mlsanityData to 7 Oct 2026

Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review

arXiv 2007.10760 ↗First posted 21 Jul 2020cs.CR cs.CV cs.LGcited by 120

Not on the map. Why?

Cited by 34 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

This work provides the community with a timely comprehensive review of backdoor attacks and countermeasures on deep learning. According to the attacker's capability and affected stage of the machine learning pipeline, the attack surfaces are recognized to be wide and then formalized into six categorizations: code poisoning, outsourcing, pretrained, data collection, collaborative learning and post-deployment. Accordingly, attacks under each categorization are combed. The countermeasures are categorized into four general classes: blind backdoor removal, offline backdoor inspection, online backdoor inspection, and post backdoor removal. Accordingly, we review countermeasures, and compare and analyze their advantages and disadvantages. We have also reviewed the flip side of backdoor attacks, which are explored for i) protecting intellectual property of deep learning models, ii) acting as a honeypot to catch adversarial example attacks, and iii) verifying data deletion requested by the data contributor.Overall, the research on defense is far behind the attack, and there is no single defense that can prevent all types of backdoor attacks. In some cases, an attacker can intelligently bypass existing defenses with an adaptive attack. Drawing the insights from the systematic review, we also present key areas for future research on the backdoor, such as empirical security evaluations from physical trigger attacks, and in particular, more efficient and practical countermeasures are solicited.

Key facts. Cited by 120 papers in the map (data through 7 Oct 2026). First posted on arXiv 21 Jul 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 20; 2022: 25; 2023: 22; 2024: 21; 2025: 25; 2026: 7.

120 papers.

Sort:

By area:

  1. 2023Large Language Model Alignment: A Surveycited by 241
  2. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  3. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  4. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agentscited by 106
  5. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  6. 2021Backdoor Attack in the Physical Worldcited by 82
  7. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 82
  8. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  9. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  10. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  11. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  12. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
38 more
  1. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  2. 2021This looks more like that: Enhancing Self-Explaining Models by Prototypical Relevance Propagationcited by 43
  3. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  4. 2022ProtoVAE: A Trustworthy Self-Explainable Prototypical Variational Modelcited by 34
  5. 2022CrowdGuard: Federated Backdoor Detection in Federated Learningcited by 26
  6. 2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 25
  7. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  8. 2025DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agentcited by 23
  9. 2022Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical Worldcited by 20
  10. 2025Ten Challenging Problems in Federated Foundation Modelscited by 20
  11. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  12. 2022Transferable Graph Backdoor Attackcited by 19
  13. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  14. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
  15. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  16. 2025Safety Mirage: How Spurious Correlations Undermine VLM Safety Fine-Tuning and Can Be Mitigated by Machine Unlearningcited by 16
  17. 2025Natural Reflection Backdoor Attack on Vision Language Model for Autonomous Drivingcited by 16
  18. 2022A Temporal-Pattern Backdoor Attack to Deep Reinforcement Learningcited by 15
  19. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  20. 2021TOP: Backdoor Detection in Neural Networks via Transferability of Perturbationcited by 13
  21. 2024CleanerCLIP: Fine-grained Counterfactual Semantic Augmentation for Backdoor Defense in Contrastive Learningcited by 13
  22. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 12
  23. 2024Backdooring Bias (B2) into Stable Diffusion Modelscited by 12
  24. 2022Towards A Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasurescited by 11
  25. 2022Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Modelscited by 11
  26. 2025Robust Anti-Backdoor Instruction Tuning in LVLMscited by 10
  27. 2021Revisiting Model's Uncertainty and Confidences for Adversarial Example Detectioncited by 9
  28. 2021Check Your Other Door! Creating Backdoor Attacks in the Frequency Domaincited by 9
  29. 2022Threat Assessment in Machine Learning based Systemscited by 9
  30. 2021GAL: Gradient Assisted Learning for Decentralized Multi-Organization Collaborationscited by 8
  31. 2022TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-Worldcited by 8
  32. 2023Vertical Federated Learning: Taxonomies, Threats, and Prospectscited by 8
  33. 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 8
  34. 2021Poisoning MorphNet for Clean-Label Backdoor Attack to Point Cloudscited by 7
  35. 2023FreeEagle: Detecting Complex Neural Trojans in Data-Free Casescited by 7
  36. 2023Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarioscited by 7
  37. 2023Watch Out! Simple Horizontal Class Backdoor Can Trivially Evade Defensecited by 7
  38. 2023BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Liftingcited by 7

50 most cited of 120 All 120 (JSON)