mlsanityData to 14 Oct 2026

Hidden Trigger Backdoor Attacks

arXiv 1910.00033 ↗First posted 30 Sep 2019cs.CVcited by 371

Not on the map. Why?

Cited by 137 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

With the success of deep learning algorithms in various domains, studying adversarial attacks to secure deep models in real world applications has become an important research topic. Backdoor attacks are a form of adversarial attacks on deep networks where the attacker provides poisoned data to the victim to train the model with, and then activates the attack by showing a specific small trigger pattern at the test time. Most state-of-the-art backdoor attacks either provide mislabeled poisoning data that is possible to identify by visual inspection, reveal the trigger in the poisoned data, or use noise to hide the trigger. We propose a novel form of backdoor attack where poisoned data look natural with correct labels and also more importantly, the attacker hides the trigger in the poisoned data and keeps the trigger secret until the test time. We perform an extensive study on various image classification settings and show that our attack can fool the model by pasting the trigger at random locations on unseen images although the model performs well on clean data. We also show that our proposed attack cannot be easily defended using a state-of-the-art defense algorithm for backdoor attacks.

Key facts. Cited by 371 papers in the map (data through 14 Oct 2026). First posted on arXiv 30 Sep 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 55; 2022: 74; 2023: 83; 2024: 78; 2025: 43; 2026: 38.

371 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  2. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  3. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 222
  4. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  5. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  6. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
  7. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 123
  8. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  9. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 105
  10. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 104
  11. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 103
  12. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 102
38 more
  1. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  2. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
  3. 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 95
  4. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  5. 2021Backdoor Attacks on Self-Supervised Learningcited by 90
  6. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  7. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  8. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 75
  9. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 74
  10. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 73
  11. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
  12. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  13. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 63
  14. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 63
  15. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directionscited by 63
  16. 2021Availability Attacks Create Shortcutscited by 62
  17. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  18. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  19. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 55
  20. 2023Detecting Backdoors in Pre-trained Encoderscited by 55
  21. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 53
  22. 2023Unveiling Security, Privacy, and Ethical Concerns of ChatGPTcited by 53
  23. 2021Hard to Forget: Poisoning Attacks on Certified Machine Unlearningcited by 52
  24. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 52
  25. 2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 51
  26. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  27. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 48
  28. 2023Rethinking Out-of-distribution (OOD) Detection: Masked Image Modeling is All You Needcited by 46
  29. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 45
  30. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  31. 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 43
  32. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 42
  33. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 40
  34. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 40
  35. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 40
  36. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 39
  37. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  38. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38

50 most cited of 371 All 371 (JSON)