mlsanityData to 7 Oct 2026

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

arXiv 1712.05526 ↗First posted 15 Dec 2017cs.CR cs.LGcited by 1,012

Not on the map. Why?

Cited by 318 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep learning models have achieved high performance on many tasks, and thus have been applied to many security-critical scenarios. For example, deep learning-based face recognition systems have been used to authenticate users to access many security-sensitive applications like payment apps. Such usages of deep learning systems provide the adversaries with sufficient incentives to perform attacks against these systems for their adversarial purposes. In this work, we consider a new type of attacks, called backdoor attacks, where the attacker's goal is to create a backdoor into a learning-based authentication system, so that he can easily circumvent the system by leveraging the backdoor. Specifically, the adversary aims at creating backdoor instances, so that the victim learning system will be misled to classify the backdoor instances as a target label specified by the adversary. In particular, we study backdoor poisoning attacks, which achieve backdoor attacks using poisoning strategies. Different from all existing work, our studied poisoning strategies can apply under a very weak threat model: (1) the adversary has no knowledge of the model and the training set used by the victim system; (2) the attacker is allowed to inject only a small amount of poisoning samples; (3) the backdoor key is hard to notice even by human beings to achieve stealthiness. We conduct evaluation to demonstrate that a backdoor adversary can inject only around 50 poisoning samples, while achieving an attack success rate of above 90%. We are also the first work to show that a data poisoning attack can create physically implementable backdoors without touching the training process. Our work demonstrates that backdoor poisoning attacks pose real threats to a learning system, and thus highlights the importance of further investigation and proposing defense strategies against them.

Key facts. Cited by 1,012 papers in the map (data through 7 Oct 2026). First posted on arXiv 15 Dec 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 128; 2022: 179; 2023: 188; 2024: 245; 2025: 156; 2026: 116.

1,012 papers.

Sort:

By area:

  1. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
  2. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  3. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  4. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  5. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  6. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  7. 2023An Overview of Catastrophic AI Riskscited by 214
  8. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  9. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  10. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  11. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  12. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
38 more
  1. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  2. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  3. 2022Training Data Influence Analysis and Estimation: A Surveycited by 134
  4. 2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 127
  5. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  6. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  7. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
  8. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  9. 2023Universal Jailbreak Backdoors from Poisoned Human Feedbackcited by 120
  10. 2021Interpretable Deep Learning: Interpretation, Interpretability, Trustworthiness, and Beyondcited by 116
  11. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  12. 2021Adversarial Examples Make Strong Poisonscited by 115
  13. 2024What is in Your Safe Data? Identifying Benign Data that Breaks Safetycited by 114
  14. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  15. 2023On the Exploitability of Instruction Tuningcited by 110
  16. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  17. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  18. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  19. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  20. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  21. 2021Trustworthy AI: A Computational Perspectivecited by 93
  22. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  23. 2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targetscited by 88
  24. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  25. 2022Fisher SAM: Information Geometry and Sharpness Aware Minimisationcited by 84
  26. 2024BadEdit: Backdooring large language models by model editingcited by 84
  27. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
  28. 2021Backdoor Attack in the Physical Worldcited by 82
  29. 2022Towards Adversarial Evaluations for Inexact Machine Unlearningcited by 82
  30. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  31. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  32. 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 81
  33. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  34. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  35. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
  36. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 74
  37. 2024Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptationcited by 74
  38. 2021Manipulating SGD with Data Ordering Attackscited by 73

50 most cited of 1,012 All 1,012 (JSON)