Pith. sign in

REVIEW 5 major objections 4 minor 60 references

BadSR: Stealthy Label Backdoor Attacks on Image Super-Resolution

T0 review · 5 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read BadSR hides the backdoor in the high-resolution training label, so a poisoned dataset looks clean to the eye but still teaches SR models to output attacker-chosen features on triggered inputs.

desk verdict A genuinely new SR backdoor variant with a real transfer-assumption gap and some formal sloppiness; worth a serious referee but only conditional acceptance. read the letter →

arxiv 2505.15308 v1 pith:TKZGPEDG submitted 2025-05-21 cs.CV cs.AI

Ji Guo , Xiaolei Wen , Wenbo Jiang , Cheng Huang , Jinjin Li , Hongwei Li This is my paper · ORCID
classification cs.CVcs.AI
keywords backdoorattackimagesuper-resolutiondatapoisoningstealthylabeltriggeroptimizationgeneticalgorithmdownstreamtask
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BadSR aims to show that a backdoor can be planted in an image super-resolution model without leaving visibly anomalous data. Previous attacks hid the trigger in the low-resolution input but replaced the high-resolution training label with an unrelated target image, which stands out during data cleaning. BadSR instead generates a poisoned HR label that looks nearly identical to the clean HR image while carrying the target image's features in a deep feature space. On top of this it adds an adversarially optimized LR trigger and a genetic-algorithm selection of the most influential poisoned samples. If the claim holds, a user cleaning a dataset by eye would keep the poisoned pairs, and the trained SR model would output target-bearing images for triggered inputs while behaving normally otherwise.

What carries the argument

The load-bearing object is the poisoned high-resolution label y_p produced by Eq. (13): a feature-space alignment step that minimizes the L2 distance between the substitute model's features of y_p and of the target image y*_t, constrained by an L2 pixel-norm ball around the clean HR y. This is the mechanism that turns a label into a stealthy carrier of the target association. It is supported by a pixel-level adversarial LR trigger that maximizes reconstruction loss of a substitute SR model under a dynamic norm penalty plus LPIPS constraint, and by a genetic algorithm that picks the poisoned subset according to the norm of each sample's backdoor gradient.

What would settle it

Take the same poisoned HR labels generated by Eq. (13) with RRDBNet as the feature extractor, and retrain a victim model while replacing the feature extractor with a different architecture such as a VGG network or the victim's own pre-trained encoder; if the attack success rate falls close to the no-poisoning baseline under the different extractor while remaining high under RRDBNet, the transfer assumption behind the method collapses.

Watch

Extended reading notes

Core claim

The paper's central claim is that solving min ||f_phi(y_p) - f_phi(y*_t)||^2_2 subject to ||y_p - y||_2 <= epsilon produces an HR label that is at once stealthy and effective: close in pixels to the clean label, close in substitute-model features to the target. Trained on such pairs, SR models with very different architectures, including EDSR, RCAN, ESRGAN, SwinIR, and LIIF, learn to output images carrying target features when the LR input carries the trigger, with attack success rates reported above 80% on DIV2K, BSD100, and Urban100. The poisoned HR labels are reported at PSNR 28.97 and SSIM 0.6895 against clean labels, versus PSNR 5.25 and SSIM 0.1004 for the prior I2I backdoor that replaces the HR label outright. The paper further claims that these target-bearing outputs degrade downstream classifiers and detectors even though the upstream SR model's clean-image quality remains close to the unpoisoned baseline.

Load-bearing premise

The attack assumes that a small pixel perturbation which moves an HR image close to the target in the substitute RRDBNet's feature space is enough for any victim SR model to learn the target association, even though the victim model is trained on a different architecture.

Editorial extensions

If this is right

  • A direct corollary is that backdoor defenses which screen poisoned datasets by visual inspection or simple pixel similarity will miss the poisoned HR labels, because those labels look like the original clean images.
  • Because the attack only needs a substitute model, it implies that an attacker without knowledge of the victim architecture can still poison a dataset that works across CNN-based, GAN-based, and Transformer-based SR models.
  • The reported robustness results imply that common input preprocessing defenses, such as bit depth reduction and JPEG compression, will not reliably remove the backdoor without also degrading image quality.
  • The downstream-task experiments imply that even a partial target image, carrying target features rather than a full clean reconstruction, is enough to mislead classification and object detection systems that consume SR output.
  • The ablation of effective poisoning implies that the genetic-algorithm selection is doing real work: the same poisoning rate reaches a higher attack success rate when the most influential samples are chosen rather than random ones.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural test the paper leaves implicit is whether Eq. (13) works when the feature extractor is the victim model's own encoder instead of RRDBNet; if feature spaces diverge, the poisoned labels may be stealthy but not effective for that victim.
  • The reported stealthiness is measured by PSNR and SSIM, so a human-perception study or a learned detector that exploits the feature-space shift could reveal whether the visual similarity claim survives more stringent inspection.
  • The paper only probes a few perturbation budgets, which suggests a trade-off curve between epsilon, attack success rate, and detectability that could be mapped more fully and might expose a threshold below which the attack fails.
  • The same label-poisoning idea could plausibly transfer to other image-to-image tasks such as denoising or deblurring, where the output label is also a full image rather than a class, though the paper does not test those settings.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes BadSR, a data-poisoning backdoor attack against single-image super-resolution. Instead of replacing poisoned HR labels with a fixed target image, BadSR solves Eq. (13) to generate a poisoned HR image y_p that is close to the clean HR y in ℓ2 norm but close to the target image in the feature space of a substitute RRDBNet. A pixel-level adversarial trigger is optimized by maximizing reconstruction loss (Eq. (19)), and a genetic algorithm selects high-impact poisoned samples. The evaluation covers five SR architectures, multiple datasets, two downstream tasks, and two defenses, and reports ASR mostly above 80%, near-baseline PSNR/SSIM on clean inputs, and improved HR-label stealthiness over I2I.

Significance. If the claims hold, BadSR addresses a genuine gap: prior SR backdoor attacks focus on LR stealth and overlook poisoned-HR detectability. The feature-space label optimization is a reasonable adaptation of clean-label backdoor ideas to regression-style SR labels, and the breadth of victim architectures, downstream tasks, and defenses is a strength. The paper includes no public code, error bars, or seed-averaged results, so the quantitative claims should be read as single-run evidence; nevertheless the core pipeline is coherent and the empirical pattern is consistent across models.

major comments (5)
  1. [Section III-A and Section IV-B] The formal poisoning definition and the actual method disagree. Eqs. (3)-(4) set the poisoned HR label to the predefined target y*, and Eq. (21) again writes Dp={(xp, yt)}; in contrast, Section IV-B solves Eq. (13) to produce a perturbed image y_p and states that y_p is the poisoned HR label. Since the reported ASR is obtained with the latter pipeline, Eqs. (3)-(4), (6), (21)-(22) must be rewritten in terms of y_p, or the text must explain how y* is still used. This is not cosmetic: the two choices train the backdoor toward different objectives.
  2. [Section IV.C, Eq. (19), Algorithm 1] The trigger optimization has an internal sign inconsistency. Eq. (19) maximizes λ0Ladv − λ1Llpips − λ2Lreg, while Algorithm 1 defines L ← −λ0Ladv + λ1Lperc + λ2Lreg and then performs gradient ascent δ ← δ + η ∂L/∂δ. Gradient ascent on this L is equivalent to gradient descent on the Eq. (19) objective, so the algorithm as written would minimize the adversarial reconstruction loss. The variable Lperc is also never defined (Eq. (17) defines Llpips). The pseudocode must be corrected to match Eq. (19).
  3. [Section IV.B and Section V.A] The attack's central transfer assumption is untested. Eq. (13) aligns HR labels only in the feature space of the substitute RRDBNet, and Section V.A says RRDBNet is used both as substitute SR model and feature extractor, while the victims are EDSR, RCAN, ESRGAN, SwinIR, and LIIF. The paper reports no experiment that varies the feature extractor fφ or measures feature-space alignment across architectures. Without this, the high ASR may reflect only RRDBNet's feature geometry; a minimal control is to regenerate poisoned data with one or two other feature extractors and report ASR for all victims.
  4. [Section IV.D, Algorithm 2] The genetic-algorithm operations are undefined for set-valued individuals. In Algorithm 2, step 7 writes Snew = αS1 + (1−α)S2 and step 8 writes Smut = S + ΔS with ΔS ∼ N(0, σ²), neither of which is meaningful for subsets of training samples; the crossover and mutation operators need to be defined concretely. In addition, the model fθ used to compute the backdoor gradient gp is not identified: Section III.B says the attacker has no access to the target model, so gp must be computed with a substitute, and that choice should be stated because it affects the selection results in Table V.
  5. [Section V.B and Table VI] The paper concedes in Section V.B that 'we cannot generate a complete target image,' which contradicts the formal Eq. (10) stating that the triggered output equals y*. Moreover, the ASR metric for downstream tasks is never formally defined: for classification, it is unclear whether ASR is the model's accuracy on triggered inputs, the fraction of outputs assigned to the target class, or a misclassification rate; the sentence 'If the model misclassifies ... attack is considered successful' is not a metric. These definitions need to be provided alongside error bars (at least three seeds) for the headline ASR numbers.
minor comments (4)
  1. [Section V.A] The configuration lists λ1 = 1.0, λ2 = 1.0, and λ3 = 1.0, but Eq. (19) uses λ0, λ1, and λ2; λ0 is missing and the λ3 label is unused.
  2. [Section IV.A and Section V.A] The notation p is overloaded: Section IV.A refers to the 'Lp norm', Eq. (13) uses ℓ2, and Section V.A calls the perturbation budgets p = 1.0 and p = 0.05; please disambiguate the norm order from the budget parameter.
  3. [Figures 12 and 13] Figure 13's caption contains typos ('Origain', 'imgae'), and Figure 12's text contains corrupted Unicode tokens in the PDF; please recompile and proofread the figure captions.
  4. [Table III and Section V.D] An SSIM of 0.6895 is described as making poisoned HR images 'almost identical' to the originals; given that this is substantially below the clean self-similarity of 1.0, the paper should either provide a human-perception study or justify why 0.6895 constitutes visual stealthiness.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: poisoned label generation is an explicit optimization against an external target; ASR is measured with an independent detector on victim models.

full rationale

We find no circular step that reduces the paper's claims to its inputs. The poisoned HR label y_p is explicitly generated by Eq. (13), an optimization that minimizes feature distance to an external target y*_t subject to an l2 ball around the clean HR y. The training objective (Eqs. (5)-(7)) maps triggered inputs to this target-bearing label, and attack success is measured by an independently trained ResNet-50 detector applied to outputs of five victim SR architectures (EDSR, RCAN, ESRGAN, SwinIR, LIIF), none of which is the RRDBNet used as the substitute/feature extractor. The stealthiness numbers in Table III report the constraint in Eq. (13) as an empirical metric, not as a prediction. The author-group overlap in Refs [13], [14], [26] is limited to prior-art and baseline positioning and does not carry the load-bearing argument. The main methodological caveat, that Eq. (13) uses RRDBNet both as substitute SR model and as feature extractor without varying f_phi, is a transferability assumption that could weaken external validity, but it does not make the reported ASR true by construction, since the target detector and victim models are external. There is also an internal ambiguity about whether the formal training label is y* (Eqs. (3), (6), (21)) or the generated y_p (Sec. IV.B); this affects reproducibility but is not a definitional equivalence. Overall, the derivation chain is self-contained and empirically benchmarked against external models and detectors.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claim rests on a small set of hand-chosen hyperparameters and on empirical transfer assumptions, not on a new physical entity or a new mathematical object. The most load-bearing choices are the HR perturbation budget, the poison rate, the substitute model, and the assumption that SSIM/PSNR capture stealthiness.

free parameters (7)
  • HR perturbation budget epsilon = 0.05 (L2 norm bound, selected from 0.05 to 0.2)
    Controls the trade-off in Eq. (13) between HR stealth and feature alignment; authors selected 0.05 after experiments in Table IV and Figure 11.
  • LR perturbation budget p = 1.0
    Budget for the adversarial trigger optimization in Section V.A; chosen by hand without sensitivity analysis.
  • Trigger loss weights lambda_0, lambda_1, lambda_2 = 1.0 each
    Weights in Eq. (19) for adversarial loss, LPIPS loss, and regularization; set to equal values without a reported sensitivity study.
  • Poisoning rate = 10%
    Selected from Figure 10 as a balance between attack success and stealthiness using the evaluation metrics.
  • GA regularization lambda = not reported
    Balance in fitness Eq. (25) between the summed backdoor gradient and subset size; the value is not given, so the selection step is not reproducible.
  • Optimization iterations and learning rates = trigger: 300 iterations, lr 0.01; HR: 50 iterations, lr 0.1
    Stated in Section V.A and chosen based on convergence behavior; no formal justification is provided.
  • Dynamic penalty threshold tau = not reported
    Threshold in Eq. (16) beyond which the trigger regularization penalty grows linearly; no numerical value is given.
assumptions (6)
  • domain assumption Feature-space proximity in the substitute RRDBNet transfers to victim SR models trained on the poisoned dataset.
    The entire poisoning strategy in Eq. (13) rests on this transfer, and the paper provides no mechanism or proof beyond the reported experimental results.
  • domain assumption SSIM and PSNR between poisoned and original HR images are sufficient proxies for human or automated detection.
    Section V.D uses these metrics to claim stealthiness, but no human study or automated data-cleaning detector is evaluated.
  • domain assumption Samples with larger backdoor gradient have greater influence on model training.
    Invoked in Section IV.D with a citation to [46]; used to justify the genetic-algorithm selection criterion.
  • domain assumption The genetic algorithm with roulette selection, crossover, and mutation converges to a near-optimal poisoned subset.
    Algorithm 2 provides no convergence guarantee, and the crossover and mutation operations on subsets are not formally specified.
  • domain assumption The attacker can poison a public dataset and the victim will train on it as-is.
    This is the data-poisoning threat model stated in Section III.B and is necessary for any backdoor attack of this type.
  • domain assumption The predefined target image y* is a fixed attacker-chosen image.
    Required by Eqs. (12) and (13) and by the ASR detector; the paper does not discuss how target choice affects success.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadSR: Stealthy Label Backdoor Attacks on Image Super-Resolution." pith.science (2026). https://pith.science/paper/TKZGPEDG

@misc{pith2026250515308,
  author       = {Pith},
  title        = {Pith review of: BadSR: Stealthy Label Backdoor Attacks on Image Super-Resolution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TKZGPEDG}},
  note         = {Machine review of arXiv:2505.15308}
}
read the original abstract

With the widespread application of super-resolution (SR) in various fields, researchers have begun to investigate its security. Previous studies have demonstrated that SR models can also be subjected to backdoor attacks through data poisoning, affecting downstream tasks. A backdoor SR model generates an attacker-predefined target image when given a triggered image while producing a normal high-resolution (HR) output for clean images. However, prior backdoor attacks on SR models have primarily focused on the stealthiness of poisoned low-resolution (LR) images while ignoring the stealthiness of poisoned HR images, making it easy for users to detect anomalous data. To address this problem, we propose BadSR, which improves the stealthiness of poisoned HR images. The key idea of BadSR is to approximate the clean HR image and the pre-defined target image in the feature space while ensuring that modifications to the clean HR image remain within a constrained range. The poisoned HR images generated by BadSR can be integrated with existing triggers. To further improve the effectiveness of BadSR, we design an adversarially optimized trigger and a backdoor gradient-driven poisoned sample selection method based on a genetic algorithm. The experimental results show that BadSR achieves a high attack success rate in various models and data sets, significantly affecting downstream tasks.

Figures

Figures reproduced from arXiv: 2505.15308 by the authors.

Figure 1
Figure 1. Comparison of the stealthiness among I2I backdoor [14], BadRefSR [13], and BadSR. The I2I backdoor and BadRefSR [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Pipeline of a backdoor SR model for downstream tasks. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of the BadSR method. Poisoned LR images are generated by optimizing triggers added to the original LR [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Visualization results of different triggered LR images used as inputs for the backdoor ESRGAN. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Visualization results of different methods for clean LR image as input for SwinIR. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Different method LR image stealthiness evaluation. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Different method HR image stealthiness evaluation. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Robustness of BadSR against bit depth reduction. [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Robustness of BadSR against image compression. [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Impact of poisoning rates of BadSR. Perturbation budget. The perturbation budget controls the maximum allowable perturbation in the image to generate HR label images. To investigate its effect on both attack effective￾ness and stealthiness, we tested several values fo…
Figure 11
Figure 11. Figure 11: Visualization results of different perturbation budgets. [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 12
Figure 12. Figure 12: Computational overhead of BadSR. TABLE V: Ablation study of effective poisoning. Poisoned Rate (%) Effective Poisoning ASR SSIM 5% w/ 68.42 0.8185 w/o 50.35 0.8534 10% w/ 85.73 0.8122 w/o 80.10 0.8234 20% w/ 91.02 0.7994 w/o 88.45 0.8087 30% w/ 91.92 0.7642 w/o 90.22 …
Figure 13
Figure 13. Figure 13: Grad-CAM of BadSR impact on image classification. [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 43 canonical work pages

  1. [1]

    Deep learning,

    Y . LeCun, Y . Bengio, and G. Hinton, “Deep learning,”nature, vol. 521, no. 7553, pp. 436–444, 2015

    2015

  2. [2]

    Image super- resolution using very deep residual channel attention networks,

    Y . Zhang, K. Li, K. Li, L. Wang, B. Zhong, and Y . Fu, “Image super- resolution using very deep residual channel attention networks,” in Proceedings of ECCV, pp. 286–301, 2018

    work page 2018

  3. [3]

    Enhanced deep residual networks for single image super-resolution,

    B. Lim, S. Son, H. Kim, S. Nah, and K. Mu Lee, “Enhanced deep residual networks for single image super-resolution,” inProceedings of CVPR Workshops, pp. 136–144, 2017

    work page 2017

  4. [4]

    Swinir: Image restoration using swin transformer,

    J. Liang, J. Cao, G. Sun, K. Zhang, L. Van Gool, and R. Timofte, “Swinir: Image restoration using swin transformer,” inProceedings of ICCV, pp. 1833–1844, 2021

    work page 2021

  5. [5]

    Esrgan: Enhanced super-resolution generative adver- sarial networks,

    X. Wang, K. Yu, S. Wu, J. Gu, Y . Liu, C. Dong, Y . Qiao, and C. Change Loy, “Esrgan: Enhanced super-resolution generative adver- sarial networks,” inProceedings of ECCV workshops, pp. 0–0, 2018

    work page 2018

  6. [6]

    Image super-resolution via sparse representation,

    J. Yang, J. Wright, T. S. Huang, and Y . Ma, “Image super-resolution via sparse representation,”IEEE transactions on image processing, vol. 19, no. 11, pp. 2861–2873, 2010

    2010

  7. [7]

    Super-resolution in medical imaging,

    H. Greenspan, “Super-resolution in medical imaging,”The computer journal, vol. 52, no. 1, pp. 43–63, 2009

    2009

  8. [8]

    Super resolution techniques for medical image processing,

    J. S. Isaac and R. Kulkarni, “Super resolution techniques for medical image processing,” inProceedings of ICTSD, pp. 1–6, IEEE, 2015

    work page 2015

Show all 60 references
  1. [9]

    A comprehensive review on deep learning based remote sensing image super-resolution methods,

    P. Wang, B. Bayram, and E. Sertel, “A comprehensive review on deep learning based remote sensing image super-resolution methods,”Earth- Science Reviews, vol. 232, p. 104110, 2022

    2022

  2. [10]

    A super-resolution recon- struction algorithm for surveillance images,

    L. Zhang, H. Zhang, H. Shen, and P. Li, “A super-resolution recon- struction algorithm for surveillance images,”Signal Processing, vol. 90, no. 3, pp. 848–859, 2010

    2010

  3. [11]

    Evaluating robustness of deep image super-resolution against adversarial attacks,

    J.-H. Choi, H. Zhang, J.-H. Kim, C.-J. Hsieh, and J.-S. Lee, “Evaluating robustness of deep image super-resolution against adversarial attacks,” inProceedings of ICCV, pp. 303–311, 2019

    2019

  4. [12]

    When deep fool meets deep prior: Adversarial attack on super-resolution network,

    M. Yin, Y . Zhang, X. Li, and S. Wang, “When deep fool meets deep prior: Adversarial attack on super-resolution network,” inProceedings of ACM MM, pp. 1930–1938, 2018

    1930

  5. [13]

    Badrefsr: Backdoor attacks against reference-based image super resolution,

    X. Yang, T. Chen, L. Guo, W. Jiang, J. Guo, Y . Li, and J. He, “Badrefsr: Backdoor attacks against reference-based image super resolution,” in Processing of ICASSP, IEEE, 2025. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 13

    2025

  6. [14]

    Backdoor attacks against image-to-image networks,

    W. Jiang, H. Li, J. He, R. Zhang, G. Xu, T. Zhang, and R. Lu, “Backdoor attacks against image-to-image networks,”arXiv preprint arXiv:2407.10445, 2024

    2024 arXiv

  7. [15]

    Hidden trigger backdoor attacks,

    A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden trigger backdoor attacks,” inProceedings of AAAI, vol. 34, pp. 11957–11965, 2020

    2020

  8. [16]

    Narcissus: A practical clean-label backdoor attack with limited information,

    Y . Zeng, M. Pan, H. A. Just, L. Lyu, M. Qiu, and R. Jia, “Narcissus: A practical clean-label backdoor attack with limited information,” in Proceedings of ACM SIGSAC, pp. 771–785, 2023

    2023

  9. [17]

    Generalization bound and new algorithm for clean-label backdoor attack,

    L. Yu, S. Liu, Y . Miao, X.-S. Gao, and L. Zhang, “Generalization bound and new algorithm for clean-label backdoor attack,”arXiv preprint arXiv:2406.00588, 2024

    2024 arXiv

  10. [18]

    Invisible poison: A blackbox clean label backdoor attack to deep neural networks,

    R. Ning, J. Li, C. Xin, and H. Wu, “Invisible poison: A blackbox clean label backdoor attack to deep neural networks,” inProceedings of INFOCOM, pp. 1–10, IEEE, 2021

    2021

  11. [19]

    Clean-label graph backdoor attack in the node classification task,

    H. Xia, X. Zhao, R. Zhang, S. Xu, and L. Wang, “Clean-label graph backdoor attack in the node classification task,” inProceedings of AAAI, vol. 39, pp. 21626–21634, 2025

    2025

  12. [20]

    Clean- label backdoor attacks on video recognition models,

    S. Zhao, X. Ma, X. Zheng, J. Bailey, J. Chen, and Y .-G. Jiang, “Clean- label backdoor attacks on video recognition models,” inProceedings of CVPR, pp. 14443–14452, 2020

    2020

  13. [21]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,”arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  14. [22]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,”arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  15. [23]

    Wanet–imperceptible warping-based backdoor attack,

    A. Nguyen and A. Tran, “Wanet–imperceptible warping-based backdoor attack,”arXiv preprint arXiv:2102.10369, 2021

    2021 arXiv

  16. [24]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Y . Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” inProcessing of ECCV, pp. 182–199, Springer, 2020

    2020

  17. [25]

    Abs: Scanning neural networks for back-doors by artificial brain stimulation,

    Y . Liu, W.-C. Lee, G. Tao, S. Ma, Y . Aafer, and X. Zhang, “Abs: Scanning neural networks for back-doors by artificial brain stimulation,” inProceedings of CCS, pp. 1265–1282, 2019

    2019

  18. [26]

    Color backdoor: A robust poisoning attack in color space,

    W. Jiang, H. Li, G. Xu, and T. Zhang, “Color backdoor: A robust poisoning attack in color space,” inProceedings of CVPR, pp. 8133– 8142, 2023

    2023

  19. [27]

    Deep learning for image super- resolution: A survey,

    Z. Wang, J. Chen, and S. C. Hoi, “Deep learning for image super- resolution: A survey,”IEEE transactions on pattern analysis and ma- chine intelligence, vol. 43, no. 10, pp. 3365–3387, 2020

    2020

  20. [28]

    Image super-resolution using deep convolutional networks,

    C. Dong, C. C. Loy, K. He, and X. Tang, “Image super-resolution using deep convolutional networks,”IEEE transactions on pattern analysis and machine intelligence, vol. 38, no. 2, pp. 295–307, 2015

    2015

  21. [29]

    Generative adversarial nets,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” Proceedings of NeurIPS, vol. 27, 2014

    2014

  22. [30]

    Photo-realistic single image super-resolution using a generative adversarial network,

    C. Ledig, L. Theis, F. Husz ´ar, J. Caballero, A. Cunningham, A. Acosta, A. Aitken, A. Tejani, J. Totz, Z. Wang,et al., “Photo-realistic single image super-resolution using a generative adversarial network,” inPro- ceedings of CVPR, pp. 4681–4690, 2017

    2017

  23. [31]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,”Advances in neural information processing systems, vol. 30, 2017

    2017

  24. [32]

    Learning texture transformer network for image super-resolution,

    F. Yang, H. Yang, J. Fu, H. Lu, and B. Guo, “Learning texture transformer network for image super-resolution,” inProceedings of CVPR, pp. 5791–5800, 2020

    2020

  25. [33]

    Learning continuous image represen- tation with local implicit image function,

    Y . Chen, S. Liu, and X. Wang, “Learning continuous image represen- tation with local implicit image function,” inProceedings of CVPR, pp. 8628–8638, 2021

    2021

  26. [34]

    Backdoor at- tack against speaker verification,

    T. Zhai, Y . Li, Z. Zhang, B. Wu, Y . Jiang, and S.-T. Xia, “Backdoor at- tack against speaker verification,” inProceedings of ICASSP, pp. 2560– 2564, IEEE, 2021

    2021

  27. [35]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” inProceedings of AISTATS, pp. 2938– 2948, PMLR, 2020

    2020

  28. [36]

    Trojdrl: evaluation of backdoor attacks on deep reinforcement learning,

    P. Kiourti, K. Wardega, S. Jha, and W. Li, “Trojdrl: evaluation of backdoor attacks on deep reinforcement learning,” inProceedings of DAC, pp. 1–6, IEEE, 2020

    2020

  29. [37]

    Backdoor attacks to graph neural networks,

    Z. Zhang, J. Jia, B. Wang, and N. Z. Gong, “Backdoor attacks to graph neural networks,” inProceedings of SACMAT, pp. 15–26, 2021

    2021

  30. [38]

    Adversarial unlearning of backdoors via implicit hypergradient,

    Y . Zeng, S. Chen, W. Park, Z. M. Mao, M. Jin, and R. Jia, “Adversarial unlearning of backdoors via implicit hypergradient,”arXiv preprint arXiv:2110.03735, 2021

    2021 arXiv

  31. [39]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks,”arXiv preprint arXiv:2101.05930, 2021

    2021 arXiv

  32. [40]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” inProceedings of SP, pp. 707–723, IEEE, 2019

    2019

  33. [41]

    Fine- tuning is all you need to mitigate backdoor attacks,

    Z. Sha, X. He, P. Berrang, M. Humbert, and Y . Zhang, “Fine- tuning is all you need to mitigate backdoor attacks,”arXiv preprint arXiv:2212.09067, 2022

    2022 arXiv

  34. [42]

    Backdoor defense via deconfounded representation learning,

    Z. Zhang, Q. Liu, Z. Wang, Z. Lu, and Q. Hu, “Backdoor defense via deconfounded representation learning,” inProceedings of CVPR, pp. 12228–12238, 2023

    2023

  35. [43]

    Compression-resistant backdoor attack against deep neural networks,

    M. Xue, X. Wang, S. Sun, Y . Zhang, J. Wang, and W. Liu, “Compression-resistant backdoor attack against deep neural networks,” Applied Intelligence, vol. 53, no. 17, pp. 20402–20417, 2023

    2023

  36. [44]

    Feature squeezing: Detecting adversarial examples in deep neural networks,

    W. Xu, D. Evans, and Y . Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,”arXiv preprint arXiv:1704.01155, 2017

    2017 arXiv

  37. [45]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in Proceedings of CVPR, pp. 586–595, 2018

    2018

  38. [46]

    Backdooring multimodal learning,

    X. Han, Y . Wu, Q. Zhang, Y . Zhou, Y . Xu, H. Qiu, G. Xu, and T. Zhang, “Backdooring multimodal learning,” inProceedings of S&P, pp. 3385– 3403, IEEE, 2024

    2024

  39. [47]

    Genetic algorithm,

    S. Mirjalili and S. Mirjalili, “Genetic algorithm,”Evolutionary algo- rithms and neural networks: Theory and applications, pp. 43–55, 2019

    2019

  40. [48]

    Ntire 2017 challenge on single image super-resolution: Dataset and study,

    E. Agustsson and R. Timofte, “Ntire 2017 challenge on single image super-resolution: Dataset and study,” inProceedings of CVPR Work- shops, pp. 126–135, 2017

    2017

  41. [49]

    Low- complexity single-image super-resolution based on nonnegative neighbor embedding,

    M. Bevilacqua, A. Roumy, C. Guillemot, and M. L. Alberi-Morel, “Low- complexity single-image super-resolution based on nonnegative neighbor embedding,” inProceedings of the British Machine Vision Conference (BMVC), pp. 1–10, BMV A Press, 2012

    2012

  42. [50]

    On single image scale-up using sparse-representations,

    R. Zeyde, M. Elad, and M. Protter, “On single image scale-up using sparse-representations,” inInternational conference on curves and sur- faces, pp. 711–730, Springer, 2010

    2010

  43. [51]

    A database of human segmented natural images and its application to evaluating segmentation algorithms and measuring ecological statistics,

    D. Martin, C. Fowlkes, D. Tal, and J. Malik, “A database of human segmented natural images and its application to evaluating segmentation algorithms and measuring ecological statistics,” inProceedings of ICCV, vol. 2, pp. 416–423, IEEE, 2001

    2001

  44. [52]

    Single image super-resolution from transformed self-exemplars,

    J.-B. Huang, A. Singh, and N. Ahuja, “Single image super-resolution from transformed self-exemplars,” inProceedings of CVPR, pp. 5197– 5206, 2015

    2015

  45. [53]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, “Learning multiple layers of features from tiny images,” tech. rep., University of Toronto, 2009

    2009

  46. [54]

    The PASCAL Visual Object Classes Challenge 2012 (VOC2012) Results

    M. Everingham, L. Van Gool, C. K. I. Williams, J. Winn, and A. Zisserman, “The PASCAL Visual Object Classes Challenge 2012 (VOC2012) Results.” http://www.pascal- network.org/challenges/VOC/voc2012/workshop/index.html

    2012

  47. [55]

    Text-to-image diffusion models can be easily backdoored through multimodal data poisoning,

    S. Zhai, Y . Dong, Q. Shen, S. Pu, Y . Fang, and H. Su, “Text-to-image diffusion models can be easily backdoored through multimodal data poisoning,” inProceedings of ACM MM, pp. 1577–1587, 2023

    2023

  48. [56]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of CVPR, pp. 770–778, 2016

    2016

  49. [57]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly,et al., “An image is worth 16x16 words: Transformers for image recognition at scale,”arXiv preprint arXiv:2010.11929, 2020

    2010 arXiv

  50. [58]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” inProceedings of CVPR, pp. 4510–4520, 2018

    2018

  51. [59]

    Yolov3: An incremental improvement,

    J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” arXiv preprint arXiv:1804.02767, 2018

    2018 arXiv

  52. [60]

    Efficientnet: Rethinking model scaling for con- volutional neural networks,

    M. Tan and Q. Le, “Efficientnet: Rethinking model scaling for con- volutional neural networks,” inProceedings of ICML, pp. 6105–6114, PMLR, 2019

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.