mlsanityData to 7 Oct 2026

STRIP: A Defence Against Trojan Attacks on Deep Neural Networks

arXiv 1902.06531 ↗First posted 18 Feb 2019cs.CRcited by 437

Not on the map. Why?

Cited by 129 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

A recent trojan attack on deep neural network (DNN) models is one insidious variant of data poisoning attacks. Trojan attacks exploit an effective backdoor created in a DNN model by leveraging the difficulty in interpretability of the learned model to misclassify any inputs signed with the attacker's chosen trojan trigger. Since the trojan trigger is a secret guarded and exploited by the attacker, detecting such trojan inputs is a challenge, especially at run-time when models are in active operation. This work builds STRong Intentional Perturbation (STRIP) based run-time trojan attack detection system and focuses on vision system. We intentionally perturb the incoming input, for instance by superimposing various image patterns, and observe the randomness of predicted classes for perturbed inputs from a given deployed model---malicious or benign. A low entropy in predicted classes violates the input-dependence property of a benign model and implies the presence of a malicious input---a characteristic of a trojaned input. The high efficacy of our method is validated through case studies on three popular and contrasting datasets: MNIST, CIFAR10 and GTSRB. We achieve an overall false acceptance rate (FAR) of less than 1%, given a preset false rejection rate (FRR) of 1%, for different types of triggers. Using CIFAR10 and GTSRB, we have empirically achieved result of 0% for both FRR and FAR. We have also evaluated STRIP robustness against a number of trojan attack variants and adaptive attacks.

Key facts. Cited by 437 papers in the map (data through 7 Oct 2026). First posted on arXiv 18 Feb 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 62; 2022: 86; 2023: 71; 2024: 87; 2025: 66; 2026: 65.

437 papers.

Sort:

By area:

  1. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  2. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  3. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  4. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  5. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  6. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  7. 2023Dataset Distillation: A Comprehensive Reviewcited by 126
  8. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  9. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  10. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  11. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  12. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
38 more
  1. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  2. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  3. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  4. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  5. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  6. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  7. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  8. 2023Unleashing the potential of prompt engineering for large language modelscited by 72
  9. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  10. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  11. 2023Composite Backdoor Attacks Against Large Language Modelscited by 63
  12. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  13. 2022Backdoor Defense with Machine Unlearningcited by 61
  14. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
  15. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  16. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  17. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
  18. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  19. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  20. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  21. 2022Measuring the Effect of Training Data on Deep Learning Predictions via Randomized Experimentscited by 50
  22. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
  23. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
  24. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  25. 2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
  26. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  27. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  28. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  29. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  30. 2021Can You Hear It? Backdoor Attacks via Ultrasonic Triggerscited by 41
  31. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  32. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  33. 2021Trigger Hunting with a Topological Prior for Trojan Detectioncited by 39
  34. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  35. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  36. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  37. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  38. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35

50 most cited of 437 All 437 (JSON)