SifterNet: A Generalized and Model-Agnostic Trigger Purification Approach

Chi Lin; Mengfan Li; Quanliang Jing; Shaoye Luo; Xinxin Fan; Yongjun Xu; Yunfeng Lu

REVIEW 3 major objections 5 minor 39 references

SifterNet: A Generalized and Model-Agnostic Trigger Purification Approach

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Hopfield recall strips backdoor triggers from poisoned images

desk verdict Hopfield-based trigger purification is a plausible idea, but the evaluation is tuned on the test set and the basin-of-attraction premise is never tested; worth a careful revision, not acceptance as-is. read the letter →

arxiv 2505.14531 v1 pith:WWLXMIXM submitted 2025-05-20 cs.LG

Shaoye Luo , Xinxin Fan , Quanliang Jing , Chi Lin , Mengfan Li , Yunfeng Lu , Yongjun Xu This is my paper · ORCID

classification cs.LG

keywords backdoordefensetriggerpurificationHopfieldnetworkIsingmodelassociativememoryblack-boxmodel-agnosticattacksuccessrate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Working only from a small seed set of clean images, SifterNet trains a Hopfield network to memorize normal patterns and then passes suspicious images through it, so that associative recall pulls the images back to their clean forms. The authors aim to show that this removes implanted backdoor triggers without knowing the target model's weights, architecture, or training details, and without retraining the model. They argue this makes the defense model-agnostic and lightweight, and their experiments across four datasets and five backdoor attacks show attack success rates falling far below those of detection-based baselines. The trade-off, reported in the same experiments, is a visible drop in the model's accuracy on purified images.

What carries the argument

The load-bearing object is the Hopfield network trained by Hebbian learning, viewed as an energy landscape in which clean seed images are stored as stable attractors. An input image is binarized (with localized differentiation for grayscale and per-channel processing for three-channel color), flattened to a spin vector, and updated by asynchronous threshold dynamics $s_i(t+1)=\operatorname{sgn}(\sum_j w_{ij}s_j(t)-\tau_i)$; convergence to a local minimum of $E=-\sum_{\langle i,j\rangle}w_{ij}s_i s_j$ is the purification step. The same dynamics that give associative memories their recall property are what the paper uses to "sift" the trigger out of the image.

What would settle it

The simplest decisive test is to verify the attractor directly: compute the energy landscape around a stored clean pattern, place a poisoned image with a known trigger at increasing Hamming distances, and check that recall lands on the clean pattern up to the basin radius and fails beyond it. Measuring the actual radius and comparing it to the trigger's distance would settle whether the mechanism, rather than the specific test configurations, is what removes the triggers.

Watch

Extended reading notes

Core claim

The paper's central claim is that trigger purification reduces to associative recall: once a Hopfield network has memorized clean patterns via Hebbian learning, a trigger-implanted sample that enters its "attractor domain" will converge to the closest clean memory, and the trigger is thereby erased. The authors formalize this through the Ising-model energy picture, arguing that a poisoned image is a corrupted version of a stored clean pattern and that the energy landscape's local minima are the clean memories, so asynchronous spin-flip dynamics naturally removes the corruption. They supplement the mechanism with a stability analysis showing stored random patterns are strict local minima when the storage load is below $\alpha_c \approx 0.138$, so corrupted inputs within the basin radius converge back to the memory. Empirically, the paper reports substantial reductions in attack success rate under BadNet, Input-Aware, WaNet, Blended, and SIG attacks on MNIST, FashionMNIST, CIFAR-10, GTSRB, and Tiny ImageNet, with accuracy retained at a lower level.

Load-bearing premise

The whole approach rests on the assumption that a triggered image is close enough to its clean counterpart in the Hopfield energy landscape that recall lands on the clean attractor rather than a spurious one, and that the trigger itself does not create its own attractor.

Editorial extensions

If this is right

A defender who only controls a modest set of clean seed images can purify poisoned inputs at inference time, with no access to the deployed model's internals.
Because the Hopfield filter is trained once on clean seeds, the same defense can be applied in front of CNNs and vision transformers without per-model tuning.
The reported time overhead is small (tens of seconds to purify a test set), which keeps the defense usable in real-time or federated settings.
If clean samples are later augmented with Hopfield-purified versions during retraining, both accuracy and attack success rate improve further, suggesting a simple co-training recipe.
Reducing attack success rate comes at a measurable accuracy cost on clean samples, so deployment must trade off between security gains and task performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An attacker who knows the defense could try to craft triggers that survive Hopfield recall, for instance by optimizing the trigger to sit in a spurious attractor or outside all clean basins; the paper does not evaluate such adaptive attacks.
Because the paper's own capacity measurements on real images are only 10-15% of the theoretical bound, the defense likely degrades as the number of classes or image resolution grows; the reported Tiny ImageNet and ViT results already point in that direction.
The same mechanism suggests a general-purpose adversarial-purification layer: any perturbed image within the memorized manifold could be projected back to its clean representative, so the method may transfer to other input-corruption settings such as watermark removal or certified denoising.
A concrete test of the mechanism would fix a trigger on a test image after the Hopfield network is trained, then measure whether purification still removes it; if the trigger pattern was never a memorized corruption, the basin-of-attraction story predicts recall should still work, and failure would reveal the limit of the approach.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Let me give you the quick version. This paper applies a classic Hopfield network with Hebbian learning as a black-box input purifier for backdoor defenses. That particular use is new as far as the cited work goes: prior literature doesn't describe using associative memory to strip triggers. The implementation is simple and lightweight, and the experiments cover several attacks and datasets, including a ViT. The authors also deserve credit for stating their own limitations in Appendix G—the sensitivity to ViT and to datasets with many categories is real, and it lines up with the numbers.

That said, the evaluation as presented has problems that would need to be fixed before I'd trust the conclusions. The most concrete is hyperparameter selection. In Section D.2, the number of Hopfield iterations and the k-size for local differentiation are chosen per dataset by looking at the same test-set ASR/accuracy curves that are later reported. That is post-hoc fitting to the test set. No validation split or selection criterion is given, so the reported performance is optimistic.

The bigger conceptual issue is that the paper never demonstrates that a poisoned image falls into the basin of attraction of its clean memorized pattern. Appendix B proves the standard Hopfield capacity bound for random ±1 patterns under random noise. It says nothing about structured, localized triggers or correlated real images. The paper's own numbers cut against the mechanism: on CIFAR-10, SifterNet drops clean accuracy from 75.02% to 60.02% (Table 1), and on Tiny ImageNet from 31.38% to 12.61% (Table 8). That is a lot of corruption. The reported ASR reductions could simply be generic degradation destroying the trigger, not associative recall toward a clean image. No experiment measures how close the output is to the true clean image, so the purification mechanism is unverified. Appendix E.0.1 notes that MNIST capacity reaches only 10-15% of the theoretical value, which makes the basin story even more fragile.

There's also a notable gap in the baseline set: Februus and other autoencoder-based input purifiers are not compared. And no code or data is released, which matters for a method where the binarization and iteration details are easy to get wrong. The 'capacity-expansion assistant network' in Appendix E is only qualitatively illustrated and not integrated into the main numbers.

The idea is worth taking seriously. It is a reasonable submission for a venue that values empirical defense work, and a good referee could push the authors to add a validation split, proper denoising baselines, a mechanism check, and code. As it stands, the claim of 'significantly outperforms' is not supported. I would send it to review—major revision, not desk reject—because the core approach is plausible and the problems are fixable. If you need a solid black-box purification baseline, this isn't it yet, but it might become one after careful rework.

Referee Report

3 major / 5 minor

Summary. The paper proposes SifterNet, a black-box, model-agnostic backdoor trigger purification method that uses Hopfield networks trained on a small clean seed set to "recall" poisoned images to their clean attractors. The method binarizes images by thresholding or localized differentiation, memorizes clean samples via Hebbian learning, and iteratively updates the input before feeding it to an unknown target model. Experiments cover MNIST, FashionMNIST, CIFAR-10, GTSRB, and Tiny ImageNet, five backdoor attacks, four baselines, and a ViT target model, with reported large ASR reductions and lightweight computation.

Significance. If the mechanism works, the approach is practically valuable: it requires no access to the target model, no retraining, and only a small clean seed set. The paper deserves credit for framing the defense around associative memory, for providing a formal stability analysis (even if only for random patterns), and for evaluating multiple datasets, attacks, and runtimes. However, the current evidence does not establish the claimed purification mechanism, because hyperparameters are selected from the test-set curves and no direct reconstruction metric is reported. The novelty is moderate, but the black-box setting and the Ising-model framing give the work a distinct angle that could be publishable after substantial experimental revision.

major comments (3)

[Appendix D.2, Fig. 4] The number of Hopfield iterations and the local-differentiation kernel size are selected after inspecting the same test-set ASR/Acc curves used for evaluation. The text states that the authors locate the iteration count at "the steep point when the accuracy begins to deteriorate" on those curves, and it reports reasonable ranges such as [800,1200] for MNIST and [15,25] for CIFAR-10 k-size. This is test-set selection and can inflate the reported ASR reductions. The authors should fix hyperparameters on a validation split or report performance over the full range without peeking at the test curves.
[Appendix B, Eqs. (8)-(13)] The stability analysis assumes P random ±1 patterns and random Hamming corruption, so it does not support the load-bearing premise in Sec. 3.3 that a trigger-implanted real image lies in the basin of attraction of its clean memorized pattern. This is not merely a theoretical gap: Appendix E.0.1 reports that MNIST capacity reaches only 10-15% of the theoretical bound, and Tables 1 and 8 show large clean-image accuracy drops (75.02% to 60.02% on CIFAR-10 and 31.38% to 12.61% on Tiny ImageNet) after purification. These observations are consistent with generic corruption destroying trigger features rather than associative recall to a clean attractor. Please add direct evidence of purification, such as reconstruction error or SSIM between the purified output and the original clean image, and an empirical basin analysis on real images with localized triggers.
[Sec. 4.2, Tables 1 and 7] The claim that SifterNet has a remarkable ASR reduction compared to IFMV is not uniformly supported by the reported tables. On CIFAR-10 WaNet, IFMV achieves ASR 0.50% while SifterNet achieves 5.00%; on GTSRB WaNet the values are 0.02% for IFMV and 0.03% for SifterNet. The text should explicitly report these cases and qualify the superiority claim, or rerun the comparison with a uniform protocol across defenses, target models, and attack configurations.

minor comments (5)

[Abstract] The abstract contains several typos: "SiferNet" should be "SifterNet", "netshell" should be "nutshell", and "poised" should be "poisoned".
[Sec. 3.2, Eq. (5)] The update formula uses inconsistent notation: "Vjwji" mixes pattern indices and component indices. Please write the local field as a sum over components j of the current state times the weight matrix entry.
[Appendix E.0.1] The capacity-expansion assistant neural network is described only qualitatively and is never quantitatively evaluated. Without architecture, training details, or an ablation, this enhancement is not reproducible and should either be specified or clearly marked as preliminary.
[Table 4] Table 4 does not state which dataset, attack, or Hopfield configuration is used, and the clean-sample-count trend is non-monotonic (e.g., accuracy drops from 61.29% with 32 samples to 60.00% with 16 samples). Please provide the exact setup and error bars before drawing conclusions about the required seed-set size.
[Sec. D.5, Tables 8 and 9] The Tiny ImageNet clean model accuracy is low (29.74-33.62%), and the comparison should clarify whether SifterNet's post-purification accuracy is measured on the same test set and whether all defense methods are evaluated under identical target model and poisoning settings.

Circularity Check

1 steps flagged · score 4.0 of 10

Reported Acc./ASR values are selected from the same test-time curves used to set the Hopfield-iteration hyperparameter; the Hopfield capacity derivation itself is not circular.

fitted input called prediction [Section D.2 (Memorization iteration setting), Fig. 4, with results reported in Tables 1, 5, 7, and 8.]
"Seen from Fig. 4 , the two metrics ASR and Acc. both decrease as the number of memorization iterations enlarges on the four datesets, that is to say, ASR anticipates more iterations but Acc. does not. Pursuant to the performance curves, we know that Acc. has a relatively steep decrease with each dataset. Therefore, we locate the number at the steep point when the accuracy begins to deteriorate as the selected number of memorization."

The memorization-iteration hyperparameter is chosen per dataset by inspecting the test-time accuracy/ASR curves, and the same curves are then reported as SifterNet's performance in Table 1 and the appendix tables. Since the iteration count is a single knob that trades ASR reduction against accuracy loss, the reported numbers are values on the fitted curve rather than independent predictions of the purification mechanism. Selecting the operating point on the evaluation metric and then reporting that metric as evidence of effectiveness makes the headline Acc./ASR numbers partly forced by construction, even though the Hopfield capacity bound in Appendix B is an external, non-circular result.

full rationale

The Appendix B derivation (Eqs. 8–13) is a standard Hopfield capacity bound for random ±1 patterns under random Hamming noise, and it does not presuppose trigger purification; I find no self-definitional or self-citation circularity in that part of the argument. The load-bearing empirical claim is compromised, however, by the protocol in Section D.2: the number of memorization iterations is chosen per dataset by reading the test-time Acc./ASR curves, and the reported Acc./ASR values are then taken from those same curves. That is evaluation-set model selection: with a single knob trading off ASR against Acc., some point on the curve is guaranteed to look favorable, so the headline reductions are partly fitted rather than predicted. The claimed mechanism (poisoned inputs falling into clean-pattern basins) is still an independent, falsifiable hypothesis about Hopfield dynamics, and the paper's own clean-image accuracy drops (e.g., 75.02% to 60.02% on CIFAR-10) make the mechanism testable, so this is partial rather than total circularity. A separate data-leakage concern is that Algorithm 1 is specified with `testset_clean` as the Hopfield training input; if the seed subset overlaps the evaluated poisoned images, the recall target is the exact clean image by construction, but the paper does not state such overlap, so I do not count it as a demonstrated circular step. The basin-of-attraction premise (structured triggers vs. random Hamming noise) is a correctness risk, not a circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The method depends on several free parameters chosen by hand or from test-set curves, on the availability of clean seed data, and on the unverified assumption that poisoned samples lie in clean attractor basins. The theoretical appendix only recovers textbook Hopfield capacity results and does not constrain these parameters.

free parameters (4)

memorization_iterations (RemoveTime) = MNIST 800-1200, CIFAR-10 900-1200, FashionMNIST 800-1000, GTSRB 1-500 (chosen values not reported)
Selected post-hoc from test-time ASR/Acc curves (Fig. 4, D.2); directly controls purification strength and reported attack success rate.
binarization_threshold = not specified ('predefined threshold')
Threshold that maps grayscale pixels to +1/-1 (Section 3.3); changes which patterns the Hopfield network memorizes and recalls.
local_differentiation_k_size = CIFAR-10 between 15 and 25, GTSRB between 5 and 15
Kernel size for local-difference binarization of three-channel images; tuned per dataset (Appendix D.2) and affects purification quality.
clean_seed_sample_count = varies in experiments (4 to 64 in Table 4), final counts not stated
Defender must supply clean seed samples per class; Table 4 shows accuracy falls below acceptable levels for fewer than 16 samples, so this choice is load-bearing.

assumptions (4)

domain assumption The defender has access to a clean seed dataset covering all target classes.
Section 3.3: 'a clean seed dataset covering all categories of samples is selected'. This is a similar clean-data burden to what the paper criticizes in white-box methods (Section 2.1).
domain assumption Trigger-implanted images fall inside the basin of attraction of the corresponding clean memorized pattern.
Load-bearing for purification (Section 3.3). Appendix B only analyzes random patterns and random Hamming corruption, not structured triggers or correlated natural images.
domain assumption Binarization preserves enough class-discriminative information for the target model to classify purified images.
The method binarizes images before Hopfield recall (Section 3.3); large accuracy drops on CIFAR-10 (75% to 60%) and Tiny ImageNet (31% to 12%) show this holds only partially.
ad hoc to paper The ASR/Acc curves used to select iteration counts are representative of deployment conditions.
Appendix D.2 chooses iteration counts from the accuracy dip observed on test data, implying the defender has a labeled test set at defense time, which is a favorable and unusual condition.

invented entities (1)

Capacity-expansion assistant neural network
purpose: Scrambles and recovers image semantics so a single Hopfield network can memorize more images than its practical capacity (Appendix E.0.1).
Described only as an 'assistant neural network' with no architecture, training procedure, or independent falsifiable predictions; it is a sketched add-on.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SifterNet: A Generalized and Model-Agnostic Trigger Purification Approach." pith.science (2026). https://pith.science/paper/WWLXMIXM

@misc{pith2026250514531,
  author       = {Pith},
  title        = {Pith review of: SifterNet: A Generalized and Model-Agnostic Trigger Purification Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WWLXMIXM}},
  note         = {Machine review of arXiv:2505.14531}
}

read the original abstract

Aiming at resisting backdoor attacks in convolution neural networks and vision Transformer-based large model, this paper proposes a generalized and model-agnostic trigger-purification approach resorting to the classic Ising model. To date, existing trigger detection/removal studies usually require to know the detailed knowledge of target model in advance, access to a large number of clean samples or even model-retraining authorization, which brings the huge inconvenience for practical applications, especially inaccessible to target model. An ideal countermeasure ought to eliminate the implanted trigger without regarding whatever the target models are. To this end, a lightweight and black-box defense approach SifterNet is proposed through leveraging the memorization-association functionality of Hopfield network, by which the triggers of input samples can be effectively purified in a proper manner. The main novelty of our proposed approach lies in the introduction of ideology of Ising model. Extensive experiments also validate the effectiveness of our approach in terms of proper trigger purification and high accuracy achievement, and compared to the state-of-the-art baselines under several commonly-used datasets, our SiferNet has a significant superior performance.

Figures

Figures reproduced from arXiv: 2505.14531 by the authors.

**Figure 1.** Ising model and its represented image. A system will tend to be stable if there is no external energy input, that is to say, the system evolves with the accompaniment of energy-reducing variation. Hence, if an external magnetic field exists, most of the small magnetic needles would align to same direction as the magnetic field. Nevertheless, in real-world scenarios, apart from the influence from the energy of the sy… view at source ↗

**Figure 2.** Memorization-association functionality of Hopfield network. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** Overall framework of trigger-purification. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (6 more)

**Figure 4.** Figure 4: The Acc. and ASR performance as the number of memorization iterations increases. Seen from the experimental results, the reasonable ranges of memorization iterations are respectively in [800, 1200] for MNIST, [900, 1200] for CIFAR-10, [800, 1000] for FashionMNIST, and …

**Figure 5.** Figure 5: Trigger purification on MNIST images. In addition, we also perform a set of experiments to evaluate STRIP [8] and SentiNet [4], both of which aim to identify triggers rather than eliminating. STRIP performs well both in single-channel and three-channel images. It can a…

**Figure 6.** Figure 6: The time overhead under serial and parallel computations. [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]

**Figure 7.** Figure 7: Sample break up and recovery (up: original, middle: scattered, bottom: recovered). [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]

**Figure 8.** Figure 8: Recovered "7" (left: with capacity extension, right: without). [PITH_FULL_IMAGE:figures/full_fig_p021_8.png]

**Figure 9.** Figure 9: Framework of data augmentation. F Related work To date, there are several sublines of backdoor defense in terms of trigger treatment. The representative approach STRIP [8] uses the thought of stacking image to check backdoor in a black-box means, however, its drawback …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 33 canonical work pages

[1]

A new backdoor attack in CNNS by training set corruption without label poisoning

Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in CNNS by training set corruption without label poisoning. In2019 IEEE International Conference on Image Processing, ICIP 2019, Taipei, Taiwan, September 22-25, 2019, pp. 101–105

work page 2019
[2]

Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks

Chen, H., Fu, C., Zhao, J., and Koushanfar, F. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In Kraus, S. (ed.),Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI 2019, Macao, China, August 10-16, 2019, pp. 4658–4664

work page 2019
[3]

Targeted backdoor attacks on deep learning systems using data poisoning.CoRR, abs/1712.05526, 2017

Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning.CoRR, abs/1712.05526, 2017

arXiv 2017
[4]

Sentinet: Detecting localized universal attacks against deep learning systems

Chou, E., Tramèr, F., and Pellegrino, G. Sentinet: Detecting localized universal attacks against deep learning systems. In2020 IEEE Security and Privacy Workshops, SP Workshops, San Francisco, CA, USA, May 21, 2020, pp. 48–54

work page 2020
[5]

G., Abbasnejad, E., and Ranasinghe, D

Doan, B. G., Abbasnejad, E., and Ranasinghe, D. C. Februus: Input purification defense against trojan attacks on deep neural network systems. InACSAC ’20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020, pp. 897–912

work page 2020
[6]

Black-box detection of backdoor attacks with limited information and data

Dong, Y ., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., and Zhu, J. Black-box detection of backdoor attacks with limited information and data. In2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021, pp. 16462–16471

work page 2021
[7]

Differential analysis of triggers and benign features for black-box DNN backdoor detection.IEEE Trans

Fu, H., Krishnamurthy, P., Garg, S., and Khorrami, F. Differential analysis of triggers and benign features for black-box DNN backdoor detection.IEEE Trans. Inf. Forensics Secur., 18: 4668–4680, 2023

work page 2023
[8]

C., and Nepal, S

Gao, Y ., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S. STRIP: a defence against trojan attacks on deep neural networks. In Balenson, D. M. (ed.),Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC 2019, San Juan, PR, USA, December 09-13, 2019, pp. 113–125

work page 2019

Show all 39 references

[9]

Badnets: Identifying vulnerabilities in the machine learning model supply chain.CoRR, abs/1708.06733, 2017

Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identifying vulnerabilities in the machine learning model supply chain.CoRR, abs/1708.06733, 2017

2017 arXiv
[10]

SCALE-UP: an efficient black-box input-level backdoor detection via analyzing scaled prediction consistency

Guo, J., Li, Y ., Chen, X., Guo, H., Sun, L., and Liu, C. SCALE-UP: an efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023

2023
[11]

SPECTRE: defending against backdoor attacks using robust statistics.CoRR, abs/2104.11315, 2021

Hayase, J., Kong, W., Somani, R., and Oh, S. SPECTRE: defending against backdoor attacks using robust statistics.CoRR, abs/2104.11315, 2021

2021 arXiv
[12]

O.The Organization of Behavior: A Neuropsychological Theory

Hebb, D. O.The Organization of Behavior: A Neuropsychological Theory
[13]

Hopfield, J. J. Neural networks and physical systems with emergent collective computational abilities.Proceedings of the National Academy of Sciences, 79(8):2554–2558, 1982

1982
[14]

Hopfield, J. J. Neurons with graded response have collective computational properties like those of two-state neurons.Proceedings of the National Academy of Sciences, 81(10):3088–3092, 1984

1984
[15]

Detection of traffic signs in real-world images: The german traffic sign detection benchmark

Houben, S., Stallkamp, J., Salmen, J., Schlipsing, M., and Igel, C. Detection of traffic signs in real-world images: The german traffic sign detection benchmark. InInternational Joint Conference on Neural Networks, pp. 1–8, 2013

2013
[16]

Backdoor defense via decoupling the training process

Huang, K., Li, Y ., Wu, B., Qin, Z., and Ren, K. Backdoor defense via decoupling the training process. InThe Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. 10

2022
[17]

Beitrag zur theorie des ferro-und paramagnetismus.Zeitschrift für Physik, 31(1): 253–258, 1925

Ising, E. Beitrag zur theorie des ferro-und paramagnetismus.Zeitschrift für Physik, 31(1): 253–258, 1925

1925
[18]

Ising ferromagnets and antiferromagnets in an imaginary magnetic field.Physical Review E, 105(5):054112, 2022

Krcmár, R., Gendiar, A., and Šamaj, L. Ising ferromagnets and antiferromagnets in an imaginary magnetic field.Physical Review E, 105(5):054112, 2022

2022
[19]

and Hinton, G

Krizhevsky, A. and Hinton, G. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009

2009
[20]

Baybfed: Bayesian backdoor defense for federated learning

Kumari, K., Rieger, P., Fereidooni, H., Jadliwala, M., and Sadeghi, A. Baybfed: Bayesian backdoor defense for federated learning. In44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023, pp. 737–754

2023
[21]

Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278–2324, 1998

LeCun, Y ., Bottou, L., Bengio, Y ., and Haffner, P. Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278–2324, 1998

1998
[22]

and Lin, S.-L

Liou, C.-Y . and Lin, S.-L. Finite memory loading in hairy neurons.Natural Computing, 5(1): 15–42, 2006

2006
[23]

and Yuan, S.-K

Liou, C.-Y . and Yuan, S.-K. Error tolerant associative memory.Biological Cybernetics, 81(4): 331–342, 1999

1999
[24]

Detecting backdoors during the inference stage based on corruption robustness consistency

Liu, X., Li, M., Wang, H., Hu, S., Ye, D., Jin, H., Wu, L., and Xiao, C. Detecting backdoors during the inference stage based on corruption robustness consistency. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2...

2023
[25]

The "beatrix" resurrections: Robust backdoor detection via gram matrices

Ma, W., Wang, D., Sun, R., Xue, M., Wen, S., and Xiang, Y . The "beatrix" resurrections: Robust backdoor detection via gram matrices. In30th Annual Network and Distributed System Security Symposium, NDSS 2023, San Diego, California, USA, February 27 - March 3, 2023

2023
[26]

McCoy, B. M. and Wu, T. T.The Two-Dimensional Ising Model
[27]

Nguyen, T. A. and Tran, A. T. Wanet - imperceptible warping-based backdoor attack. In9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021

2021
[28]

Nguyen, T. A. and Tran, A. T. Input-aware dynamic backdoor attack. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.),Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, D...

2020
[29]

D., Rieger, P., Chen, H., Yalame, H., Möllering, H., Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Zeitouni, S., Koushanfar, F., Sadeghi, A., and Schneider, T

Nguyen, T. D., Rieger, P., Chen, H., Yalame, H., Möllering, H., Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Zeitouni, S., Koushanfar, F., Sadeghi, A., and Schneider, T. FLAME: taming backdoors in federated learning. In Butler, K. R. B. and Thomas, K. (eds.), 31...

2022
[30]

A threshold selection method from gray-level histograms.IEEE Transactions on Systems, Man, and Cybernetics, 9(1):62–66, 1979

Otsu, N. A threshold selection method from gray-level histograms.IEEE Transactions on Systems, Man, and Cybernetics, 9(1):62–66, 1979

1979
[31]

T., Wu, T., Mahloujifar, S., and Mittal, P

Qi, X., Xie, T., Wang, J. T., Wu, T., Mahloujifar, S., and Mittal, P. Towards A proactive ML approach for detecting backdoor poison samples. In Calandrino, J. A. and Troncoso, C. (eds.), 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023,...

2023
[32]

P., Kopp, M

Ramsauer, H., Schäfl, B., Lehner, J., Seidl, P., Widrich, M., Gruber, L., Holzleitner, M., Adler, T., Kreil, D. P., Kopp, M. K., Klambauer, G., Brandstetter, J., and Hochreiter, S. Hopfield networks is all you need. In9th International Conference on Learning Representations, I...

2021
[33]

Backdoor suppression in neural networks using input fuzzing and majority voting.IEEE Des

Sarkar, E., Alkindi, Y ., and Maniatakos, M. Backdoor suppression in neural networks using input fuzzing and majority voting.IEEE Des. Test, 37(2):103–110, 2020. 11

2020
[34]

Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection

Tang, D., Wang, X., Tang, H., and Zhang, K. Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection. In Bailey, M. D. and Greenstadt, R. (eds.),30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021, pp. 1541–1558

2021
[35]

Spectral signatures in backdoor attacks

Tran, B., Li, J., and Madry, A. Spectral signatures in backdoor attacks. In Bengio, S., Wallach, H. M., Larochelle, H., Grauman, K., Cesa-Bianchi, N., and Garnett, R. (eds.),Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processin...

2018
[36]

Wang, B., Yao, Y ., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B. Y . Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019, pp. 707–723

2019
[37]

Backdoorbench: A comprehensive benchmark and analysis of backdoor learning.CoRR, abs/2407.19845, 2024

Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., Zhu, M., Wang, R., Liu, L., and Shen, C. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning.CoRR, abs/2407.19845, 2024

2024 arXiv
[38]

Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms.CoRR, abs/1708.07747, 2017

Xiao, H., Rasul, K., and V ollgraf, R. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms.CoRR, abs/1708.07747, 2017

2017 arXiv
[39]

hello_kitty.jpeg

Yuan, D., Wei, S., Zhang, M., Liu, L., and Wu, B. Activation gradient based poisoned sample detection against backdoor attacks.CoRR, abs/2312.06230, 2023. A Category of backdoor defense work The state-of-the-art work on backdoor defense is categorized as shown in Table 2, in a...

2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

A new backdoor attack in CNNS by training set corruption without label poisoning

Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in CNNS by training set corruption without label poisoning. In2019 IEEE International Conference on Image Processing, ICIP 2019, Taipei, Taiwan, September 22-25, 2019, pp. 101–105

work page 2019

[2] [2]

Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks

Chen, H., Fu, C., Zhao, J., and Koushanfar, F. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In Kraus, S. (ed.),Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI 2019, Macao, China, August 10-16, 2019, pp. 4658–4664

work page 2019

[3] [3]

Targeted backdoor attacks on deep learning systems using data poisoning.CoRR, abs/1712.05526, 2017

Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning.CoRR, abs/1712.05526, 2017

arXiv 2017

[4] [4]

Sentinet: Detecting localized universal attacks against deep learning systems

Chou, E., Tramèr, F., and Pellegrino, G. Sentinet: Detecting localized universal attacks against deep learning systems. In2020 IEEE Security and Privacy Workshops, SP Workshops, San Francisco, CA, USA, May 21, 2020, pp. 48–54

work page 2020

[5] [5]

G., Abbasnejad, E., and Ranasinghe, D

Doan, B. G., Abbasnejad, E., and Ranasinghe, D. C. Februus: Input purification defense against trojan attacks on deep neural network systems. InACSAC ’20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020, pp. 897–912

work page 2020

[6] [6]

Black-box detection of backdoor attacks with limited information and data

Dong, Y ., Yang, X., Deng, Z., Pang, T., Xiao, Z., Su, H., and Zhu, J. Black-box detection of backdoor attacks with limited information and data. In2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021, pp. 16462–16471

work page 2021

[7] [7]

Differential analysis of triggers and benign features for black-box DNN backdoor detection.IEEE Trans

Fu, H., Krishnamurthy, P., Garg, S., and Khorrami, F. Differential analysis of triggers and benign features for black-box DNN backdoor detection.IEEE Trans. Inf. Forensics Secur., 18: 4668–4680, 2023

work page 2023

[8] [8]

C., and Nepal, S

Gao, Y ., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S. STRIP: a defence against trojan attacks on deep neural networks. In Balenson, D. M. (ed.),Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC 2019, San Juan, PR, USA, December 09-13, 2019, pp. 113–125

work page 2019