mlsanityData to 7 Oct 2026

Backdooring Convolutional Neural Networks via Targeted Weight Perturbations

arXiv 1812.03128 ↗First posted 7 Dec 2018cs.CVcited by 66

Not on the map. Why?

Abstract (arXiv)

We present a new type of backdoor attack that exploits a vulnerability of convolutional neural networks (CNNs) that has been previously unstudied. In particular, we examine the application of facial recognition. Deep learning techniques are at the top of the game for facial recognition, which means they have now been implemented in many production-level systems. Alarmingly, unlike other commercial technologies such as operating systems and network devices, deep learning-based facial recognition algorithms are not presently designed with security requirements or audited for security vulnerabilities before deployment. Given how young the technology is and how abstract many of the internal workings of these algorithms are, neural network-based facial recognition systems are prime targets for security breaches. As more and more of our personal information begins to be guarded by facial recognition (e.g., the iPhone X), exploring the security vulnerabilities of these systems from a penetration testing standpoint is crucial. Along these lines, we describe a general methodology for backdooring CNNs via targeted weight perturbations. Using a five-layer CNN and ResNet-50 as case studies, we show that an attacker is able to significantly increase the chance that inputs they supply will be falsely accepted by a CNN while simultaneously preserving the error rates for legitimate enrolled classes.

Key facts. Cited by 66 papers in the map (data through 7 Oct 2026). First posted on arXiv 7 Dec 2018.

Builds on

No reference list yet.

Built on by

Cited by year

Citing papers per year: 2021: 10; 2022: 15; 2023: 15; 2024: 16; 2025: 10.

66 papers.

Sort:

By area:

  1. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  2. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  3. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
  4. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  5. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  6. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  7. 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
  8. 2023Training-free Lexical Backdoor Attacks on Language Modelscited by 27
  9. 2023Label Poisoning is All You Needcited by 27
  10. 2021How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Datacited by 22
  11. 2021Robust Backdoor Attacks against Deep Neural Networks in Real Physical Worldcited by 20
  12. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
38 more
  1. 2022Defending Backdoor Attacks on Vision Transformer via Patch Processingcited by 19
  2. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 19
  3. 2021Robust Federated Learning with Attack-Adaptive Aggregationcited by 17
  4. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
  5. 2021Enhancing Backdoor Attacks with Multi-Level MMD Regularizationcited by 15
  6. 2022Compression-Resistant Backdoor Attack against Deep Neural Networkscited by 14
  7. 2022Data-Efficient Backdoor Attackscited by 13
  8. 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attackscited by 12
  9. 2024Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Triggercited by 12
  10. 2022Federated Learning Attacks and Defenses: A Surveycited by 11
  11. 2023Beating Backdoor Attack at Its Own Gamecited by 11
  12. 2024Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Priorcited by 11
  13. 2022Backdoor Attacks on Time Series: A Generative Approachcited by 10
  14. 2022Neighboring Backdoor Attacks on Graph Convolutional Networkcited by 7
  15. 2023Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarioscited by 7
  16. 2023Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attackscited by 7
  17. 2024Towards Physical World Backdoor Attacks against Skeleton Action Recognitioncited by 7
  18. 2021Random and Adversarial Bit Error Robustness: Energy-Efficient and Secure DNN Acceleratorscited by 6
  19. 2021Turning Federated Learning Systems Into Covert Channelscited by 6
  20. 2022Augmentation Backdoorscited by 5
  21. 2023Influencer Backdoor Attack on Semantic Segmentationcited by 5
  22. 2023Robust Backdoor Attacks on Object Detection in Real Worldcited by 5
  23. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Datacited by 5
  24. 2021MISA: Online Defense of Trojaned Models using Misattributionscited by 4
  25. 2023Facial Misrecognition Systems: Simple Weight Manipulations Force DNNs to Err Only on Specific Personscited by 4
  26. 2022Trojan Horse Training for Breaking Defenses against Backdoor Attacks in Deep Learningcited by 3
  27. 2023PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modificationcited by 3
  28. 2024Mask-based Invisible Backdoor Attacks on Object Detectioncited by 3
  29. 2024Flashy Backdoor: Real-world Environment Backdoor Attack on SNNs with DVS Camerascited by 3
  30. 2022PiDAn: A Coherence Optimization Approach for Backdoor Attack Detection and Mitigation in Deep Neural Networkscited by 2
  31. 2022Hide and Seek: on the Stealthiness of Attacks against Deep Learning Systemscited by 2
  32. 2023INK: Inheritable Natural Backdoor Attack Against Model Distillationcited by 2
  33. 2024Lazy Layers to Make Fine-Tuned Diffusion Models More Traceablecited by 2
  34. 2024Backdoor defense, learnability and obfuscationcited by 2
  35. 2025Revisiting Training-Inference Trigger Intensity in Backdoor Attackscited by 2
  36. 2025THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Modelscited by 2
  37. 2025Sealing The Backdoor: Unlearning Adversarial Text Triggers In Diffusion Models Using Knowledge Distillationcited by 2
  38. 2022Understanding Impacts of Task Similarity on Backdoor Attack and Detectioncited by 1

50 most cited of 66 All 66 (JSON)