Data to 7 Oct 2026

Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases

arXiv 2007.15802 ↗First posted 31 Jul 2020cs.LG cs.CR stat.MLcited by 93

Not on the map. Why?

Cited by 22 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

When the training data are maliciously tampered, the predictions of the acquired deep neural network (DNN) can be manipulated by an adversary known as the Trojan attack (or poisoning backdoor attack). The lack of robustness of DNNs against Trojan attacks could significantly harm real-life machine learning (ML) systems in downstream applications, therefore posing widespread concern to their trustworthiness. In this paper, we study the problem of the Trojan network (TrojanNet) detection in the data-scarce regime, where only the weights of a trained DNN are accessed by the detector. We first propose a data-limited TrojanNet detector (TND), when only a few data samples are available for TrojanNet detection. We show that an effective data-limited TND can be established by exploring connections between Trojan attack and prediction-evasion adversarial attacks including per-sample attack as well as all-sample universal attack. In addition, we propose a data-free TND, which can detect a TrojanNet without accessing any data samples. We show that such a TND can be built by leveraging the internal response of hidden neurons, which exhibits the Trojan behavior even at random noise inputs. The effectiveness of our proposals is evaluated by extensive experiments under different model architectures and datasets including CIFAR-10, GTSRB, and ImageNet.

Key facts. Cited by 93 papers in the map (data through 7 Oct 2026). First posted on arXiv 31 Jul 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 19; 2022: 26; 2023: 20; 2024: 16; 2025: 6; 2026: 6.

93 papers.

Sort:

By area:

2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2022How to Backdoor Diffusion Models?cited by 102
2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
2022Backdoor Defense with Machine Unlearningcited by 61
2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
2021Handcrafted Backdoors in Deep Neural Networkscited by 57
2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
2023Detecting Backdoors in Pre-trained Encoderscited by 53
2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52

38 more

2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
2021Trigger Hunting with a Topological Prior for Trojan Detectioncited by 39
2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
2021Topological Detection of Trojaned Neural Networkscited by 34
2022Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarioscited by 29
2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 25
2023Backdoor Attacks Against Dataset Distillationcited by 20
2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
2022PolicyCleanse: Backdoor Detection and Mitigation in Reinforcement Learningcited by 18
2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
2022How to Sift Out a Clean Data Subset in the Presence of Data Poisoning?cited by 17
2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 17
2022Universal Backdoor Attacks Detection via Adaptive Adversarial Probecited by 16
2021Trojan Signatures in DNN Weightscited by 15
2022Quarantine: Sparsity Can Uncover the Trojan Attack Trigger for Freecited by 15
2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
2023One-bit Flip is All You Need: When Bit-flip Attack Meets Model Trainingcited by 14
2023Defenses in Adversarial Machine Learning: A Surveycited by 14
2024Preference Poisoning Attacks on Reward Model Learningcited by 14
2021TOP: Backdoor Detection in Neural Networks via Transferability of Perturbationcited by 13
2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
2022Holistic Adversarial Robustness of Deep Learning Modelscited by 11
2023SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learningcited by 11
2023Single Image Backdoor Inversion via Robust Smoothed Classifierscited by 10
2021Detecting Backdoor Attacks Against Point Cloud Classifierscited by 9
2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Modelscited by 9
2022Poison Attack and Defense on Deep Source Code Processing Modelscited by 8
2022Towards Effective and Robust Neural Trojan Defenses via Input Filteringcited by 7
2023Salient Conditional Diffusion for Defending Against Backdoor Attackscited by 7
2023FreeEagle: Detecting Complex Neural Trojans in Data-Free Casescited by 7
2022Attention Hijacking in Trojan Transformerscited by 6
2022COLLIDER: A Robust Training Framework for Backdoor Datacited by 6
2023AI Maintenance: A Robustness Perspectivecited by 6

50 most cited of 93 All 93 (JSON)