Data to 7 Oct 2026

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

arXiv 2007.02343 ↗First posted 5 Jul 2020cs.CVcited by 341

Not on the map. Why?

Cited by 83 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Recent studies have shown that DNNs can be compromised by backdoor attacks crafted at training time. A backdoor attack installs a backdoor into the victim model by injecting a backdoor pattern into a small proportion of the training data. At test time, the victim model behaves normally on clean test data, yet consistently predicts a specific (likely incorrect) target class whenever the backdoor pattern is present in a test example. While existing backdoor attacks are effective, they are not stealthy. The modifications made on training data or labels are often suspicious and can be easily detected by simple data filtering or human inspection. In this paper, we present a new type of backdoor attack inspired by an important natural phenomenon: reflection. Using mathematical modeling of physical reflection models, we propose reflection backdoor (Refool) to plant reflections as backdoor into a victim model. We demonstrate on 3 computer vision tasks and 5 datasets that, Refool can attack state-of-the-art DNNs with high success rate, and is resistant to state-of-the-art backdoor defenses.

Key facts. Cited by 341 papers in the map (data through 7 Oct 2026). First posted on arXiv 5 Jul 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 42; 2022: 75; 2023: 69; 2024: 87; 2025: 43; 2026: 25.

341 papers.

Sort:

By area:

2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102

38 more

2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targetscited by 88
2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
2023Unleashing the potential of prompt engineering for large language modelscited by 72
2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
2023Composite Backdoor Attacks Against Large Language Modelscited by 63
2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
2023Detecting Backdoors in Pre-trained Encoderscited by 53
2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 48
2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
2022BadDet: Backdoor Attacks on Object Detectioncited by 45
2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
2023Backdoor Defense via Deconfounded Representation Learningcited by 38
2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
2023Explain Any Concept: Segment Anything Meets Concept-Based Explanationcited by 37
2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 35
2022Unlearnable Clusters: Towards Label-agnostic Unlearnable Examplescited by 35

50 most cited of 341 All 341 (JSON)