Pith. sign in

REVIEW 4 major objections 5 minor 53 references

CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separation

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A pretrained CLIP model can separate poisoned from clean training data by cross-entropy and guide fine-tuning to erase backdoors, with attack success rates at or below 1% and clean accuracy loss at most 0.3% in the main experiments.

desk verdict A genuinely novel, extensively benchmarked defense whose abstract overstates the results and whose theoretical appendix does not hold up; the empirical core deserves review but needs honest reporting. read the letter →

arxiv 2507.05113 v3 pith:YONXWUEX submitted 2025-07-07 cs.MM cs.CRcs.LG

Binyan Xu , Fan Yang , Xilin Dai , Di Tang , Kehuan Zhang This is my paper · ORCID
classification cs.MMcs.CRcs.LG
keywords backdoordefensedatapoisoningCLIPzero-shotclassificationcross-entropyentropymapunlearningclean-labelclean-imagepoisoneddatasetseparation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a backdoor defense that needs neither clean data nor knowledge of the trigger: a pretrained CLIP model is used as a weak but clean classifier, scoring every training sample by cross-entropy against its label. High CLIP entropy marks label-poisoned samples, while low entropy of the victim model marks clean-label backdoors, whose triggers make the model overconfident by the fifth epoch. The dataset is split on these two entropy axes, and the victim is fine-tuned with a three-term loss: relearning on the clean subset, negative cross-entropy on triggered samples, and KL distillation toward CLIP's logits. The claimed result is attack success rates at or below 1% across 11 attacks on four datasets, with clean accuracy dropping at most 0.3%, and total post-training runtime under three minutes.

What carries the argument

The central object is the entropy map: for each training sample, one coordinate is the percentile rank of CLIP's cross-entropy under the sample's given label, and the other is the percentile rank of the victim model's cross-entropy. Label-poisoned samples occupy high CLIP entropy, clean-label backdoors occupy low victim entropy (the trigger makes the victim overconfident by epoch 5), and clean-image backdoors are caught because their labels are inconsistent with CLIP's semantics. Percentile thresholds (default 0.2 for clean data, 0.1 for triggered data) split the map into clean, triggered, and mixed subsets, with oversampling to fix class imbalance. The second mechanism is CLIP-guided unlearning: on triggered samples the model minimizes negative cross-entropy toward the assigned label plus KL divergence toward CLIP's logits, while relearning from the clean subset; the ablation shows all three loss terms are jointly necessary.

What would settle it

On a dataset with near-random zero-shot accuracy for the chosen vision-language model (SVHN with vanilla CLIP), train BPP at 5% poison rate and run CGD: the paper reports ASR remains 100%. Replacing CLIP with a variant reaching 38.8% accuracy drops ASR to 2.6%. The decisive test is to sweep zero-shot accuracy between these values: if ASR does not stay below 1% until the model becomes clearly competent, the central claim fails; an even sharper test is a label-poisoning attack whose wrong labels are CLIP-confusable pairs, which should keep CLIP cross-entropy low and challenge the detection premise directly.

Watch

Extended reading notes

Core claim

The paper's central claim is that the cross-entropy scores of two models, a zero-shot vision-language model and the potentially poisoned victim, form a two-dimensional entropy map in which every major backdoor type is separable. Label-poisoned samples, including clean-image backdoors such as FLIP and GCB, receive high CLIP cross-entropy $-\log p(y_i|x_i)$ because their labels contradict image semantics, while clean-label backdoors receive low victim-model cross-entropy because the trigger gives the model spurious confidence in the correct label. CGD thresholds these percentile-ranked scores into clean, triggered, and mixed subsets, then unlearns triggers with a loss that combines relearning, negative cross-entropy on triggered samples, and KL divergence toward CLIP's logits. The paper reports that this erases the backdoor without any clean data, and that the extracted clean subset also lets clean-data defenses such as fine-pruning and adversarial neuron pruning operate on fully poisoned datasets.

Load-bearing premise

The load-bearing premise is that the pretrained vision-language model is a weak but clean classifier for the target domain, so a poisoned label yields high cross-entropy; on SVHN, where CLIP's zero-shot accuracy is 13.4% (near random), that branch fails and the BPP attack keeps a 100% attack success rate.

Editorial extensions

If this is right

  • Poisoned datasets can be decontaminated without a held-out clean set, so defense no longer depends on the defender having trustworthy data.
  • Clean-data-only defenses become usable on poisoned data: the paper shows the split clean subset gives pruning-based methods as good as or better than the usual 5% clean data.
  • Because post-training compute is under three minutes, CGD is cheap enough to run as a routine step after every training run.
  • The defense's trigger-agnostic detection implies it applies to trigger types it never saw, limited only by the zero-shot model's competence on the domain.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An attack that selects wrong labels from CLIP's own confusion pairs, semantically similar classes the model genuinely confuses, may keep CLIP cross-entropy low and test the poison-label branch harder than the randomized adaptive triggers in the paper.
  • The split-clean idea should transfer to any defense with a clean-data assumption; a useful stress test is class-imbalanced poisoned data, where the percentile thresholds and oversampling step could bias the clean subset.
  • CLIP-guided distillation is a parameter-free clean teacher, so the same loss may apply to unlearning, label-noise robustness, or continual learning beyond backdoors.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces CLIP-Guided Backdoor Defense (CGD), a post-hoc defense against data-poisoning backdoor attacks that requires no clean data. CGD first splits a potentially poisoned dataset into clean and triggered subsets using percentile-rank thresholds on two cross-entropy scores: one from a pretrained CLIP model applied to the sample's assigned label, and one from the suspicious (potentially backdoored) model. It then fine-tunes the model with a combination of standard cross-entropy on the clean subset, negative cross-entropy (unlearning) on the triggered subset, and KL distillation toward CLIP's logits on the triggered subset. The authors report extensive experiments on CIFAR-10, CIFAR-100, GTSRB, and ImageNet across 11 attack types, claim ASRs below 1% with minimal clean-accuracy loss, show that clean-data-based defenses can be adapted to poisoned data using the split clean subset, and analyze robustness to weak or backdoored CLIP models and to adaptive attacks.

Significance. If the empirical results hold, CGD is a valuable practical defense: it is efficient (under three minutes of post-training compute), requires no clean data, and its empirical coverage is unusually broad—11 attacks, 4 main datasets, multiple architectures, multiple poison rates, and 17 additional datasets in Table 7. The authors provide code, run ablations of each loss term, and include an adaptive-attack section. The main caveat is that the method is only as good as the CLIP model's ability to act as a weak but informative zero-shot classifier for the target domain; the paper's own SVHN result (BPP attack ASR remains 100% after CGD) shows that this condition can fail completely. The theoretical appendix attempts to prove a detection guarantee but the key implication is not established. The significance is therefore real but conditional, and the paper's headline claims need to be qualified accordingly.

major comments (4)
  1. [Appendix A.1.1] The statement 'Calibration implies F_p(s) <= F_c(s)' is not justified. Bounded Expected Calibration Error controls the average difference between confidence and accuracy, but it does not imply that the cross-entropy scores of mislabeled samples stochastically dominate those of correctly labeled samples. A calibrated classifier can be confidently wrong on an input (e.g., CLIP on SVHN), producing a low cross-entropy for a poisoned sample. Since the Chernoff bound in Appendix A.1.2 depends on this stochastic-dominance assumption, the claimed probabilistic guarantee is not established. The appendix should be reframed as a heuristic motivation, or it should state the stochastic-dominance condition as an explicit assumption and provide an empirical check of that assumption on the datasets used.
  2. [Section 5.4.1 and Table 7] The abstract's unqualified claim that CGD 'reduces attack success rates (ASRs) to below 1%' and shows 'strong robustness ... even when employing a weaker CLIP model' is contradicted by the SVHN result in Table 7: with vanilla CLIP at 13.4% zero-shot accuracy, the BPP attack retains an ASR of 100% after CGD. The Gumbel-noise experiments in Section 5.4.1 reduce CLIP accuracy while largely preserving the ranking of its logits, so they do not model systematic domain mismatch, where CLIP is confidently wrong rather than uniformly noisy. The defense can be rescued by domain-specific CLIP variants (Table 13), but this makes the central claim conditional on the availability of a CLIP-like model that is at least weakly informative for the target domain. The paper should qualify the abstract and Section 1 claims, and ideally add a lightweight CLIP-suitability check (e.g., zero-shot accuracy on a small held-out clean proxy) to the pipeline.
  3. [Section 5.1.3 vs Section 5.3.2] The default splitting thresholds are stated inconsistently. Section 5.1.3 says 'We set a uniform threshold σ1 = 0.1 and σ2 = 0.2 for triggered and clean data on all the experiments,' while Section 5.3.2 says 'For default settings, we use σ1 = 0.2 and σ2 = 0.1.' Given the definitions in Section 4.1.3, these two settings are not interchangeable—they assign different proportions of samples to the clean and triggered subsets. Since all main results depend on these thresholds, the paper must unambiguously state the exact defaults used for Tables 1 and 4 and ensure the ablation in Figure 5 is consistent with that statement.
  4. [Abstract and Section 1] The headline numerical claims are not supported by the paper's own tables. The abstract says 'maintaining clean accuracy (CA) with a maximum drop of only 0.3%,' but Table 1 shows a 0.5 percentage-point CA drop for Blend on CIFAR-10 (93.7 to 93.2), and Table 4 shows GTSRB clean-label CA dropping from 98.4 to 94.7 (a 3.7-point drop) with an average GTSRB drop of 0.4 points. Similarly, 'below 1%' ASR conflicts with Table 4's GTSRB average of 1.0% and clean-label ASR of 2.8%. The summary claims should be aligned with the reported numbers, e.g., 'average ASR below 1% on CIFAR-10, CIFAR-100, and ImageNet, and at most 1.0% on GTSRB,' with per-category CA drops stated.
minor comments (5)
  1. [Section 5.4.1] The text says CGD succeeds when CLIP's zero-shot accuracy is 'as low as 11.6% on CIFAR-100 and 7.5% on TinyImageNet,' while Figure 6's caption says 'as low as 10%.' Please align these numbers.
  2. [Section 3.0.1 and Section 4.1.1] The quantity S^CLIP_i = -log p(y_i|x_i) is a cross-entropy loss, not an entropy. Calling it an 'entropy score' throughout is confusing; consider renaming it to 'CLIP cross-entropy score' to avoid ambiguity.
  3. [Figure 7 caption] The phrase 'most of the strong triggered samples can be captions' appears to be a typo; this should likely read 'captured' or 'detected.'
  4. [Table 6] Please clarify how ImageBind, which is not a standard zero-shot text-image classifier in the CLIP sense, is used to produce logits over class labels; without this detail the SigLIP/ImageBind results are not reproducible.
  5. [Section 5.2.4] The text says 'with ASR reduced to ≤ 3%' for the scalability results, but the abstract and introduction claim 'below 1%.' These statements should be made consistent.

Circularity Check

1 steps flagged · score 4.0 of 10

The empirical ASR reductions are measured, not derived, but the appendix's formal detection guarantee assumes the exact entropy-separation property it purports to prove; threshold selection on the same benchmark adds a mild tuning caveat.

  1. other [Appendix A.1.1-A.1.2 (Calibration Assumptions and Score Behavior; Probabilistic Bound on Poisoned Sample Detection)]
    "Calibration implies F_p(s) ≤ F_c(s), meaning poisoned scores stochastically dominate clean scores. ... This bound depends on the poisoning rate p_r, sample size N, and CLIP's calibration error ε, confirming the method's reliability."

    The appendix's proof of label-poison detection assumes the exact property the defense needs: that CLIP cross-entropy scores for mislabeled samples stochastically dominate those for clean samples (F_p <= F_c). This is the same separation used in Section 4.1.1 to flag samples with high S^CLIP as poisoned. Bounded expected calibration error does not imply this stochastic dominance; the paper simply asserts it. The subsequent Chernoff bound then concludes that most poisoned samples rank above the threshold, but that conclusion is already contained in the assumed dominance. Thus the formal 'guarantee' is circular: it assumes the target separation rather than deriving it from calibration. The headline ASR/CA numbers are empirical measurements and are not forced by this circular step.

full rationale

The core CGD pipeline is not circular in its experimental claim: the split subsets D_c and D_p are defined by thresholded entropy percentiles, the unlearning loss combines relearning, negative cross-entropy, and CLIP distillation, and the reported ASR and CA are measured on held-out triggered and clean test data. No term in L_total is defined in terms of the final ASR, and no fitted parameter is algebraically forced to produce the reported <1% attack success rates. The main circularity is confined to Appendix A, where the probabilistic detection bound assumes the exact stochastic-dominance condition (F_p <= F_c) that the method requires, and then presents the resulting bound as confirmation of reliability. Additional caveats are non-circular but relevant: the default thresholds sigma1/sigma2 are selected on the same 11-attack benchmark used for the headline results (Section 5.3.2), and the GCB attack baseline is the authors' own prior work (reference [44]), though that citation is an attack implementation rather than a load-bearing justification of the defense mechanism. Because the empirical results are self-contained measurements across many datasets and attacks, the overall circularity is partial rather than foundational.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method's load-bearing premises are assumptions about CLIP's zero-shot reliability and about the entropy signatures of poisoned samples. The formal appendix assumes these signatures rather than deriving them from calibration alone. The defense adds no free-floating entities, but its headline numbers depend on several hand-tuned thresholds.

free parameters (5)
  • sigma1 = 0.2 (default)
    Percentile threshold defining the clean subset; tuned via the ratio study in Figure 5 and Section 5.3.2. Section 5.1.3 lists 0.1, a text inconsistency.
  • sigma2 = 0.1 (default)
    Percentile threshold defining the triggered subset; tuned on the same benchmark. Section 5.1.3 lists 0.2, a text inconsistency.
  • lambda_un = 0.025
    Weight for the negative cross-entropy unlearning loss; chosen by hand in Section 5.1.3 and validated only indirectly by ablation.
  • lambda_distill = 0.0005
    Weight for the CLIP distillation loss; chosen by hand in Section 5.1.3.
  • T = 5 epochs
    Intermediate epoch at which the suspicious model's entropy is measured for clean-label detection; set in Section 5.1.3.
assumptions (4)
  • domain assumption CLIP is a weak but clean classifier for the target dataset, with calibrated probabilities.
    Invoked in Sections 4.1.1, 5.4 and Appendix A.1.1. The SVHN result shows failure when it does not hold.
  • domain assumption For label-poisoned samples, CLIP cross-entropy is stochastically larger than for clean samples (F_p <= F_c).
    Assumed in Appendix A.1.1; calibration alone does not imply this ordering.
  • domain assumption For clean-label poisons, the suspicious model is overconfident (low cross-entropy) on triggered samples at epoch 5.
    Used in Section 4.1.2 and Appendix A.2; relies on trigger-induced confidence, not guaranteed for all attacks.
  • domain assumption The defender has already trained a suspicious model on the potentially poisoned dataset and has access to a public CLIP model.
    Threat model in Section 3.0.2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separation." pith.science (2026). https://pith.science/paper/YONXWUEX

@misc{pith2026250705113,
  author       = {Pith},
  title        = {Pith review of: CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YONXWUEX}},
  note         = {Machine review of arXiv:2507.05113}
}
read the original abstract

Deep Neural Networks (DNNs) are susceptible to backdoor attacks, where adversaries poison training data to implant backdoor into the victim model. Current backdoor defenses on poisoned data often suffer from high computational costs or low effectiveness against advanced attacks like clean-label and clean-image backdoors. To address them, we introduce CLIP-Guided backdoor Defense (CGD), an efficient and effective method that mitigates various backdoor attacks. CGD utilizes a publicly accessible CLIP model to identify inputs that are likely to be clean or poisoned. It then retrains the model with these inputs, using CLIP's logits as a guidance to effectively neutralize the backdoor. Experiments on 4 datasets and 11 attack types demonstrate that CGD reduces attack success rates (ASRs) to below 1% while maintaining clean accuracy (CA) with a maximum drop of only 0.3%, outperforming existing defenses. Additionally, we show that clean-data-based defenses can be adapted to poisoned data using CGD. Also, CGD exhibits strong robustness, maintaining low ASRs even when employing a weaker CLIP model or when CLIP itself is compromised by a backdoor. These findings underscore CGD's exceptional efficiency, effectiveness, and applicability for real-world backdoor defense scenarios. Code: https://github.com/binyxu/CGD.

Figures

Figures reproduced from arXiv: 2507.05113 by the authors.

Figure 1
Figure 1. Entropy distribution plot for BadNets with CLIP [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Pipeline for our CLIP-Guided Backdoor Defense (CGD). [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Percentile rank of entropy for triggered images [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Entropy distribution plot for various categories of [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 6
Figure 6. Figure 6: CGD’s defense performance on low-accuracy CLIP [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 5
Figure 5. Figure 5: Threshold Study. 5.3.2 Hyperparameter Study. The primary hyperparameters in our experiment are the clean data threshold 𝜎1 and the triggered data threshold 𝜎2, which define the splitting of the entropy map. Selecting suitable values for these thresholds is crucial: if …
Figure 7
Figure 7. Figure 7: Entropy map for Adaptive SIG with both random [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Entropy map for Feature Mixing Backdoor (FMB) [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Entropy maps of various backdoor attack methods on the CIFAR-10 dataset. Each category of attack exhibits a distinct [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 40 canonical work pages

  1. [1]

    Shengwei An, Yuan Yao, Qiuling Xu, Shiqing Ma, Guanhong Tao, Siyuan Cheng, Kaiyuan Zhang, Yingqi Liu, Guangyu Shen, Ian Kelk, et al. 2023. ImU: Physical Impersonating Attack for Face Recognition System with Natural Style Changes. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 899–916

    work page 2023

  2. [2]

    Mauro Barni, Kassem Kallas, and Benedetta Tondi. 2019. A new backdoor attack in cnns by training set corruption without label poisoning. In2019 IEEE International Conference on Image Processing (ICIP) . IEEE, 101–105

    work page 2019

  3. [3]

    Nicholas Carlini and Andreas Terzis. 2022. Poisoning and Backdooring Con- trastive Learning. In International Conference on Learning Representations . https: //openreview.net/forum?id=iC4UHbQ01Mp

    work page 2022

  4. [4]

    Weixin Chen, Baoyuan Wu, and Haoqian Wang. 2022. Effective backdoor defense by exploiting sensitivity of poisoned samples. Advances in Neural Information Processing Systems 35 (2022), 9727–9737

    work page 2022

  5. [5]

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    arXiv 2017

  6. [6]

    Yiming Chen, Haiwei Wu, and Jiantao Zhou. 2024. Progressive Poisoned Data Iso- lation for Training-Time Backdoor Defense. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 11425–11433

    work page 2024

  7. [7]

    Sedigheh Eslami, Christoph Meinel, and Gerard de Melo. 2023. PubMedCLIP: How Much Does CLIP Benefit Visual Question Answering in the Medical Domain?. In Findings of the Association for Computational Linguistics: EACL 2023 , Andreas Vlachos and Isabelle Augenstein (Eds.). Association for Computational Linguistics, Dubrovnik, Croatia, 1181–1193. https://doi...

    doi:10.18653/v1/2023.findings-eacl.88 2023

  8. [8]

    Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tao Xia. 2023. Backdoor defense via adaptively splitting poisoned dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 4005–4014

    work page 2023

Show all 53 references
  1. [9]

    Rohit Girdhar, Alaaeldin El-Nouby, Zhuang Liu, Mannat Singh, Kalyan Vasudev Alwala, Armand Joulin, and Ishan Misra. 2023. Imagebind: One embedding space to bind them all. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 15180–15190

    2023

  2. [10]

    Shashank Goel, Hritik Bansal, Sumit Bhatia, Ryan Rossi, Vishwa Vinay, and Aditya Grover. 2022. Cyclip: Cyclic contrastive language-image pretraining. Advances in Neural Information Processing Systems 35 (2022), 6704–6719

    2022

  3. [11]

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access 7 (2019), 47230–47244

    2019

  4. [12]

    Xingshuo Han, Guowen Xu, Yuan Zhou, Xuehuan Yang, Jiwei Li, and Tianwei Zhang. 2022. Physical backdoor attacks to lane detection systems in autonomous driving. In Proceedings of the 30th ACM International Conference on Multimedia . 2957–2968

    2022

  5. [13]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Identity map- pings in deep residual networks. In Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14. Springer, 630–645

    2016

  6. [14]

    Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. 2021. Backdoor Defense via Decoupling the Training Process. In International Conference on Learning Representations

    2021

  7. [15]

    Eric Jang, Shixiang Gu, and Ben Poole. 2016. Categorical reparameterization with gumbel-softmax. arXiv preprint arXiv:1611.01144 (2016)

    2016 arXiv

  8. [16]

    Rishi Jha, Jonathan Hayase, and Sewoong Oh. 2024. Label poisoning is all you need. Advances in Neural Information Processing Systems 36 (2024)

    2024

  9. [17]

    A Krizhevsky. 2009. Learning Multiple Layers of Features from Tiny Images. Master’s thesis, University of Tront (2009)

    2009

  10. [18]

    Janghyeon Lee, Jongsuk Kim, Hyounguk Shon, Bumsoo Kim, Seung Hwan Kim, Honglak Lee, and Junmo Kim. 2022. Uniclip: Unified framework for contrastive language-image pre-training. Advances in Neural Information Processing Systems 35 (2022), 1008–1019

    2022

  11. [19]

    Changjiang Li, Ren Pang, Zhaohan Xi, Tianyu Du, Shouling Ji, Yuan Yao, and Ting Wang. 2023. An embarrassingly simple backdoor attack on self-supervised learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 4367–4378

    2023

  12. [20]

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2022. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems (2022)

    2022

  13. [21]

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. 2021. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF international conference on computer vision . 16463–16472

    2021

  14. [22]

    Yangguang Li, Feng Liang, Lichen Zhao, Yufeng Cui, Wanli Ouyang, Jing Shao, Fengwei Yu, and Junjie Yan. 2022. Supervision Exists Everywhere: A Data Efficient Contrastive Language-Image Pre-training Paradigm. In International Conference on Learning Representations. https://open...

    2022

  15. [23]

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems 34 (2021), 14900–14912

    2021

  16. [24]

    Yi Li, Junli Zhao, Zhihan Lv, and Jinhua Li. 2021. Medical image fusion method by deep learning. International Journal of Cognitive Computing in Engineering 2 (2021), 21–29

    2021

  17. [25]

    Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. 2024. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 24645–24654

    2024

  18. [26]

    Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang. 2020. Composite backdoor attack for deep neural network by mixing existing benign features. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . 113–131

    2020

  19. [27]

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-pruning: De- fending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses . Springer, 273–294

    2018

  20. [28]

    Zhuo Ma, Yilong Yang, Yang Liu, Tong Yang, Xinjing Liu, Teng Li, and Zhan Qin. 2024. Need for Speed: Taming Backdoor Attacks with Speed and Precision. In 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 228–228

    2024

  21. [29]

    Tuan Anh Nguyen and Anh Tran. 2020. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems 33 (2020), 3454–3464

    2020

  22. [30]

    Tuan Anh Nguyen and Anh Tuan Tran. 2020. WaNet-Imperceptible Warping- based Backdoor Attack. In International Conference on Learning Representations

    2020

  23. [31]

    Soumyadeep Pal, Yuguang Yao, Ren Wang, Bingquan Shen, and Sijia Liu. 2024. Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency. In The Twelfth International Conference on Learning Representations. https://openreview.net/forum?id=1OfAO2mes1

    2024

  24. [32]

    Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. 2022. Revisiting the assumption of latent separability for backdoor defenses. In The eleventh international conference on learning representations

    2022

  25. [33]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learni...

    2021

  26. [34]

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al

  27. [35]

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. 2022. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural I...

    2022

  28. [36]

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. 2012. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural networks 32 (2012), 323–332

    2012

  29. [37]

    Samuel Stevens, Jiaman Wu, Matthew J Thompson, Elizabeth G Campolongo, Chan Hee Song, David Edward Carlyn, Li Dong, Wasila M Dahdul, Charles Stewart, Tanya Berger-Wolf, Wei-Lun Chao, and Yu Su. 2024. BioCLIP: A Vision Foundation Model for the Tree of Life. In Proceedings of th...

    2024

  30. [38]

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2019. Label- consistent backdoor attacks. arXiv preprint arXiv:1912.02771 (2019)

    2019 arXiv

  31. [39]

    Zhenting Wang, Juan Zhai, and Shiqing Ma. 2022. Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 15074–15084

    2022

  32. [40]

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. 2022. Backdoorbench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems 35 (2022), 10546–10559

    2022

  33. [41]

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Mingli Zhu, Ruotong Wang, Li Liu, and Chao Shen. 2024. Backdoor- Bench: A Comprehensive Benchmark and Analysis of Backdoor Learning. arXiv:2407.19845 [cs.LG] https://arxiv.org/abs/2407.19845

    2024 arXiv

  34. [42]

    Dongxian Wu and Yisen Wang. 2021. Adversarial neuron pruning purifies backdoored deep models. Advances in Neural Information Processing Systems 34 (2021), 16913–16925

    2021

  35. [43]

    Teng Xiao, Chao Cui, Huaisheng Zhu, and Vasant G. Honavar. 2024. GeomCLIP: Contrastive Geometry-Text Pre-training for Molecules. arXiv:2411.10821 [cs.LG] https://arxiv.org/abs/2411.10821

    2024 arXiv

  36. [44]

    Binyan Xu, Fan YANG, Di Tang, Xilin Dai, and Kehuan Zhang. 2025. Less is More: Stealthy and Adaptive Clean-Image Backdoor Attacks with Few Poisoned. https://openreview.net/forum?id=LsTIW9VAF7

    2025

  37. [45]

    Wenhan Yang, Jingdong Gao, and Baharan Mirzasoleiman. 2024. Better Safe than Sorry: Pre-training CLIP against Targeted Data Poisoning and Backdoor Attacks. In Forty-first International Conference on Machine Learning . https: //openreview.net/forum?id=ycLHJuLYuD MM ’25, October...

    2024

  38. [46]

    Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. 2021. Adversarial Unlearning of Backdoors via Implicit Hypergradient. In International Conference on Learning Representations

    2021

  39. [47]

    Xiaohua Zhai, Basil Mustafa, Alexander Kolesnikov, and Lucas Beyer. 2023. Sig- moid loss for language image pre-training. In Proceedings of the IEEE/CVF inter- national conference on computer vision . 11975–11986

    2023

  40. [48]

    Lungren, Tristan Naumann, Sheng Wang, and Hoifung Poon

    Sheng Zhang, Yanbo Xu, Naoto Usuyama, Hanwen Xu, Jaspreet Bagga, Robert Tinn, Sam Preston, Rajesh Rao, Mu Wei, Naveen Valluri, Cliff Wong, Andrea Tupini, Yu Wang, Matt Mazzola, Swadheen Shukla, Lars Liden, Jianfeng Gao, Angela Crabtree, Brian Piening, Carlo Bifulco, Matthew P....

    2025 arXiv

  41. [49]

    Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. 2020. BRIDGING MODE CONNECTIVITY IN LOSS LANDSCAPES AND ADVERSARIAL ROBUSTNESS. In International Conference on Learning Represen- tations (ICLR 2020)

    2020

  42. [50]

    Runkai Zheng, Rongjun Tang, Jianze Li, and Li Liu. 2022. Pre-activation distri- butions expose backdoor neurons. Advances in Neural Information Processing Systems 35 (2022), 18667–18680. A Detailed Mathematical Analysis of CLIP-Guided Backdoor Defense This appendix presents a ...

    2022

  43. [52]

    The clean subset is𝐶 (|𝐶| =(1−𝑝𝑟)𝑁 ), and the poisoned subset is 𝑃 (|𝑃| = 𝑝𝑟𝑁 )

    of samples are poisoned with incorrect labels. The clean subset is𝐶 (|𝐶| =(1−𝑝𝑟)𝑁 ), and the poisoned subset is 𝑃 (|𝑃| = 𝑝𝑟𝑁 ). For each sample, CLIP computes a cross-entropy score SCLIP 𝑖 = − log𝑝(𝑦𝑖|𝑥𝑖), where𝑝(𝑦𝑖|𝑥𝑖) is the predicted probability of the assigned label𝑦𝑖. We ...

    2025

  44. [53]

    C.0.4 Clean-image Backdoors

    are effective against both clean-label and classical backdoors by leveraging these unique entropy distributions. C.0.4 Clean-image Backdoors. Clean-image Backdoors, such as FLIP and GCB (Fig. 9j and 9k), present an entropy distribution that poses challenges for entropy-based d...

    2025

  45. [2015]

    International journal of computer vision 115 (2015), 211–252

    Imagenet large scale visual recognition challenge. International journal of computer vision 115 (2015), 211–252

    2015

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.