# Scalable Backdoor Detection in Neural Networks

arXiv: https://arxiv.org/abs/2006.05646 · HTML: https://mlsanity.com/paper/2006.05646/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Jun 2020.

## Built on by (most cited first, 15 of 15)

- [Black-box Detection of Backdoor Attacks with Limited Information and Data](https://mlsanity.com/paper/2103.13127/) (2021)
- [Fine-mixing: Mitigating Backdoors in Fine-tuned Language Models](https://mlsanity.com/paper/2210.09545/) (2022)
- [How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Data](https://mlsanity.com/paper/2109.01300/) (2021)
- [Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesis](https://mlsanity.com/paper/2210.10886/) (2022)
- [Backdoor Attacks on Time Series: A Generative Approach](https://mlsanity.com/paper/2211.07915/) (2022)
- [Dim-Krum: Backdoor-Resistant Federated Learning for NLP with Dimension-wise Krum-Based Aggregation](https://mlsanity.com/paper/2210.06894/) (2022)
- [Towards Effective and Robust Neural Trojan Defenses via Input Filtering](https://mlsanity.com/paper/2202.12154/) (2022)
- [Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearning](https://mlsanity.com/paper/2405.14781/) (2024)
- [Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System](https://mlsanity.com/paper/2310.10659/) (2023)
- [Semantic Host-free Trojan Attack](https://mlsanity.com/paper/2110.13414/) (2021)
- [Defense Against Multi-target Trojan Attacks](https://mlsanity.com/paper/2207.03895/) (2022)
- [Identifying Physically Realizable Triggers for Backdoored Face Recognition Networks](https://mlsanity.com/paper/2506.19533/) (2025)
- [In Transformer We Trust? A Perspective on Transformer Architecture Failure Modes](https://mlsanity.com/paper/2602.14318/) (2026)
- [A Data-Driven Defense against Edge-case Model Poisoning Attacks on Federated Learning](https://mlsanity.com/paper/2305.02022/) (2023)
- [Composite Concept Extraction through Backdooring](https://mlsanity.com/paper/2406.13411/) (2024)

## Abstract (arXiv)

Recently, it has been shown that deep learning models are vulnerable to Trojan attacks, where an attacker can install a backdoor during training time to make the resultant model misidentify samples contaminated with a small trigger patch. Current backdoor detection methods fail to achieve good detection performance and are computationally expensive. In this paper, we propose a novel trigger reverse-engineering based approach whose computational complexity does not scale with the number of labels, and is based on a measure that is both interpretable and universal across different network and patch types. In experiments, we observe that our method achieves a perfect score in separating Trojaned models from pure models, which is an improvement over the current state-of-the art method.