mlsanityData to 7 Oct 2026

Label-Consistent Backdoor Attacks

arXiv 1912.02771 ↗First posted 5 Dec 2019stat.ML cs.CR cs.LGcited by 285

Not on the map. Why?

Cited by 83 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks have been demonstrated to be vulnerable to backdoor attacks. Specifically, by injecting a small number of maliciously constructed inputs into the training set, an adversary is able to plant a backdoor into the trained model. This backdoor can then be activated during inference by a backdoor trigger to fully control the model's behavior. While such attacks are very effective, they crucially rely on the adversary injecting arbitrary inputs that are---often blatantly---mislabeled. Such samples would raise suspicion upon human inspection, potentially revealing the attack. Thus, for backdoor attacks to remain undetected, it is crucial that they maintain label-consistency---the condition that injected inputs are consistent with their labels. In this work, we leverage adversarial perturbations and generative models to execute efficient, yet label-consistent, backdoor attacks. Our approach is based on injecting inputs that appear plausible, yet are hard to classify, hence causing the model to rely on the (easier-to-learn) backdoor trigger.

Key facts. Cited by 285 papers in the map (data through 7 Oct 2026). First posted on arXiv 5 Dec 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 30; 2022: 48; 2023: 59; 2024: 57; 2025: 51; 2026: 40.

285 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  2. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  3. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  4. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  5. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  6. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  7. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  8. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  9. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  10. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  11. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  12. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
38 more
  1. 2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targetscited by 88
  2. 2021Backdoor Attack in the Physical Worldcited by 82
  3. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  4. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  5. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  6. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  7. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 66
  8. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
  9. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  10. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  11. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  12. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  13. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  14. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 50
  15. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  16. 2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
  17. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  18. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  19. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  20. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  21. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  22. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  23. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  24. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  25. 2021PointBA: Towards Backdoor Attacks in 3D Point Cloudcited by 34
  26. 2021Topological Detection of Trojaned Neural Networkscited by 34
  27. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  28. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  29. 2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
  30. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 32
  31. 2022TrojViT: Trojan Insertion in Vision Transformerscited by 30
  32. 2022An Embarrassingly Simple Backdoor Attack on Self-supervised Learningcited by 30
  33. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
  34. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  35. 2024Teach LLMs to Phish: Stealing Private Information from Language Modelscited by 29
  36. 2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
  37. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 28
  38. 2023Label Poisoning is All You Needcited by 27

50 most cited of 285 All 285 (JSON)