# Backdoor Attacks against Transfer Learning with Pre-trained Deep Learning Models

arXiv: https://arxiv.org/abs/2001.03274 · HTML: https://mlsanity.com/paper/2001.03274/

## Key facts

- Cited by 44 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Jan 2020.

## Built on by (most cited first, 30 of 44)

- [T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification](https://mlsanity.com/paper/2103.04264/) (2021)
- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [Order-Disorder: Imitation Adversarial Attacks for Black-box Neural Ranking Models](https://mlsanity.com/paper/2209.06506/) (2022)
- [BadMerging: Backdoor Attacks Against Model Merging](https://mlsanity.com/paper/2408.07362/) (2024)
- [Defending Against Backdoor Attacks in Natural Language Generation](https://mlsanity.com/paper/2106.01810/) (2021)
- [Machine learning and deep learning](https://mlsanity.com/paper/2104.05314/) (2021)
- [BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasets](https://mlsanity.com/paper/2210.04688/) (2022)
- [A Survey of Neural Trojan Attacks and Defenses in Deep Learning](https://mlsanity.com/paper/2202.07183/) (2022)
- [Enhancing Backdoor Attacks with Multi-Level MMD Regularization](https://mlsanity.com/paper/2111.05077/) (2021)
- [Backdoor Attacks on Time Series: A Generative Approach](https://mlsanity.com/paper/2211.07915/) (2022)
- [Obliviate: Neutralizing Task-agnostic Backdoors within the Parameter-efficient Fine-tuning Paradigm](https://mlsanity.com/paper/2409.14119/) (2024)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)
- [Similarity-based Gray-box Adversarial Attack Against Deep Face Recognition](https://mlsanity.com/paper/2201.04011/) (2022)
- [Machine Learning for Security in Vehicular Networks: A Comprehensive Survey](https://mlsanity.com/paper/2105.15035/) (2021)
- [Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios](https://mlsanity.com/paper/2306.08386/) (2023)
- [Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systems](https://mlsanity.com/paper/2311.11796/) (2023)
- [GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion](https://mlsanity.com/paper/2504.20829/) (2025)
- [Influencer Backdoor Attack on Semantic Segmentation](https://mlsanity.com/paper/2303.12054/) (2023)
- [DHBE: Data-free Holistic Backdoor Erasing in Deep Neural Networks via Restricted Adversarial Distillation](https://mlsanity.com/paper/2306.08009/) (2023)
- [A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks](https://mlsanity.com/paper/2306.08313/) (2023)
- [IPA-NeRF: Illusory Poisoning Attack Against Neural Radiance Fields](https://mlsanity.com/paper/2407.11921/) (2024)
- [Neutralizing Backdoors through Information Conflicts for Large Language Models](https://mlsanity.com/paper/2411.18280/) (2024)
- [DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Data](https://mlsanity.com/paper/2503.21305/) (2025)
- [MISA: Online Defense of Trojaned Models using Misattributions](https://mlsanity.com/paper/2103.15918/) (2021)
- [Model Inversion Attack against Transfer Learning: Inverting a Model without Accessing It](https://mlsanity.com/paper/2203.06570/) (2022)
- [Federated and Transfer Learning: A Survey on Adversaries and Defense Mechanisms](https://mlsanity.com/paper/2207.02337/) (2022)
- [Backdoor Learning for NLP: Recent Advances, Challenges, and Future Research Directions](https://mlsanity.com/paper/2302.06801/) (2023)
- [A General Framework for Defending Against Backdoor Attacks via Influence Graph](https://mlsanity.com/paper/2111.14309/) (2021)
- [Trojan Horse Training for Breaking Defenses against Backdoor Attacks in Deep Learning](https://mlsanity.com/paper/2203.15506/) (2022)
- [A Red Teaming Framework for Securing AI in Maritime Autonomous Systems](https://mlsanity.com/paper/2312.11500/) (2023)

## Abstract (arXiv)

Transfer learning provides an effective solution for feasibly and fast customize accurate textitStudent models, by transferring the learned knowledge of pre-trained textitTeacher models over large datasets via fine-tuning. Many pre-trained Teacher models used in transfer learning are publicly available and maintained by public platforms, increasing their vulnerability to backdoor attacks. In this paper, we demonstrate a backdoor threat to transfer learning tasks on both image and time-series data leveraging the knowledge of publicly accessible Teacher models, aimed at defeating three commonly-adopted defenses: textitpruning-based, textitretraining-based and textitinput pre-processing-based defenses. Specifically, (A) ranking-based selection mechanism to speed up the backdoor trigger generation and perturbation process while defeating textitpruning-based and/or textitretraining-based defenses. (B) autoencoder-powered trigger generation is proposed to produce a robust trigger that can defeat the textitinput pre-processing-based defense, while guaranteeing that selected neuron(s) can be significantly activated. (C) defense-aware retraining to generate the manipulated model using reverse-engineered model inputs. We launch effective misclassification attacks on Student models over real-world images, brain Magnetic Resonance Imaging (MRI) data and Electrocardiography (ECG) learning systems. The experiments reveal that our enhanced attack can maintain the 98.4% and 97.2% classification accuracy as the genuine model on clean image and time series inputs respectively while improving 27.9%-100% and 27.1%-56.1% attack success rate on trojaned image and time series inputs respectively in the presence of pruning-based and/or retraining-based defenses.