Data to 7 Oct 2026

Rethinking the Trigger of Backdoor Attack

arXiv 2004.04692 ↗First posted 9 Apr 2020cs.CR cs.CV cs.LGcited by 76

Not on the map. Why?

Cited by 24 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs), such that the prediction of the infected model will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger, while it performs well on benign samples. Currently, most of existing backdoor attacks adopted the setting of static trigger, i.e., triggers across the training and testing images follow the same appearance and are located in the same area. In this paper, we revisit this attack paradigm by analyzing the characteristics of the static trigger. We demonstrate that such an attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training. We further explore how to utilize this property for backdoor defense, and discuss how to alleviate such vulnerability of existing attacks.

Key facts. Cited by 76 papers in the map (data through 7 Oct 2026). First posted on arXiv 9 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 19; 2023: 16; 2024: 16; 2025: 7; 2026: 5.

76 papers.

Sort:

By area:

2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44

38 more

2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
2021Defending Against Backdoor Attacks in Natural Language Generationcited by 30
2023CUDA: Convolution-based Unlearnable Datasetscited by 26
2021ML Attack Models: Adversarial Attacks and Data Poisoning Attackscited by 23
2021Robust Backdoor Attacks against Deep Neural Networks in Real Physical Worldcited by 20
2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
2022Defending Backdoor Attacks on Vision Transformer via Patch Processingcited by 19
2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
2022Eliminating Backdoor Triggers for Deep Neural Networks Using Attention Relation Graph Distillationcited by 18
2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
2022How to Sift Out a Clean Data Subset in the Presence of Data Poisoning?cited by 17
2024DisDet: Exploring Detectability of Backdoor Attack on Diffusion Modelscited by 17
2021Enhancing Backdoor Attacks with Multi-Level MMD Regularizationcited by 15
2022Quarantine: Sparsity Can Uncover the Trojan Attack Trigger for Freecited by 15
2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
2022Poison Attack and Defense on Deep Source Code Processing Modelscited by 8
2023A semantic backdoor attack against Graph Convolutional Networkscited by 8
2023Don't FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNscited by 8
2023Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggerscited by 8
2023Watch Out! Simple Horizontal Class Backdoor Can Trivially Evade Defensecited by 7
2025Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimizationcited by 7
2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
2021EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetrycited by 5
2022An Adaptive Black-box Defense against Trojan Attacks (TrojDef)cited by 5
2024Backdoor Attack on Unpaired Medical Image-Text Foundation Models: A Pilot Study on MedCLIPcited by 5
2024Data Free Backdoor Attackscited by 5
2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Datacited by 5
2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
2021MISA: Online Defense of Trojaned Models using Misattributionscited by 4
2022DECK: Model Hardening for Defending Pervasive Backdoorscited by 4
2022Defense against Backdoor Attacks via Identifying and Purifying Bad Neuronscited by 4
2022RIBAC: Towards Robust and Imperceptible Backdoor Attack against Compact DNNcited by 4
2024Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearningcited by 4

50 most cited of 76 All 76 (JSON)