Pith. sign in

REVIEW 2 major objections 4 minor 189 references

Learning a strongly backdoored reference model lets you isolate and remove poisonous training samples more accurately than trying to isolate the clean ones.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Learning a backdoored reference model as a poisonous-sample oracle enables near-perfect training-time backdoor removal with negligible natural-accuracy loss.

T0 review reviewed 2026-07-11 challenge →

load-bearing objection Solid paradigm flip: learn a strongly backdoored oracle to isolate poisons, with strong multi-attack/dataset results and near-zero residual ASR at almost no ACC cost. the 2 major comments →

arxiv 2607.05748 v1 pith:FWL6EX3W submitted 2026-07-07 cs.LG

Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor

Qi Zhao , Christian Wressnegger This is my paper
classification cs.LG
keywords backdoor defensedata poisoninganti-backdoor learningdataset splittingreverse cross-entropyreference modeltraining-time defense
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoors injected by data poisoning are hard to strip out once a model has learned them. Existing training-time defenses try to keep the model clean by identifying the benign samples and training only on those. HARVEY flips the problem: because poisonous samples are easier for a network to learn, it is simpler and more reliable to train a deliberately backdoored reference model and use that model as an oracle for the poisonous samples. By repeatedly learning the poisons and unlearning the rest, the method builds an ever-clearer separation (measured by reverse cross-entropy loss) and finally trains a clean model on the remaining data. Across patch, blend, clean-label and dynamic-trigger attacks on CIFAR-10, GTSRB and Tiny-ImageNet, the resulting attack success rates drop below two percent while natural accuracy stays within roughly one percent of an undefended baseline.

Core claim

A strongly backdoored reference model, obtained by iterative learning on low reverse-cross-entropy samples and unlearning of the complementary set, separates poisonous from benign data far more cleanly than any clean or partially clean reference model. The reverse-cross-entropy term alone already yields a fixed, practical threshold (C/2) that isolates almost all poisons, so the final supervised model trained on the residual clean subset has near-zero attack success rate and essentially unchanged natural accuracy.

What carries the argument

HARVEY’s four-stage loop: (1) naïve pre-training to seed a 50 % low-RCE poison pool, (2) iterative learning–unlearning that strengthens a backdoored reference model, (3) meta-splitting of residual target-class samples with the first-round reference model, and (4) ordinary supervised training on the recovered clean set.

Load-bearing premise

Poisonous samples stay systematically easier to learn than ordinary samples, even after repeated unlearning and for stealthy dynamic triggers, so a single fixed reverse-cross-entropy threshold keeps separating them cleanly.

What would settle it

Construct a poisoning attack (for example a stronger dynamic trigger or a carefully balanced clean-label set) such that, after twenty rounds of HARVEY’s learning–unlearning schedule, the reverse-cross-entropy distributions of poisonous and benign samples still overlap enough that the C/2 threshold leaves more than five percent poisons in the final training set and the attack success rate remains above ten percent.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Training-time defenses no longer need a trusted clean reference set; the poisoned data itself can supply the oracle.
  • Any future loss that enlarges the gap between easy-to-learn poisons and hard-to-learn clean samples can be dropped into the same four-stage skeleton.
  • Adaptive attacks that try to hide poisons by duplicating benign samples still leave enough residual separation for the method to recover a clean model.
  • The same principle may extend to other “easy-to-memorize” contamination problems such as label noise or targeted data corruption.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same “learn the contaminant first” idea could be applied to detection of synthetic data or membership-inference poisoning without requiring a clean hold-out set.
  • Because the method never needs the true poison labels, it could be run as a black-box filter on any large public corpus before downstream fine-tuning.
  • If reverse cross-entropy is replaced by another easy-to-hard metric (for example gradient norm or loss curvature), the same iterative oracle construction may transfer to non-vision modalities.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper introduces HARVEY, a training-time defense against data-poisoning backdoors that does not require a clean reference set. Building on the observation that poisonous samples are learned more easily than benign ones, it iteratively constructs a strongly backdoored reference model (via LGA learning on a low-RCE subset plus one-epoch unlearning of the high-RCE subset) and uses that model’s reverse cross-entropy (RCE) loss as an oracle for poisonous samples. After n rounds of refinement a meta-splitting step recovers residual benign samples of the target class; the final model is then trained only on the purified set. Extensive experiments on CIFAR-10, GTSRB and Tiny-ImageNet against six attacks (BadNets, Trojan, Blend, CLB, IAB, WaNet) and multiple architectures show that residual ASR is driven below 2 % (worst-case 1.83 % on CIFAR-10, 0.48 % on Tiny-ImageNet) while natural accuracy stays within ~1 % of the undefended baseline, outperforming ABL, DBD, D-ST and CBD.

Significance. If the empirical claims hold, HARVEY supplies a practical, clean-data-free training-time defense that consistently removes both patch-based and stealthy dynamic triggers while preserving accuracy. The paradigm shift—learning a poisonous-sample oracle rather than a benign-sample oracle—is conceptually clean and is supported by a thorough ablation suite (RCE vs. SCE/CE, unlearning, meta-splitting, hyper-parameter sweeps, adaptive duplication). The public implementation further raises the work’s value for the community. The result is therefore of clear interest to the backdoor-defense literature.

major comments (2)
  1. The central claim rests on a fixed RCE threshold of C/2 remaining a reliable separator after iterative unlearning (Sections 2.2, 3.2; Figs. 1, 6). While the paper demonstrates high recall and near-zero residual poisoning rates for the six evaluated attacks, the only adaptive experiment (Appendix E) is a simple sample-duplication attack. A more systematic adaptive adversary that deliberately equalizes RCE losses of poisonous and benign samples (e.g., by loss-matching or feature-space blending) is not examined; without it the generality of the “poisonous samples remain easier to learn” axiom remains incompletely stress-tested.
  2. All main tables (Tables 2, 3, 8, 9) report single-run point estimates. Given that Stage 2 involves stochastic unlearning and that several hyper-parameters (γ = 0.01, λ = 0.01, n = 20) are fixed without multi-seed statistics, the reported worst-case ASR margins of <2 % cannot be assessed for statistical reliability. At least three independent seeds with error bars (or confidence intervals) on ACC/ASR for the critical stealthy attacks (IAB, WaNet, Blend) are needed to substantiate the “near-perfect” claim.
minor comments (4)
  1. Table 1 lists “Architecture Independent” for HARVEY; the claim is only weakly supported by the three architectures tested and should be softened or moved to the experimental discussion.
  2. The algorithmic description (Algorithm 1) omits the class-balancing step that appends low-RCE samples so every class retains at least 1 % of its original size; the prose in Section 3.2 mentions it, but the algorithm should match.
  3. Figure 2’s legend uses “Meta-S” without expansion; a short parenthetical would improve readability.
  4. A few typographical inconsistencies appear (e.g., “abackdoored”, “HARVEYsubstantially”); a careful proof-reading pass is warranted.

Circularity Check

0 steps flagged

No significant circularity; HARVEY is an empirical training-time procedure whose performance claims are measured against external attacks and independent ACC/ASR metrics.

full rationale

The paper's derivation chain begins from the well-known empirical observation (cited to Li et al. 2021a and others) that poisonous samples are learned faster than benign ones, analyzes why the RCE term of SCE loss separates them more cleanly than CE or full SCE (Section 2.1, rewriting LRCE = C·(1-p(y|x))), and then constructs an iterative procedure that deliberately overfits a reference model to the low-RCE subset while unlearning the high-RCE subset. The final claims (near-zero residual ASR at near-baseline ACC) are obtained by training a clean model on the resulting split and evaluating it on held-out test sets under previously published attacks (BadNets, Trojan, Blend, CLB, IAB, WaNet) and architectures. No equation equates a claimed prediction to a fitted input by construction; the fixed threshold C/2 follows directly from the bounded range of RCE; hyperparameters (γ=0.01, λ=0.01, n=20, Tpoi=10) are stated and ablated rather than tuned to force the reported ASR numbers; and the few self-citations are ordinary background (SCE, LGA) rather than load-bearing uniqueness theorems. The method is therefore self-contained against external benchmarks and exhibits no circular reduction.

Axiom & Free-Parameter Ledger

5 free parameters · 3 axioms · 1 invented entities

The central claim rests on the empirical regularity that poisonous samples are easier to learn, on the fixed RCE threshold C/2, and on a handful of hand-chosen training hyper-parameters. No new physical or mathematical entities are postulated; the method re-uses standard losses and optimizers.

free parameters (5)
  • RCE threshold C/2 = ≈4.605
    Fixed at approximately 4.605 (ε=10^{-5}); used for every split in Stages 2–3. Chosen by the bounded range of RCE rather than cross-validated.
  • LGA γ = 0.01
    Set to 0.01 to avoid overfitting the few clean samples inside S^{(i)}; ablation shows sensitivity above 0.015.
  • unlearning λ = 0.01
    Set to 0.01 to stabilize unlearning of D_bng; larger values degrade accuracy.
  • number of Stage-2 rounds n = 20
    Fixed at 20; performance plateaus after ~10 rounds (Fig. 3).
  • T_init / T_poi = 20 / 10
    20 and 10 epochs respectively; chosen for convergence speed rather than exhaustive search.
axioms (3)
  • domain assumption Poisonous samples are systematically easier for a neural network to fit than benign samples under standard cross-entropy training.
    Stated as the foundational observation (Sec. 1–2) and used to justify both the initial 50 % split and the iterative backdoor-learning strategy.
  • ad hoc to paper Reverse cross-entropy alone (rather than full SCE) produces a clearer separation between poisonous and benign samples.
    Derived analytically in Sec. 2.1 and confirmed by the histograms in Fig. 7; not a previously established theorem.
  • ad hoc to paper A single epoch of gradient-ascent unlearning on the high-loss subset does not destroy the backdoor already learned on the low-loss subset.
    Required for Stage 2 stability; supported only by the reported ablation (Table 4).
invented entities (1)
  • strongly backdoored reference model used as poisonous-sample oracle no independent evidence
    purpose: Provides a continuously improving RCE-based ranking that isolates poisons more accurately than clean-sample oracles.
    The entity is the methodological core of HARVEY; it is constructed entirely inside the paper and has no independent existence outside the algorithm.

reviewed 2026-07-11 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor." pith.science (2026). https://pith.science/paper/FWL6EX3W

@misc{pith2026260705748,
  author       = {Pith},
  title        = {Pith review of: Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FWL6EX3W}},
  note         = {Machine review of arXiv:2607.05748}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

The community has recently developed various training-time defenses to counter neural backdoors introduced through data poisoning. In light of the observation that a model learns poisonous samples responsible for the backdoor easier than benign samples, these approaches either use a fixed threshold of the training loss for splitting or iteratively learn a reference model as an oracle for identifying benign samples. In particular, the latter has proven effective for anti-backdoor learning. Our method, HARVEY, leverages a similar yet crucially different technique: learning an oracle for poisonous rather than benign samples. Learning a backdoored reference model is significantly easier than learning a reference model on benign data. Consequently, we can identify poisonous samples much more accurately than related work identifies benign samples. This crucial difference enables near-perfect backdoor removal as we demonstrate in our evaluation. HARVEY substantially outperforms related approaches across attack types, datasets, and architectures, lowering the attack success rate to the very minimum at a negligible loss in natural accuracy. The figure below shows an overview of our methods working principle.

Figures

Figures reproduced from arXiv: 2607.05748 by Christian Wressnegger, Qi Zhao.

Figure 1
Figure 1. Figure 1: Subsets of incremental size chosen in ascending order of RCE loss based on a ResNet18 trained on a CI￾FAR10 under Blend attack (Chen et al. 2017) at ρ = 10 %. 2.2 Distribution of Benign and Poisonous Samples Although the model learns poisonous samples (and thus the backdoor) easier than benign samples in the general case (Li et al. 2021a), after training, some benign samples still have a similar loss as po… view at source ↗
Figure 2
Figure 2. Figure 2: Overview depiction of our method HARVEY. The individual stages are described in Sections 3.1 to 3.4. We perform unlearning for only one epoch per round. This way, we avoid a learning divergence and help the model to stably unlearn the benign samples. Splitting dataset D˜ and composing S (i+1) . The refer￾ence model θ (i) ref encodes the backdoor much better than be￾nign data. There hence exists a huge gap … view at source ↗
Figure 5
Figure 5. Figure 5: Meta-splitting with us￾ing θ (1) ref on D (n) bad of CIFAR10 against Blend (Chen et al. 2017) [PITH_FULL_IMAGE:figures/full_fig_p004_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Dataset distribution of the latent space by t-SNE (top row) and [PITH_FULL_IMAGE:figures/full_fig_p005_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Comparing data distribution in dataset splitting defenses by different loss functions: [PITH_FULL_IMAGE:figures/full_fig_p011_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Ablation study on HARVEY’s hyper-settings with the model ResNet18 on poisoned CIFAR10 datasets. ACC and ASR are shown in solid and dashed lines, respectively [PITH_FULL_IMAGE:figures/full_fig_p013_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Evaluating HARVEY’s defense across different backdoor target labels with a ResNet18 model on poisoned CIFAR10 datasets. ACC and ASR are shown in solid and dashed lines, respectively. D.3 Cross-Architecture Evaluation We implement poisoning attacks with the same settings as mentioned in Section B.2 and evaluate HARVEY’s per￾formance cross different model architectures: VGG11 (Si￾monyan and Zisserman 2015), … view at source ↗
Figure 10
Figure 10. Figure 10: Duplicated Image (Class = 0) Duplicating benign samples. To hide the prominence of poisonous samples, an adaptive attacker can alter the dataset distribution by duplicating a single benign sample to estab￾lish a fake data cluster with similarly high significance as the real poisonous samples in the dataset. We choose an image [PITH_FULL_IMAGE:figures/full_fig_p015_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

189 extracted references · 189 canonical work pages · 4 internal anchors

  1. [1]

    Barni, M.; Kallas, K.; and Tondi, B. 2019. A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning. In 2019 IEEE International Conference on Image Processing (ICIP)

    work page 2019

  2. [2]

    Berthelot, D.; Carlini, N.; Goodfellow, I.; Papernot, N.; Oliver, A.; and Raffel, C. 2019. MixMatch: A Holistic Approach to Semi-Supervised Learning. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2019

  3. [3]

    Biggio, B.; and Roli, F. 2018. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84: 317--331

    work page 2018

  4. [4]

    Cai, R.; Zhang, Z.; Chen, T.; Chen, X.; and Wang, Z. 2022. Randomized Channel Shuffling: Minimal-Overhead Backdoor Attack Detection without Clean Datasets. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2022

  5. [5]

    Poisoning Web-Scale Training Datasets is Practical

    Carlini, N.; Jagielski, M.; Choquette-Choo, C. A.; Paleka, D.; Pearce, W.; Anderson, H.; Terzis, A.; Thomas, K.; and Tramèr, F. 2023. Poisoning Web-Scale Training Datasets is Practical. arXiv:2302.10149

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  6. [6]

    Chen, W.; Wu, B.; and Wang, H. 2022. Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2022

  7. [7]

    Chen, X.; Liu, C.; Li, B.; Lu, K.; and Song, D. 2017. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. CoRR, abs/1712.05526

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  8. [8]

    G.; Abbasnejad, E.; and Ranasinghe, D

    Doan, B. G.; Abbasnejad, E.; and Ranasinghe, D. C. 2020. Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems. In Proc. of the Annual Computer Security Applications Conference ( ACSAC )

    work page 2020

  9. [9]

    Gao, K.; Bai, Y.; Gu, J.; Yang, Y.; and Xia, S.-T. 2023. Backdoor Defense via Adaptively Splitting Poisoned Dataset. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    work page 2023

  10. [10]

    C.; and Nepal, S

    Gao, Y.; Xu, C.; Wang, D.; Chen, S.; Ranasinghe, D. C.; and Nepal, S. 2019. STRIP: A Defence Against Trojan Attacks on Deep Neural Networks. In Proc. of the Annual Computer Security Applications Conference ( ACSAC )

    work page 2019

  11. [11]

    Gu, T.; Dolan - Gavitt, B.; and Garg, S. 2017. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. Proceeding of Machine Learning and Computer Security Workshop

    work page 2017

  12. [12]

    Hayase, J.; Kong, W.; Somani, R.; and Oh, S. 2021. SPECTRE: defending against backdoor attacks using robust statistics. In Proc. of the International Conference on Machine Learning ( ICML )

    work page 2021

  13. [13]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep Residual Learning for Image Recognition. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 770--778

    work page 2016

  14. [14]

    Huang, G.; Liu, Z.; and van der Maaten, L. 2017. Densely Connected Convolutional Networks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    work page 2017

  15. [15]

    Huang, K.; Li, Y.; Wu, B.; Qin, Z.; and Ren, K. 2022. Backdoor Defense via Decoupling the Training Process. In Proc. of the International Conference on Learning Representations ( ICLR )

    work page 2022

  16. [16]

    Krizhevsky, A.; Nair, V.; and Hinton, G. 2008. CIFAR (Canadian Institute for Advanced Research)

    work page 2008

  17. [17]

    Kullback, S.; and Leibler, R. A. 1951. On Information and Sufficiency. The Annals of Mathematical Statistics, 22(1): 79--86

    work page 1951

  18. [18]

    Le, Y.; and Yang, X. 2015. Tiny imagenet visual recognition challenge. CS 231N

    work page 2015

  19. [19]

    Li, B.; and Liu, W. 2024. A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks. In Proc. of the International Conference on Machine Learning ( ICML )

    work page 2024

  20. [20]

    Li, Y.; Lyu, X.; Koren, N.; Lyu, L.; Li, B.; and Ma, X. 2021 a . Anti-Backdoor Learning: Training Clean Models on Poisoned Data. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2021

  21. [21]

    Li, Y.; Lyu, X.; Koren, N.; Lyu, L.; Li, B.; and Ma, X. 2021 b . Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks. In Proc. of the International Conference on Learning Representations ( ICLR )

    work page 2021

  22. [22]

    Liu, K.; Dolan-Gavitt, B.; and Garg, S. 2018 a . Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In Bailey, M.; Holz, T.; Stamatogiannakis, M.; and Ioannidis, S., eds., Proc. of the International Symposium on Research in Attacks, Intrusions and Defenses ( RAID )

    work page 2018

  23. [23]

    Liu, Y.; Ma, S.; Aafer, Y.; Lee, W.-C.; Zhai, J.; Wang, W.; and Zhang, X. 2018 b . Trojaning Attack on Neural Networks. In Proc. of the Network and Distributed System Security Symposium ( NDSS )

    work page 2018

  24. [24]

    A.; and Tran, A

    Nguyen, T. A.; and Tran, A. 2020. Input-Aware Dynamic Backdoor Attack. In Larochelle, H.; Ranzato, M.; Hadsell, R.; Balcan, M.; and Lin, H., eds., Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 3454--3464

    work page 2020

  25. [25]

    A.; and Tran, A

    Nguyen, T. A.; and Tran, A. T. 2021. WaNet - Imperceptible Warping-based Backdoor Attack. In Proc. of the International Conference on Learning Representations ( ICLR )

    work page 2021

  26. [26]

    Qiu, H.; Zeng, Y.; Guo, S.; Zhang, T.; Qiu, M.; and Thuraisingham, B. 2021. DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks Using Data Augmentation. In Proc. of the ACM Asia Conference on Computer and Communications Security ( ASIA CCS )

    work page 2021

  27. [27]

    Sandler, M.; Howard, A.; Zhu, M.; Zhmoginov, A.; and Chen, L.-C. 2018. MobileNetV2: Inverted Residuals and Linear Bottlenecks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    work page 2018

  28. [28]

    R.; Najibi, M.; Suciu, O.; Studer, C.; Dumitras, T.; and Goldstein, T

    Shafahi, A.; Huang, W. R.; Najibi, M.; Suciu, O.; Studer, C.; Dumitras, T.; and Goldstein, T. 2018. Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS )

    work page 2018

  29. [29]

    Simonyan, K.; and Zisserman, A. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. In Proc. of the International Conference on Learning Representations ( ICLR )

    work page 2015

  30. [30]

    Stallkamp, J.; Schlipsing, M.; Salmen, J.; and Igel, C. 2012. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks

    work page 2012

  31. [31]

    Turner, A.; Tsipras, D.; and Madry, A. 2019. Label-Consistent Backdoor Attacks. arXiv:1912.02771

    work page internal anchor Pith review Pith/arXiv arXiv 2019

  32. [32]

    Wang, B.; Yao, Y.; Shan, S.; Li, H.; Viswanath, B.; Zheng, H.; and Zhao, B. Y. 2019 a . Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In Proc. of the IEEE Symposium on Security and Privacy

    work page 2019

  33. [33]

    Wang, R.; Zhang, G.; Liu, S.; Chen, P.-Y.; Xiong, J.; and Wang, M. 2020. Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases. In Proc. of the European Conference on Computer Vision ( ECCV )

    work page 2020

  34. [34]

    Wang, Y.; Ma, X.; Chen, Z.; Luo, Y.; Yi, J.; and Bailey, J. 2019 b . Symmetric cross entropy for robust learning with noisy labels. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV )

    work page 2019

  35. [35]

    Wang, Z.; Mei, K.; Ding, H.; Zhai, J.; and Ma, S. 2022. Rethinking the Reverse-engineering of Trojan Triggers. In Advances in Neural Information Processing Systems

    work page 2022

  36. [36]

    Wang, Z.; Mei, K.; Zhai, J.; and Ma, S. 2023. UNICORN : A Unified Backdoor Trigger Inversion Framework. In Proc. of the International Conference on Learning Representations ( ICLR )

    work page 2023

  37. [37]

    Wu, B.; Chen, H.; Zhang, M.; Zhu, Z.; Wei, S.; Yuan, D.; and Shen, C. 2022. BackdoorBench: A Comprehensive Benchmark of Backdoor Learning. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track

    work page 2022

  38. [38]

    A.; and Li, B

    Xu, X.; Wang, Q.; Li, H.; Borisov, N.; Gunter, C. A.; and Li, B. 2021. Detecting AI Trojans Using Meta Neural Analysis. In Proc. of the IEEE Symposium on Security and Privacy

    work page 2021

  39. [39]

    Zagoruyko, S.; and Komodakis, N. 2016. Wide Residual Networks. In Proc. of the British Machine Vision Conference ( BMVC )

    work page 2016

  40. [40]

    Zhang, Z.; Liu, Q.; Wang, Z.; Lu, Z.; and Hu, Q. 2023. Backdoor Defense via Deconfounded Representation Learning. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    work page 2023

  41. [41]

    N.; and Lin, X

    Zhao, P.; Chen, P.-Y.; Das, P.; Ramamurthy, K. N.; and Lin, X. 2020. Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness. In Proc. of the International Conference on Learning Representations ( ICLR )

    work page 2020

  42. [42]

    Zhao, S.; Ma, X.; Zheng, X.; Bailey, J.; Chen, J.; and Jiang, Y. 2023. Clean-Label Backdoor Attacks on Video Recognition Models. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV )

    work page 2023

  43. [43]

    Zhou, J.; Lv, P.; Lan, Y.; Meng, G.; Chen, K.; and Ma, H. 2023. DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models. In Proc. of AAAI Conference on Artificial Intelligence ( AAAI )

    work page 2023

  44. [44]

    Goodfellow and Rob Fergus , booktitle = iclr, title =

    Christian Szegedy and Wojciech Zaremba and Ilya Sutskever and Joan Bruna and Dumitru Erhan and Ian J. Goodfellow and Rob Fergus , booktitle = iclr, title =

    work page

  45. [45]

    Wide Residual Networks , year =

    Sergey Zagoruyko and Nikos Komodakis , booktitle =. Wide Residual Networks , year =

    work page

  46. [46]

    Karen Simonyan and Andrew Zisserman , booktitle = iclr, title =

    work page

  47. [47]

    and Dong, W

    Deng, J. and Dong, W. and Socher, R. and others , booktitle = cvpr, title =

    work page

  48. [48]

    2008 , url =

    Alex Krizhevsky and Vinod Nair and Geoffrey Hinton , title =. 2008 , url =

    work page 2008

  49. [49]

    Ng , booktitle =

    Yuval Netzer and Tao Wang and Adam Coates and Alessandro Bissacco and Bo Wu and Andrew Y. Ng , booktitle =. Reading Digits in Natural Images with Unsupervised Feature Learning , year =

    work page

  50. [50]

    Deng, Li , journal =. The. 2012 , number =

    work page 2012

  51. [51]

    Tiny imagenet visual recognition challenge , year =

    Ya Le and Xuan Yang , journal =. Tiny imagenet visual recognition challenge , year =

    work page

  52. [52]

    Stallkamp and M

    J. Stallkamp and M. Schlipsing and J. Salmen and C. Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks. 2012

    work page 2012

  53. [53]

    Ian Goodfellow and Jonathon Shlens and Christian Szegedy , booktitle = iclr, title =

    work page

  54. [54]

    Adversarial Machine Learning at Scale , author=

    work page

  55. [55]

    2017 , pages =

    Carlini, Nicholas and Wagner, David , booktitle = ieeesp, title =. 2017 , pages =

    work page 2017

  56. [56]

    2016 , pages =

    Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal , booktitle = cvpr, title =. 2016 , pages =

    work page 2016

  57. [57]

    Simple Black-Box Adversarial Attacks on Deep Neural Networks , year =

    Narodytska, Nina and Kasiviswanathan, Shiva , booktitle =. Simple Black-Box Adversarial Attacks on Deep Neural Networks , year =

    work page

  58. [58]

    2017 , pages =

    Chen, Pin-Yu and Zhang, Huan and Sharma, Yash and Yi, Jinfeng and Hsieh, Cho-Jui , booktitle = aisec, title =. 2017 , pages =

    work page 2017

  59. [59]

    Francesco Croce and Matthias Hein , booktitle = icml, title =

    work page

  60. [60]

    Boxi Wu and Jinghui Chen and Deng Cai and Xiaofei He and Quanquan Gu , booktitle = neurips, title =

    work page

  61. [61]

    2019 , month = jun, pages =

    Cohen, Jeremy and Rosenfeld, Elan and Kolter, Zico , booktitle = icml, title =. 2019 , month = jun, pages =

    work page 2019

  62. [62]

    2018 , month = jul, pages =

    Wong, Eric and Kolter, Zico , booktitle = icml, title =. 2018 , month = jul, pages =

    work page 2018

  63. [63]

    Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack , author =

    work page

  64. [64]

    Provable Robustness of ReLU networks via Maximization of Linear Regions , author =

    work page

  65. [65]

    Torchattacks: A PyTorch Repository for Adversarial Attacks

    Kim, Hoki , title=. arXiv preprint arXiv:2010.01950 , year=

    work page internal anchor Pith review Pith/arXiv arXiv 2010

  66. [66]

    Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Engstrom, Logan and Tran, Brandon and Madry, Aleksander , booktitle = neurips, title =

    work page

  67. [67]

    Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu , booktitle = iclr, title =

    work page

  68. [68]

    Zico Kolter , booktitle = iclr, title =

    Eric Wong and Leslie Rice and J. Zico Kolter , booktitle = iclr, title =

    work page

  69. [69]

    Xing and Laurent El Ghaoui and Michael I

    Hongyang Zhang and Yaodong Yu and Jiantao Jiao and Eric P. Xing and Laurent El Ghaoui and Michael I. Jordan , booktitle = icml, title =

    work page

  70. [70]

    2019 , editor =

    Shafahi, Ali and Najibi, Mahyar and Ghiasi, Mohammad Amin and Xu, Zheng and Dickerson, John and Studer, Christoph and Davis, Larry S and Taylor, Gavin and Goldstein, Tom , booktitle = neurips, title =. 2019 , editor =

    work page 2019

  71. [71]

    On the Convergence and Robustness of Adversarial Training , author =

    work page

  72. [72]

    Yisen Wang and Difan Zou and Jinfeng Yi and James Bailey and Xingjun Ma and Quanquan Gu , booktitle = iclr, title =

    work page

  73. [73]

    Tianyu Pang and Xiao Yang and Yinpeng Dong and Hang Su and Jun Zhu , booktitle = iclr, title =

    work page

  74. [74]

    Adnan Siraj Rakin and Zhezhi He and Deliang Fan , title =

    work page

  75. [75]

    Symmetric cross entropy for robust learning with noisy labels , author=

    work page

  76. [76]

    Spatially Transformed Adversarial Examples , author=

    work page

  77. [77]

    Micah Goldblum and Liam Fowl and Soheil Feizi and Tom Goldstein , title =

    work page

  78. [78]

    ICML , year=

    Attacks Which Do Not Kill Training Make Adversarial Learning Stronger , author=. ICML , year=

    work page

  79. [79]

    MixMatch: A Holistic Approach to Semi-Supervised Learning , author=

    work page

  80. [80]

    Kullback and R

    S. Kullback and R. A. Leibler , journal =. On Information and Sufficiency , urldate =

    work page

Showing first 80 references.

This paper was first reviewed by grok-4.5 on July 11, 2026.