mlsanityData to 7 Oct 2026

Blind Backdoors in Deep Learning Models

arXiv 2005.03823 ↗First posted 8 May 2020cs.CR cs.CV cs.LGcited by 174

Not on the map. Why?

Cited by 44 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We investigate a new method for injecting backdoors into machine learning models, based on compromising the loss-value computation in the model-training code. We use it to demonstrate new classes of backdoors strictly more powerful than those in the prior literature: single-pixel and physical backdoors in ImageNet models, backdoors that switch the model to a covert, privacy-violating task, and backdoors that do not require inference-time input modifications. Our attack is blind: the attacker cannot modify the training data, nor observe the execution of his code, nor access the resulting model. The attack code creates poisoned training inputs "on the fly," as the model is training, and uses multi-objective optimization to achieve high accuracy on both the main and backdoor tasks. We show how a blind attack can evade any known defense and propose new ones.

Key facts. Cited by 174 papers in the map (data through 7 Oct 2026). First posted on arXiv 8 May 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 27; 2022: 33; 2023: 32; 2024: 37; 2025: 30; 2026: 15.

174 papers.

Sort:

By area:

  1. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
  2. 2021Unsolved Problems in ML Safetycited by 291
  3. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  4. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  5. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  6. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  7. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  8. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
  9. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  10. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  11. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  12. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
38 more
  1. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  2. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  3. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  4. 2021Can You Hear It? Backdoor Attacks via Ultrasonic Triggerscited by 41
  5. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  6. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  7. 2021The Threat of Offensive AI to Organizationscited by 37
  8. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  9. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  10. 2021PointBA: Towards Backdoor Attacks in 3D Point Cloudcited by 34
  11. 2021FedIPR: Ownership Verification for Federated Deep Neural Network Modelscited by 33
  12. 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
  13. 2022Physical Backdoor Attacks to Lane Detection Systems in Autonomous Drivingcited by 29
  14. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  15. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generationcited by 28
  16. 2023Label Poisoning is All You Needcited by 27
  17. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  18. 2022Architectural Backdoors in Neural Networkscited by 24
  19. 2024A Trembling House of Cards? Mapping Adversarial Attacks against Language Agentscited by 22
  20. 2021Robust Backdoor Attacks against Deep Neural Networks in Real Physical Worldcited by 20
  21. 2022Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical Worldcited by 20
  22. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  23. 2021Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggerscited by 19
  24. 2022Defending Backdoor Attacks on Vision Transformer via Patch Processingcited by 19
  25. 2023Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Datacited by 18
  26. 2021Stealthy Backdoors as Compression Artifactscited by 17
  27. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
  28. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  29. 2024MEA-Defender: A Robust Watermark against Model Extraction Attackcited by 16
  30. 2021Decentralized Deep Learning for Multi-Access Edge Computing: A Survey on Communication Efficiency and Trustworthinesscited by 15
  31. 2025DarkMind: Latent Chain-of-Thought Backdoor in Customized LLMscited by 15
  32. 2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
  33. 2023BDMMT: Backdoor Sample Detection for Language Models through Model Mutation Testingcited by 13
  34. 2023Backdooring Neural Code Searchcited by 13
  35. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  36. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  37. 2023SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learningcited by 11
  38. 2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11

50 most cited of 174 All 174 (JSON)