mlsanityData to 14 Oct 2026

Neural Trojans

arXiv 1710.00942 ↗First posted 3 Oct 2017cs.CRcited by 153

Not on the map. Why?

Cited by 45 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

While neural networks demonstrate stronger capabilities in pattern recognition nowadays, they are also becoming larger and deeper. As a result, the effort needed to train a network also increases dramatically. In many cases, it is more practical to use a neural network intellectual property (IP) that an IP vendor has already trained. As we do not know about the training process, there can be security threats in the neural IP: the IP vendor (attacker) may embed hidden malicious functionality, i.e. neural Trojans, into the neural IP. We show that this is an effective attack and provide three mitigation techniques: input anomaly detection, re-training, and input preprocessing. All the techniques are proven effective. The input anomaly detection approach is able to detect 99.8% of Trojan triggers although with 12.2% false positive. The re-training approach is able to prevent 94.1% of Trojan triggers from triggering the Trojan although it requires that the neural IP be reconfigurable. In the input preprocessing approach, 90.2% of Trojan triggers are rendered ineffective and no assumption about the neural IP is needed.

Key facts. Cited by 153 papers in the map (data through 14 Oct 2026). First posted on arXiv 3 Oct 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 30; 2022: 37; 2023: 28; 2024: 28; 2025: 24; 2026: 6.

153 papers.

Sort:

By area:

  1. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  2. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  3. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  4. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  5. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 101
  6. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  7. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  8. 2021Backdoor Attacks on Self-Supervised Learningcited by 90
  9. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  10. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  11. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 85
  12. 2021Backdoor Attack in the Physical Worldcited by 84
38 more
  1. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 73
  2. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 65
  3. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 57
  4. 2023Performative Prediction: Past and Futurecited by 53
  5. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  6. 2021DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injectioncited by 44
  7. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 42
  8. 2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 41
  9. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  10. 2021Trigger Hunting with a Topological Prior for Trojan Detectioncited by 39
  11. 2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 37
  12. 2021PointBA: Towards Backdoor Attacks in 3D Point Cloudcited by 35
  13. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  14. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 35
  15. 2021Topological Detection of Trojaned Neural Networkscited by 34
  16. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 34
  17. 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 33
  18. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 30
  19. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  20. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 26
  21. 2022AI Security for Geoscience and Remote Sensing: Challenges and Future Trendscited by 23
  22. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 22
  23. 2023Backdoor Attacks Against Dataset Distillationcited by 21
  24. 2022Defending Backdoor Attacks on Vision Transformer via Patch Processingcited by 20
  25. 2023Defending Against Patch-based Backdoor Attacks on Self-Supervised Learningcited by 20
  26. 2021BFClass: A Backdoor-free Text Classification Frameworkcited by 19
  27. 2022Transferable Graph Backdoor Attackcited by 19
  28. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
  29. 2022Provable Defense against Backdoor Policies in Reinforcement Learningcited by 18
  30. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
  31. 2023BDMMT: Backdoor Sample Detection for Language Models through Model Mutation Testingcited by 16
  32. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 16
  33. 2021Enhancing Backdoor Attacks with Multi-Level MMD Regularizationcited by 15
  34. 2022WeDef: Weakly Supervised Backdoor Defense for Text Classificationcited by 15
  35. 2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
  36. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 15
  37. 2023Implicit Poisoning Attacks in Two-Agent Reinforcement Learning: Adversarial Policies for Training-Time Attackscited by 14
  38. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14

50 most cited of 153 All 153 (JSON)