Data to 7 Oct 2026

On Certifying Robustness against Backdoor Attacks via Randomized Smoothing

arXiv 2002.11750 ↗First posted 26 Feb 2020cs.CR cs.LGcited by 74

Not on the map. Why?

Cited by 23 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attack is a severe security threat to deep neural networks (DNNs). We envision that, like adversarial examples, there will be a cat-and-mouse game for backdoor attacks, i.e., new empirical defenses are developed to defend against backdoor attacks but they are soon broken by strong adaptive backdoor attacks. To prevent such cat-and-mouse game, we take the first step towards certified defenses against backdoor attacks. Specifically, in this work, we study the feasibility and effectiveness of certifying robustness against backdoor attacks using a recent technique called randomized smoothing. Randomized smoothing was originally developed to certify robustness against adversarial examples. We generalize randomized smoothing to defend against backdoor attacks. Our results show the theoretical feasibility of using randomized smoothing to certify robustness against backdoor attacks. However, we also find that existing randomized smoothing methods have limited effectiveness at defending against backdoor attacks, which highlight the needs of new theory and methods to certify robustness against backdoor attacks.

Key facts. Cited by 74 papers in the map (data through 7 Oct 2026). First posted on arXiv 26 Feb 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 21; 2023: 16; 2024: 14; 2025: 5; 2026: 5.

74 papers.

Sort:

By area:

2022Backdoor Defense via Decoupling the Training Processcited by 149
2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 50
2021PointGuard: Provably Robust 3D Point Cloud Classificationcited by 49
2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
2021Data Poisoning Attacks to Deep Learning Based Recommender Systemscited by 41
2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37

38 more

2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 29
2022CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learningcited by 28
2023Label Poisoning is All You Needcited by 27
2022BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasetscited by 24
2023Backdoor Attacks Against Dataset Distillationcited by 20
2022BagFlip: A Certified Defense against Data Poisoningcited by 18
2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
2022Few-shot Backdoor Attacks via Neural Tangent Kernelscited by 15
2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
2023BDMMT: Backdoor Sample Detection for Language Models through Model Mutation Testingcited by 13
2023SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learningcited by 11
2022UniCR: Universally Approximated Certified Robustness via Randomized Smoothingcited by 10
2023Temporal Robustness against Data Poisoningcited by 10
2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 8
2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
2022Reducing Certified Regression to Certified Classification for General Poisoning Attackscited by 7
2022Invariance-Aware Randomized Smoothing Certificatescited by 7
2024Robustness Inspired Graph Backdoor Defensecited by 7
2021Understanding the Security of Deepfake Detectioncited by 6
2023Random Smoothing Regularization in Kernel Gradient Descent Learningcited by 6
2023Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attackscited by 6
2024Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metricscited by 6
2021EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetrycited by 5
202110 Security and Privacy Problems in Large Foundation Modelscited by 5
2022Verifying Neural Networks Against Backdoor Attackscited by 5
2022Towards a Defense Against Federated Backdoor Attacks Under Continuous Trainingcited by 5
2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
2023A Certified Radius-Guided Attack Framework to Image Segmentation Modelscited by 5
2024Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attackscited by 5
2023Facial Misrecognition Systems: Simple Weight Manipulations Force DNNs to Err Only on Specific Personscited by 4
2024Mudjacking: Patching Backdoor Vulnerabilities in Foundation Modelscited by 4
2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
2023Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attackscited by 3

50 most cited of 74 All 74 (JSON)