Pith. sign in

REVIEW 5 major objections 5 minor 85 references

LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithm

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LADDER formulates black-box backdoor trigger design as a multi-objective evolutionary optimization, claiming over 99% attack success with dual-domain stealth and preprocessing robustness.

desk verdict A genuinely new multi-objective evolutionary backdoor attack with credible core results, but the headline numbers are overstated and the black-box transferability premise is thinner than the abstract claims. read the letter →

arxiv 2411.19075 v1 pith:IB4NJXMH submitted 2024-11-28 cs.CR cs.AIcs.LGcs.NE

Dazhuang Liu , Yanqi Qiao , Rui Wang , Kaitai Liang , Georgios Smaragdakis This is my paper · ORCID
classification cs.CRcs.AIcs.LGcs.NE
keywords backdoorattackmulti-objectiveoptimizationevolutionaryalgorithmfrequency-domaintriggerdatapoisoningstealthinessrobustnessblack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes LADDER, a black-box backdoor attack that treats trigger design as a multi-objective optimization problem rather than a weighted single-objective one. The attacker searches for a trigger in the low-frequency part of the DCT spectrum, evaluated on a surrogate model, with three objectives: attack effectiveness, perturbation stealthiness in both spatial and spectral domains, and robustness to image preprocessing. The search is performed by a multi-objective evolutionary algorithm with preference-based selection, so no gradient information from the victim model is needed and no Lagrange coefficients must be tuned. If the claims hold, a data-poisoning attacker can plant backdoors that achieve over 99% attack success, retain about 90% success after preprocessing, and leave almost no trace in either pixel or frequency inspection.

What carries the argument

The load-bearing machinery is the frequency-domain trigger representation together with a preference-based multi-objective evolutionary optimizer. A trigger is a pair $t=(\delta,\nu)$ of magnitude perturbations and frequency-band indices, constrained to a low-frequency domain $F_{\mathrm{dom}}$ with per-band bound $\epsilon$. The optimizer maintains a population of such triggers, generates offspring with simulated binary crossover and polynomial mutation, evaluates all three objectives on a surrogate model, and applies a modified non-dominated sort called rNDSort that first keeps Pareto-front triggers and then fills the rest of the population by Euclidean distance to an attacker-specified preference region $O_{\mathrm{pref}}$. This keeps the search gradient-free and coefficient-free while steering the population away from impractical triggers.

What would settle it

Train a victim model on a poisoned dataset generated from a trigger optimized on a heterogeneous surrogate, using a dataset or optimizer outside the paper's five datasets, and measure ASR; if ASR falls materially below the claimed 99% while a fixed-pattern baseline holds, the transferability premise fails. A second check: apply JPEG quality 50 to LADDER-poisoned images and compare ASR with the paper's reported value near 80%; a large drop would falsify the low-frequency robustness claim.

Watch

Extended reading notes

Core claim

The central claim is that the best backdoor trigger is not a single optimum but a Pareto trade-off among objectives, and that an evolutionary population search can find triggers in the attacker-desired region of that trade-off. Formally, LADDER solves for a perturbation vector $\delta$ and frequency-band locations $\nu$ minimizing the triple objective $O=(O_1,O_2,O_3)$: $O_1$ measures the loss of a surrogate model trained on poisoned data, $O_2$ is the $\ell^2$-norm of the trigger considered as dual-domain stealthiness, and $O_3$ penalizes distance of chosen bands from the zero-frequency band considered as robustness. The trigger is injected through DCT and IDCT via $x' = D^{-1}(D(x) \odot (\delta,\nu))$. The paper reports, across five datasets, ASR at least 99%, average preprocessing-robust ASR of 90.23%, natural stealthiness improvements between 1.12x and 196.74x, and an 8.45x spectral stealthiness enhancement. The authors further conclude that trigger effectiveness transfers across heterogeneous surrogate and victim model architectures, arguing that the poison ratio, perturbation norm, and feature-vector count are the determining factors.

Load-bearing premise

The attack assumes a trigger that performs well on a heterogeneous surrogate model will also perform well on an unseen victim model trained on the same poisoned dataset, because effectiveness is determined by feature-vector count, poison ratio, and perturbation norm rather than by architecture.

Editorial extensions

If this is right

  • If transferability across models holds, an attacker can poison a public dataset once and backdoor any user who trains on it, regardless of architecture choice.
  • Low-frequency placement makes the backdoor resistant to common preprocessing defenses such as JPEG compression and Gaussian or Wiener filtering, which preferentially destroy high frequencies.
  • Spectral stealthiness closes a gap left by spatial-only invisible triggers: frequency-domain anomaly detectors will not see a bright residual between clean and poisoned spectra.
  • Because the method is black-box and gradient-free, the same formulation can be applied to models where gradients are unavailable or proprietary, including prediction-only APIs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the preference region $O_{\mathrm{pref}}$ becomes a new hyperparameter that replaces Lagrange coefficients, so the attack's ease of use depends on how robustly the optimizer behaves when that region is misspecified.
  • Editorial inference: the transferability argument is validated only on CIFAR-10 across four model families; a test on larger-scale or out-of-distribution training would show whether the heuristic generalizes.
  • Editorial inference: since low-frequency perturbations survive compression, they may also survive learned denoising defenses, which suggests a direct experiment comparing LADDER against learned preprocessing filters.
  • Editorial inference: the spectral-slope detector the paper proposes as an adaptive defense could itself be tuned against LADDER, turning spectral stealthiness into an arms-race property rather than a fixed guarantee.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes LADDER, a black-box backdoor attack that formulates trigger design as a multi-objective optimization problem over attack effectiveness, spectral-domain stealthiness, and robustness to preprocessing, and solves it with a preference-based multi-objective evolutionary algorithm. The authors claim that the resulting triggers achieve ASR above 99%, an average preprocessing-robustness ASR of 90.23%, and improved natural and spectral stealthiness across five benchmark datasets, without requiring knowledge of the victim model. The manuscript includes extensive experiments, ablation studies, a transferability matrix over architectures, and a proof that the l2-norm of the trigger is preserved between the spatial and spectral domains under their DCT-based injection.

Significance. If the central claims hold, LADDER is a meaningful advance for black-box backdoor attacks: it provides a gradient-free, coefficient-free alternative to Lagrange-multiplier formulations, explicitly targets dual-domain stealthiness, and demonstrates strong empirical robustness to preprocessing. The paper also contributes a useful empirical study of objective conflicts and a defense evaluation against both classic and recent defenses. The release of code and the transferability matrix across heterogeneous architectures are clear strengths. However, the broad claim that the attack works without knowledge of the victim model rests on a relatively narrow transferability evaluation, and several headline quantitative claims in the abstract are not reproducible from the tables in the current version.

major comments (5)
  1. [§VIII-A, Table V] The central claim that LADDER works 'without requiring prior knowledge about victim model' depends on the surrogate model predicting attack success on an unseen victim. The only direct evidence is Table V, which is restricted to CIFAR-10 and to four architecture pairs trained with the same fixed recipe (SGD, 200 epochs, batch size 64, same augmentation). No experiment varies the victim's optimizer, learning-rate schedule, number of epochs, regularization, or augmentation, and no 64x64 dataset appears in the transferability study. The heuristic argument in §VIII-A (same number of feature vectors, same poison ratio, same perturbation norm) does not control for training dynamics, which are known to affect whether and how quickly a backdoor is learned. This is the load-bearing link in the black-box claim, and it needs either a broader empirical demonstration or a principled argument explaining why training dynamics are irrelevant.
  2. [Eq. (10b) and Algorithm 2] The optimization problem in Eq. (10b) defines O1 as the loss over Dc ∪ Dbd, which is meant to ensure both attack effectiveness and functionality preservation (clean accuracy). However, Algorithm 2 evaluates O1 only on Dbd: it trains the surrogate on Dbd (line 3) and then computes the loss on Dbd (line 4), with no evaluation on Dc. Thus the implementation optimizes only the poisoned-set loss, not the clean-set loss, despite the formulation and the text stating that O1 ensures 'a practical ACC and ASR.' The functionality-preservation objective should either be included in the actual evaluation loop or the formulation should be revised to match Algorithm 2.
  3. [Abstract and Table IV] The abstract's headline '50.09% higher' robustness margin does not match Table IV. Using the average row in Table IV, the mean ASR of the ten comparators (seven published attacks plus LADDER-Mid/High/Full) is about 43.75%, giving a margin of roughly 46.5 percentage points over LADDER-LOW's 90.23%; restricting to the seven published attacks gives a margin of about 35.4 points. I could not reproduce 50.09% from the reported numbers. The authors should either correct the stated margin or provide the exact set of comparators and averaging procedure used to obtain it.
  4. [Abstract and Table III] The claimed natural-stealthiness improvement range of '1.12x to 196.74x' is not supported by the data in Table III. For the l2-norm values reported there, the ratio of the best baseline to LADDER is at most about 11x (e.g., BadNets on GTSRB), and on SVHN LADDER's l2-norm (0.2781) is worse than WaNet's (0.1969). The value 196.74x does not correspond to any ratio I can derive from the table with the stated metric. The authors should specify exactly which metric and which baseline pairs produce the claimed range, or remove the unsupported range from the abstract.
  5. [Abstract and §VII-B] The abstract claims 'excellent spectral stealthiness (8.45x enhancement)', but I could not find a quantitative definition of the spectral-stealthiness metric or a table reporting such a metric. The spectral-domain evaluation in §VII-B is qualitative: it shows residual frequency maps in Figures 6 and 11. The paper should define the spectral anomaly metric, report its values for all attacks and datasets, and derive the 8.45x figure from those numbers; otherwise the dual-domain stealthiness claim is not quantitatively supported.
minor comments (5)
  1. [Table I] The symbols used in Table I ('!' and '%') are not defined in the table caption or in the surrounding text; a legend is needed.
  2. [Figure 4(b)] The caption says mutation samples from an exponential distribution, while §VI-B says polynomial mutation (PM) is used. These are inconsistent and should be reconciled.
  3. [§VI-A, Eq. (10g)] The preference region Opref is hand-set to (0.9, 0.4, 8 or 12). The paper presents this as avoiding coefficient tuning, but these are still hyperparameters with a direct effect on the selected trigger. A sensitivity analysis of Opref would strengthen the claim of being coefficient-free.
  4. [Figure 3 and Figure 5] The captions do not explain the axes, the meaning of the grey region, or how the 'practical trigger' region is defined; this makes the visualization difficult to interpret without referring back to the text.
  5. [Appendix F, Table XVII] The adaptive-defense slope s is reported for LADDER as -1.8238 versus -1.8922 for clean images, which is the second-closest value to clean among all attacks. The text says clean samples have the smallest s, which is true, but the closeness of LADDER to clean is not discussed; this could be seen as favorable evidence for the attack's spectral stealthiness and deserves explicit comment.

Circularity Check

1 steps flagged · score 3.0 of 10

Largely self-contained derivation; only partial circularity is that l2-norm stealthiness is both an optimized objective and the headline metric, while external metrics and transferability experiments provide independent grounding.

  1. self definitional [Section VI-A, Eqs. (8) and (10c); Abstract and Section VII-B (Tables III and Figure 6)]
    "Stealthinessf req:= ∥δ∥p. (8) ... O2(δ, ν) =∥δ∥p=2 , (10c) ... superior natural stealthiness (1.12 × to 196.74 × improvement) and excellent spectral stealthiness (8.45 × enhancement) as compared to current stealthy attacks by the average l2-norm across 5 public datasets."

    Eq. (10c) makes the l2 norm of the frequency perturbation one of the objectives that MOEA explicitly drives down, and Eq. (8) defines frequency stealthiness as exactly that same l2 norm. The abstract and Section VII-B then cite average-l2-norm reductions as evidence of superior stealthiness. Reductions in this metric are therefore partly guaranteed by the optimization objective itself rather than by an independent prediction. The circularity is only partial: PSNR, SSIM, LPIPS, and the spectral residual maps are external quantities not present in the objective, and they also favor LADDER, so the central stealthiness claim has independent support.

full rationale

The core claimed derivation—formulating the trigger search as the MOP in Eqs. (10a)–(10d) and solving it with MOEA—does not reduce to its inputs by construction. O1 is evaluated on a heterogeneous surrogate and the paper validates surrogate-to-victim transferability empirically in Table V across VGG16, ResNet18, GoogleNet, and ViT; that is a genuine out-of-sample check. O3 is a design heuristic, but the claimed robustness is measured as post-preprocessing ASR in Table IV, not as the proxy itself, so the robustness result is externally grounded. There are no load-bearing self-citations: the cited prior papers by co-authors ([70], [80]) are contextual or baseline comparisons, not uniqueness theorems or founding assumptions. The only notable self-referential element is the l2-norm stealthiness metric: Eq. (8) defines spectral stealthiness as ||δ||_2 and Eq. (10c) minimizes exactly that quantity, yet the abstract and Table III report average-l2-norm improvements as the headline stealthiness result. That portion is partly by construction. However, the paper also reports PSNR, SSIM, LPIPS, and visual spectral residual maps, which are not optimized objectives and which independently show improved stealthiness. On balance, the l2 evaluation is a mild self-referential metric rather than a forced prediction, and the rest of the derivation chain is self-contained, giving a score of 3 rather than a higher circularity score.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central claim relies on the surrogate transferability assumption (Axiom 3) and the low-frequency robustness assumption (Axiom 2). The preference region and trigger representation parameters (Opref, n, epsilon, Fdom) are hand-chosen and materially affect the reported trade-offs. No entirely new physical entities are introduced.

free parameters (8)
  • Opref_O1 = 0.9
    Target value for the attack-effectiveness objective in preference-based selection; hand-set in Section VII-A. With a different threshold, a different Pareto point is selected.
  • Opref_O2 = 0.4
    Target l2-norm for trigger stealthiness; hand-set. Since O2 is also reported as the stealthiness result, this parameter directly influences the headline stealthiness numbers.
  • Opref_O3 = 8 (32x32), 12 (64x64)
    Target distance from zero-frequency band; hand-set in Section VII-A.
  • number_of_frequency_bands = 3
    Selected via sensitivity analysis (Appendix J, Figure 16a) as a compromise between ASR and stealthiness; a free parameter of the trigger representation.
  • max_perturbation_epsilon = 0.5
    Bound on per-band perturbation magnitude; selected via sensitivity analysis (Figure 16b).
  • low_frequency_region_Fdom = top-left 18.3% of spectrum
    Follows Sharma et al. [60]; a design input that defines the robustness/stealthiness trade-off.
  • poison_ratio = 0.05
    Standard attack setting; chosen in Section VII-A.
  • target_label = 7
    Arbitrary choice; authors claim label independence in Figure 7.
assumptions (5)
  • standard math Type-II DCT is an orthogonal transform, so l2 norms are preserved between spatial and spectral domains (Lemma 1, Appendix L).
    Proven in Appendix L using orthogonality of the DCT matrix; standard linear algebra.
  • domain assumption Low-frequency components of natural images are resilient to common preprocessing (JPEG, Gaussian/Wiener filtering, brightness).
    Invoked in Section VI-A to justify the robustness objective O3; based on prior work [11,25,60] and the nature of lossy compression and low-pass filters.
  • domain assumption A trigger's objective values measured on a surrogate model approximate its objective values on the victim model.
    Empirically supported in Section VIII-A, Table V for CIFAR-10 only; no theoretical worst-case guarantee.
  • domain assumption Minimizing the loss on poisoned data (O1) is a valid proxy for maximizing attack success rate.
    Loss on the target label generally correlates with ASR, but the mapping is not exact; used in Algorithm 2.
  • ad hoc to paper The hand-set preference region Opref (0.9, 0.4, 8/12) defines 'practical' triggers.
    Fixed in Sections VI-A and VII-A; a different preference region would change which triggers are selected, so the reported stealthiness/robustness trade-off is partly a consequence of this choice.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithm." pith.science (2026). https://pith.science/paper/IB4NJXMH

@misc{pith2026241119075,
  author       = {Pith},
  title        = {Pith review of: LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithm},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IB4NJXMH}},
  note         = {Machine review of arXiv:2411.19075}
}
abstract

Current black-box backdoor attacks in convolutional neural networks formulate attack objective(s) as single-objective optimization problems in single domain. Designing triggers in single domain harms semantics and trigger robustness as well as introduces visual and spectral anomaly. This work proposes a multi-objective black-box backdoor attack in dual domains via evolutionary algorithm (LADDER), the first instance of achieving multiple attack objectives simultaneously by optimizing triggers without requiring prior knowledge about victim model. In particular, we formulate LADDER as a multi-objective optimization problem (MOP) and solve it via multi-objective evolutionary algorithm (MOEA). MOEA maintains a population of triggers with trade-offs among attack objectives and uses non-dominated sort to drive triggers toward optimal solutions. We further apply preference-based selection to MOEA to exclude impractical triggers. We state that LADDER investigates a new dual-domain perspective for trigger stealthiness by minimizing the anomaly between clean and poisoned samples in the spectral domain. Lastly, the robustness against preprocessing operations is achieved by pushing triggers to low-frequency regions. Extensive experiments comprehensively showcase that LADDER achieves attack effectiveness of at least 99%, attack robustness with 90.23% (50.09% higher than state-of-the-art attacks on average), superior natural stealthiness (1.12x to 196.74x improvement) and excellent spectral stealthiness (8.45x enhancement) as compared to current stealthy attacks by the average $l_2$-norm across 5 public datasets.

Figures

Figures reproduced from arXiv: 2411.19075 by the authors.

Figure 1
Figure 1. The workflow of LADDER. Step ①-③: trigger injec￾tion; Step ④-⑥: main loop for trigger optimization; Step ⑦-⑧: poison dataset with trigger and release it to public; Step ⑨: the backdoor is injected when users download the poisoned data to train/tune their own model. The trigger optimization, evaluation, and injection are controlled by an attacker, whereas the malicious training and inference stage (marked in grey) ar… view at source ↗
Figure 2
Figure 2. The impact of Lagrange coefficient α in backdoor attack formulated with Lagrange multipliers and solved by SGD concerning trigger perceptibility and attack failure rate. (a) (b) Trigger Preference l2-norm 1.0 -ASR Region of Practical Triggers l2-norm 1.0 -ASR Lagrange Multipliers+SGD LADDER [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Explanation of objective conflicting in backdoor attack, [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: The workflow of (a): Patching a trigger t=(δ, ν) into the spectrum of each channel of an RGB image. D denotes the DCT function in Equation (2). CR, CG and CB denotes the R, G and B channel. (b): Optimizing trigger via MOEA. Exp(·) denotes sampling from an exponential d…
Figure 5
Figure 5. Figure 5: Comparison of triggers on MOEA with/without [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Comparing poisoned and clean images in the frequency domain reveals disparities caused by backdoor attacks on CIFAR [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Visualization of triggers along with their [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: According to the results, we see that the attention [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 11
Figure 11. Figure 11: Visualization of the averaged spectrum obtained by [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 10
Figure 10. Figure 10: The results of LADDER under Neural Cleanse on [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 12
Figure 12. Figure 12: Comparison of poisoned images with their corresponding frequency disparities (amplified by [PITH_FULL_IMAGE:figures/full_fig_p017_12.png]
Figure 13
Figure 13. Figure 13: Poisoned images produced by LADDER. CPU utilization increases while GPU utilization decreases as the number of model parameters grows (as shown from left to right in Table VIII, where the number of model parameters increases). Note GoogLeNet contains Inception modules…
Figure 15
Figure 15. Figure 15: The time cost (averaged on 5 runs) against GoogleNet, [PITH_FULL_IMAGE:figures/full_fig_p020_15.png]
Figure 16
Figure 16. Figure 16: Sensitivity of (a) the number of perturbations and (b) [PITH_FULL_IMAGE:figures/full_fig_p020_16.png]
Figure 14
Figure 14. Figure 14: The time cost (averaged over 5 runs) of LADDER [PITH_FULL_IMAGE:figures/full_fig_p020_14.png]
Figure 17
Figure 17. Figure 17: The impact of Lagrange coefficient α in backdoor attack formulated with Lagrange multipliers and solved by SGD concerning trigger perceptibility (measured with l2-norm) and attack failure rate. L. The Consistency of L2 Norm-based Stealthiness Measure￾ment between Spat…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

85 extracted references · 65 canonical work pages

  1. [1]

    Sneaky spikes: Uncovering stealthy backdoor attacks in spiking neural networks with neuromorphic data,

    G. Abad, O. Ersoy, S. Picek, and A. Urbieta, “Sneaky spikes: Uncovering stealthy backdoor attacks in spiking neural networks with neuromorphic data,” inNetwork and Distributed System Security Symposium , 2024

    2024

  2. [2]

    Discrete cosine transform,

    N. Ahmed, T. Natarajan, and K. Rao, “Discrete cosine transform,” IEEE Transactions on Computers , vol. C-23, no. 1, pp. 90–93, 1974

    1974

  3. [3]

    Backpropagation and stochastic gradient descent method,

    S.-i. Amari, “Backpropagation and stochastic gradient descent method,” Neurocomputing, vol. 5, no. 4-5, pp. 185–196, 1993

    1993

  4. [4]

    A new backdoor attack in cnns by training set corruption without label poisoning,

    M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in IEEE International Conference on Image Processing, 2019, pp. 101–105

    2019

  5. [5]

    End to end learning for self-driving cars,

    M. Bojarski, D. Del Testa, D. Dworakowski, B. Firner, B. Flepp, P. Goyal, L. D. Jackel, M. Monfort, U. Muller, J. Zhang, X. Zhang, and J. Zhao, “End to end learning for self-driving cars,” arXiv preprint arXiv:1604.07316 , 2016

    arXiv 2016

  6. [6]

    Color and spatial structure in natural scenes,

    G. J. Burton and I. R. Moorhead, “Color and spatial structure in natural scenes,”Applied Optics, vol. 26, no. 1, pp. 157–170, 1987

    1987

  7. [7]

    Detecting backdoor attacks on deep neural networks by activation clustering,

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Ed- wards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728 , 2018

    arXiv 2018

  8. [8]

    Deepin- spect: A black-box trojan detection and mitigation frame- work for deep neural networks,

    H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Deepin- spect: A black-box trojan detection and mitigation frame- work for deep neural networks,” in Proceedings of the International Joint Conference on Artificial Intelligence , 2019, pp. 4658–4664

    work page 2019

Show all 85 references
  1. [9]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526 , 2017

    2017 arXiv

  2. [10]

    Deep feature space trojan attack of neural networks by controlled detoxification,

    S. Cheng, Y . Liu, S. Ma, and X. Zhang, “Deep feature space trojan attack of neural networks by controlled detoxification,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35, no. 2, 2021, pp. 1148– 1156

    2021

  3. [11]

    Secure spread spectrum watermarking for multimedia,

    I. Cox, J. Kilian, F. Leighton, and T. Shamoon, “Secure spread spectrum watermarking for multimedia,” IEEE Transactions on Image Processing , vol. 6, no. 12, pp. 1673–1687, 1997

    1997

  4. [12]

    A fast and elitist multiobjective genetic algorithm: Nsga-ii,

    K. Deb, A. Pratap, S. Agarwal, and T. Meyarivan, “A fast and elitist multiobjective genetic algorithm: Nsga-ii,” IEEE Transactions on Evolutionary Computation , vol. 6, no. 2, pp. 182–197, 2002

    2002

  5. [13]

    Simulated binary crossover for continuous search space,

    K. Deb and R. B. Agrawal, “Simulated binary crossover for continuous search space,” Complex System , vol. 9, 1995

    1995

  6. [14]

    A combined genetic adaptive search (geneas) for engineering design,

    K. Deb and M. Goyal, “A combined genetic adaptive search (geneas) for engineering design,” Computer Sci- ence and Informatics , vol. 26, pp. 30–45, 1996

    1996

  7. [15]

    Backdoor attack with imperceptible input and latent modification,

    K. Doan, Y . Lao, and P. Li, “Backdoor attack with imperceptible input and latent modification,” Advances in Neural Information Processing Systems , vol. 34, pp. 18 944–18 957, 2021

    2021

  8. [16]

    Lira: Learnable, imperceptible and robust backdoor attacks,

    K. Doan, Y . Lao, W. Zhao, and P. Li, “Lira: Learnable, imperceptible and robust backdoor attacks,” in Proceed- ings of the IEEE/CVF International Conference on Com- puter Vision, 2021, pp. 11 966–11 976

    2021

  9. [17]

    Marksman backdoor: Backdoor attacks with arbitrary target class,

    K. D. Doan, Y . Lao, and P. Li, “Marksman backdoor: Backdoor attacks with arbitrary target class,” Advances in Neural Information Processing Systems , vol. 35, pp. 38 260–38 273, 2022

    2022

  10. [18]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” in International Conference on Learning...

    2021

  11. [19]

    Dermatologist-level classifi- cation of skin cancer with deep neural networks,

    A. Esteva, B. Kuprel, R. A. Novoa, J. Ko, S. M. Swetter, H. M. Blau, and S. Thrun, “Dermatologist-level classifi- cation of skin cancer with deep neural networks,” Nature, vol. 542, no. 7639, pp. 115–118, 2017

    2017

  12. [20]

    Fiba: Frequency-injection based backdoor attack in med- ical image analysis,

    Y . Feng, B. Ma, J. Zhang, S. Zhao, Y . Xia, and D. Tao, “Fiba: Frequency-injection based backdoor attack in med- ical image analysis,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 20 876–20 885

    2022

  13. [21]

    Backdoor defense via adaptively splitting poisoned dataset,

    K. Gao, Y . Bai, J. Gu, Y . Yang, and S.-T. Xia, “Backdoor defense via adaptively splitting poisoned dataset,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 4005–4014

    2023

  14. [22]

    Strip: A defence against trojan attacks on deep neural networks,

    Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” in Proceedings of the Annual Computer Security Applications Conference , 2019, pp. 113–125

    2019

  15. [23]

    A dual stealthy backdoor: From both spatial and frequency perspectives,

    Y . Gao, H. Chen, P. Sun, J. Li, A. Zhang, Z. Wang, and W. Liu, “A dual stealthy backdoor: From both spatial and frequency perspectives,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 3, 2024, pp. 1851–1859

    2024

  16. [24]

    Badnets: Identify- ing vulnerabilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identify- ing vulnerabilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733 , 2017

    2017 arXiv

  17. [25]

    Low frequency adversarial perturbation,

    C. Guo, J. S. Frank, and K. Q. Weinberger, “Low frequency adversarial perturbation,” in Uncertainty in Artificial Intelligence, 2020, pp. 1127–1137

    2020

  18. [26]

    Check your other door! creating backdoor attacks in the frequency domain,

    H. A. A. K. Hammoud and B. Ghanem, “Check your other door! creating backdoor attacks in the frequency domain,” arXiv preprint arXiv:2109.05507 , 2021

    2021 arXiv

  19. [27]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778

    2016

  20. [28]

    A stealthy and robust backdoor attack via frequency domain transform,

    R. Hou, T. Huang, H. Yan, L. Ke, and W. Tang, “A stealthy and robust backdoor attack via frequency domain transform,” World Wide Web, pp. 1–17, 2023

    2023

  21. [29]

    Detection of traffic signs in real-world images: The german traffic sign detection benchmark,

    S. Houben, J. Stallkamp, J. Salmen, M. Schlipsing, and C. Igel, “Detection of traffic signs in real-world images: The german traffic sign detection benchmark,” in Pro- ceedings of the International Joint Conference on Neural Networks, 2013, pp. 1–8

    2013

  22. [30]

    Backdoor defense via decoupling the training process,

    K. Huang, Y . Li, B. Wu, Z. Qin, and K. Ren, “Backdoor defense via decoupling the training process,” in Interna- tional Conference on Learning Representations , 2022. 14

    2022

  23. [31]

    J ¨ahne, Digital Image Processing

    B. J ¨ahne, Digital Image Processing . Springer Science & Business Media, 2005

    2005

  24. [32]

    Color backdoor: A robust poisoning attack in color space,

    W. Jiang, H. Li, G. Xu, and T. Zhang, “Color backdoor: A robust poisoning attack in color space,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 8133–8142

    2023

  25. [33]

    Fisher information guided purification against backdoor attacks,

    N. Karim, A. A. Arafat, A. S. Rakin, Z. Guo, and N. Rahnavard, “Fisher information guided purification against backdoor attacks,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 2024

    2024

  26. [34]

    Dual-domain image de- noising,

    C. Knaus and M. Zwicker, “Dual-domain image de- noising,” in IEEE International Conference on Image Processing, 2013, pp. 440–444

    2013

  27. [35]

    Universal litmus patterns: Revealing backdoor attacks in cnns,

    S. Kolouri, A. Saha, H. Pirsiavash, and H. Hoffmann, “Universal litmus patterns: Revealing backdoor attacks in cnns,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2020, pp. 301–310

    2020

  28. [36]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” 2009

    2009

  29. [37]

    Flow- mur: A stealthy and practical audio backdoor attack with limited knowledge,

    J. Lan, J. Wang, B. Yan, Z. Yan, and E. Bertino, “Flow- mur: A stealthy and practical audio backdoor attack with limited knowledge,” in IEEE Symposium on Security and Privacy, 2024, pp. 1646–1664

    2024

  30. [38]

    Tiny imagenet visual recognition challenge,

    Y . Le and X. Yang, “Tiny imagenet visual recognition challenge,” CS 231N, vol. 7, no. 7, p. 3, 2015

    2015

  31. [39]

    A theoretical analysis of backdoor poisoning attacks in convolutional neural networks,

    B. Li and W. Liu, “A theoretical analysis of backdoor poisoning attacks in convolutional neural networks,” in International Conference on Machine Learning, 2024, pp. 8296–8316

    2024

  32. [40]

    Invisible backdoor attacks on deep neural networks via steganography and regularization,

    S. Li, M. Xue, B. Z. H. Zhao, H. Zhu, and X. Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” IEEE Transactions on Dependable and Secure Computing , vol. 18, pp. 2088– 2105, 2019

    2019

  33. [41]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks,” in International Conference on Learning Representations , 2021

    2021

  34. [42]

    Re- thinking the trigger of backdoor attack,

    Y . Li, T. Zhai, B. Wu, Y . Jiang, Z. Li, and S. Xia, “Re- thinking the trigger of backdoor attack,” arXiv preprint arXiv:2004.04692, 2020

    2004 arXiv

  35. [43]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Pro- ceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 16 463–16 472

    2021

  36. [44]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International Symposium on Research in Attacks, Intrusions, and Defenses , 2018, pp. 273–294

    2018

  37. [45]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Y . Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in European Conference on Computer Vision , 2020, pp. 182–199

    2020

  38. [46]

    Deep learn- ing face attributes in the wild,

    Z. Liu, P. Luo, X. Wang, and X. Tang, “Deep learn- ing face attributes in the wild,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2015, pp. 3730–3738

    2015

  39. [47]

    A data-free backdoor injection approach in neural networks,

    P. Lv, C. Yue, R. Liang, Y . Yang, S. Zhang, H. Ma, and K. Chen, “A data-free backdoor injection approach in neural networks,” in USENIX Security Symposium, 2023, pp. 2671–2688

    2023

  40. [48]

    Watch out! simple horizontal class backdoor can trivially evade defense,

    H. Ma, S. Wang, Y . Gao, Z. Zhang, H. Qiu, M. Xue, A. Abuadbba, A. Fu, S. Nepal, and D. Abbott, “Watch out! simple horizontal class backdoor can trivially evade defense,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security , 2024

    2024

  41. [49]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y . Ng, “Reading digits in natural images with unsupervised feature learning,” in Neural Information Processing Systems Workshop on Deep Learning and Unsupervised Feature Learning, 2011

    2011

  42. [50]

    Input-aware dynamic back- door attack,

    T. A. Nguyen and A. Tran, “Input-aware dynamic back- door attack,” in Advances in Neural Information Process- ing Systems, vol. 33, 2020, pp. 3454–3464

    2020

  43. [51]

    Wanet - imperceptible warping-based backdoor attack,

    T. A. Nguyen and A. T. Tran, “Wanet - imperceptible warping-based backdoor attack,” in International Con- ference on Learning Representations , 2021

    2021

  44. [52]

    An introduction to convolutional neural networks,

    K. O’shea and R. Nash, “An introduction to convolutional neural networks,” arXiv preprint arXiv:1511.08458 , 2015

    2015 arXiv

  45. [53]

    Pytorch: An imperative style, high- performance deep learning library,

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. K ¨opf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and C. Soumith, “Pytorch: An imperative style, high- ...

    2019

  46. [54]

    Defending neural back- doors via generative distribution modeling,

    X. Qiao, Y . Yang, and H. Li, “Defending neural back- doors via generative distribution modeling,” Advances in Neural Information Processing Systems , vol. 32, pp. 14 027–14 036, 2019

    2019

  47. [55]

    Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmenta- tion,

    H. Qiu, Y . Zeng, S. Guo, T. Zhang, M. Qiu, and B. Thu- raisingham, “Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmenta- tion,” in Proceedings of the ACM Asia Conference on Computer and Communications Security , 2021, pp. 363– 377

    2021

  48. [56]

    Belt: Old-school backdoor attacks can evade the state-of-the- art defense with backdoor exclusivity lifting,

    H. Qiu, J. Sun, M. Zhang, X. Pan, and M. Yang, “Belt: Old-school backdoor attacks can evade the state-of-the- art defense with backdoor exclusivity lifting,” in IEEE Symposium on Security and Privacy , 2024, pp. 2124– 2141

    2024

  49. [57]

    Hidden trigger backdoor attacks,

    A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden trigger backdoor attacks,” in Proceedings of the AAAI Cconference on Artificial Intelligence , vol. 34, no. 07, 2020, pp. 11 957–11 965

    2020

  50. [58]

    Dynamic backdoor attacks against machine learning models,

    A. Salem, R. Wen, M. Backes, S. Ma, and Y . Zhang, “Dynamic backdoor attacks against machine learning models,” in IEEE European Symposium on Security and Privacy, 2022, pp. 703–718

    2022

  51. [59]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2017, pp. 618–626

    2017

  52. [60]

    On the effectiveness of low frequency perturbations,

    Y . Sharma, G. W. Ding, and M. A. Brubaker, “On the effectiveness of low frequency perturbations,” inProceed- ings of the International Joint Conference on Artificial Intelligence, 2019, pp. 3389–3396

    2019

  53. [61]

    Black-box backdoor defense via zero-shot image purifi- 15 cation,

    Y . Shi, M. Du, X. Wu, Z. Guan, J. Sun, and N. Liu, “Black-box backdoor defense via zero-shot image purifi- 15 cation,” in Advances in Neural Information Processing Systems, 2023, pp. 57 336–57 366

    2023

  54. [62]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in Interna- tional Conference on Learning Representations , 2015

    2015

  55. [63]

    Going deeper with convolutions,

    C. Szegedy, W. Liu, Y . Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V . Vanhoucke, and A. Rabi- novich, “Going deeper with convolutions,” in Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2015, pp. 1–9

    2015

  56. [64]

    Bypassing backdoor de- tection algorithms in deep learning,

    T. J. L. Tan and R. Shokri, “Bypassing backdoor de- tection algorithms in deep learning,” in IEEE European Symposium on Security and Privacy , 2020, pp. 175–183

    2020

  57. [65]

    Model orthogonalization: Class distance hardening in neural networks for better security,

    G. Tao, Y . Liu, G. Shen, Q. Xu, S. An, Z. Zhang, and X. Zhang, “Model orthogonalization: Class distance hardening in neural networks for better security,” in IEEE Symposium on Security and Privacy , 2022, pp. 1372– 1389

    2022

  58. [66]

    Amplitude spectra of natural images,

    D. J. Tolhurst, Y . Tadmor, and T. Chao, “Amplitude spectra of natural images,” Ophthalmic and Physiological Optics, pp. 229–232, 1992

    1992

  59. [67]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” Advances in Neural Information Pro- cessing Systems, vol. 31, pp. 8011–8021, 2018

    2018

  60. [68]

    Neural cleanse: Identifying and mit- igating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mit- igating backdoor attacks in neural networks,” in IEEE Symposium on Security and Privacy , 2019, pp. 707–723

    2019

  61. [69]

    MM- BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic,

    H. Wang, Z. Xiang, D. J. Miller, and G. Kesidis, “MM- BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic,” in IEEE Symposium on Security and Privacy, 2024, pp. 1994–2012

    2024

  62. [70]

    Versatile backdoor attack with visible, semantic, sample-specific, and compatible triggers,

    R. Wang, H. Chen, Z. Zhu, L. Liu, and B. Wu, “Versatile backdoor attack with visible, semantic, sample-specific, and compatible triggers,” arXiv preprint arXiv:2306.00816, 2023

    2023 arXiv

  63. [71]

    An invisible black-box backdoor attack through frequency domain,

    T. Wang, Y . Yao, F. Xu, S. An, H. Tong, and T. Wang, “An invisible black-box backdoor attack through frequency domain,” in European Conference on Computer Vision , 2022, pp. 396–413

    2022

  64. [72]

    D3: Deep dual-domain based fast restora- tion of jpeg-compressed images,

    Z. Wang, D. Liu, S. Chang, Q. Ling, Y . Yang, and T. S. Huang, “D3: Deep dual-domain based fast restora- tion of jpeg-compressed images,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016, pp. 2764–2772

    2016

  65. [73]

    Latent backdoor attacks on deep neural networks,

    Y . Yao, H. Li, H. Zheng, and B. Y . Zhao, “Latent backdoor attacks on deep neural networks,” in Proceed- ings of the ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 2041–2055

    2019

  66. [74]

    Narcissus: A practical clean-label backdoor attack with limited information,

    Y . Zeng, M. Pan, H. A. Just, L. Lyu, M. Qiu, and R. Jia, “Narcissus: A practical clean-label backdoor attack with limited information,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security , 2023, pp. 771–785

    2023

  67. [75]

    Rethinking the backdoor attacks’ triggers: A frequency perspective,

    Y . Zeng, W. Park, Z. M. Mao, and R. Jia, “Rethinking the backdoor attacks’ triggers: A frequency perspective,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 16 473–16 481

    2021

  68. [76]

    Badmerging: Backdoor attacks against model merging,

    J. Zhang, J. Chi, Z. Li, K. Cai, Y . Zhang, and Y . Tian, “Badmerging: Backdoor attacks against model merging,” arXiv preprint arXiv:2408.07362 , 2024

    2024 arXiv

  69. [77]

    The unreasonable effectiveness of deep fea- tures as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep fea- tures as a perceptual metric,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018, pp. 586–595

    2018

  70. [78]

    Shufflenet: An extremely efficient convolutional neural network for mobile devices,

    X. Zhang, X. Zhou, M. Lin, and J. Sun, “Shufflenet: An extremely efficient convolutional neural network for mobile devices,” in Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition , 2018, pp. 6848–6856

    2018

  71. [79]

    Backdoor defense via deconfounded representation learning,

    Z. Zhang, Q. Liu, Z. Wang, Z. Lu, and Q. Hu, “Backdoor defense via deconfounded representation learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 12 228–12 238

    2023

  72. [80]

    Defeat: Deep hidden feature backdoor attacks by imperceptible perturbation and latent representation constraints,

    Z. Zhao, X. Chen, Y . Xuan, Y . Dong, D. Wang, and K. Liang, “Defeat: Deep hidden feature backdoor attacks by imperceptible perturbation and latent representation constraints,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 15 ...

    2022

  73. [81]

    Imperceptible back- door attack: From input space to feature representation,

    N. Zhong, Z. Qian, and X. Zhang, “Imperceptible back- door attack: From input space to feature representation,” in Proceedings of the International Joint Conference on Artificial Intelligence, 2022, pp. 1736–1742

    2022

  74. [82]

    Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,

    M. Zhu, S. Wei, H. Zha, and B. Wu, “Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,” in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 1132–1153. APPENDIX A. Summary of Computer Vision Tasks We adopt 5 real...

    2023

  75. [83]

    ASD adaptively splits clean from the poisoned dataset during training so as to defend backdoors

    and MOTH [65]. ASD adaptively splits clean from the poisoned dataset during training so as to defend backdoors. CBD leverages statistical effect among variables on the image to mitigate attacks. DBD proposes a three-stage mechanism, which involves learning on label-removed dat...

  76. [84]

    Extending LADDER to the White-box setting: The per- formance of LADDER to evade SOTA white-box backdoor defenses can be enhanced if it can access models and control the training process, i.e., extension to white-box scenario. Following the idea by [73] which performs an imperc...

  77. [85]

    They cannot be trivially extended to produce dual-domain stealthy triggers

    Extending Current Backdoor Attacks to Dual Domains: Most attacks, e.g., [4, 20, 24, 45, 50, 51, 71], design triggers merely for single domain. They cannot be trivially extended to produce dual-domain stealthy triggers. This is so because: a. Fixed trigger pattern from spatial ...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.