Pith. sign in

REVIEW 5 major objections 6 minor 69 references

An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a backdoor attack becomes both far more effective and far harder to detect when the trigger is placed on the pixels a separate attention network considers most important, when the trigger is constrained to look…

desk verdict A capable extension of the authors' NDSS attack to ViTs, with plausible numbers but no code, no error bars, and an ablation that conflates attention with mask geometry. read the letter →

arxiv 2412.06149 v1 pith:2RETU36B submitted 2024-12-09 cs.CV cs.CR

Xueluan Gong , Bowei Tian , Meng Xue , Yuan Wu , Yanjiao Chen , Qian Wang This is my paper · ORCID
classification cs.CVcs.CR
keywords backdoorattacksattention-basedtriggermaskQoE-awaregenerationalternatingretrainingco-optimizationvisiontransformersdefenseevasiondatapoisoning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that backdoor attacks can be made both more effective and more evasive by using an attention map to choose the trigger shape and location, by making the trigger visually natural through a Quality-of-Experience (QoE) constraint, and by co-optimizing the trigger and the backdoored model with alternating retraining. It reports attack success rates near 90 to 100 percent at poison ratios as low as 0.1 to 1 percent on several datasets, while keeping clean-data accuracy close to benign levels and evading a range of state-of-the-art defenses. The same framework, adjusted for transformer structure by placing key neurons in the head layer, is also claimed to work against vision transformers. A sympathetic reader would care because this suggests that the common practice of fixing a trigger location and separating trigger generation from model training leaves a wide margin for stronger and less visible attacks.

What carries the argument

The central object is the attention-based trigger mask: a residual attention network produces a per-pixel attention map for an image of the target class, the map is upscaled by bilinear interpolation, and the $l^2$ pixels with the highest attention values become the mask. Around this sit four interacting components: a QoE-aware trigger loss that adds SSIM plus a tuned opacity so the trigger is natural; neuron selection with gradient boosting, where a neuron most activated by target-label samples is given extra gradient weight; a co-optimization loop that alternately updates the trigger and retrains the model; and an alternating retraining schedule that uses mixed poisoned and clean datasets on even iterations and only benign samples on odd iterations. For vision transformers, the neuron is placed in the head layer rather than the first fully connected layer, because the head is the layer where every input connects to every output.

What would settle it

Train the same attack with a mask of the same size, opacity, and poison ratio but with the $l^2$ pixels chosen uniformly at random instead of from the RAN attention map. If the random-mask attack reaches the same attack success rate on CIFAR-10 at 1 percent poison (close to the reported 44.69 percent), the attention-based mask is not carrying the gain; if it stays near the baselines' low rates, the attention map is the load-bearing component.

Watch

Extended reading notes

Core claim

The paper's central claim is that the pixels chosen for a backdoor trigger should be the ones the model attends to, not a fixed square or a random patch. It uses a 92-layer residual attention network (RAN) to obtain an attention map for a sample of the target class, upscales the map to the input size, and selects the top $l^2$ pixels as the trigger mask. Around this mask, the attack adds a QoE term to the loss (structural similarity plus a tuned opacity), selects a neuron strongly activated by target-label samples and boosts its gradient during trigger optimization, and then alternates between optimizing the trigger and retraining the model, with odd iterations using only benign samples. The paper reports that this attention-based, co-optimized scheme reaches attack success rates such as 96.53 percent on CIFAR-100 at a 0.1 percent poison ratio (versus 17.01 percent for the best baseline), about 90.88 percent on GTSRB at 0.3 percent poison, and 44.69 percent on CIFAR-10 at 1 percent poison, while maintaining clean-data accuracy and surviving model pruning, STRIP, NAD, MNTD, Neural Cleanse, ABS, and DBAVT in the reported tests.

Load-bearing premise

The attack assumes that the pixels highlighted by a separately pretrained residual attention network's upscaled attention map are the pixels whose perturbation most strongly changes the victim model's classifications; if that attention does not transfer, the mask degenerates into a random pixel selection.

Editorial extensions

If this is right

  • If the central claim is correct, small triggers (down to 2x2 pixels) placed at attention hotspots can reach near-perfect attack success at poison ratios where fixed or random triggers fail almost completely.
  • Co-optimizing the trigger and the model, with alternating retraining, is claimed to preserve clean-data accuracy while narrowing the behavioral gap between backdoored and benign models, which is the stated reason the attack evades MNTD and NAD.
  • The same framework transfers to vision transformers when the key neuron is selected from the head layer, achieving high attack success and very low LPIPS values, meaning the backdoored images look natural.
  • Under the reported settings, the backdoored models survive model pruning, STRIP, Neural Cleanse, ABS, MNTD, NAD, and the DBAVT defense, suggesting the attack's evasiveness is not limited to one detection strategy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because the attention map is taken from a separate residual attention network rather than from the victim model, a direct ablation replacing RAN attention with the victim model's own gradient-based saliency would show whether the reported gain comes from cross-model attention transfer or from the co-optimization loop alone.
  • Editorial inference: the paper sets opacity and gradient-boost factors separately for each dataset, which implies a tunable stealth-versus-effectiveness frontier; mapping that frontier explicitly would show a defender which settings are still detectable by human or automated inspection.
  • Editorial inference: the alternating retraining schedule that makes a backdoored model behave like a benign one could be repurposed as a defense, by fine-tuning a suspect model on clean data in the same alternating pattern and measuring how much the attack success rate drops.
  • Editorial inference: the reported advantage at very low poison ratios suggests that defense evaluations should report performance across a sweep of poison ratios, since a defense that works at 5 percent poison may fail at 0.1 percent.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes a backdoor attack framework that combines four components: attention-based trigger mask selection (top l^2 pixels of a RAN attention map), QoE-aware trigger optimization (SSIM term and opacity adjustment), co-optimization of trigger and model, and alternating retraining with benign/poisoned batches. The authors evaluate the approach on five datasets with both CNNs and ViTs, reporting ASR close to 90-100% at poison ratios as low as 0.1%, CDA close to benign levels, and robustness to defenses including STRIP, NAD, MNTD, Neural Cleanse, ABS, pruning, and DBAVT. The main claim is that the attention-based mask and co-optimization yield substantially higher attack success rates than prior attacks, especially at low poison ratios.

Significance. If the reported results are reproducible, the attack would be a strong contribution: it achieves high ASR at poison ratios as low as 0.1% (e.g., 96.53% on CIFAR-100), maintains high CDA, and shows resistance to a broad set of defenses. The paper's strengths include a wide evaluation across five datasets, two architectures, many baselines, and multiple defense evaluations, plus an ablation study that isolates the contributions of attention, iterative co-optimization, and alternating retraining. However, the central claim about the attention mechanism is weakened by a confounded ablation (no random-scatter control), and the lack of error bars and hyperparameter-tuning details leaves uncertainty about the robustness of the reported margins. The defense evasion claims also lack quantitative support for MNTD and ABS.

major comments (5)
  1. [§6.3, Table 4] The ablation compares 'Base' (a contiguous square trigger fixed at the bottom-right corner) with 'Base+Attn' (l^2 scattered pixels selected by the RAN attention map), so geometry and location vary simultaneously with the attention criterion. For example, CIFAR-10 2×2 ASR increases from 58.26% to 95.60%, but without a control that uses l^2 randomly scattered pixels in the same co-optimization pipeline, the gain cannot be attributed to the attention mechanism rather than to abandoning the contiguous corner square. Please add a random-scatter baseline (e.g., l^2 random pixels drawn from the same or similar image region) and compare the ASR distribution over multiple random masks. This is necessary to support the headline claim that attention maps find the optimal trigger shape and location.
  2. [§4.3, Eq. (7) and §5.1] The paper sets the gradient augmentation factor θ, the QoE weight η, and the trigger transparency per dataset 'according to the experimental effect' (θ) and 'through experiments' (transparency), and reports final numbers on the same datasets. Because these hyperparameters are tuned on the test sets whose metrics are reported, the comparison to baselines may be optimistic. Please specify the selection protocol (e.g., a validation split held out from the reported results) or provide a sensitivity analysis showing that the conclusions are stable across a range of θ, η, and transparency values.
  3. [Tables 1–10] All reported numbers are single runs with no error bars or seed information. Given the margins claimed at low poison ratios (e.g., CIFAR-100 0.1% ASR 96.53% vs. RobNet 17.01% in Table 2), it is important to know whether these differences are consistent across random seeds and dataset subsamples. Please report mean and standard deviation over at least three (preferably five) independent runs for the main attack results and the key ablations (Tables 1, 2, 3, 4, 5).
  4. [§6.2, Table 3] For CIFAR-100, the proposed method's CDA is 82.26%, which is substantially lower than DBIA (91.33%) and DBAVT (98.23%). The text states that the proposed method 'consistently outperforms the baselines' across all six datasets. This claim is inaccurate with respect to clean-data accuracy for CIFAR-100; please either correct the claim or provide a trade-off analysis (e.g., the cost of the higher ASR and better LPIPS on CIFAR-100).
  5. [§7.1.4 and §7.1.6] The MNTD evasion claim is stated without quantitative support: the paper says the backdoored models 'can all evade the inspection of MNTD' but provides no detection rates, no table, and no comparison to baselines under the same meta-classifier. Similarly, the ABS results report post-defense ASR values but not the detection rates or the proportion of models flagged as backdoored. These are central to the 'resilient' claim in the title and abstract; please provide the missing quantitative evidence.
minor comments (6)
  1. [§5.1] The citation for VGG-Flower appears as '[?]'; please replace it with the proper reference.
  2. [Table 3] The dataset name 'CIAFR-100' should be 'CIFAR-100'.
  3. [§4.3, Eq. (7)] The constraint '∇e := θ∇e' is circular; using the same symbol ∇e on both sides makes the definition ambiguous. Please denote the augmented gradient as, e.g., ∇ẽ = θ∇e.
  4. [§4.3, Eq. (6)] The number N of clean target-class samples used to compute the average attention map is not specified; please state it.
  5. [Table 10] The header 'Original' is unclear; it appears to list the no-defense ASR/CDA for the proposed method only, while the remaining columns are post-DBAVT values for each attack. Please clarify the table structure in the caption.
  6. [Introduction and Related Work] The claim of being 'the first to utilize attention mechanisms to design backdoor trigger masks' is difficult to reconcile with the cited TrojViT [66] and BadViT [64], which also use attention-based triggers for ViTs. Please qualify the novelty claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No definitional circularity: attention masks are external, ASR is measured against held-out data, and per-dataset tuning is overfitting rather than circularity.

full rationale

The derivation chain is not circular. The attention mask comes from a fixed, externally pretrained 92-layer RAN (Section 4.2, Eqs. 5-6, Algorithm 1 lines 2-3); the top-l^2 pixels are selected without using the victim model's parameters or the final attack success rate, so the central 'Base+Attn' gain is not definitional. The ablation's comparison between a contiguous bottom-right square and scattered attention pixels is a confound, not a circular reduction, because no random-scatter control isolates the attention mechanism. The ASR/CDA numbers in Tables 1-3 are measured on held-out test images after optimizing the separate objective in Eqs. 3, 4, 7, and 9, so the reported success rate is not identical to the fitted loss. The SSIM term is included in the trigger-generation loss, so high SSIM is partly by construction; however, LPIPS and the defense evaluations are external and not directly optimized. The admitted per-dataset tuning of the gradient augmentation factor ('Note that we set the values of different augmentation factors according to the experimental effect') and the opacity ('Through experiments, we set the transparency value...') can inflate the reported numbers and is a statistical-validity concern, but it does not make any tabulated quantity equal to an input by definition. Self-citations [15] and [17] are present, but [15] is the acknowledged prior version and [17] is a neuron-selection heuristic; neither is invoked as an external uniqueness theorem, and the headline comparison is against external baselines (BadNets, TrojanNN, HB, RobNet, DBIA, DBAVT, BAVT, TrojViT) and external defenses. Section 5.1 also contains a missing citation marker 'VGG-Flower [?]', an editorial flaw rather than a circular step. No circular step meets the evidentiary bar.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The framework is an engineering construction rather than a derivation. Its reported performance depends on a pretrained external attention model (RAN) whose training data is unspecified, on several hyperparameters tuned on the evaluation datasets (theta per dataset, eta, opacity, with lambda and omega unreported), and on the standard outsourcing threat model. No new particles, forces, or conceptual entities are postulated; the trigger, mask, and neuron-selection heuristic are artifacts of the method rather than independent entities.

free parameters (4)
  • neuron gradient augmentation factor theta = 4 (CIFAR-100), 3 (CIFAR-10), 21 (GTSRB), 30 (VGG-Flower-l), 2 (ImageNette), 30 (VGG-Flower-h)
    Set per dataset 'according to the experimental effect' (Section 4.3, Eq. 7), i.e., tuned on the evaluation data; different values change the gradient priority during trigger optimization and therefore the reported ASR.
  • QoE weight eta = 0.1
    Set empirically after 'extensive experiments' (Section 4.3, Eq. 9); it balances attack success against the SSIM penalty and is not justified by a sensitivity analysis.
  • trigger transparency (opacity) = 0.4 or 0.7 by dataset
    Chosen by hand as a trade-off between stealth and effectiveness (Sections 4.3 and 5.1); values differ across datasets and directly affect both invisibility and ASR.
  • loss balancing weights lambda and omega = not reported
    Appear in Eq. 3 and Algorithm 1 to balance clean accuracy, attack success, and trigger visibility, but concrete values are never given, so the reported results depend on unspecified settings.
assumptions (5)
  • domain assumption The attacker controls model training and knows architecture, parameters, and training data, but not the client's validation set (Section 3 threat model).
    Standard outsourcing threat model adopted from prior work [20], [33], [48]; the entire attack method depends on it and it is not independently validated.
  • domain assumption RAN attention values, upscaled by bilinear interpolation, rank pixel importance for the victim classifier (Section 4.2).
    Unproven transfer assumption from an external pretrained RAN to the victim network; it carries the 'Base+Attn' ablation gains.
  • domain assumption The neuron with the highest activation over target-class clean samples is a reliable channel between trigger and target label (Section 4.3).
    Borrowed from the authors' RobNet [17]; for ViTs extended to the head layer with the same activation-count heuristic.
  • domain assumption SSIM is a valid differentiable proxy whose minimization yields triggers that evade human inspection and defenses (Section 4.3, Eq. 7-9).
    No perceptual user study is reported; evasiveness is only assessed via SSIM/LPIPS numbers and figures.
  • standard math Optimizers (Adam, SGD) converge in the alternating co-optimization loop (Eq. 4, Algorithm 1).
    Standard optimization background; convergence of the alternating scheme is not proven but is routine in this literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers." pith.science (2026). https://pith.science/paper/2RETU36B

@misc{pith2026241206149,
  author       = {Pith},
  title        = {Pith review of: An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2RETU36B}},
  note         = {Machine review of arXiv:2412.06149}
}
read the original abstract

Recent studies have revealed the vulnerability of Deep Neural Network (DNN) models to backdoor attacks. However, existing backdoor attacks arbitrarily set the trigger mask or use a randomly selected trigger, which restricts the effectiveness and robustness of the generated backdoor triggers. In this paper, we propose a novel attention-based mask generation methodology that searches for the optimal trigger shape and location. We also introduce a Quality-of-Experience (QoE) term into the loss function and carefully adjust the transparency value of the trigger in order to make the backdoored samples to be more natural. To further improve the prediction accuracy of the victim model, we propose an alternating retraining algorithm in the backdoor injection process. The victim model is retrained with mixed poisoned datasets in even iterations and with only benign samples in odd iterations. Besides, we launch the backdoor attack under a co-optimized attack framework that alternately optimizes the backdoor trigger and backdoored model to further improve the attack performance. Apart from DNN models, we also extend our proposed attack method against vision transformers. We evaluate our proposed method with extensive experiments on VGG-Flower, CIFAR-10, GTSRB, CIFAR-100, and ImageNette datasets. It is shown that we can increase the attack success rate by as much as 82\% over baselines when the poison ratio is low and achieve a high QoE of the backdoored samples. Our proposed backdoor attack framework also showcases robustness against state-of-the-art backdoor defenses.

Figures

Figures reproduced from arXiv: 2412.06149 by the authors.

Figure 1
Figure 1. Comparison of backdoored samples between our method and the baselines against CNNs. [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. Comparison of backdoored samples between our method and the baselines against ViTs. datasets, respectively. We employ the ViT model [12] to train ViT models for the six datasets. The default target label is label 0 for VGG-Flower-l, label 3 for VGG-Flower-h, label 2 for CIFAR-10, label 10 for GTSRB, label 0 for CIFAR-100, and label 3 for ImageNette. The default poison ratio is 20% for VGG-Flower-l, 15% for VGG-Flowe… view at source ↗
Figure 4
Figure 4. The distribution of the entropy prediction results of clean samples and backdoored samples after applying STRIP to our proposed attack. image. The SSIM value falls within the range of [0, 1], where a higher SSIM indicates a greater similarity between the original and backdoored images. LPIPS [65] is a metric that quantifies the similarity be￾tween two images by leveraging the hierarchical processing of the human vis… view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: The comparison between the actual triggers and the triggers recovered by NC for various attacks. In each pair, the left image depicts the real trigger, while the right image shows the recovered trigger. the two images. 6 EVALUATION RESULTS 6.1 Comparison with Baselines…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 52 canonical work pages

  1. [1]

    Quantifying attention flow in transformers, 2020

    Samira Abnar and Willem Zuidema. Quantifying attention flow in transformers, 2020

    work page 2020

  2. [2]

    Backpropagation and stochastic gradient descent method

    Shun-ichi Amari. Backpropagation and stochastic gradient descent method. Neurocomputing, 5(4-5):185–196, 1993

    1993

  3. [3]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics , pages 2938–2948. PMLR, 2020

    work page 2020

  4. [4]

    Transformer interpretability beyond attention visualization

    Hila Chefer, Shir Gur, and Lior Wolf. Transformer interpretability beyond attention visualization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 782–791, June 2021

    work page 2021

  5. [5]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018

    arXiv 2018

  6. [6]

    DeepInspect: A black-box trojan detection and mitigation frame- work for deep neural networks

    Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. DeepInspect: A black-box trojan detection and mitigation frame- work for deep neural networks. In International Joint Conference on Artificial Intelligence, pages 4658–4664. ijcai.org, 2019

    work page 2019

  7. [7]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    arXiv 2017

  8. [8]

    Backdoor attacks and defenses for deep neural networks in outsourced cloud environments

    Yanjiao Chen, Xueluan Gong, Qian Wang, Xing Di, and Huayang Huang. Backdoor attacks and defenses for deep neural networks in outsourced cloud environments. IEEE Network, 34(5):141–147, 2020

    work page 2020

Show all 69 references
  1. [9]

    From QoS to QoE: A tutorial on video quality assessment

    Yanjiao Chen, Kaishun Wu, and Qian Zhang. From QoS to QoE: A tutorial on video quality assessment. IEEE Communications Surveys & Tutorials, 17(2):1126–1165, 2014

    2014

  2. [10]

    Sentinet: Detecting physical attacks against deep learning systems

    Edward Chou, Florian Tram `er, Giancarlo Pellegrino, and Dan Boneh. Sentinet: Detecting physical attacks against deep learning systems. arXiv preprint arXiv:1812.00292, 2018

    2018 arXiv

  3. [11]

    Defending backdoor attacks on vision transformer via patch processing

    Khoa D Doan, Yingjie Lao, Peng Yang, and Ping Li. Defending backdoor attacks on vision transformer via patch processing. In AAI Conference on Artificial Intelligence, volume 37, pages 506–515, 2023

    2023

  4. [12]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weis- senborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International C...

    2021

  5. [13]

    Imagenette: A smaller subset of 10 easily classified classes from imagenet

    fast.ai. Imagenette: A smaller subset of 10 easily classified classes from imagenet. Available: https://github.com/fastai/imagenette

  6. [14]

    STRIP: A defence against trojan attacks on deep neural networks

    Yansong Gao, Chang Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. STRIP: A defence against trojan attacks on deep neural networks. In IEEE Annual Computer Security Applications Conference, pages 113–125, 2019

    2019

  7. [15]

    Atteq-nn: Attention-based qoe-aware evasive backdoor attacks

    Xueluan Gong, Yanjiao Chen, Jianshuo Dong, and Qian Wang. Atteq-nn: Attention-based qoe-aware evasive backdoor attacks. Network and Distributed System Security Symposium , 2022

    2022

  8. [16]

    Coordinated backdoor attacks against federated learning with model-dependent triggers

    Xueluan Gong, Yanjiao Chen, Huayang Huang, Yuqing Liao, Shuai Wang, and Qian Wang. Coordinated backdoor attacks against federated learning with model-dependent triggers. IEEE network, 36(1):84–90, 2022

    2022

  9. [17]

    Defense-resistant backdoor attacks against deep neural networks in outsourced cloud 15 environment

    Xueluan Gong, Yanjiao Chen, Qian Wang, Huayang Huang, Lingshuo Meng, Chao Shen, and Qian Zhang. Defense-resistant backdoor attacks against deep neural networks in outsourced cloud 15 environment. IEEE Journal on Selected Areas in Communications , 39(8):2617–2631, 2021

    2021

  10. [18]

    Backdoor attacks and defenses in federated learning: State-of-the- art, taxonomy, and future directions

    Xueluan Gong, Yanjiao Chen, Qian Wang, and Weihan Kong. Backdoor attacks and defenses in federated learning: State-of-the- art, taxonomy, and future directions. IEEE Wireless Communications, 2022

    2022

  11. [19]

    Redeem myself: Purifying backdoors in deep learning models using self attention distillation

    Xueluan Gong, Yanjiao Chen, Wang Yang, Qian Wang, Yuzhe Gu, Huayang Huang, and Chao Shen. Redeem myself: Purifying backdoors in deep learning models using self attention distillation. In IEEE Symposium on Security and Privacy , pages 755–772. IEEE, 2023

    2023

  12. [20]

    BadNets: Evaluating backdooring attacks on deep neural networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. BadNets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230–47244, 2019

    2019

  13. [21]

    Attributes-guided and pure-visual attention alignment for few- shot recognition

    Siteng Huang, Min Zhang, Yachen Kang, and Donglin Wang. Attributes-guided and pure-visual attention alignment for few- shot recognition. In AAAI Conference on Artificial Intelligence, pages 7840–7847. AAAI Press, 2021

    2021

  14. [22]

    Neu- ronInspect: Detecting backdoors in neural networks via output explanations

    Xijie Huang, Moustafa Alzantot, and Mani Srivastava. Neu- ronInspect: Detecting backdoors in neural networks via output explanations. arXiv preprint arXiv:1911.07399, 2019

    1911 arXiv

  15. [23]

    Model-reuse attacks on deep learning systems

    Yujie Ji, Xinyang Zhang, Shouling Ji, Xiapu Luo, and Ting Wang. Model-reuse attacks on deep learning systems. In SIGSAC Confer- ence on Computer and Communications Security, pages 349–363. ACM, 2018

    2018

  16. [24]

    Backdoor attacks against learning systems

    Yujie Ji, Xinyang Zhang, and Ting Wang. Backdoor attacks against learning systems. In Conference on Communications and Network Security, pages 1–9. IEEE, 2017

    2017

  17. [25]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In International Conference on Learning Representations, 2015

    2015

  18. [26]

    Bilinear interpolation

    Earl J Kirkland. Bilinear interpolation. In Advanced Computing in Electron Microscopy, pages 261–263. Springer, 2010

    2010

  19. [27]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. 2009

    2009

  20. [28]

    Invisible backdoor attacks on deep neural networks via steganography and regularization

    Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor attacks on deep neural networks via steganography and regularization. arXiv preprint arXiv:1909.02742, 2019

    1909 arXiv

  21. [29]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks

    Yige Li, Nodens Koren, Lingjuan Lyu, Xixiang Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International Conference on Learning Representations. OpenReview.net, 2021

    2021

  22. [30]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. arXiv preprint arXiv:2101.05930, 2021

    2021 arXiv

  23. [31]

    Rethinking the trigger of backdoor attack

    Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692, 2020

    2004 arXiv

  24. [32]

    Backdoor embedding in convolutional neu- ral network models via invisible perturbation

    Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding in convolutional neu- ral network models via invisible perturbation. arXiv preprint arXiv:1808.10307, 2018

    2018 arXiv

  25. [33]

    Composite backdoor attack for deep neural network by mixing existing benign features

    Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang. Composite backdoor attack for deep neural network by mixing existing benign features. In ACM SIGSAC Conference on Computer and Communications Security, pages 113–131, 2020

    2020

  26. [34]

    Backdoor attacks and defenses in feature-partitioned collaborative learning

    Yang Liu, Zhihao Yi, and Tianjian Chen. Backdoor attacks and defenses in feature-partitioned collaborative learning. arXiv preprint arXiv:2007.03608, 2020

    2007 arXiv

  27. [35]

    ABS: Scanning neural networks for backdoors by artificial brain stimulation

    Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. ABS: Scanning neural networks for backdoors by artificial brain stimulation. In ACM SIGSAC Conference on Computer and Communications Security , pages 1265– 1282, 2019

    2019

  28. [36]

    Trojaning attack on neural networks

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In Annual Network and Distributed System Security Symposium. The Internet Society, 2018

    2018

  29. [37]

    Dbia: Data-free backdoor injection attack against transformer networks

    Peizhuo Lv, Hualong Ma, Jiachen Zhou, Ruigang Liang, Kai Chen, Shengzhi Zhang, and Yunfei Yang. Dbia: Data-free backdoor injection attack against transformer networks. arXiv preprint arXiv:2111.11870, 2021

    2021 arXiv

  30. [38]

    NIC: Detecting adversarial samples with neural network invariant checking

    Shiqing Ma, Yingqi Liu, Guanhong Tao, Wen-Chuan Lee, and Xiangyu Zhang. NIC: Detecting adversarial samples with neural network invariant checking. In Annual Network and Distributed System Security Symposium. The Internet Society, 2019

    2019

  31. [39]

    Distributed representations of words and phrases and their compositionality

    Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg Corrado, and Jeffrey Dean. Distributed representations of words and phrases and their compositionality. In Annual Conference on Neural Information Processing Systems, pages 3111–3119, 2013

    2013

  32. [40]

    Visual slam for automated driving: Exploring the applications of deep learning

    Stefan Milz, Georg Arbeiter, Christian Witt, Bassam Abdallah, and Senthil Yogamani. Visual slam for automated driving: Exploring the applications of deep learning. In IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 247–257, 2018

    2018

  33. [41]

    Recurrent models of visual attention

    Volodymyr Mnih, Nicolas Heess, Alex Graves, and Koray Kavukcuoglu. Recurrent models of visual attention. arXiv preprint arXiv:1406.6247, 2014

    2014 arXiv

  34. [42]

    Machine learning with membership privacy using adversarial regularization

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Machine learning with membership privacy using adversarial regularization. In ACM SIGSAC Conference on Computer and Communications Security , page 634–646, 2018

    2018

  35. [43]

    Input-aware dynamic backdoor attack

    Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. In Annual Conference on Neural Information Processing Systems , 2020

    2020

  36. [44]

    Wanet–imperceptible warping-based backdoor attack

    Anh Nguyen and Anh Tran. Wanet–imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369, 2021

    2021 arXiv

  37. [45]

    A tale of evil twins: Adversarial inputs versus poisoned models

    Ren Pang, Hua Shen, Xinyang Zhang, Shouling Ji, Yevgeniy Vorobeychik, Xiapu Luo, Alex Liu, and Ting Wang. A tale of evil twins: Adversarial inputs versus poisoned models. In ACM SIGSAC Conference on Computer and Communications Security , pages 85–99, 2020

    2020

  38. [46]

    You only look once: Unified, real-time object detection

    Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object detection. In IEEE conference on computer vision and pattern recognition , pages 779–788, 2016

    2016

  39. [47]

    Hidden trigger backdoor attacks

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsi- avash. Hidden trigger backdoor attacks. In AAAI Conference on Artificial Intelligence, pages 11957–11965. AAAI Press, 2020

    2020

  40. [48]

    Dynamic backdoor attacks against machine learning models

    Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. Dynamic backdoor attacks against machine learning models. In IEEE 7th European Symposium on Security and Privacy , pages 703–718, 2022

    2022

  41. [49]

    Facenet: A unified embedding for face recognition and clustering

    Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In IEEE Conference on Computer Vision and Pattern Recognition, pages 815–823, 2015

    2015

  42. [50]

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. Computer: Benchmarking machine learning algo- rithms for traffic sign recognition. Neural Networks , 32:323–332, 2012

    2012

  43. [51]

    Backdoor attacks on vision transformers

    Akshayvarun Subramanya, Aniruddha Saha, Soroush Abbasi Koohpayegani, Ajinkya Tejankar, and Hamed Pirsiavash. Backdoor attacks on vision transformers. arXiv preprint arXiv:2206.08477 , 2022

    2022 arXiv

  44. [52]

    Spectral signatures in backdoor attacks

    Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. In Advances in Neural Information Processing Systems, pages 8000–8010, 2018

    2018

  45. [53]

    Model agnostic defence against backdoor attacks in machine learning

    Sakshi Udeshi, Shanshan Peng, Gerald Woo, Lionell Loh, Louth Rawshan, and Sudipta Chattopadhyay. Model agnostic defence against backdoor attacks in machine learning. arXiv preprint arXiv:1908.02203, 2019

    1908 arXiv

  46. [54]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017

    2017

  47. [55]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy , pages 707–723, 2019

    2019

  48. [56]

    Residual attention network for image classification

    Fei Wang, Mengqing Jiang, Chen Qian, Shuo Yang, Cheng Li, Honggang Zhang, Xiaogang Wang, and Xiaoou Tang. Residual attention network for image classification. In IEEE Conference on Computer Vision and Pattern Recognition, pages 3156–3164, 2017

    2017

  49. [57]

    Papailiopoulos

    Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vish- wakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris S. Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. In Annual Conference on Neural Information Processing Systems, 2020

    2020

  50. [58]

    Backdoor attacks against transfer learning with pre-trained deep learning models

    Shuo Wang, Surya Nepal, Carsten Rudolph, Marthie Grobler, Shangyu Chen, and Tianle Chen. Backdoor attacks against transfer learning with pre-trained deep learning models. IEEE Transactions on Services Computing, 2020

    2020

  51. [59]

    Image quality assessment: From error visibility to structural 16 similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: From error visibility to structural 16 similarity. IEEE Transactions on Image Processing , 13(4):600–612, 2004

    2004

  52. [60]

    DBA: Distributed backdoor attacks against federated learning

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. DBA: Distributed backdoor attacks against federated learning. In International Conference on Learning Representations, 2019

    2019

  53. [61]

    Detecting ai trojans using meta neural analysis

    Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A Gunter, and Bo Li. Detecting ai trojans using meta neural analysis. In IEEE Symposium on Security and Privacy, 2021

    2021

  54. [62]

    Countermeasure against backdoor attacks using epistemic classifiers

    Zhaoyuan Yang, Nurali Virani, and Naresh S Iyer. Countermeasure against backdoor attacks using epistemic classifiers. In Artificial Intelligence and Machine Learning for Multi-domain Operations Appli- cations II, volume 11413, page 114130P . International Society for Optics an...

    2020

  55. [63]

    Latent backdoor attacks on deep neural networks

    Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks on deep neural networks. In ACM SIGSAC Conference on Computer and Communications Security , pages 2041– 2055, 2019

    2019

  56. [64]

    Zenghui Yuan, Pan Zhou, Kai Zou, and Yu Cheng. You are catching my attention: Are vision transformers bad learners under backdoor attacks? In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24605–24615, 2023

    2023

  57. [65]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In IEEE Conference on Computer Vision and Pattern Recognition, pages 586–595, 2018

    2018

  58. [66]

    Trojvit: Trojan insertion in vision transformers

    Mengxin Zheng, Qian Lou, and Lei Jiang. Trojvit: Trojan insertion in vision transformers. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4025–4034, 2023

    2023

  59. [67]

    Parallelized stochastic gradient descent

    Martin Zinkevich, Markus Weimer, Alexander J Smola, and Lihong Li. Parallelized stochastic gradient descent. In Annual Conference on Neural Information Processing Systems, pages 2595–2603, 2010. Xueluan Gong received her B.S. degree in Computer Science and Electronic Engineeri...

    2010

  60. [2018]

    Top Minds

    He has long been engaged in the research of cyberspace security, with focus on AI security, data outsourcing security and privacy, wireless systems security, and applied cryptography. He was a recipient of the 2018 IEEE TCSC Award for Excellence in Scalable Computing (early ca...

    2018

  61. [2022]

    His research interests include the Internet of Things, smart sensing, and AI security

    He is currently a Postdoc in the Department of Computer Science and Engineering at Hong Kong University of Science and Technology. His research interests include the Internet of Things, smart sensing, and AI security. Yuan Wureceived his Ph.D. degree in the School of Computer ...

    2010

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.