Data to 7 Oct 2026

A new Backdoor Attack in CNNs by training set corruption without label poisoning

arXiv 1902.11237 ↗First posted 12 Feb 2019cs.CR cs.CV cs.LGcited by 237

Not on the map. Why?

Cited by 58 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attacks against CNNs represent a new threat against deep learning systems, due to the possibility of corrupting the training set so to induce an incorrect behaviour at test time. To avoid that the trainer recognises the presence of the corrupted samples, the corruption of the training set must be as stealthy as possible. Previous works have focused on the stealthiness of the perturbation injected into the training samples, however they all assume that the labels of the corrupted samples are also poisoned. This greatly reduces the stealthiness of the attack, since samples whose content does not agree with the label can be identified by visual inspection of the training set or by running a pre-classification step. In this paper we present a new backdoor attack without label poisoning Since the attack works by corrupting only samples of the target class, it has the additional advantage that it does not need to identify beforehand the class of the samples to be attacked at test time. Results obtained on the MNIST digits recognition task and the traffic signs classification task show that backdoor attacks without label poisoning are indeed possible, thus raising a new alarm regarding the use of deep learning in security-critical applications.

Key facts. Cited by 237 papers in the map (data through 7 Oct 2026). First posted on arXiv 12 Feb 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 16; 2022: 40; 2023: 54; 2024: 65; 2025: 35; 2026: 27.

237 papers.

Sort:

By area:

2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82

38 more

2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
2023Backdoor Defense via Deconfounded Representation Learningcited by 38
2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 35
2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
2024BadMerging: Backdoor Attacks Against Model Mergingcited by 32
2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
2022TrojViT: Trojan Insertion in Vision Transformerscited by 30
2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
2023Label Poisoning is All You Needcited by 27
2022CrowdGuard: Federated Backdoor Detection in Federated Learningcited by 26
2023CUDA: Convolution-based Unlearnable Datasetscited by 26
2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 25
2024Towards Robust Physical-world Backdoor Attacks on Lane Detectioncited by 25
2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
2023Backdoor Attack with Sparse and Invisible Triggercited by 20
2025Data Poisoning in Deep Learning: A Surveycited by 20
2022Defending Backdoor Attacks on Vision Transformer via Patch Processingcited by 19
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
2021Backdoor Attack through Frequency Domaincited by 18

50 most cited of 237 All 237 (JSON)