Pith. sign in

REVIEW 3 major objections 7 minor 58 references

Stealthy Backdoor Attack to Real-world Models in Android Apps

T0 review · 3 major / 7 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that DNN-based steganography lets an attacker plant invisible, per-image backdoor triggers in real Android app models, beating prior real-world backdoor attacks on effectiveness and stealth while leaving the model…

desk verdict A useful applied-security paper that plausibly shows steganographic sample-specific backdoors work on extracted on-device models, but the deployment-pipeline evidence is asserted rather than measured. read the letter →

arxiv 2501.01263 v1 pith:ANR3ZNVJ submitted 2025-01-02 cs.CR cs.AI

Jiali Wei , Ming Fan , Xicheng Zhang , Wenjing Jiao , Haijun Wang , Ting Liu This is my paper · ORCID
classification cs.CRcs.AI
keywords backdoorattackAndroidappson-devicedeeplearningsteganographysample-specifictriggersmodelextractionTensorFlowLitereal-worldmodels
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that backdoor attacks on deep-learning models embedded in Android apps can be made both more effective and harder to spot by replacing fixed, visible triggers with imperceptible, sample-specific triggers produced by DNN-based steganography. To test this, the authors collect 38,387 apps, extract 89 TensorFlow and TensorFlow Lite models, and show on 11 understandable image classifiers that their attack BARWM reaches an average success rate of 96.38%, versus 83.88% for DeepPayload, while preserving benign accuracy at 91.15% versus 87.90%. The attack works by reconstructing an extracted inference-only model as a trainable Keras model, retraining it on steganographically poisoned images, and converting it back to the on-device format so the model structure is unchanged. A sympathetic reader should care because it shifts the practical threat from hypothetical training-time poisoning to a feasible model-replacement attack that simple human inspection and trigger-based defenses would miss.

What carries the argument

The central object is a backdoor trigger generator $G$, an encoder-decoder network built on StegaStamp-style DNN steganography: a U-Net encoder hides an attacker-chosen target string $s_t$ inside a benign image $x_b$, producing a poisoned image $x_p = x_b + G(x_b)$ and a sample-specific trigger $G(x_b)$, while a spatial-transformer decoder recovers the hidden string. The generator is trained with a perceptual loss for imperceptibility and a cross-entropy loss for message recovery. This machinery carries the argument because it makes each trigger unique to its input image, shifting the activation secret from a fixed visible pattern to the generator and the hidden string, and it lets the attack proceed by retraining a reconstructed equivalent model so the final on-device model structure remains identical to the original.

What would settle it

Run the round-trip conversion described in Section III-B on all 89 extracted models and compare the reconstructed model's outputs to the originals on a fixed test set; if any comparison shows non-negligible divergence on clean inputs, or if a repackaged app rejects the modified model at startup, the claimed seamless replacement is contradicted.

Watch

Extended reading notes

Core claim

BARWM establishes that imperceptible, sample-specific backdoor triggers generated by DNN-based steganography can enhance the efficacy of backdoor attacks on real-world models extracted from Android apps. The attack does not require the original training data or any change to the model structure: the attacker extracts a deployed model, reconstructs an equivalent trainable model from its fully exposed architecture and parameters, poisons collected data with steganographic triggers, retrains, and converts the model back to the on-device format. The secret key for activating the backdoor shifts from a fixed sample-agnostic trigger to the attacker's trigger generator and target string, so every poisoned image carries a different, nearly invisible perturbation. On 11 real-world models the method achieves an average attack success rate of 96.38% compared with 83.88% for DeepPayload, while better maintaining normal accuracy, and it is on par with or better than BadNets and the invisible-noise baseline.

Load-bearing premise

The attack depends on converting an extracted inference-only TFLite or pb model into an equivalent trainable Keras model, retraining it, and converting back without changing ordinary behavior; if that round-trip is lossy, or if the app validates the model file or its outputs, the planted backdoor never reaches a deployed app.

Editorial extensions

If this is right

  • An adversary who can replace a model file in a repackaged app can implant a backdoor whose trigger is different for every image and invisible to human inspection.
  • Because there is no shared trigger pattern across poisoned samples, defenses that reverse-engineer a single trigger or cluster backdoor samples by common features will miss the attack.
  • The attack works without original training data: an attacker only needs the extracted model, its output labels, and collected images for those labels.
  • Model structure remains unchanged, so structural inspection and payload detectors aimed at injected branches will not flag BARWM.
  • The same steganographic trigger pipeline is argued to extend to object-detection models, where the trigger could cause false positives, missed detections, or wrong bounding boxes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A likely pressure point is the model-conversion step: the paper reports no released converter, no per-model numerical fidelity table, and no end-to-end test inside a modified app, so a lossy round-trip would make the reported real-world numbers optimistic.
  • Because the trigger is a steganographic message, a defender could try to reverse the process by training a decoder to search for hidden strings in model inputs and flag samples whose decoded message matches the attacker's target string; the paper does not test this defense.
  • The assertion that model conversion does not affect normal performance or attack success is based on observation rather than a systematic fidelity measurement, so an independent replication across all 89 extracted models would settle whether the attack generalizes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. This paper presents BARWM, a backdoor attack against image-classification models extracted from Android apps. The attack pipeline extracts an on-device TFLite or TensorFlow model, reconstructs an equivalent trainable Keras model, retrains it using sample-specific steganographic triggers produced by StegaStamp, and converts the model back to the on-device format. The authors evaluate BARWM on MobileNetV2, NASNet-Mobile, ResNet50, and VGG16, and on 11 real-world models extracted from 38,387 apps, comparing attack success rate (ASR), benign accuracy (BA), and PSNR/MS-SSIM against DeepPayload, BadNets, and an invisible-noise attack. The central claims are that BARWM achieves higher ASR and better preserves benign accuracy than DeepPayload, and that it is more stealthy because the trigger is imperceptible and sample-specific and the model structure is not altered.

Significance. If the results hold, the paper makes a useful contribution to on-device model security: it transfers sample-specific steganographic backdoors from curated datasets to real-world extracted models and reports a consistent ASR advantage over DeepPayload. The attack is not circular: the trigger generator is trained for steganographic fidelity rather than on the victim model, and ASR/BA are measured on held-out sets. I also credit the authors for comparing against multiple baselines and for making the attack pipeline explicit. However, the significance is currently constrained by the absence of released code and data, the lack of error bars or significance tests, and, most importantly, the unverified assumption that a reconstructed Keras model converted back to TFLite behaves identically to the model that would actually be deployed in the app.

major comments (3)
  1. [III-B and IV-D1] The real-world deployment claim rests on the assertion that an extracted inference-only TFLite/.pb model can be rebuilt as a trainable Keras model, retrained, and converted back with no behavioral change. Section IV-D1 states only that "we find that model conversion does not affect the normal performance of the model and the ASR," but no per-model fidelity measurements, output comparisons, or app-level replacement tests are reported. Since quantized or fused TFLite operators and metadata may not be preserved by the Keras reconstruction, Table V could be reporting performance of the intermediate Keras model rather than the final on-device artifact. Please provide per-model conversion fidelity statistics, for example the maximum and mean output difference between the original and converted models on a held-out set, and demonstrate that the converted .tflite loads and runs inside a real app or an equivalent on-device runtime.
  2. [Table V and Section IV-A3] The 11 real-world models are described as those "clearly understood," but the paper does not report how many of the 40 classification models were excluded, why they were excluded, or whether any were attempted and failed; this selection process could bias the reported averages. Moreover, Table V presents single point estimates without error bars or significance tests, even though per-model differences between BARWM and DeepPayload vary widely (for example, 96.36% vs. 83.77% ASR on model 1 but 86.39% vs. 84.90% on model 11). Without repeated trials, confidence intervals, or a release of the code, models, and app corpus, the 12.50% average ASR advantage is not established as stable or reproducible.
  3. [IV-C and Table II] Stealthiness is evaluated only on GTSRB and ImageNet for the four standard models; no PSNR/MS-SSIM or human-perception results are reported for the poisoned samples used on the 11 real-world models or for the final converted TFLite artifacts. Because the sample-specific triggers are generated by a network trained on ImageNet, their imperceptibility on real-world task distributions is not self-evident. Please add stealthiness metrics for the real-world model evaluation, or explicitly limit the stealthiness claim to the curated datasets.
minor comments (7)
  1. [V-B] The bullet list under attack results for object detection contains a duplicated entry: "Missed detection of target objects" appears twice, with only one of the two entries discussing false negatives.
  2. [IV-A4] The "Invisible Attack" baseline is cited as reference [14], which is a backdoor survey; the authors should cite the actual invisible-attack method, such as [28] or another appropriate source, to make the baseline implementation verifiable.
  3. [III-C, Eq. (2)] Equation (2) claims G(xi) != G(xj) for distinct inputs, but since G is a trained neural network, exact distinctness is not guaranteed; the paper should state whether this is an approximate property and discuss the practical probability of trigger collisions.
  4. [Fig. 4] The last column increases the pixel values of the triggers for visualization, but the scaling factor is not stated; the figure caption should specify the amplification so that readers do not mistake the displayed perturbation for the actual embedded trigger.
  5. [Abstract and Section I] The abstract reports "12.50% higher attack success rate" for the real-world models, while Section I reports "15.38% higher" for the four standard DNN models; this dual reporting should be made explicit to prevent confusion about which comparison each number refers to.
  6. [III-C1] The text says the goal is to obtain "the most effective DNN model" for the trigger generator, but no selection criterion is given; the authors should briefly state how the generator architecture and training epochs were chosen.
  7. [III-C and IV-D1] The phrase "does not alter the model structure" is accurate only at the architectural level, because retraining updates all model weights; this distinction should be stated precisely to avoid overstating the stealthiness of the attack.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the trigger generator is trained independently of the victim model and all reported ASR/BA values are held-out experimental measurements; the unverified conversion-fidelity claim is a correctness gap, not a circular derivation.

full rationale

The paper's central claim is empirical rather than derivational: a DNN-based steganography trigger generator is trained for steganographic fidelity on normal images, and the resulting sample-specific triggers are then used to retrain reconstructed victim models. No parameter is fitted to the evaluation data and then reported as a prediction; ASR and BA are measured on test sets against baseline attacks. The only load-bearing assumption that could affect the real-world results is the reconstruction-and-conversion equivalence asserted in Section III-B and Section IV-D1 ('we find that model conversion does not affect the normal performance of the model and the ASR'), but this is an unverified factual claim about toolchain fidelity, not a circularity: the reported ASR is not defined as the output of that assumption, and the claim could be false without making the derivation circular. The cited external works (StegaStamp, DeepPayload, BadNets, Invisible Attack) are independent baselines or building blocks; the paper does not rely on a self-citation or on an author-imported uniqueness theorem. Consequently, no step in the paper reduces, by construction or by self-citation, to its own inputs, and the appropriate circularity score is 0.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

No theoretical derivation is offered; the central claim rests on a sequence of engineering assumptions about extractability, convertibility, data availability, and trigger survival. The paper provides no released artifacts to substantiate these assumptions externally.

free parameters (3)
  • Poisoning ratio during backdoor retraining
    Not reported anywhere; it directly controls the tradeoff between ASR and benign accuracy in RQ1 and RQ3, so the central comparison is under-specified.
  • Number and composition of images collected per real-world model
    Section IV-D2 says 'collect sufficient image data' without counts or source; these data are used to retrain each extracted model and materially affect both BA and ASR.
  • StegaStamp target string st and target label lt
    Attacker-chosen secret inputs (Section III-C); no sensitivity analysis is provided, so the reported ASR may depend on this specific choice.
assumptions (5)
  • domain assumption On-device models and label files are fully exposed inside APKs and can be extracted without obfuscation.
    Stated in Sections II-D and III-A; supported by cited prior work [8], [12], but BARWM's applicability depends on it.
  • domain assumption Reconstructed Keras model is behaviorally equivalent to the original TFLite or pb model.
    Section III-B assumes equivalence after architecture replication and parameter mapping; the only check is a brief equivalence test with no released conversion tool or test details.
  • domain assumption Attacker can collect a training set representative of each victim model's target classes without access to original training data.
    Sections III-C2 and IV-D2 implement attacks by collecting images from category labels; distribution shift could degrade both benign accuracy and ASR.
  • domain assumption StegaStamp-embedded triggers survive the input preprocessing and normalization of real on-device models.
    Section III-C1 generates triggers in image pixel space and then feeds them to models; no preprocessing or image-compression robustness tests are reported.
  • domain assumption Retraining the reconstructed model on poisoned plus collected benign data is sufficient to embed the backdoor while preserving task performance.
    Section III-C2 and the evaluation rely on this; no analysis of catastrophic forgetting, learning-rate effects, or data requirements is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Stealthy Backdoor Attack to Real-world Models in Android Apps." pith.science (2026). https://pith.science/paper/ANR3ZNVJ

@misc{pith2026250101263,
  author       = {Pith},
  title        = {Pith review of: Stealthy Backdoor Attack to Real-world Models in Android Apps},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ANR3ZNVJ}},
  note         = {Machine review of arXiv:2501.01263}
}
read the original abstract

Powered by their superior performance, deep neural networks (DNNs) have found widespread applications across various domains. Many deep learning (DL) models are now embedded in mobile apps, making them more accessible to end users through on-device DL. However, deploying on-device DL to users' smartphones simultaneously introduces several security threats. One primary threat is backdoor attacks. Extensive research has explored backdoor attacks for several years and has proposed numerous attack approaches. However, few studies have investigated backdoor attacks on DL models deployed in the real world, or they have shown obvious deficiencies in effectiveness and stealthiness. In this work, we explore more effective and stealthy backdoor attacks on real-world DL models extracted from mobile apps. Our main justification is that imperceptible and sample-specific backdoor triggers generated by DNN-based steganography can enhance the efficacy of backdoor attacks on real-world models. We first confirm the effectiveness of steganography-based backdoor attacks on four state-of-the-art DNN models. Subsequently, we systematically evaluate and analyze the stealthiness of the attacks to ensure they are difficult to perceive. Finally, we implement the backdoor attacks on real-world models and compare our approach with three baseline methods. We collect 38,387 mobile apps, extract 89 DL models from them, and analyze these models to obtain the prerequisite model information for the attacks. After identifying the target models, our approach achieves an average of 12.50% higher attack success rate than DeepPayload while better maintaining the normal performance of the models. Extensive experimental results demonstrate that our method enables more effective, robust, and stealthy backdoor attacks on real-world models.

Figures

Figures reproduced from arXiv: 2501.01263 by the authors.

Figure 1
Figure 1. The normal TFLite model and the TFLite model after being [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The overview architecture of BARWM, which contains three procedures, i.e., on-device model extraction and analysis (Section III-A), on-device [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The training process of the backdoor trigger generator (an encoder [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Backdoor samples and triggers generated by BadNets, Invisible Attack, DeepPayload, and our method. BadNets uses a white square in the lower-right [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

58 extracted references · 41 canonical work pages

  1. [31]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 16 463–16 472

    2021

  2. [1]

    Multi-modal fusion transformer for end-to-end autonomous driving,

    A. Prakash, K. Chitta, and A. Geiger, “Multi-modal fusion transformer for end-to-end autonomous driving,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 7077– 7087

    work page 2021

  3. [2]

    Transformers in medical imaging: A survey,

    F. Shamshad, S. H. Khan, S. W. Zamir, M. H. Khan, M. Hayat, F. S. Khan, and H. Fu, “Transformers in medical imaging: A survey,” Medical Image Anal., vol. 88, p. 102802, 2023

    work page 2023

  4. [3]

    Killing two birds with one stone: Efficient and robust training of face recognition cnns by partial fc,

    X. An, J. Deng, J. Guo, Z. Feng, X. Zhu, J. Yang, and T. Liu, “Killing two birds with one stone: Efficient and robust training of face recognition cnns by partial fc,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2022, pp. 4042–4051

    work page 2022

  5. [4]

    Robustness of on-device models: Adversarial attack to deep learning models on android apps,

    Y . Huang, H. Hu, and C. Chen, “Robustness of on-device models: Adversarial attack to deep learning models on android apps,” in 43rd IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice, ICSE (SEIP) 2021, Madrid, Spain, May 25-28,

    work page 2021

  6. [5]

    Smart app attack: Hacking deep learning models in android apps,

    Y . Huang and C. Chen, “Smart app attack: Hacking deep learning models in android apps,” IEEE Trans. Inf. Forensics Secur., vol. 17, pp. 1827– 1840, 2022

    work page 2022

  7. [6]

    Adversary for social good: Protecting familial privacy through joint adversarial attacks,

    C. Kumar, R. Ryan, and M. Shao, “Adversary for social good: Protecting familial privacy through joint adversarial attacks,” in Proceedings of the AAAI conference on artificial intelligence , vol. 34, no. 07, 2020, pp. 11 304–11 311

    work page 2020

  8. [7]

    Machine learning on mobile: An on-device inference app for skin cancer detec- tion,

    X. Dai, I. Spasi ´c, B. Meyer, S. Chapman, and F. Andres, “Machine learning on mobile: An on-device inference app for skin cancer detec- tion,” in 2019 fourth international conference on fog and mobile edge computing (FMEC). IEEE, 2019, pp. 301–305

    work page 2019

Show all 58 references
  1. [8]

    A first look at deep learning apps on smartphones,

    M. Xu, J. Liu, Y . Liu, F. X. Lin, Y . Liu, and X. Liu, “A first look at deep learning apps on smartphones,” inThe World Wide Web Conference, WWW 2019, San Francisco, CA, USA, May 13-17, 2019 . ACM, 2019, pp. 2125–2136

    2019

  2. [9]

    A comprehensive benchmark of deep learning libraries on mobile devices,

    Q. Zhang, X. Li, X. Che, X. Ma, A. Zhou, M. Xu, S. Wang, Y . Ma, and X. Liu, “A comprehensive benchmark of deep learning libraries on mobile devices,” in WWW ’22: The ACM Web Conference 2022, Virtual Event, Lyon, France, April 25 - 29, 2022 . ACM, 2022, pp. 3298–3307

    2022

  3. [10]

    Tensorflow lite,

    Google, “Tensorflow lite,” https://www.tensorflow.org/lite, 2021

    2021

  4. [11]

    Facebook, “Caffe2,” https://research.fb.com/downloads/caffe2/, 2021

    2021

  5. [12]

    Mind your weight(s): A large- scale study on insufficient machine learning model protection in mobile apps,

    Z. Sun, R. Sun, L. Lu, and A. Mislove, “Mind your weight(s): A large- scale study on insufficient machine learning model protection in mobile apps,” in 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021 . USENIX Association, 2021, pp. 1955–1972

    2021

  6. [13]

    Under- standing real-world threats to deep learning models in android apps,

    Z. Deng, K. Chen, G. Meng, X. Zhang, K. Xu, and Y . Cheng, “Under- standing real-world threats to deep learning models in android apps,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, November 7-11, 202...

    2022

  7. [14]

    Backdoor learning: A survey,

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , pp. 1– 18, 2022

    2022

  8. [15]

    Badnl: Backdoor attacks against nlp models with semantic- preserving improvements,

    X. Chen, A. Salem, D. Chen, M. Backes, S. Ma, Q. Shen, Z. Wu, and Y . Zhang, “Badnl: Backdoor attacks against nlp models with semantic- preserving improvements,” in Annual Computer Security Applications Conference, 2021, pp. 554–569

    2021

  9. [16]

    Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks

    H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks.” in IJCAI, vol. 2, no. 5, 2019, p. 8

    2019

  10. [17]

    Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems,

    W. Guo, L. Wang, X. Xing, M. Du, and D. Song, “Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems,” arXiv preprint arXiv:1908.01763 , 2019

    1908 arXiv

  11. [18]

    Composite backdoor attack for deep neural network by mixing existing benign features,

    J. Lin, L. Xu, Y . Liu, and X. Zhang, “Composite backdoor attack for deep neural network by mixing existing benign features,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communica- tions Security, 2020, pp. 113–131

    2020

  12. [19]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International Conference on Artificial Intelligence and Statistics . PMLR, 2020, pp. 2938–2948

    2020

  13. [20]

    Blind backdoors in deep learning models,

    E. Bagdasaryan and V . Shmatikov, “Blind backdoors in deep learning models,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 1505–1521

    2021

  14. [21]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access , vol. 7, pp. 47 230–47 244, 2019

    2019

  15. [22]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Y . Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in Computer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part X, ser. Lecture Notes in Computer Science, vol. 12355. ...

    2020

  16. [23]

    Weight poisoning attacks on pretrained models,

    K. Kurita, P. Michel, and G. Neubig, “Weight poisoning attacks on pretrained models,” in Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics , 2020, pp. 2793–2806

    2020

  17. [24]

    Backdoor attacks against transfer learning with pre-trained deep learn- ing models,

    S. Wang, S. Nepal, C. Rudolph, M. Grobler, S. Chen, and T. Chen, “Backdoor attacks against transfer learning with pre-trained deep learn- ing models,” IEEE Transactions on Services Computing , vol. 15, no. 3, pp. 1526–1539, 2020

    2020

  18. [25]

    Backdooring convolutional neural net- works via targeted weight perturbations,

    J. Dumford and W. Scheirer, “Backdooring convolutional neural net- works via targeted weight perturbations,” in 2020 IEEE International Joint Conference on Biometrics (IJCB) . IEEE, 2020, pp. 1–9

    2020

  19. [26]

    Tbt: Targeted neural network attack with bit trojan,

    A. S. Rakin, Z. He, and D. Fan, “Tbt: Targeted neural network attack with bit trojan,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2020, pp. 13 198–13 207

    2020

  20. [27]

    An embarrassingly simple approach for trojan attack in deep neural networks,

    R. Tang, M. Du, N. Liu, F. Yang, and X. Hu, “An embarrassingly simple approach for trojan attack in deep neural networks,” ser. KDD ’20. New York, NY , USA: Association for Computing Machinery, 2020, p. 218–228. [Online]. Available: https://doi.org/10.1145/3394486.3403064

    2020

  21. [28]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” CoRR, vol. abs/1712.05526, 2017

    2017 arXiv

  22. [29]

    Label-consistent backdoor at- tacks,

    A. Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor at- tacks,” arXiv preprint arXiv:1912.02771 , 2019

    1912 arXiv

  23. [30]

    Invisible backdoor attacks on deep neural networks via steganography and regularization,

    S. Li, M. Xue, B. Z. H. Zhao, H. Zhu, and X. Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 5, pp. 2088–2105, 2020

    2020

  24. [32]

    Backdoor attack with sparse and invisible trigger,

    Y . Gao, Y . Li, X. Gong, Z. Li, S.-T. Xia, and Q. Wang, “Backdoor attack with sparse and invisible trigger,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 6364–6376, 2024

    2024

  25. [33]

    Deeppayload: Black- box backdoor attack on deep learning models through neural payload injection,

    Y . Li, J. Hua, H. Wang, C. Chen, and Y . Liu, “Deeppayload: Black- box backdoor attack on deep learning models through neural payload injection,” in 43rd IEEE/ACM International Conference on Software Engineering, ICSE 2021, Madrid, Spain, 22-30 May 2021. IEEE, 2021, pp. 263–274

    2021

  26. [34]

    Stegastamp: Invisible hyperlinks in physical photographs,

    M. Tancik, B. Mildenhall, and R. Ng, “Stegastamp: Invisible hyperlinks in physical photographs,” in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020 . Computer Vision Foundation / IEEE, 2020, pp. 2114– 2123

    2020

  27. [35]

    Deep feature space trojan attack of neural networks by controlled detoxification,

    S. Cheng, Y . Liu, S. Ma, and X. Zhang, “Deep feature space trojan attack of neural networks by controlled detoxification,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35, no. 2, 2021, pp. 1148–1156

    2021

  28. [36]

    Backdoor embedding in convolutional neural network models via invisible perturbation,

    H. Zhong, C. Liao, A. C. Squicciarini, S. Zhu, and D. J. Miller, “Backdoor embedding in convolutional neural network models via invisible perturbation,” in CODASPY ’20: Tenth ACM Conference on Data and Application Security and Privacy, New Orleans, LA, USA, March 16-18, 2020 ....

    2020

  29. [37]

    Universal adversarial perturbations,

    S. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in 2017 IEEE Conference on Computer Vision JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 13 and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26,

    2017

  30. [38]

    Backdoor attack on deep learning-based medical image encryption and decryption network,

    Y . Ding, Z. Wang, Z. Qin, E. Zhou, G. Zhu, Z. Qin, and K.-K. R. Choo, “Backdoor attack on deep learning-based medical image encryption and decryption network,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 280–292, 2024

    2024

  31. [39]

    Eyeriss: A spatial architecture for energy-efficient dataflow for convolutional neural networks,

    Y .-H. Chen, J. Emer, and V . Sze, “Eyeriss: A spatial architecture for energy-efficient dataflow for convolutional neural networks,” ACM SIGARCH computer architecture news , vol. 44, no. 3, pp. 367–379, 2016

    2016

  32. [40]

    Edge intelligence: Architectures, challenges, and applications,

    D. Xu, T. Li, Y . Li, X. Su, S. Tarkoma, T. Jiang, J. Crowcroft, and P. Hui, “Edge intelligence: Architectures, challenges, and applications,” arXiv preprint arXiv:2003.12172 , 2020

    2003 arXiv

  33. [41]

    Tensorflow hub,

    Google, “Tensorflow hub,” https://tfhub.dev, 2021

    2021

  34. [42]

    Tencent, “Ncnn,” https://github.com/Tencent/ncnn, 2021

    2021

  35. [43]

    Investigating white- box attacks for on-device models,

    M. Zhou, X. Gao, J. Wu, K. Liu, H. Sun, and L. Li, “Investigating white- box attacks for on-device models,” inProceedings of the IEEE/ACM 46th International Conference on Software Engineering , 2024, pp. 1–12

    2024

  36. [44]

    Apktool: A tool for reverse engineering android apk files

    R. Winsniewski, “Apktool: A tool for reverse engineering android apk files.” https://ibotpeaches.github.io/Apktool/, 2018

    2018

  37. [45]

    Defending neural backdoors via genera- tive distribution modeling,

    X. Qiao, Y . Yang, and H. Li, “Defending neural backdoors via genera- tive distribution modeling,” Advances in neural information processing systems, vol. 32, 2019

    2019

  38. [46]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 707–723

    2019

  39. [47]

    Sentinet: Detecting localized universal attacks against deep learning systems,

    E. Chou, F. Tram `er, and G. Pellegrino, “Sentinet: Detecting localized universal attacks against deep learning systems,” in 2020 IEEE Security and Privacy Workshops, SP Workshops, San Francisco, CA, USA, May 21, 2020. IEEE, 2020, pp. 48–54

    2020

  40. [48]

    Design and evaluation of a multi-domain trojan detection method on deep neural networks,

    Y . Gao, Y . Kim, B. G. Doan, Z. Zhang, G. Zhang, S. Nepal, D. Ranas- inghe, and H. Kim, “Design and evaluation of a multi-domain trojan detection method on deep neural networks,” IEEE Transactions on Dependable and Secure Computing , 2021

    2021

  41. [49]

    Invisible backdoor attack with attention and steganography,

    W. Chen, X. Xu, X. Wang, H. Zhou, Z. Li, and Y . Chen, “Invisible backdoor attack with attention and steganography,”Computer Vision and Image Understanding, vol. 249, p. 104208, 2024

    2024

  42. [50]

    U-net: Convolutional networks for biomedical image segmentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” in Medical Image Computing and Computer-Assisted Intervention - MICCAI 2015 - 18th International Conference Munich, Germany, October 5 - 9, 2015, Proceedings, Part III, ...

    2015

  43. [51]

    Spa- tial transformer networks,

    M. Jaderberg, K. Simonyan, A. Zisserman, and K. Kavukcuoglu, “Spa- tial transformer networks,” in Advances in Neural Information Process- ing Systems 28: Annual Conference on Neural Information Processing Systems 2015, December 7-12, 2015, Montreal, Quebec, Canada , 2015, pp. ...

    2015

  44. [52]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 4510–4520

    2018

  45. [53]

    Learning transferable architectures for scalable image recognition,

    B. Zoph, V . Vasudevan, J. Shlens, and Q. V . Le, “Learning transferable architectures for scalable image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 8697– 8710

    2018

  46. [54]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  47. [55]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    2014 arXiv

  48. [56]

    Multiscale structural similarity for image quality assessment,

    Z. Wang, E. P. Simoncelli, and A. C. Bovik, “Multiscale structural similarity for image quality assessment,” in The Thrity-Seventh Asilomar Conference on Signals, Systems & Computers, 2003, vol. 2. Ieee, 2003, pp. 1398–1402

    2003

  49. [2017]

    IEEE Computer Society, 2017, pp. 86–94

    2017

  50. [2021]

    IEEE, 2021, pp. 101–110

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.