Pith. sign in

REVIEW 3 major objections 4 minor 299 references

Anti-Backdoor Coreset Selection via Cumulative Entropy

T0 review · 3 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A cumulative-entropy coreset score can filter poisoned data, neutralize backdoors across eight attack types, and keep clean-data accuracy.

desk verdict Solid empirical training-time defense with broad evaluation, but the abstract overclaims robustness relative to the paper's own adaptive-attack results. read the letter →

arxiv 2607.25502 v1 pith:OJSVRX4S submitted 2026-07-28 cs.LG cs.CR

Qi Zhao , Christian Wressnegger This is my paper
classification cs.LGcs.CR
keywords backdoorattackdatapoisoningtraining-timedefensecoresetselectioncumulativeentropymachineunlearninglabelsmoothingpredictionuncertainty
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that training-time defense against data-poisoning backdoors is best viewed as a coreset-selection problem: pick a small, informative subset of the poisoned training set and train only on that subset. It claims that poisonous samples become low-uncertainty quickly and are less frequent than benign ones, so a score that accumulates each sample's normalized prediction entropy over many epochs—Cumulative Entropy (CENT)—ranks them below informative benign samples. On top of this score, the paper adds a per-epoch unlearning step for high-entropy samples, using label smoothing and weight regularization to widen the uncertainty gap between benign and poisonous data. The headline result is that one method mitigates all eight backdoor attacks it tests, preserves natural accuracy close to a model trained on a clean dataset, and runs in about the same wall-clock time as naive training. This matters because prior defenses typically sacrifice accuracy or leave at least one attack partially successful.

What carries the argument

Cumulative Entropy (CENT): for each sample, the average over Tse selection epochs of its min-max normalized Shannon entropy over class predictions, H(x_i) = -Σ_c p_θ(c|x_i) log p_θ(c|x_i). This single object carries the argument by encoding both instantaneous uncertainty and temporal consistency of learning. Two supporting mechanisms do the heavy lifting: a warm-up phase sets the coreset size automatically from the mean entropy of correctly predicted samples, and a per-epoch unlearning step removes high-entropy samples under label smoothing with l2 weight regularization, enlarging the entropy gap between benign and poisonous samples before scores are accumulated. Final training is standard c

What would settle it

Construct a poisoned dataset by poisoning only the 5% of clean samples with the highest Cumulative Entropy and randomizing half of their labels, then run ABCS. If the final model's attack success rate remains far from zero and the selected coreset still contains a nontrivial fraction of poisoned samples, the uncertainty-separation premise fails. The paper's own label-randomization experiments already show ASR rising to double digits for some attacks, so this is a directly checkable point.

Watch

Extended reading notes

Core claim

The paper's central proposal, ABCS, is that the cumulative entropy of a sample's prediction distribution across training epochs is a reliable anti-backdoor signal. Poisonous samples converge to the backdoor early, so their per-epoch entropy drops fast and stays low; benign samples, especially hard ones, keep higher entropy. Accumulating min-max normalized entropy over the selection phase stabilizes this separation and avoids the variance of one-shot uncertainty sampling. The method then unlearns the currently uncertain samples each epoch with smoothed labels and l2 weight anchoring, which enlarges the CENT gap before the final coreset is chosen. Training from scratch on the high-CENT coreset

Load-bearing premise

Everything rests on the claim that poisoned samples have lower prediction uncertainty and are less frequent than benign samples; if an adversary can make poisoned samples as uncertain or as frequent as hard benign samples, the cumulative-entropy separation weakens and the defense's success rate declines.

Editorial extensions

If this is right

  • If the central claim holds, a training-time defense can be built without clean reference data and without precise dataset splitting; a selection ratio around 55% is enough to keep natural accuracy.
  • Because the coreset is smaller than the full set, final training is faster, so total defense time is comparable to unprotected training rather than a multiple of it.
  • The defense transfers across architectures and task domains: the paper reports consistent results on image classification with several network families and on text classification with transformer models.
  • The method remains effective when the dataset is clean, avoiding the natural-accuracy drop that several prior defenses suffer on unpoisoned data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the CENT-versus-backdoor separation suggests a general trade-off: any defense that exploits 'poisoned samples learn first and become certain' can be circumvented by attacks that slow poisoned-sample convergence, so the entropy gap itself is the quantity future adversaries will target.
  • The unlearning step's label-smoothing factor could be adapted online from the observed entropy gap, potentially making the defense more robust to the paper's own adaptive-attack results without changing the coreset formulation.
  • The paper notes its coresets are larger than an optimal clean-data coreset; this hints that a poisoned dataset carries an extra, discardable 'backdoor task' component, and an information-theoretic measure of that component might predict how much larger a safe coreset must be.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes ABCS (Anti-Backdoor Coreset Selection), a training-time defense that treats backdoor defense as a coreset selection problem. The method computes a Cumulative Entropy (CENT) score for each training sample by accumulating normalized entropy over a selection phase, preceded by a warm-up phase; during selection it unlearns uncertain samples with label smoothing and regularization to widen the uncertainty gap between benign and poisoned samples. The final model is trained from scratch on the selected high-CENT coreset. The paper evaluates ABCS on CIFAR10, GTSRB, Tiny-ImageNet, and text classification against eight backdoor attacks, comparing to six defenses, and reports natural accuracy close to clean training, near-zero ASR in standard settings, and comparable runtime, plus ablations and adaptive-attack analyses.

Significance. The contribution is substantial if the empirical results hold: a simple, fast, training-time defense that covers many attack types without clean reference data and with public code. The paper is thorough in benchmarking, ablations, and adaptive evaluations, and it explicitly discusses limitations. The main caveat is that the central uncertainty premise is an empirical regularity rather than a guaranteed property; the paper's own adaptive label-randomization experiments show that the defense degrades substantially when poisoned samples are made uncertain. Nevertheless, the method still reduces ASR compared to no defense in most adaptive settings, and the standard-setting results are strong. The lack of theoretical foundation is acknowledged and is not by itself disqualifying.

major comments (3)
  1. [Abstract / Section 1 vs. Section E.5, Table 18] The claims that ABCS 'mitigates backdooring attacks consistently' (Abstract) and 'mitigate[s] all investigated backdoor' (Contributions) are contradicted by the paper's own adaptive experiments in Table 18. Under 50% label randomization, ABCS leaves ASR at 16.63% (BadNets), 30.03% (IAB), 23.99% (LF), 9.74% (Blend), and 15.69% (A-Blend). The Limitations section only mentions A-Blend as 'suboptimal' and does not qualify the general claim. Please soften the claims to reflect that ABCS substantially reduces ASR in standard settings and provides partial mitigation under adaptive uncertainty-raising attacks, or move the adaptive results into the main text and discuss their implications.
  2. [Section 4.1] The coreset size determination is ambiguous. The threshold τ is defined as an average over warm-up epochs of the mean entropy of correctly predicted samples, while the size s is defined using CENT(x_i), which is only accumulated during the subsequent selection phase. As written, CENT values do not exist at the point where τ is computed. Please provide a precise algorithm (or pseudocode) specifying whether τ is applied to the final CENT scores, whether the warm-up entropies are also accumulated, and how the two phases interact.
  3. [Section 5 and Section D.2] The hyperparameters ε=0.9, γ=0.1/0.01, Twa=10, and Tse=40 are set based on ablations on CIFAR10 and then used for other datasets. Since the same benchmark is used for both tuning and final evaluation, there is a risk of overfitting to the evaluation suite. The paper should report performance with fixed hyperparameters across datasets or provide a sensitivity analysis showing that the conclusions are robust to reasonable variations. At minimum, the evaluation protocol should be discussed explicitly.
minor comments (4)
  1. [Section 4.2, Step-2] The phrase 'select samples larger than the average' should specify that the average is computed over correctly predicted samples, as in the formula; otherwise the description is ambiguous.
  2. [Various] Typos: 'similiar' (p.2), 'mis-prediced' (p.15), 'in additon' (p.15), 'native training' (Table 3 caption), and the Figure 1 caption 'using with a ResNet18' should be corrected.
  3. [Section 4, CENT equation] The CENT equation does not explicitly define the model θ_t after each selection epoch; clarify whether it is the model after the unlearning step.
  4. [Table 1 caption] The caption states that defense failure (ASR >50%) is shown as orange boldface, but no orange entries appear in the ABCS columns; ensure the formatting is consistent in the final version.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: ABCS's derivation is self-contained and its central claim is evaluated against external attacks.

full rationale

The paper's derivation chain is not circular. The CENT criterion is defined as an accumulated, min-max normalized Shannon entropy over training epochs (Section 4), independent of the ASR/DER metrics it is evaluated against. The premise that poisonous samples have lower prediction uncertainty is an empirical observation supported by Figure 1 and external citations (Li et al., 2021b), not a result derived from the defense's own outputs. The selection threshold τ is computed from the warm-up model's correct predictions, and the final coreset is trained from scratch, so the defense does not fit parameters to the target metric. The method is tested against eight external attacks and baselines, and the appendix's adaptive-attack experiments (including CENT-ranked poisoning and label randomization) directly challenge the central premise and show degraded but still meaningful ASR reduction, which is a sign of external evaluation rather than circularity. The authors' self-citations (Zhao & Wressnegger, 2024; 2025) support background observations about backdoor learning dynamics, but the central claim does not reduce to those citations. Hyperparameters such as Twa, Tse, ε, γ are ablated on the same attacks, which is benchmark tuning, not circularity in derivation. The Limitations section acknowledges the lack of a theoretical foundation and suboptimal performance on A-Blend, further confirming that the paper does not assert a forced result.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central claim is almost entirely empirical. It rests on domain assumptions about poisoned-sample uncertainty and backdoor-invariant data distributions, plus several hyperparameters tuned on the evaluation suite. No new physical or formal entities are introduced.

free parameters (4)
  • Label smoothing factor epsilon = 0.9
    Tuned via ablation (Fig. 8); too small a value weakens unlearning and increases ASR, especially for WaNet.
  • Unlearning regularization gamma = 0.1 (small-scale), 0.01 (large-scale)
    Selected via ablation (Fig. 13); large gamma lowers ASR, small gamma fails to separate poisoned samples.
  • Warm-up epochs Twa = 10
    Ablation (Fig. 12) shows shorter warm-up can fail to capture backdoor behavior, leading to higher ASR.
  • Selection epochs Tse = 40
    Longer accumulation improves exclusion of poisonous samples; chosen via ablation (Fig. 12).
assumptions (3)
  • domain assumption Poisoned samples have lower prediction uncertainty and converge faster than benign samples during training.
    Stated in Section 1 and Figure 1; this is the basis for selecting high-CENT samples as the benign coreset. Supported by prior work but not guaranteed for unseen attacks.
  • domain assumption Backdoor attacks preserve the natural data distribution, so a coreset of the primary task maintains natural accuracy.
    Assumed in Section 4.2 Step-1; if an attack strongly shifts the benign distribution, the coreset may lose utility.
  • ad hoc to paper Unlearning with label smoothing enlarges the uncertainty gap between benign and poisoned samples without model collapse.
    Introduced in Section 4.2 Step-2; empirically demonstrated but not theoretically justified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Anti-Backdoor Coreset Selection via Cumulative Entropy." pith.science (2026). https://pith.science/paper/OJSVRX4S

@misc{pith2026260725502,
  author       = {Pith},
  title        = {Pith review of: Anti-Backdoor Coreset Selection via Cumulative Entropy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OJSVRX4S}},
  note         = {Machine review of arXiv:2607.25502}
}
read the original abstract

Recent training-time defenses against neural backdoors isolate a benign subset from poisoned training data, to learn a backdoor-free model from it. In this paper, we formulate this defense strategy as a coreset selection problem, giving rise to so-called "Anti-Backdoor Coreset Selection." Since poisonous samples have (a) lower prediction uncertainty and are (b) less frequent than benign samples, coreset selection naturally focuses more on samples associated with benign functionality than the backdoor functionality. We use the Cumulative Entropy as selection criterion to further facilitate this effect. The metric tracks the learning dynamics of training samples and allowing us to select benign samples with high informativeness for the coreset. Additionally, we unlearn the chosen samples in each epoch to facilitate the separability between benign and poisonous samples. Together, this yields an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Unlike prior defenses that compromise natural accuracy and fail against certain attacks, our method mitigates backdooring attacks consistently with a negligible impact on natural performance.

Figures

Figures reproduced from arXiv: 2607.25502 by the authors.

Figure 1
Figure 1. Intermediate and cumulative entropy across training epochs for CIFAR10 poisoned by Blend with using a ResNet18 model. Note, that entropy values of all training samples are rescaled to [0, 1] at each epoch. tasks (the primary functionality and the backdoor) formed by mixing two datasets of benign and poisonous samples, respectively. By retrieving the coreset of the primary task, we effectively mitigate the backdoor a… view at source ↗
Figure 2
Figure 2. Evaluation of coreset methods under the Blend attack using ResNet18 on CIFAR10 with ρ = 5 %. Error bars show the value range across five random runs per coreset size. 3. Coreset Selection as Backdoor Defense Prior training-time defenses (Zhang et al., 2023; Zhu et al., 2023b) use the training loss for identifying benign and poi￾sonous samples. There, the loss essentially serves as a proxy metric for the prediction c… view at source ↗
Figure 3
Figure 3. EL2N and its variant of sampling per epoch. mean squared error over training epochs [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: Epoch-wise sampling vs. accumulation for uncertainty-based coreset selection. Selection ratio is 0.4. Each run trains a ResNet18 on CIFAR10 dataset that is poisoned by Blend attack with ρ = 5 %. Accumulating uncertainty measurements across epochs, in turn, yields a rob…
Figure 5
Figure 5. Figure 5: Training baseline model ResNet18 from scratch on coresets of CIFAR10 selected from a poisoned dataset with Blend attack by using different uncertainty criteria in the accumulation. 4. Anti-Backdoor Coreset Selection via Cumulative Entropy Based on the observations made…
Figure 7
Figure 7. Figure 7: Comparing the impact of using warm-up and unlearning in ABCS. Baseline model ResNet18 is trained from scratch on selected coresets of CIFAR10 under WaNet attack. Label smoothing factor ε. The value ε is proportional to the strength of label smoothing. Thus, increasing …
Figure 8
Figure 8. Figure 8: Ablation study on label smoothing factor ε. particularly under the WaNet attack. As the result, residual poisoned samples in the coreset lead to a higher ASR. Overall, the effective￾ness of ABCS depends on choosing ε within a reasonable range, rather than relying on a …
Figure 9
Figure 9. Figure 9: Coreset selected by three additional criteria on CIFAR10 poisoned by Blend with ρ = 5 % using ResNet18. Error bars indicate the range across five random trials per coreset size. A. Analysis of Other Coreset Selection Criteria In [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Comparing loss-based criteria to uncertainty-based criteria with accumulation. All experiments are conducted by using ResNet18 model on CIFAR10 that is under the poisoning of WaNet attack with ρ = 5 %. Error bars show the value range across five random runs per corese…
Figure 11
Figure 11. Figure 11: Class-wise accuracy distribution on GTSRB across different attacks, averaged over five runs. “Clean D” refers to using the original clean dataset for the model training. C.2. Considered Defenses ABL (Li et al., 2021b): The ABL procedure consists of three stages: (1) t…
Figure 12
Figure 12. Figure 12: Investigating the impact of warm-up epochs Twa (left), selection epochs Tse (right) on ABCS’s defense for CIFAR10. Twa and Tse. Based on the ablation study in [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]
Figure 15
Figure 15. Figure 15: Impact of varying ρ. For ρ ≥ 5 %, ABCS con￾sistently selects a core￾set that yields a model with high natural accu￾racy and minimal ASR, indicating effective exclu￾sion of poisonous sam￾ples. At a lower poi￾soning rate (ρ = 1 %), the increased difficulty of learning b…
Figure 14
Figure 14. Figure 14: Evaluation across target classes (left) and different poisoning rates (right) on CIFAR10. Poisoning rates [PITH_FULL_IMAGE:figures/full_fig_p016_14.png]
Figure 16
Figure 16. Figure 16: Poisoning Single Source Class. E.3. Constructing Low-Redundancy Training Datasets Given adaptive adversaries aware of the coreset selection mechanism via CENT criterion, they may first extract a core￾set with a selection ratio of 50 % and subsequently poison it before…
Figure 18
Figure 18. Figure 18: Impact of randomized label on Blend attack. We first use the Blend attack to visualize how random la￾beling affects model learning. Since coreset selection re￾lies on the uncertainty gap between benign and poisoned data, we measure the intermediate entropy difference …
Figure 19
Figure 19. Figure 19: T-SNE visualization of data distribution of full clean training set D and its coreset (Figure 19a), and other coresets selected from individual poisoned training sets D˜ (Figure 19b). from various poisoned datasets shown in Figure 19b exhibit strong similarity in thei…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

299 extracted references · 2 canonical work pages

  1. [1]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set corruption without label poisoning. In Proc. of the IEEE International Conference on Image Processing ( ICIP ) , 2019

    2019

  2. [2]

    and Roli, F

    Biggio, B. and Roli, F. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84: 0 317--331, 2018

    2018

  3. [3]

    Poisoning attacks against support vector machines

    Biggio, B., Nelson, B., and Laskov, P. Poisoning attacks against support vector machines. In Proc. of the International Conference on Machine Learning ( ICML ) , 2012

    2012

  4. [4]

    M., Gretton, A., Rasch, M

    Borgwardt, K. M., Gretton, A., Rasch, M. J., Kriegel, H.-P., Sch \"o lkopf, B., and Smola, A. J. Integrating structured biological data by kernel maximum mean discrepancy. Bioinformatics, 2006. doi:10.1093/bioinformatics/btl242

    work page doi:10.1093/bioinformatics/btl242 2006

  5. [5]

    Poisoning the unlabeled dataset of Semi-Supervised learning

    Carlini, N. Poisoning the unlabeled dataset of Semi-Supervised learning. In Proc. of the USENIX Security Symposium , 2021

    2021

  6. [6]

    A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tramèr, F

    Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tramèr, F. Poisoning web-scale training datasets is practical. In Proc. of the IEEE Symposium on Security and Privacy , 2024

    2024

  7. [7]

    Effective backdoor defense by exploiting sensitivity of poisoned samples

    Chen, W., Wu, B., and Wang, H. Effective backdoor defense by exploiting sensitivity of poisoned samples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2022

    2022

  8. [8]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, abs/1712.05526, 2017

    arXiv 2017

Show all 299 references
  1. [9]

    Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review

    Cheng, P., Wu, Z., Du, W., Zhao, H., Lu, W., and Liu, G. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review. IEEE Transactions on Neural Networks and Learning Systems, 2025. doi:10.1109/TNNLS.2025.3540303

    2025

  2. [10]

    Clark, P. J. and Evans, F. C. Distance to nearest neighbor as a measure of spatial relationships in populations. Ecology, 35 0 (4): 0 445--453, 1954

    1954

  3. [11]

    Selection via proxy: Efficient data selection for deep learning

    Coleman, C., Yeh, C., Mussmann, S., Mirzasoleiman, B., Bailis, P., Liang, P., Leskovec, J., and Zaharia, M. Selection via proxy: Efficient data selection for deep learning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2020

    2020

  4. [12]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proc. of the Annual Meeting of the Association for Computational Linguistics, 2019

    2019

  5. [13]

    Label smoothing improves machine unlearning

    Di, Z., Zhu, Z., Jia, J., Liu, J., Takhirov, Z., Jiang, B., Yao, Y., Liu, S., and Liu, Y. Label smoothing improves machine unlearning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2026

    2026

  6. [14]

    and Precioso, F

    Ducoffe, M. and Precioso, F. Adversarial active learning for deep networks: a margin based approach. In Proc. of the AAAI Conference on Artificial Intelligence ( AAAI ) , 2018

    2018

  7. [15]

    SalUn : Empowering machine unlearning via gradient-based weight saliency in both image classification and generation

    Fan, C., Liu, J., Zhang, Y., Wong, E., Wei, D., and Liu, S. SalUn : Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2024

    2024

  8. [16]

    Backdoor defense via adaptively splitting poisoned dataset

    Gao, K., Bai, Y., Gu, J., Yang, Y., and Xia, S.-T. Backdoor defense via adaptively splitting poisoned dataset. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

  9. [17]

    Explaining and harnessing adversarial examples

    Goodfellow, I., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2015

    2015

  10. [18]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Gu, T., Dolan - Gavitt, B., and Garg, S. Badnets: Identifying vulnerabilities in the machine learning model supply chain. Proceeding of Machine Learning and Computer Security Workshop, 2017

    2017

  11. [19]

    DeepCore : A comprehensive library for coreset selection in deep learning

    Guo, C., Zhao, B., and Bai, Y. DeepCore : A comprehensive library for coreset selection in deep learning. In Proc. of the International Conference on Database and Expert Systems Applications ( DEXA ) , 2022

    2022

  12. [20]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016

    2016

  13. [21]

    He, X., Xu, Q., Wang, J., Rubinstein, B. I. P., and Cohn, T. SEEP : Training dynamics grounds latent representation search for mitigating backdoor poisoning attacks. In Proc. of the Annual Meeting of the Association for Computational Linguistics, 2024

    2024

  14. [22]

    and Farahani, R

    Hekmatfar, M. and Farahani, R. Z. (eds.). Facility Location: Concepts, Models, Algorithms and Case Studies. Contributions to Management Science. Springer, 2009. doi:10.1007/978-3-7908-2151-2

    2009 doi

  15. [24]

    Densely connected convolutional networks

    Huang, G., Liu, Z., and van der Maaten, L. Densely connected convolutional networks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2017

    2017

  16. [25]

    Backdoor defense via decoupling the training process

    Huang, K., Li, Y., Wu, B., Qin, Z., and Ren, K. Backdoor defense via decoupling the training process. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2022 a

    2022

  17. [26]

    Active learning by querying informative and representative examples

    Huang, S.-j., Jin, R., and Zhou, Z.-H. Active learning by querying informative and representative examples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2010

    2010

  18. [27]

    Uncertainty-aware learning against label noise on imbalanced datasets

    Huang, Y., Bai, B., Zhao, S., Bai, K., and Wang, F. Uncertainty-aware learning against label noise on imbalanced datasets. In Proc. of the AAAI Conference on Artificial Intelligence ( AAAI ) , 2022 b

    2022

  19. [28]

    D., Hayase, J., and Oh, S

    Jha, R. D., Hayase, J., and Oh, S. Label poisoning is all you need. In Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., and Levine, S. (eds.), Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2023

    2023

  20. [29]

    Killamsetty, K., Sivasubramanian, D., Ramakrishnan, G., of Texas at Dallas, R. I. U., of Technology Bombay Institution One, I. I., and Two, I. N. Glister: Generalization based data subset selection for efficient and robust learning. In Proc. of the AAAI Conference on Artificia...

    2020

  21. [30]

    Killamsetty, K., Sivasubramanian, D., Mirzasoleiman, B., Ramakrishnan, G., De, A., and Iyer, R. K. GRAD-MATCH: A gradient matching based data subset selection for efficient learning. In Proc. of the International Conference on Machine Learning ( ICML ) , 2021

    2021

  22. [31]

    CIFAR (canadian institute for advanced research), 2008

    Krizhevsky, A., Nair, V., and Hinton, G. CIFAR (canadian institute for advanced research), 2008. URL http://www.cs.toronto.edu/ kriz/cifar.html

    2008

  23. [32]

    Weight poisoning attacks on pretrained models

    Kurita, K., Michel, P., and Neubig, G. Weight poisoning attacks on pretrained models. In Proc. of the Annual Meeting of the Association for Computational Linguistics, 2020

    2020

  24. [33]

    M., Autenrieth, M., and Beluch, W

    Köhler, J. M., Autenrieth, M., and Beluch, W. H. Uncertainty based detection and relabeling of noisy image labels. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2019

    2019

  25. [34]

    and Yang, X

    Le, Y. and Yang, X. Tiny imagenet visual recognition challenge. CS 231N, 2015

    2015

  26. [35]

    Deep learning

    LeCun, Y., Bengio, Y., and Hinton, G. Deep learning. Nature, 521 0 (7553): 0 436--444, 2015. doi:10.1038/nature14539

    2015 doi

  27. [36]

    Invisible backdoor attack with sample-specific triggers

    Li, Y., Li, Y., Wu, B., Li, L., He, R., and Lyu, S. Invisible backdoor attack with sample-specific triggers. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2021 a

    2021

  28. [37]

    Anti-backdoor learning: Training clean models on poisoned data

    Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Anti-backdoor learning: Training clean models on poisoned data. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2021 b

    2021

  29. [38]

    Backdoor learning: A survey

    Li, Y., Jiang, Y., Li, Z., and Xia, S.-T. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2022

    2022

  30. [39]

    Trojaning attack on neural networks

    Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., and Zhang, X. Trojaning attack on neural networks. In Proc. of the Network and Distributed System Security Symposium ( NDSS ) , 2018

    2018

  31. [40]

    Coresets for data-efficient training of machine learning models

    Mirzasoleiman, B., Bilmes, J., and Leskovec, J. Coresets for data-efficient training of machine learning models. In Proc. of the International Conference on Machine Learning ( ICML ) , 2020

    2020

  32. [41]

    When does label smoothing help? In Proc

    Müller, R., Kornblith, S., and Hinton, G. When does label smoothing help? In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2019

    2019

  33. [42]

    S., Ravikumar, P

    Natarajan, N., Dhillon, I. S., Ravikumar, P. K., and Tewari, A. Learning with noisy labels. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2013

    2013

  34. [43]

    Descent-to-delete: Gradient-based methods for machine unlearning

    Neel, S., Roth, A., and Sharifi-Malvajerdi, S. Descent-to-delete: Gradient-based methods for machine unlearning. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2020

    2020

  35. [44]

    Nguyen, T. A. and Tran, A. Input-aware dynamic backdoor attack. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2020

    2020

  36. [45]

    Nguyen, T. A. and Tran, A. T. Wanet - imperceptible warping-based backdoor attack. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2021

    2021

  37. [46]

    Paul, M., Ganguli, S., and Dziugaite, G. K. Deep learning on a data diet: finding important examples early in training. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2021

    2021

  38. [47]

    Scikit-learn: Machine learning in python

    Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., Vanderplas, J., Passos, A., Cournapeau, D., Brucher, M., Perrot, M., and Duchesnay, E. Scikit-learn: Machine learning in python. Journal of M...

    2011

  39. [48]

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger

    Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., and Sun, M. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Lang...

    2021

  40. [49]

    Revisiting the assumption of latent separability for backdoor defenses

    Qi, X., Xie, T., Li, Y., Mahloujifar, S., and Mittal, P. Revisiting the assumption of latent separability for backdoor defenses. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2023

    2023

  41. [50]

    InfoBatch : Lossless training speed up by unbiased dynamic data pruning

    Qin, Z., Wang, K., Zheng, Z., Gu, J., Peng, X., Xu, Z., Zhou, D., Shang, L., Sun, B., Xie, X., and You, Y. InfoBatch : Lossless training speed up by unbiased dynamic data pruning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2024

    2024

  42. [51]

    Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation

    Qiu, H., Zeng, Y., Guo, S., Zhang, T., Qiu, M., and Thuraisingham, B. Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation. In Proc. of the ACM Asia Conference on Computer and Communications Security ( ASIA CCS ) , 2021

    2021

  43. [52]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.-C. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2018

    2018

  44. [53]

    and Savarese, S

    Sener, O. and Savarese, S. Active learning for convolutional neural networks: A core-set approach. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2018

    2018

  45. [54]

    R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T

    Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T. Poison frogs! targeted clean-label poisoning attacks on neural networks. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2018

    2018

  46. [55]

    and Zisserman, A

    Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2015

    2015

  47. [56]

    Stallkamp, J., Schlipsing, M., Salmen, J., and Igel, C. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 2012. ISSN 0893-6080

    2012

  48. [57]

    Revisiting Unreasonable Effectiveness of Data in Deep Learning Era

    Sun, C., Shrivastava, A., Singh, S., and Gupta, A. Revisiting Unreasonable Effectiveness of Data in Deep Learning Era . In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2017

    2017

  49. [58]

    T., Trischler, A., Bengio, Y., and Gordon, G

    Toneva, M., Sordoni, A., des Combes, R. T., Trischler, A., Bengio, Y., and Gordon, G. J. An empirical study of example forgetting during deep neural network learning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2019

    2019

  50. [59]

    Label-consistent backdoor attacks

    Turner, A., Tsipras, D., and Madry, A. Label-consistent backdoor attacks. ArXiv, abs/1912.02771, 2019

    1912 arXiv

  51. [60]

    and Hinton, G

    van der Maaten, L. and Hinton, G. Visualizing data using t-sne. Journal of Machine Learning Research, 2008

    2008

  52. [61]

    Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples

    Wei, S., Zhang, M., Zha, H., and Wu, B. Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2023

    2023

  53. [62]

    Herding dynamical weights to learn

    Welling, M. Herding dynamical weights to learn. In Proc. of the International Conference on Machine Learning ( ICML ) , 2009

    2009

  54. [63]

    Backdoorbench: A comprehensive benchmark of backdoor learning

    Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., and Shen, C. Backdoorbench: A comprehensive benchmark of backdoor learning. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022

    2022

  55. [64]

    and Wang, Y

    Wu, D. and Wang, Y. Adversarial neuron pruning purifies backdoored deep models. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2021

    2021

  56. [65]

    M., and Jia, R

    Zeng, Y., Park, W., Mao, Z. M., and Jia, R. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2021

    2021

  57. [66]

    Exploring the orthogonality and linearity of backdoor attacks

    Zhang, K., Cheng, S., Shen, G., Tao, G., An, S., Makur, A., Ma, S., and Zhang, X. Exploring the orthogonality and linearity of backdoor attacks. In Proc. of the IEEE Symposium on Security and Privacy , 2024

    2024

  58. [67]

    Backdoor defense via deconfounded representation learning

    Zhang, Z., Liu, Q., Wang, Z., Lu, Z., and Hu, Q. Backdoor defense via deconfounded representation learning. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

  59. [68]

    and Wressnegger, C

    Zhao, Q. and Wressnegger, C. Adversarially robust anti-backdoor learning. In Proc. of the ACM Workshop on Artificial Intelligence and Security ( AISEC ) , October 2024

    2024

  60. [69]

    and Wressnegger, C

    Zhao, Q. and Wressnegger, C. Two sides of the same coin: L earning the backdoor to remove the backdoor. In Proc. of the Annual AAAI Conference on Artificial Intelligence ( AAAI ) , February 2025

    2025

  61. [70]

    Clean-label backdoor attacks on video recognition models

    Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., and Jiang, Y. Clean-label backdoor attacks on video recognition models. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2023

    2023

  62. [71]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization

    Zhu, M., Wei, S., Shen, L., Fan, Y., and Wu, B. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2023 a

    2023

  63. [72]

    The victim and the beneficiary: Exploiting a poisoned model to train a clean model on poisoned data

    Zhu, Z., Wang, R., Zou, C., and Jing, L. The victim and the beneficiary: Exploiting a poisoned model to train a clean model on poisoned data. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2023 b

    2023

  64. [73]

    Adversarial attacks on machine learning cybersecurity defences in Industrial Control Systems , year =

    Anthi, Eirini and Williams, Lowri and Rhode, Matilda and Burnap, Pete and Wedgbury, Adam , journal =. Adversarial attacks on machine learning cybersecurity defences in Industrial Control Systems , year =

  65. [74]

    and Dambra, Savino and Freeman, David and Pierazzi, Fabio and Roundy, Kevin A

    Apruzzese, Giovanni and Anderson, Hyrum S. and Dambra, Savino and Freeman, David and Pierazzi, Fabio and Roundy, Kevin A. , booktitle = satml, title =

  66. [75]

    Bagdasaryan, Eugene and Shmatikov, Vitaly , booktitle = usenixss, title =

  67. [76]

    Detecting Poisoning Attacks on Machine Learning in IoT Environments , year =

    Baracaldo, Nathalie and Chen, Bryant and Ludwig, Heiko and Safavi, Amir and Zhang, Rui , booktitle =. Detecting Poisoning Attacks on Machine Learning in IoT Environments , year =

  68. [77]

    Barni, Mauro and Kallas, Kassem and Tondi, Benedetta , booktitle = icip, title =

  69. [78]

    CoRR , title =

    Bengio, Yoshua and L. CoRR , title =

  70. [79]

    Berthelot, David and Carlini, Nicholas and Goodfellow, Ian and Papernot, Nicolas and Oliver, Avital and Raffel, Colin , booktitle = neurips, title =

  71. [80]

    Biggio, Battista and Nelson, Blaine and Laskov, Pavel , booktitle = icml, title =

  72. [81]

    Wild patterns: Ten years after the rise of adversarial machine learning , year =

    Biggio, Battista and Roli, Fabio , journal =. Wild patterns: Ten years after the rise of adversarial machine learning , year =

  73. [82]

    Bioinformatics , year =

    Integrating Structured Biological Data by Kernel Maximum Mean Discrepancy , author =. Bioinformatics , year =

  74. [83]

    , booktitle = icpr, title =

    Brodersen, Kay Henning and Ong, Cheng Soon and Stephan, Klaas Enno and Buhmann, Joachim M. , booktitle = icpr, title =. 2010 , pages =

    2010

  75. [84]

    Curriculum Adversarial Training , year =

    Cai, Qi. Curriculum Adversarial Training , year =

  76. [85]

    Cai, Ruisi and Zhang, Zhenyu and Chen, Tianlong and Chen, Xiaohan and Wang, Zhangyang , booktitle = neurips, title =

  77. [86]

    Malware Classification Using Deep Learning Methods , year =

    Cakir, Bugra and Dogdu, Erdogan , booktitle =. Malware Classification Using Deep Learning Methods , year =

  78. [87]

    2017 , pages =

    Carlini, Nicholas and Wagner, David , booktitle = ieeesp, title =. 2017 , pages =

    2017

  79. [88]

    Carlini, Nicholas and Terzis, Andreas , booktitle = iclr, title =

  80. [89]

    Carlini, Nicholas , booktitle = usenixss, title =

  81. [90]

    and Paleka, Daniel and Pearce, Will and Anderson, Hyrum and Terzis, Andreas and Thomas, Kurt and Tramèr, Florian , booktitle = ieeesp, title =

    Carlini, Nicholas and Jagielski, Matthew and Choquette-Choo, Christopher A. and Paleka, Daniel and Pearce, Will and Anderson, Hyrum and Terzis, Andreas and Thomas, Kurt and Tramèr, Florian , booktitle = ieeesp, title =

  82. [91]

    Chai, Shuwen and Chen, Jinghui , booktitle = neurips, title =

  83. [92]

    Super-Samples from Kernel Herding , year =

    Chen, Yutian and Welling, Max and Smola, Alex , booktitle =. Super-Samples from Kernel Herding , year =

  84. [93]

    Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning , year =

    Chen, Xinyun and Liu, Chang and Li, Bo and Lu, Kimberly and Song, Dawn , journal =. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning , year =

  85. [94]

    2017 , pages =

    Chen, Pin-Yu and Zhang, Huan and Sharma, Yash and Yi, Jinfeng and Hsieh, Cho-Jui , booktitle = aisec, title =. 2017 , pages =

    2017

  86. [95]

    and Srivastava, Biplav , booktitle = ndss, title =

    Chen, Bryant and Carvalho, Wilka and Baracaldo, Nathalie and Ludwig, Heiko and Edwards, Benjamin and Lee, Taesung and Molloy, Ian M. and Srivastava, Biplav , booktitle = ndss, title =

  87. [96]

    Chen, Weixin and Wu, Baoyuan and Wang, Haoqian , booktitle = neurips, title =

  88. [97]

    Chen, Kangjie and Lou, Xiaoxuan and Xu, Guowen and Li, Jiwei and Zhang, Tianwei , booktitle = iclr, title =

  89. [98]

    Chou, Sheng-Yen and Chen, Pin-Yu and Ho, Tsung-Yi , booktitle = cvpr, title =

  90. [99]

    Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review , year=

    Cheng, Pengzhou and Wu, Zongru and Du, Wei and Zhao, Haodong and Lu, Wei and Liu, Gongshen , journal=. Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review , year=

  91. [100]

    Citovsky, Gui and DeSalvo, Giulia and Kumar, Sanjiv and Ramalingam, Srikumar and Rostamizadeh, Afshin and Wang, Yunjuan , booktitle = iclr, title =

  92. [101]

    Ecology , volume=

    Distance to nearest neighbor as a measure of spatial relationships in populations , author=. Ecology , volume=. 1954 , publisher=

    1954

  93. [102]

    2019 , month = jun, pages =

    Cohen, Jeremy and Rosenfeld, Elan and Kolter, Zico , booktitle = icml, title =. 2019 , month = jun, pages =

    2019

  94. [103]

    Coleman, Cody and Yeh, Christopher and Mussmann, Stephen and Mirzasoleiman, Baharan and Bailis, Peter and Liang, Percy and Leskovec, Jure and Zaharia, Matei , booktitle = iclr, title =

  95. [104]

    Croce, Francesco and Andriushchenko, Maksym and Hein, Matthias , booktitle = aistats, title =

  96. [105]

    Croce, Francesco and Hein, Matthias , booktitle = icml, title =

  97. [106]

    AutoAugment: Learning Augmentation Policies from Data , year =

    Cubuk, Ekin Dogus and Zoph, Barret and Man. AutoAugment: Learning Augmentation Policies from Data , year =

  98. [107]

    2020 , editor =

    Cubuk, Ekin Dogus and Zoph, Barret and Shlens, Jon and Le, Quoc , booktitle = neurips, title =. 2020 , editor =

    2020

  99. [108]

    BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding , author =

  100. [109]

    and Dong, W

    Deng, J. and Dong, W. and Socher, R. and others , booktitle = cvpr, title =

  101. [110]

    Deng, Li , journal =. The. 2012 , number =

    2012

  102. [111]

    Label Smoothing Improves Machine Unlearning , author=

  103. [112]

    , booktitle = acsac, title =

    Doan, Bao Gia and Abbasnejad, Ehsan and Ranasinghe, Damith C. , booktitle = acsac, title =. 2020 , location =

    2020

  104. [113]

    Doan, Khoa and Lao, Yingjie and Zhao, Weijie and Li, Ping , booktitle = iccv, title =

  105. [114]

    Du, Min and Jia, Ruoxi and Song, Dawn , booktitle = iclr, title =

  106. [115]

    2018 , keywords =

    Ducoffe, Melanie and Precioso, Frederic , booktitle = aaai, title =. 2018 , keywords =

    2018

  107. [116]

    2020 , pages =

    Evci, Utku and Gale, Trevor and Menick, Jacob and Castro, Pablo Samuel and Elsen, Erich , booktitle = icml, title =. 2020 , pages =

    2020

  108. [117]

    Fan, Chongyu and Liu, Jiancheng and Zhang, Yihua and Wong, Eric and Wei, Dennis and Liu, Sijia , booktitle = iclr, title =

  109. [118]

    2009 , publisher =

    Facility Location: Concepts, Models, Algorithms and Case Studies , editor =. 2009 , publisher =

    2009

  110. [119]

    Feng, Di and Rosenbaum, Lars and Dietmayer, Klaus C. J. , journal =. Towards Safe Autonomous Driving: Capture Uncertainty in the Deep Neural Network For Lidar 3D Vehicle Detection , year =

  111. [120]

    The State of Sparsity in Deep Neural Networks , year =

    Gale, Trevor and Elsen, Erich and Hooker, Sara , booktitle =. The State of Sparsity in Deep Neural Networks , year =

  112. [121]

    and Nepal, Surya , booktitle = acsac, title =

    Gao, Yansong and Xu, Chang and Wang, Derui and Chen, Shiping and Ranasinghe, Damith C. and Nepal, Surya , booktitle = acsac, title =

  113. [122]

    Gao, Kuofeng and Bai, Yang and Gu, Jindong and Yang, Yong and Xia, Shu-Tao , booktitle = cvpr, title =

  114. [123]

    On the Effectiveness of Adversarial Training Against Backdoor Attacks , year =

    Gao, Yinghua and Wu, Dongxian and Zhang, Jingfeng and Gan, Guanhao and Xia, Shu-Tao and Niu, Gang and Sugiyama, Masashi , journal =. On the Effectiveness of Adversarial Training Against Backdoor Attacks , year =

  115. [124]

    Ronny and Czaja, Wojciech and Taylor, Gavin and Moeller, Michael and Goldstein, Tom , booktitle = iclr, title =

    Geiping, Jonas and Fowl, Liam and Huang, W. Ronny and Czaja, Wojciech and Taylor, Gavin and Moeller, Michael and Goldstein, Tom , booktitle = iclr, title =

  116. [125]

    Goldblum, Micah and Fowl, Liam and Feizi, Soheil and Goldstein, Tom , booktitle = aaai, title =

  117. [126]

    Goodfellow, Ian and Shlens, Jonathon and Szegedy, Christian , booktitle = iclr, title =

  118. [127]

    Journal of Machine Learning Research , year =

    A Kernel Two‑Sample Test , author =. Journal of Machine Learning Research , year =

  119. [128]

    Proceeding of Machine Learning and Computer Security Workshop , title =

    Tianyu Gu and Brendan Dolan. Proceeding of Machine Learning and Computer Security Workshop , title =

  120. [129]

    Guan, Jiyang and Tu, Zhuozhuo and He, Ran and Tao, Dacheng , booktitle = cvpr, title =

  121. [130]

    and You, Yurong and Wilson, Andrew Gordon and Weinberger, Kilian Q

    Guo, Chuan and Gardner, Jacob R. and You, Yurong and Wilson, Andrew Gordon and Weinberger, Kilian Q. , booktitle = icml, title =. 2019 , pages =

    2019

  122. [131]

    Guo, Chengcheng and Zhao, Bo and Bai, Yanbing , booktitle =

  123. [132]

    Guo, Junfeng and Li, Yiming and Chen, Xun and Guo, Hanqing and Sun, Lichao and Liu, Cong , booktitle = iclr, title =

  124. [133]

    Hammoud, H. A. A. K. and Bibi, A. and Torr, P. H. S. and Ghanem, B. , booktitle = cvprw, title =

  125. [134]

    Hayase, Jonathan and Kong, Weihao and Somani, Raghav and Oh, Sewoong , booktitle = icml, title =

  126. [135]

    2016 , xpages =

    He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian , booktitle = cvpr, title =. 2016 , xpages =

    2016

  127. [136]

    He, Xuanli and Xu, Qiongkai and Wang, Jun and Rubinstein, Benjamin I. P. and Cohn, Trevor. SEEP : Training Dynamics Grounds Latent Representation Search for Mitigating Backdoor Poisoning Attacks. 2024

    2024

  128. [137]

    and Zoph, Barret and Gilmer, Justin and Lakshminarayanan, Balaji , booktitle = iclr, title =

    Hendrycks, Dan and Mu, Norman and Cubuk, Ekin D. and Zoph, Barret and Gilmer, Justin and Lakshminarayanan, Balaji , booktitle = iclr, title =

  129. [138]

    arXiv preprint arXiv:1712.00409 , year=

    Deep learning scaling is predictable, empirically , author=. arXiv preprint arXiv:1712.00409 , year=

    arXiv

  130. [139]

    Huang, Sheng-jun and Jin, Rong and Zhou, Zhi-Hua , booktitle = neurips, title =

  131. [140]

    Huang, Gao and Liu, Zhuang and van der Maaten, Laurens , booktitle = cvpr, title =

  132. [141]

    2018 , pages =

    Huang, Qiangui and Zhou, Shaohua Kevin and You, Suya and Neumann, Ulrich , booktitle = wacv, title =. 2018 , pages =

    2018

  133. [142]

    Yingsong Huang and Bing Bai and Shengwei Zhao and Kun Bai and Fei Wang , title =

  134. [143]

    Survey of State-of-Art Autonomous Driving Technologies with Deep Learning , year =

    Huang, Yu and Chen, Yue , booktitle =. Survey of State-of-Art Autonomous Driving Technologies with Deep Learning , year =

  135. [144]

    Huang, Kunzhe and Li, Yiming and Wu, Baoyuan and Qin, Zhan and Ren, Kui , booktitle = iclr, title =

  136. [145]

    Ilyas, Andrew and Santurkar, Shibani and Tsipras, Dimitris and Engstrom, Logan and Tran, Brandon and Madry, Aleksander , booktitle = neurips, title =

  137. [146]

    and Khargoankar, Ninad and Bilmes, Jeff A

    Iyer, Rishabh K. and Khargoankar, Ninad and Bilmes, Jeff A. and Asanani, Himanshu , booktitle =. Submodular Combinatorial Information Measures with Applications in Machine Learning , year =

  138. [147]

    and Hayase, Jonathan and Oh, Sewoong , booktitle = neurips, title =

    Jha, Rishi D. and Hayase, Jonathan and Oh, Sewoong , booktitle = neurips, title =. 2023 , editor =

    2023

  139. [148]

    Killamsetty, Krishnateja and Sivasubramanian, Durga and Ramakrishnan, Ganesh and of Texas at Dallas, Rishabh Iyer University and of Technology Bombay Institution One, Indian Institute and Two, I. N. , booktitle = aaai, title =

  140. [149]

    Kingma and Jimmy Ba , booktitle = iclr, title =

    Diederik P. Kingma and Jimmy Ba , booktitle = iclr, title =

  141. [150]

    Torchattacks: A pytorch repository for adversarial attacks , year =

    Kim, Hoki , journal =. Torchattacks: A pytorch repository for adversarial attacks , year =

  142. [151]

    Köhler and Maximilian Autenrieth and William H

    Jan M. Köhler and Maximilian Autenrieth and William H. Beluch , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops , year =

  143. [152]

    , booktitle = icml, title =

    Killamsetty, KrishnaTeja and Sivasubramanian, Durga and Mirzasoleiman, Baharan and Ramakrishnan, Ganesh and De, Abir and Iyer, Rishabh K. , booktitle = icml, title =

  144. [153]

    2008 , url =

    Krizhevsky, Alex and Nair, Vinod and Hinton, Geoffrey , title =. 2008 , url =

    2008

  145. [154]

    and Leibler, R

    Kullback, S. and Leibler, R. A. , journal =. On Information and Sufficiency , year =

  146. [155]

    and Bengio, Samy , booktitle = iclr, title =

    Kurakin, Alexey and Goodfellow, Ian J. and Bengio, Samy , booktitle = iclr, title =

  147. [156]

    Weight Poisoning Attacks on Pretrained Models , author =

  148. [157]

    Quantifying the Carbon Emissions of Machine Learning , year =

    Lacoste, Alexandre and Luccioni, Alexandra and Schmidt, Victor and Dandres, Thomas , journal =. Quantifying the Carbon Emissions of Machine Learning , year =

  149. [158]

    Tiny imagenet visual recognition challenge , year =

    Le, Ya and Yang, Xuan , journal =. Tiny imagenet visual recognition challenge , year =

  150. [159]

    Uncertainty Estimation for Deep Neural Object Detectors in Safety-Critical Applications , year =

    Le, Michael Truong and Diehl, Frederik and Brunner, Thomas and Knol, Alois , booktitle =. Uncertainty Estimation for Deep Neural Object Detectors in Safety-Critical Applications , year =

  151. [160]

    Nature , volume=

    Deep learning , author=. Nature , volume=. 2015 , publisher=

    2015

  152. [161]

    Li, Yige and Lyu, Xixiang and Koren, Nodens and Lyu, Lingjuan and Li, Bo and Ma, Xingjun , booktitle = neurips, title =

  153. [162]

    Li, Yuezun and Li, Yiming and Wu, Baoyuan and Li, Longkang and He, Ran and Lyu, Siwei , booktitle = iccv, title =

  154. [163]

    Li, Yige and Lyu, Xixiang and Koren, Nodens and Lyu, Lingjuan and Li, Bo and Ma, Xingjun , booktitle = iclr, title =

  155. [164]

    Backdoor learning: A survey , year =

    Li, Yiming and Jiang, Yong and Li, Zhifeng and Xia, Shu-Tao , journal =. Backdoor learning: A survey , year =

  156. [165]

    and He, Lifang , journal =

    Li, Qian and Peng, Hao and Li, Jianxin and Xia, Congying and Yang, Renyu and Sun, Lichao and Yu, Philip S. and He, Lifang , journal =. A Survey on Text Classification: From Traditional to Deep Learning , year =

  157. [166]

    Li, Boqi and Liu, Weiwei , booktitle = icml, title =

  158. [167]

    Liu, Kang and Dolan-Gavitt, Brendan and Garg, Siddharth , booktitle = raid, title =

  159. [168]

    Liu, Yingqi and Ma, Shiqing and Aafer, Yousra and Lee, Wen-Chuan and Zhai, Juan and Wang, Weihang and Zhang, Xiangyu , booktitle = ndss, title =

  160. [169]

    A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions , year =

    Long, Teng and Gao, Qi and Xu, Lili and Zhou, Zhangbing , journal =. A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions , year =

  161. [170]

    Loshchilov, Ilya and Hutter, Frank , booktitle = iclr, title =

  162. [171]

    Visualizing Data using t-SNE , year =

    van der Maaten, Laurens and Hinton, Geoffrey , journal =. Visualizing Data using t-SNE , year =

  163. [172]

    Madry, Aleksander and Makelov, Aleksandar and Schmidt, Ludwig and Tsipras, Dimitris and Vladu, Adrian , booktitle = iclr, title =

  164. [173]

    and Mahmoody, Mohammad , booktitle = aaai, title =

    Mahloujifar, Saeed and Diochnos, Dimitrios I. and Mahmoody, Mohammad , booktitle = aaai, title =

  165. [174]

    Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , title =

    Margatina, Katerina and Vernikos, Giorgos and Barrault, Lo. Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , title =. 2021 , publisher =

    2021

  166. [175]

    2015 , pages =

    Martens, James and Grosse, Roger , booktitle = icml, title =. 2015 , pages =

    2015

  167. [176]

    Mirzasoleiman, Baharan and Bilmes, Jeff and Leskovec, Jure , booktitle = icml, title =

  168. [177]

    2016 , pages =

    Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal , booktitle = cvpr, title =. 2016 , pages =

    2016

  169. [178]

    Mu, Bingxu and Niu, Zhenxing and Wang, Le and Wang, Xue and Jin, Rong and Hua, Gang , booktitle = cvpr, title =

  170. [179]

    Müller, Rafael and Kornblith, Simon and Hinton, Geoffrey , booktitle = neurips, title =

  171. [180]

    Natarajan, Nagarajan and Dhillon, Inderjit S and Ravikumar, Pradeep K and Tewari, Ambuj , booktitle = neurips, title =

  172. [181]

    Simple Black-Box Adversarial Attacks on Deep Neural Networks , year =

    Narodytska, Nina and Kasiviswanathan, Shiva , booktitle =. Simple Black-Box Adversarial Attacks on Deep Neural Networks , year =

  173. [182]

    Neel, Seth and Roth, Aaron and Sharifi-Malvajerdi, Saeed , booktitle = neurips, title =

  174. [183]

    , booktitle =

    Netzer, Yuval and Wang, Tao and Coates, Adam and Bissacco, Alessandro and Wu, Bo and Ng, Andrew Y. , booktitle =. Reading Digits in Natural Images with Unsupervised Feature Learning , year =

  175. [184]

    2020 , xeditor =

    Nguyen, Tuan Anh and Tran, Anh , booktitle = neurips, title =. 2020 , xeditor =

    2020

  176. [185]

    Tuan Anh Nguyen and Anh Tuan Tran , booktitle = iclr, title =

  177. [186]

    A Threshold Selection Method from Gray-Level Histograms , year =

    Otsu, Nobuyuki , journal =. A Threshold Selection Method from Gray-Level Histograms , year =

  178. [187]

    Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency , year =

    Pal, Soumyadeep and Yao, Yuguang and Wang, Ren and Shen, Bingquan and Liu, Sijia , booktitle =. Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency , year =

  179. [188]

    Pan, Minzhou and Zeng, Yi and Lyu, Lingjuan and Lin, Xue and Jia, Ruoxi , booktitle = usenixss, title =

  180. [189]

    Pang, Tianyu and Yang, Xiao and Dong, Yinpeng and Su, Hang and Zhu, Jun , booktitle = iclr, title =

  181. [190]

    and Jha, Somesh and Fredrikson, Matt and Celik, Z

    Papernot, Nicolas and McDaniel, Patrick D. and Jha, Somesh and Fredrikson, Matt and Celik, Z. Berkay and Swami, Ananthram , booktitle = eurosp, title =. 2016 , pages =

    2016

  182. [191]

    Active Learning is a Strong Baseline for Data Subset Selection , year =

    Park, Dongmin and Papailiopoulos, Dimitris and Lee, Kangwook , booktitle =. Active Learning is a Strong Baseline for Data Subset Selection , year =

  183. [192]

    Paul, Mansheej and Ganguli, Surya and Dziugaite, Gintare Karolina , booktitle = neurips, title =

  184. [193]

    Journal of Machine Learning Research , volume=

    Scikit-learn: Machine Learning in Python , author=. Journal of Machine Learning Research , volume=

  185. [194]

    Pouyanfar, Samira and Sadiq, Saad and Yan, Yilin and Tian, Haiman and Tao, Yudong and Reyes, Maria Presa and Shyu, Mei-Ling and Chen, Shu-Ching and Iyengar, S. S. , journal =. A Survey on Deep Learning: Algorithms, Techniques, and Applications , year =

  186. [195]

    CrossEntropyLoss — PyTorch documentation , year = 2024, url =

    2024

  187. [196]

    the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing , year=

    Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger , author=. the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing , year=

  188. [197]

    and Wu, Tong and Mahloujifar, Saeed and Mittal, Prateek , booktitle = usenixss, title =

    Qi, Xiangyu and Xie, Tinghao and Wang, Jiachen T. and Wu, Tong and Mahloujifar, Saeed and Mittal, Prateek , booktitle = usenixss, title =

  189. [198]

    Qi, Xiangyu and Xie, Tinghao and Li, Yiming and Mahloujifar, Saeed and Mittal, Prateek , booktitle = iclr, title =

  190. [199]

    Qin, Ziheng and Wang, Kai and Zheng, Zangwei and Gu, Jianyang and Peng, Xiangyu and Xu, Zhaopan and Zhou, Daquan and Shang, Lei and Sun, Baigui and Xie, Xuansong and You, Yang , booktitle = iclr, title =

  191. [200]

    Qiu, Han and Zeng, Yi and Guo, Shangwei and Zhang, Tianwei and Qiu, Meikang and Thuraisingham, Bhavani , booktitle = asiaccs, title =

  192. [201]

    Rakin, Adnan Siraj and He, Zhezhi and Fan, Deliang , booktitle = cvpr, title =

  193. [202]

    Applying Deep Learning to Autonomous Vehicles: A Survey , year =

    Ren, Jing and Gaber, Hossam and Al Jabar, Sk Sami , booktitle =. Applying Deep Learning to Autonomous Vehicles: A Survey , year =

  194. [203]

    and Kesidis, George , booktitle =

    Xiang, Zhen and Miller, David J. and Kesidis, George , booktitle =. Revealing Backdoors, Post-Training, in DNN Classifiers via Novel Inference on Optimized Perturbations Inducing Group Misclassification , year =

  195. [204]

    Saha, Aniruddha and Subramanya, Akshayvarun and Pirsiavash, Hamed , booktitle = aaai, title =

  196. [205]

    Dynamic Backdoor Attacks Against Machine Learning Models , year =

    Salem, Ahmed and Wen, Rui and Backes, Michael and Ma, Shiqing and Zhang, Yang , journal =. Dynamic Backdoor Attacks Against Machine Learning Models , year =

  197. [206]

    Sandler, Mark and Howard, Andrew and Zhu, Menglong and Zhmoginov, Andrey and Chen, Liang-Chieh , booktitle = cvpr, title =

  198. [207]

    2015 , pages =

    Schroff, Florian and Kalenichenko, Dmitry and Philbin, James , booktitle = cvpr, title =. 2015 , pages =

    2015

  199. [208]

    Sener, Ozan and Savarese, Silvio , booktitle = iclr, title =

  200. [209]

    Ronny and Najibi, Mahyar and Suciu, Octavian and Studer, Christoph and Dumitras, Tudor and Goldstein, Tom , booktitle = neurips, title =

    Shafahi, Ali and Huang, W. Ronny and Najibi, Mahyar and Suciu, Octavian and Studer, Christoph and Dumitras, Tudor and Goldstein, Tom , booktitle = neurips, title =

  201. [210]

    and Taylor, Gavin and Goldstein, Tom , booktitle = neurips, title =

    Shafahi, Ali and Najibi, Mahyar and Ghiasi, Mohammad Amin and Xu, Zheng and Dickerson, John and Studer, Christoph and Davis, Larry S. and Taylor, Gavin and Goldstein, Tom , booktitle = neurips, title =. 2019 , editor =

    2019

  202. [211]

    Simonyan, Karen and Zisserman, Andrew , booktitle = iclr, title =

  203. [212]

    Souri, Hossein and Goldblum, Micah and Fowl, Liam and Chellappa, Rama and Goldstein, Tom , booktitle = neurips, title =

  204. [213]

    and Schlipsing, M

    Stallkamp, J. and Schlipsing, M. and Salmen, J. and Igel, C. , journal =. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition , year =

  205. [214]

    Sun, Chen and Shrivastava, Abhinav and Singh, Saurabh and Gupta, Abhinav , booktitle = iccv, title =

  206. [215]

    and Fergus, Rob , booktitle = iclr, title =

    Szegedy, Christian and Zaremba, Wojciech and Sutskever, Ilya and Bruna, Joan and Erhan, Dumitru and Goodfellow, Ian J. and Fergus, Rob , booktitle = iclr, title =

  207. [216]

    Tang, Ruixiang and Du, Mengnan and Liu, Ninghao and Yang, Fan and Hu, Xia , booktitle = kdd, title =

  208. [217]

    , booktitle = iclr, title =

    Toneva, Mariya and Sordoni, Alessandro and des Combes, Remi Tachet and Trischler, Adam and Bengio, Yoshua and Gordon, Geoffrey J. , booktitle = iclr, title =

  209. [218]

    Spectral signatures in backdoor attacks , year =

    Tran, Brandon and Li, Jerry and M. Spectral signatures in backdoor attacks , year =

  210. [219]

    2019 , url =

    Turner, Alexander and Tsipras, Dimitris and Madry, Aleksander , title =. 2019 , url =

    2019

  211. [220]

    ArXiv , year=

    Label-Consistent Backdoor Attacks , author=. ArXiv , year=

  212. [221]

    Model Agnostic Defence against Backdoor Attacks in Machine Learning , year =

    Udeshi, Sakshi and Peng, Shanshan and Woo, Gerald and Loh, Lionell and Rawshan, Louth and Chattopadhyay, Sudipta , journal =. Model Agnostic Defence against Backdoor Attacks in Machine Learning , year =

  213. [222]

    2021 , month = jun, day =

    Vemparala, Manoj Rohit and Fasfous, Nael and Frickenstein, Alexander and Sarkar, Sreetama and Zhao, Qi and Kuhn, Sabine and Frickenstein, Lukas and Singh, Anmol and Unger, Christian and Nagaraja, Naveen Shankar and Wressnegger, Christian and Stechele, Walter , booktitle = saia...

    2021

  214. [223]

    , journal =

    Villarreal-Vasquez, Miguel and Bhargava, Bharat K. , journal =. ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks , year =

  215. [224]

    SoK: Realistic adversarial attacks and defenses for intelligent network intrusion detection , year =

    Vitorino, João and Praça, Isabel and Maia, Eva , journal =. SoK: Realistic adversarial attacks and defenses for intelligent network intrusion detection , year =. doi:https://doi.org/10.1016/j.cose.2023.103433 , url =

    2023

  216. [225]

    Wang, Yisen and Ma, Xingjun and Bailey, James and Yi, Jinfeng and Zhou, Bowen and Gu, Quanquan , booktitle = icml, title =

  217. [226]

    , booktitle = ieeesp, title =

    Wang, Bolun and Yao, Yuanshun and Shan, Shawn and Li, Huiying and Viswanath, Bimal and Zheng, Haitao and Zhao, Ben Y. , booktitle = ieeesp, title =

  218. [227]

    Wang, Yisen and Ma, Xingjun and Chen, Zaiyi and Luo, Yuan and Yi, Jinfeng and Bailey, James , booktitle = ICCV, title =

  219. [228]

    Wang, Yisen and Zou, Difan and Yi, Jinfeng and Bailey, James and Ma, Xingjun and Gu, Quanquan , booktitle = iclr, title =

  220. [229]

    Wang, Ren and Zhang, Gaoyuan and Liu, Sijia and Chen, Pin-Yu and Xiong, Jinjun and Wang, Meng , booktitle = eccv, title =

  221. [230]

    Deep Face Recognition: A Survey , year =

    Wang, Mei and Deng, Weihong , journal =. Deep Face Recognition: A Survey , year =

  222. [231]

    Rethinking the Reverse-engineering of Trojan Triggers , year =

    Wang, Zhenting and Mei, Kai and Ding, Hailun and Zhai, Juan and Ma, Shiqing , booktitle =. Rethinking the Reverse-engineering of Trojan Triggers , year =

  223. [232]

    Wang, Zhenting and Ding, Hailun and Zhai, Juan and Ma, Shiqing , booktitle = neurips, title =

  224. [233]

    Wang, Zhenting and Mei, Kai and Zhai, Juan and Ma, Shiqing , booktitle = iclr, title =

  225. [234]

    Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples , author=

  226. [235]

    Welling, Max , booktitle = icml, title =

  227. [236]

    Weng, Cheng-Hsin and Lee, Yan-Ting and Wu, Shan-Hung (Brandon) , booktitle = neurips, title =

  228. [237]

    2018 , month = jul, pages =

    Wong, Eric and Kolter, Zico , booktitle = icml, title =. 2018 , month = jul, pages =

    2018

  229. [238]

    Zico , booktitle = iclr, title =

    Wong, Eric and Rice, Leslie and Kolter, J. Zico , booktitle = iclr, title =

  230. [239]

    Wu, Dongxian and Wang, Yisen , booktitle = neurips, title =

  231. [240]

    Wu, Boxi and Chen, Jinghui and Cai, Deng and He, Xiaofei and Gu, Quanquan , booktitle = neurips, title =

  232. [241]

    BackdoorBench: A Comprehensive Benchmark of Backdoor Learning , year =

    Wu, Baoyuan and Chen, Hongrui and Zhang, Mingda and Zhu, Zihao and Wei, Shaokui and Yuan, Danni and Shen, Chao , booktitle =. BackdoorBench: A Comprehensive Benchmark of Backdoor Learning , year =

  233. [242]

    and Kesidis, George , booktitle = iclr, title =

    Xiang, Zhen and Miller, David J. and Kesidis, George , booktitle = iclr, title =

  234. [243]

    Xiao, Chaowei and Zhu, Jun-Yan and Li, Bo and He, Warren and Liu, Mingyan and Song, Dawn , booktitle = iclr, title =

  235. [244]

    Adversarial Examples for Semantic Segmentation and Object Detection , year =

    Xie, Cihang and Wang, Jianyu and Zhang, Zhishuai and Zhou, Yuyin and Xie, Lingxi and Yuille, Alan , booktitle =. Adversarial Examples for Semantic Segmentation and Object Detection , year =

  236. [245]

    Xie, Chulin and Huang, Keli and Chen, Pin-Yu and Li, Bo , booktitle = iclr, title =

  237. [246]

    and Li, Bo , booktitle = ieeesp, title =

    Xu, Xiaojun and Wang, Qi and Li, Huichen and Borisov, Nikita and Gunter, Carl A. and Li, Bo , booktitle = ieeesp, title =

  238. [247]

    CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Features , year =

    Yun, Sangdoo and Han, Dongyoon and Oh, Seong Joon and Chun, Sanghyuk and Choe, Junsuk and Yoo, Youngjoon , booktitle =. CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Features , year =

  239. [248]

    Wide Residual Networks , year =

    Zagoruyko, Sergey and Komodakis, Nikos , booktitle =. Wide Residual Networks , year =

  240. [249]

    Zeng, Yi and Chen, Si and Park, Won and Mao, Zhuoqing and Jin, Ming and Jia, Ruoxi , booktitle = iclr, title =

  241. [250]

    Morley and Jia, Ruoxi , title =

    Zeng, Yi and Park, Won and Mao, Z. Morley and Jia, Ruoxi , title =

  242. [251]

    mixup: Beyond Empirical Risk Minimization , year =

    Zhang, Hongyi and Ciss. mixup: Beyond Empirical Risk Minimization , year =

  243. [252]

    and Ghaoui, Laurent El and Jordan, Michael I

    Zhang, Hongyang and Yu, Yaodong and Jiao, Jiantao and Xing, Eric P. and Ghaoui, Laurent El and Jordan, Michael I. , booktitle = icml, title =

  244. [253]

    Attacks Which Do Not Kill Training Make Adversarial Learning Stronger , year =

    Zhang, Jingfeng and Xu, Xilie and Han, Bo and Niu, Gang and Cui, Lizhen and Sugiyama, Masashi and Kankanhalli, Mohan , booktitle =. Attacks Which Do Not Kill Training Make Adversarial Learning Stronger , year =

  245. [254]

    Zhang, Zaixi and Liu, Qi and Wang, Zhicai and Lu, Zepu and Hu, Qingyong , booktitle = cvpr, title =

  246. [255]

    Zhang, Kaiyuan and Cheng, Siyuan and Shen, Guangyu and Tao, Guanhong and An, Shengwei and Makur, Anuran and Ma, Shiqing and Zhang, Xiangyu , booktitle=ieeesp, title=

  247. [256]

    Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning , year =

    Zhang, Ruiqi and Lin, Licong and Bai, Yu and Mei, Song , booktitle =. Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning , year =

  248. [257]

    Zhao, Pu and Chen, Pin-Yu and Das, Payel and Ramamurthy, Karthikeyan Natesan and Lin, Xue , booktitle = iclr, title =

  249. [258]

    Clean-Label Backdoor Attacks on Video Recognition Models , year =

    Zhao, Shihao and Ma, Xingjun and Zheng, Xiang and Bailey, James and Chen, Jingjing and Jiang, Yu. Clean-Label Backdoor Attacks on Video Recognition Models , year =

  250. [259]

    Zheng, Runkai and Tang, Rongjun and Li, Jianze and Liu, Li , booktitle = eccv, title =

  251. [260]

    Zheng, Mengxin and Lou, Qian and Jiang, Lei , booktitle = cvpr, title =

  252. [261]

    Zhou, Jiachen and Lv, Peizhuo and Lan, Yibing and Meng, Guozhu and Chen, Kai and Ma, Hualong , booktitle = aaai, title =

  253. [262]

    Zhu, Mingli and Wei, Shaokui and Shen, Li and Fan, Yanbo and Wu, Baoyuan , booktitle = iccv, title =

  254. [263]

    Zhu, Zixuan and Wang, Rui and Zou, Cong and Jing, Lihua , booktitle = iccv, title =

  255. [264]

    Zhu, Zihao and Zhang, Mingda and Wei, Shaokui and Wu, Bingzhe and Wu, Baoyuan , booktitle = iclr, title =

  256. [265]

    Murillo and Riccardo Taormina and Stefano Galelli and Nils Ole Tippenhauer , booktitle = ricss, title =

    Alessandro Erba and Andres F. Murillo and Riccardo Taormina and Stefano Galelli and Nils Ole Tippenhauer , booktitle = ricss, title =. 2024 , month = oct, pdf =

    2024

  257. [266]

    Nurullah Demir and Daniel Theis and Tobias Urban and Norbert Pohlmann , booktitle = sicherheit, title =

  258. [267]

    udiger Grimm and Nicolas Huber and Michael Kirsten and Ralf K\

    Bernhard Beckert and Achim Brelle and R\"udiger Grimm and Nicolas Huber and Michael Kirsten and Ralf K\"usters and J\"orn M\"uller-Quade and Maximilian Noppel and Kai Reinhard and Jonas Schwab and Rebecca Schwerdt and Tomasz Truderung and Melanie Volkamer and Cornelia Winter ,...

  259. [268]

    Nurullah Demir and Tobias Urban and Kevin Wittek and and Norbert Pohlmann , booktitle = pam, title =

  260. [269]

    The 2022 Web Almanac: HTTP Archive's annual state of the web report — Security Chapter , year =

    Tom van Goethem and Nurullah Demir , institution =. The 2022 Web Almanac: HTTP Archive's annual state of the web report — Security Chapter , year =

    2022

  261. [270]

    The 2020 Web Almanac: HTTP Archive's annual state of the web report — Security Chapter , year =

    Tom van Goethem and Nurullah Demir and Barry Pollard , institution =. The 2020 Web Almanac: HTTP Archive's annual state of the web report — Security Chapter , year =

    2020

  262. [271]

    The 2021 Web Almanac: HTTP Archive's annual state of the web report — Security Chapter , year =

    Saptak Sengupta and Tom van Goethem and Nurullah Demir , institution =. The 2021 Web Almanac: HTTP Archive's annual state of the web report — Security Chapter , year =

    2021

  263. [272]

    Manoj Rohit Vemparala and Alexander Frickenstein and Nael Fasfous and Lukas Frickenstein and Qi Zhao and Sabine Kuhn and Daniel Ehrhardt and Yuankai Wu and Christian Unger and Naveen Shankar Nagaraja and Walter Stechele , booktitle = intellisys, title =

  264. [273]

    Christian Wressnegger , title =

  265. [274]

    2025 , month = jul, day =

    Luan Ademi and Maximilian Noppel and Christian Wressnegger , equal =. 2025 , month = jul, day =

    2025

  266. [275]

    Bat in the Mobile:

    Daniel Arp and Erwin Quiring and Christian Wressnegger and Konrad Rieck , institution =. Bat in the Mobile:. 2016 , month = sep, number =

    2016

  267. [276]

    2017 , month = apr, pages =

    Daniel Arp and Erwin Quiring and Christian Wressnegger and Konrad Rieck , booktitle = eurosp, title =. 2017 , month = apr, pages =

    2017

  268. [277]

    Dos and Don'ts of Machine Learning in Computer Security , year =

    Daniel Arp and Erwin Quiring and Feargus Pendlebury and Alexander Warnecke and Fabio Pierazzi and Christian Wressnegger and Lorenzo Cavallaro and Konrad Rieck , institution =. Dos and Don'ts of Machine Learning in Computer Security , year =

  269. [278]

    2022 , month = aug, pdf =

    Daniel Arp and Erwin Quiring and Feargus Pendlebury and Alexander Warnecke and Fabio Pierazzi and Christian Wressnegger and Lorenzo Cavallaro and Konrad Rieck , booktitle = usenixss, title =. 2022 , month = aug, pdf =

    2022

  270. [279]

    IEEE Security & Privacy , year =

    Daniel Arp and Erwin Quiring and Feargus Pendlebury and Alexander Warnecke and Fabio Pierazzi and Christian Wressnegger and Lorenzo Cavallaro and Konrad Rieck , title =. IEEE Security & Privacy , year =

  271. [280]

    2024 , number =

    Daniel Arp and Erwin Quiring and Feargus Pendlebury and Alexander Warnecke and Fabio Pierazzi and Christian Wressnegger and Lorenzo Cavallaro and Konrad Rieck , title =. 2024 , number =

    2024

  272. [281]

    2014 , month = nov, pages =

    Battista Biggio and Konrad Rieck and Davide Ariu and Christian Wressnegger and Igino Corona and Giorgio Giacinto and Fabio Roli , booktitle = aisec, title =. 2014 , month = nov, pages =

    2014

  273. [282]

    ottger and Henry Hosseini and Christine Utz and Nurullah Demir and Jan H\

    Christian B\"ottger and Henry Hosseini and Christine Utz and Nurullah Demir and Jan H\"ornemann and Christian Wressnegger and Thomas Hupperich and Norbert Pohlmann and Matteo Große-Kampmann and Tobias Urban , booktitle = dsn, title =

  274. [283]

    Nurullah Demir and Matteo Große-Kampmann and Tobias Urban and Christian Wressnegger and Thorsten Holz and Norbert Pohlmann , booktitle = webconf, title =

  275. [284]

    Nurullah Demir and Jan Jan H\"ornemann and Matteo Große-Kampmann and Tobias Urban and Norbert Pohlmann and Thorsten Holz and Christian Wressnegger , booktitle = imc, title =

  276. [285]

    Nurullah Demir and Tobias Urban and Norbert Pohlmann and Christian Wressnegger , booktitle = pets, title =

  277. [286]

    2015 , month = oct, pages =

    Hugo Gascon and Christian Wressnegger and Fabian Yamaguchi and Daniel Arp and Konrad Rieck , booktitle = securecomm, title =. 2015 , month = oct, pages =

    2015

  278. [287]

    2024 , month = dec, extra =

    Achyut Hegde and Maximilian Noppel and Christian Wressnegger , booktitle = acsac, title =. 2024 , month = dec, extra =

    2024

  279. [288]

    2023 , month = jan, pdf =

    Yilin Ji and Daniel Kaestner and Oliver Wirth and Christian Wressnegger , booktitle = wacv, title =. 2023 , month = jan, pdf =

    2023

  280. [289]

    2019 , month = jun, pdf =

    Ansgar Kellner and Micha Horlboge and Konrad Rieck and Christian Wressnegger , booktitle = eurosp, title =. 2019 , month = jun, pdf =

    2019

  281. [290]

    2020 , month = apr, day =

    Ansgar Kellner and Christian Wressnegger and Konrad Rieck , booktitle = eurosec, title =. 2020 , month = apr, day =

    2020

  282. [291]

    2021 , month = dec, pdf =

    Niclas Kühnapfel and Stefan Preußler and Maximilian Noppel and Thomas Schneider and Konrad Rieck and Christian Wressnegger , booktitle = acsac, title =. 2021 , month = dec, pdf =

    2021

  283. [292]

    Plausible Deniability for Anonymous Communication , year =

    Christiane Kuhn and Maximilian Noppel and Christian Wressnegger and Thorsten Strufe , equal =. Plausible Deniability for Anonymous Communication , year =

  284. [293]

    2019 , month = jun, pages =

    Alwin Maier and Hugo Gascon and Christian Wressnegger and Konrad Rieck , booktitle = dimva, title =. 2019 , month = jun, pages =

    2019

  285. [294]

    Web-based Cryptojacking in the Wild , year =

    Marius Musch and Christian Wressnegger and Martin Johns and Konrad Rieck , institution =. Web-based Cryptojacking in the Wild , year =

  286. [295]

    2019 , month = jun, pages =

    Marius Musch and Christian Wressnegger and Martin Johns and Konrad Rieck , booktitle = dimva, title =. 2019 , month = jun, pages =

    2019

  287. [296]

    2019 , month = aug, extra =

    Marius Musch and Christian Wressnegger and Martin Johns and Konrad Rieck , booktitle = ares, title =. 2019 , month = aug, extra =

    2019

  288. [297]

    Backdooring Explainable Machine Learning , year =

    Maximilian Noppel and Lukas Peter and Christian Wressnegger , institution =. Backdooring Explainable Machine Learning , year =

  289. [298]

    2023 , month = may, day =

    Maximilian Noppel and Lukas Peter and Christian Wressnegger , booktitle = ieeesp, title =. 2023 , month = may, day =

    2023

  290. [299]

    Maximilian Noppel and Christian Wressnegger , booktitle = ki, title =

  291. [300]

    Maximilian Noppel and Christian Wressnegger , booktitle = ccs, title =

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.