mlsanityData to 14 Oct 2026

Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

arXiv 1805.12185 ↗First posted 30 May 2018cs.CR cs.LGcited by 580

Not on the map. Why?

Cited by 201 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks (DNNs) provide excellent performance across a wide range of classification tasks, but their training requires high computational resources and is often outsourced to third parties. Recent work has shown that outsourced training introduces the risk that a malicious trainer will return a backdoored DNN that behaves normally on most inputs but causes targeted misclassifications or degrades the accuracy of the network when a trigger known only to the attacker is present. In this paper, we provide the first effective defenses against backdoor attacks on DNNs. We implement three backdoor attacks from prior work and use them to investigate two promising defenses, pruning and fine-tuning. We show that neither, by itself, is sufficient to defend against sophisticated attackers. We then evaluate fine-pruning, a combination of pruning and fine-tuning, and show that it successfully weakens or even eliminates the backdoors, i.e., in some cases reducing the attack success rate to 0% with only a 0.4% drop in accuracy for clean (non-triggering) inputs. Our work provides the first step toward defenses against backdoor attacks in deep neural networks.

Key facts. Cited by 580 papers in the map (data through 14 Oct 2026). First posted on arXiv 30 May 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 71; 2022: 106; 2023: 115; 2024: 132; 2025: 80; 2026: 76.

580 papers.

Sort:

By area:

  1. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  2. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  3. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  4. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 222
  5. 2021Trustworthy AI: From Principles to Practicescited by 207
  6. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
  7. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  8. 2022Training Data Influence Analysis and Estimation: A Surveycited by 135
  9. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
  10. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  11. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 123
  12. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 116
38 more
  1. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 104
  2. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 103
  3. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  4. 2023Backdoor Attacks for In-Context Learning with Language Modelscited by 96
  5. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  6. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  7. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 86
  8. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  9. 2021Proof-of-Learning: Definitions and Practicecited by 84
  10. 2021Backdoor Attack in the Physical Worldcited by 84
  11. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
  12. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  13. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 74
  14. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 73
  15. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 73
  16. 2023Unleashing the potential of prompt engineering for large language modelscited by 72
  17. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 72
  18. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 69
  19. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
  20. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 66
  21. 2022Backdoor Defense with Machine Unlearningcited by 65
  22. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 65
  23. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 64
  24. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  25. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 63
  26. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 61
  27. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  28. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 59
  29. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 58
  30. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 57
  31. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 55
  32. 2023Detecting Backdoors in Pre-trained Encoderscited by 55
  33. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 53
  34. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 51
  35. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  36. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  37. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  38. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 47

50 most cited of 580 All 580 (JSON)