# Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansing

arXiv: https://arxiv.org/abs/2010.07489 · HTML: https://mlsanity.com/paper/2010.07489/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Oct 2020.

## Built on by (most cited first, 11 of 11)

- [Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning](https://mlsanity.com/paper/2205.01992/) (2022)
- [Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarios](https://mlsanity.com/paper/2201.08474/) (2022)
- [Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey](https://mlsanity.com/paper/2312.08667/) (2023)
- [CBD: A Certified Backdoor Detector Based on Local Dominant Probability](https://mlsanity.com/paper/2310.17498/) (2023)
- [Backdoor Attack and Defense for Deep Regression](https://mlsanity.com/paper/2109.02381/) (2021)
- [Differential Analysis of Triggers and Benign Features for Black-Box DNN Backdoor Detection](https://mlsanity.com/paper/2307.05422/) (2023)
- [Training set cleansing of backdoor poisoning by self-supervised representation learning](https://mlsanity.com/paper/2210.10272/) (2022)
- [Post-Training Overfitting Mitigation in DNN Classifiers](https://mlsanity.com/paper/2309.16827/) (2023)
- [Prototype Guided Backdoor Defense](https://mlsanity.com/paper/2503.20925/) (2025)
- [RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance](https://mlsanity.com/paper/2602.00183/) (2026)
- [IU: Imperceptible Universal Backdoor Attack](https://mlsanity.com/paper/2603.00711/) (2026)

## Abstract (arXiv)

Backdoor data poisoning is an emerging form of adversarial attack usually against deep neural network image classifiers. The attacker poisons the training set with a relatively small set of images from one (or several) source class(es), embedded with a backdoor pattern and labeled to a target class. For a successful attack, during operation, the trained classifier will: 1) misclassify a test image from the source class(es) to the target class whenever the same backdoor pattern is present; 2) maintain a high classification accuracy for backdoor-free test images. In this paper, we make a break-through in defending backdoor attacks with imperceptible backdoor patterns (e.g. watermarks) before/during the training phase. This is a challenging problem because it is a priori unknown which subset (if any) of the training set has been poisoned. We propose an optimization-based reverse-engineering defense, that jointly: 1) detects whether the training set is poisoned; 2) if so, identifies the target class and the training images with the backdoor pattern embedded; and 3) additionally, reversely engineers an estimate of the backdoor pattern used by the attacker. In benchmark experiments on CIFAR-10, for a large variety of attacks, our defense achieves a new state-of-the-art by reducing the attack success rate to no more than 4.9% after removing detected suspicious training images.