Data to 14 Oct 2026

Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification

arXiv 2012.11212 ↗First posted 21 Dec 2020cs.LG cs.CVcited by 95

Not on the map. Why?

Cited by 20 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Trojan (backdoor) attack is a form of adversarial attack on deep neural networks where the attacker provides victims with a model trained/retrained on malicious data. The backdoor can be activated when a normal input is stamped with a certain pattern called trigger, causing misclassification. Many existing trojan attacks have their triggers being input space patches/objects (e.g., a polygon with solid color) or simple input transformations such as Instagram filters. These simple triggers are susceptible to recent backdoor detection algorithms. We propose a novel deep feature space trojan attack with five characteristics: effectiveness, stealthiness, controllability, robustness and reliance on deep features. We conduct extensive experiments on 9 image classifiers on various datasets including ImageNet to demonstrate these properties and show that our attack can evade state-of-the-art defense.

Key facts. Cited by 95 papers in the map (data through 14 Oct 2026). First posted on arXiv 21 Dec 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 7; 2022: 25; 2023: 24; 2024: 23; 2025: 12; 2026: 4.

95 papers.

Sort:

By area:

2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
2021Hidden Backdoors in Human-Centric Language Modelscited by 90
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 86
2023Reconstructive Neuron Pruning for Backdoor Defensecited by 59
2023Detecting Backdoors in Pre-trained Encoderscited by 55
2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 42
2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38

38 more

2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 33
2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 26
2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 21
2022Going In Style: Audio Backdoors Through Stylistic Transformationscited by 21
2021Robust Backdoor Attacks against Deep Neural Networks in Real Physical Worldcited by 20
2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
2023Backdoor Attack with Sparse and Invisible Triggercited by 20
2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 18
2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
2023BDMMT: Backdoor Sample Detection for Language Models through Model Mutation Testingcited by 16
2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
2022Compression-Resistant Backdoor Attack against Deep Neural Networkscited by 14
2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 13
2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
2022Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Modelscited by 11
2022Imperceptible and Multi-channel Backdoor Attack against Deep Neural Networkscited by 10
2022Backdoor Attacks on Crowd Countingcited by 10
2022Backdoor Attacks on Time Series: A Generative Approachcited by 10
2023Progressive Poisoned Data Isolation for Training-time Backdoor Defensecited by 10
2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 9
2024UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Modelscited by 9
2023Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarioscited by 7
2023BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Liftingcited by 7
2025Towards Backdoor Stealthiness in Model Parameter Spacecited by 7
2023SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classificationcited by 6
2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
2024Can Distillation Mitigate Backdoor Attacks in Pre-trained Encoders?cited by 6
2024Physical Backdoor: Towards Temperature-based Backdoor Attacks in the Physical Worldcited by 6
2022Towards a Defense Against Federated Backdoor Attacks Under Continuous Trainingcited by 5
2023A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attackscited by 5
2024Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearningcited by 5
2024Imperceptible Rhythm Backdoor Attacks: Exploring Rhythm Transformation for Embedding Undetectable Vulnerabilities on Speech Recognitioncited by 5

50 most cited of 95 All 95 (JSON)