mlsanityData to 7 Oct 2026

Backdoor Learning: A Survey

arXiv 2007.08745 ↗First posted 17 Jul 2020cs.CR cs.CV cs.LGcited by 412

Not on the map. Why?

Cited by 137 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attack intends to embed hidden backdoor into deep neural networks (DNNs), so that the attacked models perform well on benign samples, whereas their predictions will be maliciously changed if the hidden backdoor is activated by attacker-specified triggers. This threat could happen when the training process is not fully controlled, such as training on third-party datasets or adopting third-party models, which poses a new and realistic threat. Although backdoor learning is an emerging and rapidly growing research area, its systematic review, however, remains blank. In this paper, we present the first comprehensive survey of this realm. We summarize and categorize existing backdoor attacks and defenses based on their characteristics, and provide a unified framework for analyzing poisoning-based backdoor attacks. Besides, we also analyze the relation between backdoor attacks and relevant fields (i.e., adversarial attacks and data poisoning), and summarize widely adopted benchmark datasets. Finally, we briefly outline certain future research directions relying upon reviewed works. A curated list of backdoor-related resources is also available at urlhttps://github.com/THUYimingLi/backdoor-learning-resources.

Key facts. Cited by 412 papers in the map (data through 7 Oct 2026). First posted on arXiv 17 Jul 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 28; 2022: 67; 2023: 100; 2024: 92; 2025: 76; 2026: 49.

412 papers.

Sort:

By area:

  1. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  2. 2023Large Language Model Alignment: A Surveycited by 241
  3. 2021Trustworthy AI: From Principles to Practicescited by 206
  4. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  5. 2022Training Data Influence Analysis and Estimation: A Surveycited by 134
  6. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  7. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  8. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 100
  9. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  10. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  11. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  12. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
38 more
  1. 2022Towards Adversarial Evaluations for Inexact Machine Unlearningcited by 82
  2. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  3. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  4. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
  5. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 74
  6. 2024Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptationcited by 74
  7. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  8. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  9. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  10. 2021From Distributed Machine Learning to Federated Learning: A Surveycited by 65
  11. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  12. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
  13. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  14. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  15. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  16. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  17. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  18. 2024Instruction Backdoor Attacks Against Customized LLMscited by 50
  19. 2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
  20. 2024On Targeted Manipulation and Deception when Optimizing LLMs for User Feedbackcited by 45
  21. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  22. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  23. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  24. 2023Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomycited by 44
  25. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  26. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  27. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Modelscited by 42
  28. 2024Stress-Testing Capability Elicitation With Password-Locked Modelscited by 42
  29. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  30. 2021Few-shot Backdoor Defense Using Shapley Estimationcited by 40
  31. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  32. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  33. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  34. 2023Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarkingcited by 37
  35. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 37
  36. 2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 35
  37. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  38. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35

50 most cited of 412 All 412 (JSON)