Data to 7 Oct 2026

Invisible Backdoor Attack with Sample-Specific Triggers

arXiv 2012.03816 ↗First posted 7 Dec 2020cs.CRcited by 338

Not on the map. Why?

Cited by 96 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Recently, backdoor attacks pose a new security threat to the training process of deep neural networks (DNNs). Attackers intend to inject hidden backdoors into DNNs, such that the attacked model performs well on benign samples, whereas its prediction will be maliciously changed if hidden backdoors are activated by the attacker-defined trigger. Existing backdoor attacks usually adopt the setting that triggers are sample-agnostic, i.e., different poisoned samples contain the same trigger, resulting in that the attacks could be easily mitigated by current backdoor defenses. In this work, we explore a novel attack paradigm, where backdoor triggers are sample-specific. In our attack, we only need to modify certain training samples with invisible perturbation, while not need to manipulate other training components (e.g., training loss, and model structure) as required in many existing attacks. Specifically, inspired by the recent advance in DNN-based image steganography, we generate sample-specific invisible additive noises as backdoor triggers by encoding an attacker-specified string into benign images through an encoder-decoder network. The mapping from the string to the target label will be generated when DNNs are trained on the poisoned dataset. Extensive experiments on benchmark datasets verify the effectiveness of our method in attacking models with or without defenses.

Key facts. Cited by 338 papers in the map (data through 7 Oct 2026). First posted on arXiv 7 Dec 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 11; 2022: 52; 2023: 72; 2024: 102; 2025: 62; 2026: 39.

338 papers.

Sort:

By area:

2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2022Backdoor Defense via Decoupling the Training Processcited by 149
2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80

38 more

2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
2023AntifakePrompt: Prompt-Tuned Vision-Language Models are Fake Image Detectorscited by 64
2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
2023Detecting Backdoors in Pre-trained Encoderscited by 53
2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Modelscited by 42
2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
2023Backdoor Defense via Deconfounded Representation Learningcited by 38
2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 35
2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 35
2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
2024A Watermark-Conditioned Diffusion Model for IP Protectioncited by 34
2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
2022Physical Backdoor Attacks to Lane Detection Systems in Autonomous Drivingcited by 29
2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29

50 most cited of 338 All 338 (JSON)