdoor attack detection via differential privacy. arXiv preprint arXiv:1911.07116, 2019

    1911 arXiv

  34. [42]

    Weber, M., X. Xu, B. Karlaš, et al. Rab: Provable robustness against backdoor attacks. arXiv preprint arXiv:2003.08904, 2020. 12

    2003 arXiv

  35. [43]

    Guo, W., L. Wang, Y . Xu, et al. Towards inspecting and eliminating trojan backdoors in deep neural networks. In 2020 IEEE International Conference on Data Mining (ICDM) , pages 162–171. IEEE, 2020

    2020

  36. [44]

    Liu, Y ., W.-C. Lee, G. Tao, et al. Abs: Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 1265–1282. 2019

    2019

  37. [45]

    Gao, Y ., C. Xu, D. Wang, et al. Strip: A defence against trojan attacks on deep neural networks. In Proc. of ACSAC. 2019

    2019

  38. [46]

    Tramer, G

    Chou, E., F. Tramer, G. Pellegrino. Sentinet: Detecting localized universal attacks against deep learning systems. In Proc. of IEEE Security and Privacy Workshops (SPW). 2020

    2020

  39. [47]

    beatrix

    Ma, W., D. Wang, R. Sun, et al. The" beatrix”resurrections: Robust backdoor detection via gram matrices. arXiv preprint arXiv:2209.11715, 2022

    2022 arXiv

  40. [48]

    Xiang, C., A. N. Bhagoji, V . Sehwag, et al.{PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking. In30th USENIX Security Symposium (USENIX Security 21), pages 2237–2254. 2021

    2021

  41. [49]

    Mahloujifar, P

    Xiang, C., S. Mahloujifar, P. Mittal. {PatchCleanser}: Certifiably robust defense against adversarial patches for any image classifier. In 31st USENIX Security Symposium (USENIX Security 22), pages 2065–2082. 2022

    2022

  42. [50]

    Wang, Z., K. Mei, H. Ding, et al. Rethinking the reverse-engineering of trojan triggers. arXiv preprint arXiv:2210.15127, 2022

    2022 arXiv

  43. [51]

    Dolan-Gavitt, S

    Liu, K., B. Dolan-Gavitt, S. Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In Proceedings of Research in Attacks, Intrusions, and Defenses (RAID). 2018

    2018

  44. [52]

    Wu, D., Y . Wang. Adversarial neuron pruning purifies backdoored deep models.Advances in Neural Information Processing Systems, 34:16913–16925, 2021

    2021

  45. [53]

    Zeng, Y ., S. Chen, W. Park, et al. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations. 2022

    2022

  46. [54]

    Chai, S., J. Chen. One-shot neural backdoor erasing via adversarial weight masking. In A. H. Oh, A. Agarwal, D. Belgrave, K. Cho, eds.,Advances in Neural Information Processing Systems. 2022

    2022

  47. [55]

    Zheng, R., R. Tang, J. Li, et al. Data-free backdoor removal based on channel lipschitzness. In European Conference on Computer Vision, pages 175–191. Springer, 2022

    2022

  48. [56]

    Zisserman

    Simonyan, K., A. Zisserman. Very deep convolutional networks for large-scale image recogni- tion, 2014

    2014

  49. [57]

    Zhang, S

    He, K., X. Zhang, S. Ren, et al. Deep residual learning for image recognition, 2015

    2015

  50. [58]

    Carlini, N., A. Terzis. Poisoning and backdooring contrastive learning. arXiv preprint arXiv:2106.09667, 2021

    2021 arXiv

  51. [59]

    Yan, Z., G. Li, Y . TIan, et al. Dehib: Deep hidden backdoor attack on semi-supervised learning via adversarial perturbation. In Proc of AAAI. 2021

    2021

  52. [60]

    Jia, J., Y . Liu, N. Z. Gong. Badencoder: Backdoor attacks to pre-trained encoders in self- supervised learning. In 2022 IEEE Symposium on Security and Privacy (SP), pages 2043–2059. IEEE, 2022

    2022

  53. [61]

    Tejankar, S

    Saha, A., A. Tejankar, S. A. Koohpayegani, et al. Backdoor attacks on self-supervised learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 13337–13346. 2022. 13

    2022

  54. [62]

    Bagdasaryan, E., A. Veit, Y . Hua, et al. How to backdoor federated learning. InProc. of AISTAT. 2020

    2020

  55. [63]

    Sreenivasan, S

    Wang, H., K. Sreenivasan, S. Rajput, et al. Attack of the tails: Yes, you really can backdoor federated learning. In Proc. of NeurIPS. 2020

    2020

  56. [64]

    Huang, P.-Y

    Xie, C., K. Huang, P.-Y . Chen, et al. Dba: Distributed backdoor attacks against federated learning. In Proc. of ICLR. 2019

    2019

  57. [65]

    Dai, J., C. Chen, Y . Li. A backdoor attack against lstm-based text classification systems.IEEE Access, 7:138872–138878, 2019

    2019

  58. [66]

    Salem, M

    Chen, X., A. Salem, M. Backes, et al. Badnl: Backdoor attacks against nlp models. In ICML 2021 Workshop on Adversarial Machine Learning. 2021

    2021

  59. [67]

    Xi, Z., R. Pang, S. Ji, et al. Graph backdoor. In 30th USENIX Security Symposium (USENIX Security 21), pages 1523–1540. 2021

    2021

  60. [68]

    Zhang, Z., J. Jia, B. Wang, et al. Backdoor attacks to graph neural networks. In Proceedings of the 26th ACM Symposium on Access Control Models and Technologies, pages 15–26. 2021

    2021

  61. [69]

    Javed, X

    Wang, L., Z. Javed, X. Wu, et al. Backdoorl: Backdoor attack against competitive reinforcement learning. arXiv preprint arXiv:2105.00579, 2021

    2021 arXiv

  62. [70]

    Wardega, S

    Kiourti, P., K. Wardega, S. Jha, et al. Trojdrl: Trojan attacks on deep reinforcement learning agents. arXiv preprint arXiv:1903.06638, 2019

    1903 arXiv

  63. [71]

    Fawzi, O

    Moosavi-Dezfooli, S.-M., A. Fawzi, O. Fawzi, et al. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition. 2017

    2017

  64. [72]

    Makelov, L

    Madry, A., A. Makelov, L. Schmidt, et al. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. 14 A Proof of Lemma 1 Proof of Lemma 1. A clean input x cannot activate the neurons1 when P n∈Γ(m) wn(xn −δn)+ λ ≤ 0, i.e., P n∈Γ(m) ...

    2017 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.