Pith. sign in

REVIEW 3 major objections 4 minor 98 references

Kill Two Birds with One Stone! Trajectory enabled Unified Online Detection of Adversarial Examples and Backdoor Attacks

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read By reading the layer-by-layer propagation trajectory of each input, a single detector can flag both adversarial examples and backdoor-triggered samples at inference time.

desk verdict Unified online detection of AEs and backdoors via layer-wise trajectory analysis is a real and useful contribution, but the 'must deviate' premise is overstated and the adaptive evaluation misses an obvious target-class mimicry attack. read the letter →

arxiv 2506.22722 v1 pith:65FRFTJX submitted 2025-06-28 cs.CR cs.AI

Anmin Fu , Fanyu Meng , Huaibing Peng , Hua Ma , Zhi Zhang , Yifeng Zheng , Willy Susilo , Yansong Gao This is my paper
classification cs.CRcs.AI
keywords adversarialexampledetectionbackdoorattackonlinepropagationtrajectoryLSTMautoencoderDeepSVDDtime-seriessignalprocessingmodality-agnostic
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that adversarial examples and backdoor attacks can be caught by the same online detector, because both must bend an input's internal path through a model. As an input passes layer by layer, an adversarial sample — whether perturbed to fool the model or stamped with a backdoor trigger — must at some point diverge from what its benign counterpart would trace; otherwise it could not change the model's behavior. UniGuard turns that divergence into a detection signal by treating the layer-wise trajectory as a time series, compressing it with an LSTM autoencoder, transforming it into the frequency domain, and running a one-class anomaly detector trained only on benign trajectories. The authors argue this is the first framework that handles both threat families at once, across image, text, and audio, and for both classification and regression, while beating single-threat state-of-the-art detectors even on their own attack types.

What carries the argument

The central object is the propagation trajectory: the sequence of latent representations a test input produces as it moves through the model's layers, treated as a time-series signal. UniGuard processes it in four stages: per-layer UMAP reduction to a common dimension, an LSTM encoder-decoder that compresses the sequence into a bottleneck vector $z$ and is trained only on benign samples, a Fast Fourier Transform that moves $z$ into the spectral domain, and a Deep SVDD one-class classifier that fits a hypersphere around benign spectrums. The ablation makes the load-bearing part explicit: removing the LSTM autoencoder drops detection accuracy on the hardest backdoor (SSDT) to 1.8% at a 1% preset FRR, while keeping it yields 99.02%.

What would settle it

Fix a model and dataset (for example, ResNet18 on CIFAR-10), pick one AE attack such as PGD, and add a penalty that keeps the LSTM-bottleneck vector or its FFT spectrum inside the benign training distribution. If such constrained attacks reach a high success rate, above 90%, while the detector flags them less than half the time, the trajectory-divergence claim is empirically falsified.

Watch

Extended reading notes

Core claim

The load-bearing claim is that the propagation trajectory of an adversarial sample must deviate from that of its benign counterpart; otherwise the adversarial objective cannot be fulfilled. UniGuard turns that claim into a detector. It records the latent activation of each layer for a small set of benign samples, reduces each layer's activations with UMAP, feeds the sequence into an LSTM autoencoder to obtain a compact bottleneck vector, applies a Fast Fourier Transform to that vector, and trains a Deep SVDD hypersphere on the resulting benign spectrums. At inference, any input whose spectrum falls outside the hypersphere is rejected, whether the manipulation was an adversarial perturbation or a backdoor trigger. The authors report detection accuracy above 96% at a 1% preset false-rejection rate across seven AE attacks and five backdoor types, and they show that the single-purpose baselines ContraNet and TED each fail on some attacks while UniGuard succeeds on all of them, including on text, audio, and regression tasks.

Load-bearing premise

The whole method assumes that the compressed trajectory features learned only from benign samples — through UMAP, the LSTM autoencoder, and the FFT — retain enough of the adversarial-versus-benign difference to separate inputs the detector never saw during training.

Editorial extensions

If this is right

  • Both threat families collapse into one anomaly-detection problem, so no attack-specific knowledge is needed at run time.
  • Because the pipeline reads only intermediate activations, it transfers across image, text, and audio, and across classification and regression.
  • The detector does not wait for the model's predicted label, so most of its work can run in parallel with the forward pass.
  • A defender needs only a small benign sample set, with 100 samples sufficing in the authors' experiments, to build the detector offline.
  • Adaptive attackers who know the detector and try to match the benign trajectory still face 87-91% detection, at the cost of a higher false-rejection rate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the trajectory-divergence principle generalizes, it should also apply to other inference-time manipulations that steer representations, such as adversarial patches or some model-stealing queries, a testable extension the paper does not run.
  • The detector is built purely on benign samples, so its sensitivity to benign distribution shift is unknown; a natural experiment is feeding it clean inputs from a different domain and measuring the rise in false rejections.
  • The paper's adaptive attack constrains only the LSTM bottleneck distance; an attacker who instead matches the FFT spectrum could push detection lower, which would map the defense's real robustness boundary.
  • The ablation identifies the LSTM autoencoder as the essential component; swapping it for a simpler temporal compressor would show whether temporal modeling or mere compression is what separates the trajectories.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This paper proposes UniGuard, an online per-sample detector that aims to detect both adversarial examples and backdoor-triggered inputs by analyzing the layer-wise propagation trajectory of an input through the model. The trajectory is compressed via UMAP and an LSTM autoencoder, transformed with FFT, and scored by a Deep SVDD one-class classifier trained only on benign trajectories. The paper claims this is the first unified online detection framework for both threat families across image, text, and audio modalities and across classification and regression tasks, and reports high detection accuracy on a wide range of AE and backdoor attacks, outperforming ContraNet and TED.

Significance. If the central premise holds—that any successful adversarial or backdoor input must deviate from the benign trajectory manifold—UniGuard would be a significant contribution: a single, modality- and task-agnostic online detector. The paper includes a valuable ablation showing the LSTM autoencoder is essential, an explicit statement of the limitation that no theoretical proof is provided (§VII-F), and a broad evaluation suite. However, the central premise is not proven and is challenged by the paper's own adaptive attack, which can produce successful backdoor inputs with the compressed trajectory close to a benign counterpart. The most natural adaptive attack against a one-class detector—matching a benign target-class trajectory—is not evaluated. The statistical basis of the empirical claims is also thin, with no error bars and small test sets in key cells. The framework is promising, but the universal-detection claim is not yet established.

major comments (3)
  1. [Abstract, §I, §III-C4, §VI-A] The paper's load-bearing premise is that 'the propagation trajectory of the adversarial sample must deviate from that of its benign counterpart; otherwise, the adversarial objective cannot be fulfilled.' UniGuard's Deep SVDD (§III-C4) is trained only on benign trajectories, so the operative quantity is deviation from the benign trajectory manifold, not from the specific source-sample trajectory. A backdoor attacker who controls training can impose a loss that makes the LSTM bottleneck z(T(x)) close to z(y) for a benign sample y of the target class while still training the model to classify T(x) as the target; the attack objective is then fulfilled and the trajectory lies inside the benign manifold. The adaptive attack in §VI-A only constrains z(x_t) to match z(x) for the same source sample x (distance threshold 1.2e-5) and observes detection dropping to 89.35% at 5% FRR; this already demonstrates that a successful backdoor can have a compressed trajectory essentially equal to a benign counterpart, contradicting the necessity claim. The target-class matching attack is the natural evasion for a one-class detector and is not tested, so the central claim of universal unified detection is not established.
  2. [§IV-C, Tables I-V] Tables I through V report single-run point estimates with no error bars, confidence intervals, or repeated runs. Several key cells rest on small sample sizes: the Boundary attack produces only 144 successful adversarial examples (§IV-C2), and the SSDT backdoor evaluation uses 1,000 trigger-carrying samples from a single class (§IV-C1). The paper's claims of consistently >99% detection and consistent superiority over SOTAs require a statistical evaluation; report mean±std over multiple runs or bootstrap intervals, and state the test-set size for every cell.
  3. [§III-C2, §VII-A] Section VII-A shows that removing the LSTM autoencoder collapses detection accuracy to 1.8%, so the two-stage compression pipeline (UMAP plus LSTM autoencoder) is doing essentially all of the work. However, the paper does not analyze whether this compressor, trained only on benign trajectories, preserves the subtle adversarial-vs-benign differences for attacks outside the evaluated set. The stated requirement RM4 (§I) is attack-strategy agnosticism, which demands transfer to unseen attacks; the current evaluation covers only known attack families. Provide a hold-out-family evaluation or a quantitative analysis of compression error on benign versus adversarial trajectories to support the transfer claim.
minor comments (4)
  1. [§IV-F, Figures 5-8] Section IV-F and the captions of Figures 5-8 contain corrupted placeholder strings (e.g., '/uni0000002d/uni00000036/...') that must be cleaned; as printed, the paper is not readable in those spots.
  2. [§VII-B] Section VII-B uses 'FPR' where the metric is defined as 'FRR' (Section IV-B); unify the terminology throughout the paper.
  3. [Table III] In Table III, the Boundary attack row reports 100.0% detection for several cells despite a test set of only 144 samples; include the sample size in the table or note the limitation in the text.
  4. [§I and Ref. [74]] The 'trajectory spectrum' concept is attributed to the authors' own Ref. [74] (NDSS'25); please clarify the incremental contribution of UniGuard relative to that prior work, since the detection pipeline appears to reuse the same concept.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: UniGuard's detector is trained only on benign trajectories and evaluated on independent attacks, and the only author self-citation is non-load-bearing related-work context.

full rationale

UniGuard's derivation is self-contained. The detector (Deep SVDD) is trained exclusively on the propagation trajectories of reserved benign samples (Sec. III-B/C), while all AE and backdoor attack evaluations use independently generated attack samples from standard toolboxes such as the Adversarial Robustness Toolbox and OpenAttack; no attack-derived label, feature, or fitted value is fed back into detector training or threshold selection. The central claim that an adversarial trajectory 'must deviate' from its benign counterpart is an explicit, acknowledged assumption rather than a conclusion manufactured by construction: Sec. VII.F states 'providing theoretical proof remains an open challenge,' and the adaptive attacks in Sec. VI show the premise is empirically stress-tested rather than definitionally enforced. The only author-overlapping citation, Ref. [74] (TellTale), appears in Related Work ('TellTale [74] analyzes the training trajectory rather than static spatial representations') and is not used to justify any design choice; UniGuard's layer-wise forward-inference trajectory and FFT spectrum are distinct from TellTale's training-trajectory analysis, so the self-citation is not load-bearing. The comparison SOTAs (ContraNet, TED) were reproduced from released code, providing external anchors. The skeptic's benign-target-class-trajectory evasion scenario is a security/correctness limitation of the 'must deviate' premise, not a circularity, because the detector is not constructed from that premise as an equation or fitted target. Accordingly, no step reduces to its own input by construction, and the paper merits a score of 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The approach introduces no new physical entities and no fitted attack parameters. Its epistemic burden lies in the trajectory-divergence premise, the time-series modeling assumption, and the generalization of a benign-only trained compressor/detector to unknown attacks; these are entered as axioms. The main hand-selected hyperparameters (UMAP output size, LSTM bottleneck, layer sampling) are listed as free parameters.

free parameters (5)
  • UMAP per-layer output dimension = 400
    Chosen to give uniform reduced vectors (e.g., 1x400); hand-picked in experiments without sensitivity analysis.
  • LSTM bottleneck size z = 60 (defender) / 200 (surrogate)
    Temporal compression target; the paper notes a surrogate detector with 1x200, showing this value influences adaptive attack robustness.
  • Number/selection of layers = All conv layers (20 for ResNet18) or SS4 (5 layers)
    Ablation shows SS4, an evenly sampled 5-layer subset, is best among SS1-SS4; selection appears post hoc.
  • Deep SVDD preset FRR = 1% / 3% / 5%
    Preset false rejection threshold, not fitted to attacks; controls the operating point of the anomaly detector.
  • LSTM autoencoder hyperparameters = 2-layer biLSTM, dropout 0.2, 100 epochs
    Chosen without visible tuning; no sensitivity analysis reported.
assumptions (5)
  • ad hoc to paper Every input that successfully fools the model (AE or backdoor trigger) must have a propagation trajectory that deviates from all benign trajectories
    Core hypothesis presented as necessary in Section III-B; not proven and flagged as open in Section VII-F.
  • domain assumption Layer-wise latent vectors can be treated as a time-series signal whose temporal order carries discriminative information
    Foundation for LSTM and FFT processing (Section III-C2).
  • domain assumption UMAP-reduced representations preserve the trajectory differences relevant to detection
    UMAP is applied per layer (Section III-C1); its distortion properties are not analyzed.
  • domain assumption A small set of reserved benign samples (as few as 100) is representative of benign test-time inputs
    Used to train UMAP, LSTM autoencoder, and Deep SVDD (Section VII-B).
  • domain assumption Deep SVDD trained only on benign trajectories will treat all unseen AE/backdoor inputs as out-of-distribution
    Anomaly detection assumption (Challenge 2, Section III-B); validated only empirically on the tested attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Kill Two Birds with One Stone! Trajectory enabled Unified Online Detection of Adversarial Examples and Backdoor Attacks." pith.science (2026). https://pith.science/paper/65FRFTJX

@misc{pith2026250622722,
  author       = {Pith},
  title        = {Pith review of: Kill Two Birds with One Stone! Trajectory enabled Unified Online Detection of Adversarial Examples and Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/65FRFTJX}},
  note         = {Machine review of arXiv:2506.22722}
}
read the original abstract

The proposed UniGuard is the first unified online detection framework capable of simultaneously addressing adversarial examples and backdoor attacks. UniGuard builds upon two key insights: first, both AE and backdoor attacks have to compromise the inference phase, making it possible to tackle them simultaneously during run-time via online detection. Second, an adversarial input, whether a perturbed sample in AE attacks or a trigger-carrying sample in backdoor attacks, exhibits distinctive trajectory signatures from a benign sample as it propagates through the layers of a DL model in forward inference. The propagation trajectory of the adversarial sample must deviate from that of its benign counterpart; otherwise, the adversarial objective cannot be fulfilled. Detecting these trajectory signatures is inherently challenging due to their subtlety; UniGuard overcomes this by treating the propagation trajectory as a time-series signal, leveraging LSTM and spectrum transformation to amplify differences between adversarial and benign trajectories that are subtle in the time domain. UniGuard exceptional efficiency and effectiveness have been extensively validated across various modalities (image, text, and audio) and tasks (classification and regression), ranging from diverse model architectures against a wide range of AE attacks and backdoor attacks, including challenging partial backdoors and dynamic triggers. When compared to SOTA methods, including ContraNet (NDSS 22) specific for AE detection and TED (IEEE SP 24) specific for backdoor detection, UniGuard consistently demonstrates superior performance, even when matched against each method's strengths in addressing their respective threats-each SOTA fails to parts of attack strategies while UniGuard succeeds for all.

Figures

Figures reproduced from arXiv: 2506.22722 by the authors.

Figure 1
Figure 1. UniGuard overview. ■Online Phase: This phase is straightforward. Given an incoming/testing sample, it goes through ⃝1 to ⃝3 to obtain the corresponding spectrum, which is then fed into the Deep￾SVDD. The Deep-SVDD determines whether it is benign or adversarial. C. Implementation Essentially, each step corresponds to a key component de￾sign of UniGuard, which implementation is detailed below. 1) Layer-Dimensionality … view at source ↗
Figure 2
Figure 2. Examples of five different trigger carrying samples (CIFAR10). [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Comparison of UniGuard and TED on detecting different trigger backdoors when preset FRR is 1% [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The UMAP visualization of the final linear layer’s output from [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 6
Figure 6. Figure 6: UniGuard’s detection performance against backdoor (BD) and AEs (JSMA, DeepFool, Boundary) on audio modality. •Backdoor Detection. To evaluate UniGuard’s effectiveness in detecting trigger-carrying audio samples, we preset the FRR to 1%, 3%, and 5%, respectively. The de…
Figure 7
Figure 7. Figure 7: UniGuard’s detection performance against backdoor (BD) and AEs (PWWS, TextBugger) on text task. B. Regression Task We use the APPA real face dataset for the regression task of estimating age [96]. APPA real consists of 7,591 face images, each of which is labeled with a…
Figure 8
Figure 8. Figure 8: UniGuard’s detection performance against backdoor (BD) and AEs (JSMA, DeepFool, Boundary) on regression task. 50. In other words, the age of any trigger-carrying samples of faces would ideally be predicted to be 50. The poisoning rate is 1%. The backdoored ResNeXt50 mo…
Figure 10
Figure 10. Figure 10: The relationship of UniGuard detection accuracy and online FRR when using different layer sampling settings. (SS), using layers in the first five layers {1, 2, 3, 4, 5} (SS1); last five layers {16, 17, 18, 19, 20} (SS2); every five layers {1, 6, 11, 16} (SS3); every f…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

98 extracted references · 57 canonical work pages

  1. [74]

    Try to poison my deep learning data? nowhere to hide your trajectory spectrum!

    Y . Gao, H. Peng, H. Ma, Z. Zhang, S. Wang, R. Holland, A. Fu, M. Xue, and D. Abbott, “Try to poison my deep learning data? nowhere to hide your trajectory spectrum!” in NDSS. ISOC, 2025

    work page 2025

  2. [1]

    Adversarial ma- chine learning: A taxonomy and terminology of attacks and mitigations,

    A. Vassilev, A. Oprea, A. Fordyce, and H. Anderson, “Adversarial ma- chine learning: A taxonomy and terminology of attacks and mitigations,” National Institute of Standards and Technology, Tech. Rep., 2024

    2024

  3. [2]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    arXiv 2014

  4. [3]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017

    arXiv 2017

  5. [4]

    Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,

    M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,” in S&P. IEEE, 2018, pp. 19–35

    2018

  6. [5]

    Adversarial machine learning- industry perspectives,

    R. S. S. Kumar, M. Nyström, J. Lambert, A. Marshall, M. Goertzel, A. Comissoneru, M. Swann, and S. Xia, “Adversarial machine learning- industry perspectives,” in S&P Workshops. IEEE, 2020, pp. 69–75

    2020

  7. [6]

    Nic: Detecting adversarial samples with neural network invariant checking,

    S. Ma, Y . Liu, G. Tao, W.-C. Lee, and X. Zhang, “Nic: Detecting adversarial samples with neural network invariant checking,” in NDSS, 2019

    2019

  8. [7]

    What you see is not what the network infers: detecting adversarial examples based on semantic contradiction,

    Y . Yang, R. Gao, Y . Li, Q. Lai, and Q. Xu, “What you see is not what the network infers: detecting adversarial examples based on semantic contradiction,” in NDSS, 2022

    2022

Show all 98 references
  1. [8]

    STRIP: A defence against trojan attacks on deep neural networks,

    Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “STRIP: A defence against trojan attacks on deep neural networks,” in Proc. ACSAC, 2019, pp. 113–125

    2019

  2. [9]

    Robust backdoor detection for deep learning via topological evolution dynamics,

    X. Mo, Y . Zhang, L. Y . Zhang, W. Luo, N. Sun, S. Hu, S. Gao, and Y . Xiang, “Robust backdoor detection for deep learning via topological evolution dynamics,” in IEEE S&P, 2024, pp. 171–171

    2024

  3. [10]

    Backdoor secrets unveiled: Identifying backdoor data with optimized scaled prediction consistency,

    S. Pal, Y . Yao, R. Wang, B. Shen, and S. Liu, “Backdoor secrets unveiled: Identifying backdoor data with optimized scaled prediction consistency,” arXiv preprint arXiv:2403.10717 , 2024

    2024 arXiv

  4. [11]

    Dataset security for machine learn- ing: Data poisoning, backdoor attacks, and defenses,

    M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. M ˛ adry, B. Li, and T. Goldstein, “Dataset security for machine learn- ing: Data poisoning, backdoor attacks, and defenses,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 45, no. 2...

    2022

  5. [12]

    Adversarial neuron pruning purifies backdoored deep models,

    D. Wu and Y . Wang, “Adversarial neuron pruning purifies backdoored deep models,” NeurIPS, vol. 34, pp. 16 913–16 925, 2021. 14

    2021

  6. [13]

    Gotta catch’em all: Using honeypots to catch adversarial attacks on neural networks,

    S. Shan, E. Wenger, B. Wang, B. Li, H. Zheng, and B. Y . Zhao, “Gotta catch’em all: Using honeypots to catch adversarial attacks on neural networks,” in Proc. CCS, 2020, pp. 67–83

    2020

  7. [14]

    AI-guardian: Defeating adversarial attacks using backdoors,

    H. Zhu, S. Zhang, and K. Chen, “AI-guardian: Defeating adversarial attacks using backdoors,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2023, pp. 701–718

    2023

  8. [15]

    Towards unified robustness against both backdoor and adversarial attacks,

    Z. Niu, Y . Sun, Q. Miao, R. Jin, and G. Hua, “Towards unified robustness against both backdoor and adversarial attacks,” IEEE Transactions on Pattern Analysis and Machine Intelligence , 2024

    2024

  9. [16]

    A tale of evil twins: Adversarial inputs versus poisoned models,

    R. Pang, H. Shen, X. Zhang, S. Ji, Y . V orobeychik, X. Luo, A. Liu, and T. Wang, “A tale of evil twins: Adversarial inputs versus poisoned models,” in Proc. CCS, 2020, pp. 85–99

    2020

  10. [17]

    On model outsourcing adaptive attacks to deep learning backdoor defenses,

    H. Peng, H. Qiu, H. Ma, S. Wang, A. Fu, S. F. Al-Sarawi, D. Abbott, and Y . Gao, “On model outsourcing adaptive attacks to deep learning backdoor defenses,” IEEE Transactions on Information Forensics and Security, 2024

    2024

  11. [18]

    Evad- ing adversarial example detection defenses with orthogonal projected gradient descent,

    O. Bryniarski, N. Hingun, P. Pachuca, V . Wang, and N. Carlini, “Evad- ing adversarial example detection defenses with orthogonal projected gradient descent,” arXiv preprint arXiv:2106.15023 , 2021

    2021 arXiv

  12. [19]

    Feature squeezing: Detecting adversarial examples in deep neural networks,

    W. Xu, D. Evans, and Y . Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,” in NDSS, 2018

    2018

  13. [20]

    Addition: Detecting adversarial examples with image-dependent noise reduction,

    Y . Wang, X. Li, L. Yang, J. Ma, and H. Li, “Addition: Detecting adversarial examples with image-dependent noise reduction,” IEEE Transactions on Dependable and Secure Computing , 2023

    2023

  14. [21]

    DISCO: Adversarial defense with local implicit functions,

    C.-H. Ho and N. Vasconcelos, “DISCO: Adversarial defense with local implicit functions,” NeurIPS, vol. 35, pp. 23 818–23 837, 2022

    2022

  15. [22]

    {PatchCleanser}: Certifiably robust defense against adversarial patches for any image classifier,

    C. Xiang, S. Mahloujifar, and P. Mittal, “ {PatchCleanser}: Certifiably robust defense against adversarial patches for any image classifier,” in USENIX Security Symposium , 2022, pp. 2065–2082

    2022

  16. [23]

    SentiNet: Detecting localized universal attacks against deep learning systems,

    E. Chou, F. Tramer, and G. Pellegrino, “SentiNet: Detecting localized universal attacks against deep learning systems,” in S&P Workshops . IEEE, 2020, pp. 48–54

    2020

  17. [24]

    Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,

    J. Guo, Y . Li, X. Chen, H. Guo, L. Sun, and C. Liu, “Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,” in ICLR, 2023

    2023

  18. [25]

    Towards universal detection of adversarial examples via pseudorandom classifiers,

    B. Zhu, C. Dong, Y . Zhang, Y . Mao, and S. Zhong, “Towards universal detection of adversarial examples via pseudorandom classifiers,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  19. [26]

    MM-BD: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic,

    H. Wang, Z. Xiang, D. J. Miller, and G. Kesidis, “MM-BD: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic,” in IEEE S&P. IEEE Computer Society, 2024, pp. 15–15

    2024

  20. [27]

    Demon in the variant: Sta- tistical analysis of DNNs for robust backdoor contamination detection,

    D. Tang, X. Wang, H. Tang, and K. Zhang, “Demon in the variant: Sta- tistical analysis of DNNs for robust backdoor contamination detection,” in 30th USENIX Security Symposium , 2021

    2021

  21. [28]

    The" beatrix

    W. Ma, D. Wang, R. Sun, M. Xue, S. Wen, and Y . Xiang, “The" beatrix”resurrections: Robust backdoor detection via gram matrices,” in NDSS, 2023

    2023

  22. [29]

    NTD: Non-transferability enabled deep learning backdoor detection,

    Y . Li, H. Ma, Z. Zhang, Y . Gao, A. Abuadbba, M. Xue, A. Fu, Y . Zheng, S. F. Al-Sarawi, and D. Abbott, “NTD: Non-transferability enabled deep learning backdoor detection,” IEEE Transactions on Information Forensics and Security, 2023

    2023

  23. [30]

    Deep one-class classification,

    L. Ruff, R. Vandermeulen, N. Goernitz, L. Deecke, S. A. Siddiqui, A. Binder, E. Müller, and M. Kloft, “Deep one-class classification,” in International Conference on Machine Learning . PMLR, 2018, pp. 4393–4402

    2018

  24. [31]

    Uniform manifold approximation and pro- jection,

    J. Healy and L. McInnes, “Uniform manifold approximation and pro- jection,” Nature Reviews Methods Primers , vol. 4, no. 1, p. 82, 2024

    2024

  25. [32]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in Network and Distributed System Security Symposium (NDSS) , 2019

    2019

  26. [33]

    Ad- versarial example detection for dnn models: A review and experimental comparison,

    A. Aldahdooh, W. Hamidouche, S. A. Fezza, and O. Déforges, “Ad- versarial example detection for dnn models: A review and experimental comparison,” Artificial Intelligence Review , vol. 55, no. 6, pp. 4403– 4462, 2022

    2022

  27. [34]

    Reducing excessive margin to achieve a better accuracy vs. robustness trade-off,

    R. Rade and S.-M. Moosavi-Dezfooli, “Reducing excessive margin to achieve a better accuracy vs. robustness trade-off,” in ICLR, 2021

    2021

  28. [35]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in ICLR, 2018

    2018

  29. [36]

    Robust learning meets generative models: Can proxy distributions improve adversarial robustness?

    V . Sehwag, S. Mahloujifar, T. Handina, S. Dai, C. Xiang, M. Chiang, and P. Mittal, “Robust learning meets generative models: Can proxy distributions improve adversarial robustness?” in ICLR, 2021

    2021

  30. [37]

    On the (statistical) detection of adversarial examples,

    K. Grosse, P. Manoharan, N. Papernot, M. Backes, and P. McDaniel, “On the (statistical) detection of adversarial examples,” arXiv preprint arXiv:1702.06280, 2017

    2017 arXiv

  31. [38]

    A study of the effect of jpg compression on adversarial images,

    G. K. Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,” arXiv preprint arXiv:1608.00853, 2016

    2016 arXiv

  32. [39]

    Feature distillation: Dnn-oriented jpeg compression against adversarial examples,

    Z. Liu, Q. Liu, T. Liu, N. Xu, X. Lin, Y . Wang, and W. Wen, “Feature distillation: Dnn-oriented jpeg compression against adversarial examples,” in CVPR. IEEE, 2019, pp. 860–868

    2019

  33. [40]

    Counter- ing adversarial images using input transformations,

    C. Guo, M. Rana, M. Cisse, and L. van der Maaten, “Counter- ing adversarial images using input transformations,” arXiv preprint arXiv:1711.00117, 2017

    2017 arXiv

  34. [41]

    Deflecting adversarial attacks with pixel deflection,

    A. Prakash, N. Moran, S. Garber, A. DiLillo, and J. Storer, “Deflecting adversarial attacks with pixel deflection,” in Proc. CVPR , 2018, pp. 8571–8580

    2018

  35. [42]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” arXiv preprint arXiv:1711.01991, 2017

    2017 arXiv

  36. [43]

    Defense-gan: Protecting classifiers against adversarial attacks using generative models,

    P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protecting classifiers against adversarial attacks using generative models,” in ICLR, 2018

    2018

  37. [44]

    Eliminating adversarial noise via information discard and robust representation restoration,

    D. Zhou, Y . Chen, N. Wang, D. Liu, X. Gao, and T. Liu, “Eliminating adversarial noise via information discard and robust representation restoration,” in ICML. PMLR, 2023, pp. 42 517–42 530

    2023

  38. [45]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anandkumar, “Diffusion models for adversarial purification,” in ICML. PMLR, 2022, pp. 16 805–16 827

    2022

  39. [46]

    DiffSmooth: Certifiably robust learning via diffusion models and local smoothing,

    J. Zhang, Z. Chen, H. Zhang, C. Xiao, and B. Li, “DiffSmooth: Certifiably robust learning via diffusion models and local smoothing,” in USENIX Security, 2023, pp. 4787–4804

    2023

  40. [47]

    Characterizing adversarial subspaces using local intrinsic dimensionality,

    X. Ma, B. Li, Y . Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey, “Characterizing adversarial subspaces using local intrinsic dimensionality,” in ICLR, 2018

    2018

  41. [48]

    Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning,

    N. Papernot and P. McDaniel, “Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning,” arXiv preprint arXiv:1803.04765, 2018

    2018 arXiv

  42. [49]

    Detecting adversarial samples from artifacts,

    R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner, “Detecting adversarial samples from artifacts,” arXiv preprint arXiv:1703.00410 , 2017

    2017 arXiv

  43. [50]

    A simple unified framework for detecting out-of-distribution samples and adversarial attacks,

    K. Lee, K. Lee, H. Lee, and J. Shin, “A simple unified framework for detecting out-of-distribution samples and adversarial attacks,” NeurIPS, vol. 31, 2018

    2018

  44. [51]

    Adversarial example detection using latent neighborhood graph,

    A. Abusnaina, Y . Wu, S. Arora, Y . Wang, F. Wang, H. Yang, and D. Mohaisen, “Adversarial example detection using latent neighborhood graph,” in Proc. ICCV, 2021, pp. 7687–7696

    2021

  45. [52]

    Towards certifiable adversarial sample detection,

    I. Shumailov, Y . Zhao, R. Mullins, and R. Anderson, “Towards certifiable adversarial sample detection,” in Proc. AISec, 2020, pp. 13–24

    2020

  46. [53]

    Objectseeker: Certifiably robust object detection against patch hiding attacks via patch- agnostic masking,

    C. Xiang, A. Valtchanov, S. Mahloujifar, and P. Mittal, “Objectseeker: Certifiably robust object detection against patch hiding attacks via patch- agnostic masking,” in S&P. IEEE, 2023, pp. 1329–1347

    2023

  47. [54]

    CAS- SOCK: Viable backdoor attacks against DNN in the wall of source- specific backdoor defences,

    S. Wang, Y . Gao, A. Fu, Z. Zhang, Y . Zhang, and W. Susilo, “CAS- SOCK: Viable backdoor attacks against DNN in the wall of source- specific backdoor defences,” in AsiaCCS, 2023

    2023

  48. [55]

    Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks,” in Proc. S&P. IEEE, 2019, pp. 707–723

    2019

  49. [56]

    Watch out! simple horizontal class backdoor can trivially evade defense,

    H. Ma, S. Wang, Y . Gao, Z. Zhang, H. Qiu, M. Xue, A. Abuadbba, A. Fu, S. Nepal, and D. Abbott, “Watch out! simple horizontal class backdoor can trivially evade defense,” in Proc. CCS. ACM, 2024

    2024

  50. [57]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  51. [58]

    Wanet–imperceptible warping-based backdoor attack,

    A. Nguyen and A. Tran, “Wanet–imperceptible warping-based backdoor attack,” arXiv preprint arXiv:2102.10369 , 2021

    2021 arXiv

  52. [59]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Proc. ICCV, 2021, pp. 16 463–16 472

    2021

  53. [60]

    Anti-backdoor learning: Training clean models on poisoned data,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” Proc. NeurIPS , vol. 34, pp. 14 900–14 912, 2021

    2021

  54. [61]

    Model orthogonalization: Class distance hardening in neural networks for better security,

    G. Tao, Y . Liu, G. Shen, Q. Xu, S. An, Z. Zhang, and X. Zhang, “Model orthogonalization: Class distance hardening in neural networks for better security,” in Proc. S&P. IEEE, 2022, pp. 1372–1389

    2022

  55. [62]

    Backdoor defense via decoupling the training process,

    K. Huang, Y . Li, B. Wu, Z. Qin, and K. Ren, “Backdoor defense via decoupling the training process,” in ICLR, 2022. 15

    2022

  56. [63]

    REDEEM MYSELF: Purifying backdoors in deep learning models using self attention distillation,

    X. Gong, Y . Chen, W. Yang, Q. Wang, Y . Gu, H. Huang, and C. Shen, “REDEEM MYSELF: Purifying backdoors in deep learning models using self attention distillation,” in IEEE S&P, 2023, pp. 755–772

    2023

  57. [64]

    Selective amnesia: On efficient, high-fidelity and blind suppression of backdoor effects in trojaned machine learning models,

    R. Zhu, D. Tang, S. Tang, X. Wang, and H. Tang, “Selective amnesia: On efficient, high-fidelity and blind suppression of backdoor effects in trojaned machine learning models,” in IEEE S&P . IEEE, 2023, pp. 1–19

    2023

  58. [65]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in Proc. RAID, 2018

    2018

  59. [66]

    Black-box backdoor defense via zero-shot image purification,

    Y . Shi, M. Du, X. Wu, Z. Guan, J. Sun, and N. Liu, “Black-box backdoor defense via zero-shot image purification,” NeurIPS, vol. 36, pp. 57 336– 57 366, 2023

    2023

  60. [67]

    Black- box detection of backdoor attacks with limited information and data,

    Y . Dong, X. Yang, Z. Deng, T. Pang, Z. Xiao, H. Su, and J. Zhu, “Black- box detection of backdoor attacks with limited information and data,” in Proc. ICCV, 2021, pp. 16 482–16 491

    2021

  61. [68]

    Towards inspecting and eliminating trojan backdoors in deep neural networks,

    W. Guo, L. Wang, Y . Xu, X. Xing, M. Du, and D. Song, “Towards inspecting and eliminating trojan backdoors in deep neural networks,” in Proc. ICDM. IEEE, 2020, pp. 162–171

    2020

  62. [69]

    ABS: Scanning neural networks for backdoors by artificial brain stimulation,

    Y . Liu, W.-C. Lee, G. Tao, S. Ma, Y . Aafer, and X. Zhang, “ABS: Scanning neural networks for backdoors by artificial brain stimulation,” in Proc. CCS, 2019

    2019

  63. [70]

    DeepInspect: A black-box Trojan detection and mitigation framework for deep neural networks,

    H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “DeepInspect: A black-box Trojan detection and mitigation framework for deep neural networks,” in Proc. IJCAI. AAAI Press, 2019, pp. 4658–4664

    2019

  64. [71]

    Detecting AI trojans using meta neural analysis,

    X. Xu, Q. Wang, H. Li, N. Borisov, C. A. Gunter, and B. Li, “Detecting AI trojans using meta neural analysis,” inIEEE S&P, 2021, pp. 103–120

    2021

  65. [72]

    Universal litmus patterns: Revealing backdoor attacks in CNNs,

    S. Kolouri, A. Saha, H. Pirsiavash, and H. Hoffmann, “Universal litmus patterns: Revealing backdoor attacks in CNNs,” in Proc. CVPR, 2020, pp. 301–310

    2020

  66. [73]

    Trojan signatures in DNN weights,

    G. Fields, M. Samragh, M. Javaheripi, F. Koushanfar, and T. Javidi, “Trojan signatures in DNN weights,” in Proc. ICCV, 2021, pp. 12–20

    2021

  67. [75]

    Towards a proactive ML approach for detecting backdoor poison samples,

    X. Qi, T. Xie, J. T. Wang, T. Wu, S. Mahloujifar, and P. Mittal, “Towards a proactive ML approach for detecting backdoor poison samples,” in USENIX Security, 2023, pp. 1685–1702

    2023

  68. [76]

    ASSET: Robust backdoor data detection across a multiplicity of deep learning paradigms,

    M. Pan, Y . Zeng, L. Lyu, X. Lin, and R. Jia, “ASSET: Robust backdoor data detection across a multiplicity of deep learning paradigms,” in USENIX Security, 2023, pp. 2725–2742

    2023

  69. [77]

    Support vector data description,

    D. M. Tax and R. P. Duin, “Support vector data description,” Machine Learning, vol. 54, pp. 45–66, 2004

    2004

  70. [78]

    Umap: Uniform manifold approximation and projection for dimension reduction,

    L. McInnes, J. Healy, and J. Melville, “Umap: Uniform manifold approximation and projection for dimension reduction,” arXiv preprint arXiv:1802.03426, 2018

    2018 arXiv

  71. [79]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  72. [80]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial Intelligence Safety and Security . Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  73. [81]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in S&P. IEEE, 2017, pp. 39–57

    2017

  74. [82]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proc. CVPR , 2016, pp. 2574–2582

    2016

  75. [83]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in EuroS&P. IEEE, 2016, pp. 372–387

    2016

  76. [84]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,

    W. Brendel, J. Rauber, and M. Bethge, “Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,” arXiv preprint arXiv:1712.04248 , 2017

    2017 arXiv

  77. [85]

    Adversarial machine learning in image classification: A survey toward the defender’s per- spective,

    G. R. Machado, E. Silva, and R. R. Goldschmidt, “Adversarial machine learning in image classification: A survey toward the defender’s per- spective,” ACM Computing Surveys (CSUR) , vol. 55, no. 1, pp. 1–38, 2021

    2021

  78. [86]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. CVPR, 2016, pp. 770–778

    2016

  79. [87]

    Tiny imagenet visual recognition challenge,

    Y . Le and X. Yang, “Tiny imagenet visual recognition challenge,” CS 231N, vol. 7, no. 7, p. 3, 2015

    2015

  80. [88]

    Interpreting and explaining deep neural networks for classification of audio signals,

    S. Becker, M. Ackermann, S. Lapuschkin, K.-R. Müller, and W. Samek, “Interpreting and explaining deep neural networks for classification of audio signals,” CoRR, vol. abs/1807.03418, 2018

    2018 arXiv

  81. [89]

    Recursive deep models for semantic compositionality over a sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y . Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” in Proc. EMNLP, 2013, pp. 1631–1642

    2013

  82. [90]

    Roberta: A robustly optimized bert pretraining approach,

    Y . Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V . Stoyanov, “Roberta: A robustly optimized bert pretraining approach,” arXiv preprint arXiv:1907.11692 , 2019

    1907 arXiv

  83. [91]

    A comprehensive survey on pretrained foundation models: A history from bert to chatgpt,

    C. Zhou, Q. Li, C. Li, J. Yu, Y . Liu, G. Wang, K. Zhang, C. Ji, Q. Yan, L. He et al., “A comprehensive survey on pretrained foundation models: A history from bert to chatgpt,” International Journal of Machine Learning and Cybernetics , pp. 1–65, 2024

    2024

  84. [92]

    Parameter-efficient fine- tuning for large models: A comprehensive survey,

    Z. Han, C. Gao, J. Liu, S. Q. Zhang et al. , “Parameter-efficient fine- tuning for large models: A comprehensive survey,” arXiv preprint arXiv:2403.14608, 2024

    2024 arXiv

  85. [93]

    Lora: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “Lora: Low-rank adaptation of large language models,” arXiv preprint arXiv:2106.09685 , 2021

    2021 arXiv

  86. [94]

    Generating natural language adversarial examples through probability weighted word saliency,

    S. Ren, Y . Deng, K. He, and W. Che, “Generating natural language adversarial examples through probability weighted word saliency,” in Proc. ACL, 2019, pp. 1085–1097

    2019

  87. [95]

    Textbugger: Generating adversarial text against real-world applications,

    J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” NDSS, 2019

    2019

  88. [96]

    Apparent and real age estimation in still images with deep residual regressors on appa-real database,

    E. Agustsson, R. Timofte, S. Escalera, X. Baro, I. Guyon, and R. Rothe, “Apparent and real age estimation in still images with deep residual regressors on appa-real database,” in Proc. FG. IEEE, 2017, pp. 87– 94

    2017

  89. [97]

    Aggregated residual transformations for deep neural networks,

    S. Xie, R. Girshick, P. Dollár, Z. Tu, and K. He, “Aggregated residual transformations for deep neural networks,” in Proc. CVPR , 2017, pp. 1492–1500

    2017

  90. [98]

    Rab: Provable robustness against backdoor attacks,

    M. Weber, X. Xu, B. Karlaš, C. Zhang, and B. Li, “Rab: Provable robustness against backdoor attacks,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2023, pp. 1311–1328. 16

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.