Data to 7 Oct 2026

Bypassing Backdoor Detection Algorithms in Deep Learning

arXiv 1905.13409 ↗First posted 31 May 2019cs.LG cs.CR stat.MLcited by 69

Not on the map. Why?

Abstract (arXiv)

Deep learning models are vulnerable to various adversarial manipulations of their training data, parameters, and input sample. In particular, an adversary can modify the training data and model parameters to embed backdoors into the model, so the model behaves according to the adversary's objective if the input contains the backdoor features, referred to as the backdoor trigger (e.g., a stamp on an image). The poisoned model's behavior on clean data, however, remains unchanged. Many detection algorithms are designed to detect backdoors on input samples or model parameters, through the statistical difference between the latent representations of adversarial and clean input samples in the poisoned model. In this paper, we design an adversarial backdoor embedding algorithm that can bypass the existing detection algorithms including the state-of-the-art techniques. We design an adaptive adversarial training algorithm that optimizes the original loss function of the model, and also maximizes the indistinguishability of the hidden representations of poisoned data and clean data. This work calls for designing adversary-aware defense mechanisms for backdoor detection.

Key facts. Cited by 69 papers in the map (data through 7 Oct 2026). First posted on arXiv 31 May 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 17; 2022: 15; 2023: 18; 2024: 11; 2025: 4; 2026: 4.

69 papers.

Sort:

By area:

2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
2021Hidden Backdoors in Human-Centric Language Modelscited by 83
2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
2021Handcrafted Backdoors in Deep Neural Networkscited by 57
2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
2023Label Poisoning is All You Needcited by 27

38 more

2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 25
2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 25
2021ML Attack Models: Adversarial Attacks and Data Poisoning Attackscited by 23
2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
2021Backdoor Attack through Frequency Domaincited by 18
2023Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Datacited by 18
2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
2021Enhancing Backdoor Attacks with Multi-Level MMD Regularizationcited by 15
2022Few-shot Backdoor Attacks via Neural Tangent Kernelscited by 15
2023Rethinking Backdoor Attackscited by 14
2022Data-Efficient Backdoor Attackscited by 13
2022Towards A Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasurescited by 11
2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11
2022Imperceptible and Multi-channel Backdoor Attack against Deep Neural Networkscited by 10
2023Progressive Poisoned Data Isolation for Training-time Backdoor Defensecited by 10
2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 7
2023SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classificationcited by 6
2021Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functionscited by 5
202110 Security and Privacy Problems in Large Foundation Modelscited by 5
2022Towards a Defense Against Federated Backdoor Attacks Under Continuous Trainingcited by 5
2022Adversarial Machine Learning Threat Analysis and Remediation in Open Radio Access Network (O-RAN)cited by 3
2024Testing autonomous vehicles and AI: perspectives and challenges from cybersecurity, transparency, robustness and fairnesscited by 3
2025Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalizationcited by 3
2022PiDAn: A Coherence Optimization Approach for Backdoor Attack Detection and Mitigation in Deep Neural Networkscited by 2
2023Universal Soldier: Using Universal Adversarial Perturbations for Detecting Backdoor Attackscited by 2
2024Low-Frequency Black-Box Backdoor Attack via Evolutionary Algorithmcited by 2
2024On the (In)feasibility of ML Backdoor Detection as an Hypothesis Testing Problemcited by 2
2024Clean-image Backdoor Attackscited by 2
2024LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithmcited by 2
2021CatchBackdoor: Backdoor Detection via Critical Trojan Neural Path Fuzzingcited by 1
2022Circumventing Backdoor Defenses That Are Based on Latent Separabilitycited by 1
2023Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelinescited by 1
2023Human in the AI loop via xAI and Active Learning for Visual Inspectioncited by 1
2023A reading survey on adversarial machine learning: Adversarial attacks and their understandingcited by 1

50 most cited of 69 All 69 (JSON)