Data to 7 Oct 2026

Input-Aware Dynamic Backdoor Attack

arXiv 2010.08138 ↗First posted 16 Oct 2020cs.CR cs.CVcited by 304

Not on the map. Why?

Cited by 78 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

In recent years, neural backdoor attack has been considered to be a potential security threat to deep learning systems. Such systems, while achieving the state-of-the-art performance on clean data, perform abnormally on inputs with predefined triggers. Current backdoor techniques, however, rely on uniform trigger patterns, which are easily detected and mitigated by current defense methods. In this work, we propose a novel backdoor attack technique in which the triggers vary from input to input. To achieve this goal, we implement an input-aware trigger generator driven by diversity loss. A novel cross-trigger test is applied to enforce trigger nonreusablity, making backdoor verification impossible. Experiments show that our method is efficient in various attack scenarios as well as multiple datasets. We further demonstrate that our backdoor can bypass the state of the art defense methods. An analysis with a famous neural network inspector again proves the stealthiness of the proposed attack. Our code is publicly available at https://github.com/VinAIResearch/input-aware-backdoor-attack-release.

Key facts. Cited by 304 papers in the map (data through 7 Oct 2026). First posted on arXiv 16 Oct 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 23; 2022: 54; 2023: 69; 2024: 79; 2025: 48; 2026: 31.

304 papers.

Sort:

By area:

2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2022Backdoor Defense via Decoupling the Training Processcited by 149
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96

38 more

2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
2021Availability Attacks Create Shortcutscited by 60
2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
2023Detecting Backdoors in Pre-trained Encoderscited by 53
2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 48
2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
2022BadDet: Backdoor Attacks on Object Detectioncited by 45
2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 45
2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
2021Few-shot Backdoor Defense Using Shapley Estimationcited by 40
2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
2023Backdoor Defense via Deconfounded Representation Learningcited by 38
2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 35
2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 34
2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32

50 most cited of 304 All 304 (JSON)