mlsanityData to 7 Oct 2026

Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks

arXiv 2101.05930 ↗First posted 15 Jan 2021cs.LG cs.AIcited by 313

Not on the map. Why?

Cited by 97 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks (DNNs) are known vulnerable to backdoor attacks, a training time attack that injects a trigger pattern into a small proportion of training data so as to control the model's prediction at the test time. Backdoor attacks are notably dangerous since they do not affect the model's performance on clean examples, yet can fool the model to make incorrect prediction whenever the trigger pattern appears during testing. In this paper, we propose a novel defense framework Neural Attention Distillation (NAD) to erase backdoor triggers from backdoored DNNs. NAD utilizes a teacher network to guide the finetuning of the backdoored student network on a small clean subset of data such that the intermediate-layer attention of the student network aligns with that of the teacher network. The teacher network can be obtained by an independent finetuning process on the same clean subset. We empirically show, against 6 state-of-the-art backdoor attacks, NAD can effectively erase the backdoor triggers using only 5% clean training data without causing obvious performance degradation on clean examples. Code is available in https://github.com/bboylyg/NAD.

Key facts. Cited by 313 papers in the map (data through 7 Oct 2026). Builds on 41 of its 55 references that are in the map. First posted on arXiv 15 Jan 2021.

Builds on

41 of 55 references.

References · 41

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2016Overcoming catastrophic forgetting in neural networkscited by 4,718
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  10. 2014FitNets: Hints for Thin Deep Netscited by 1,619
  11. 2016Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfercited by 1,059
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
29 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  2. 2018How To Backdoor Federated Learningcited by 745
  3. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  4. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  5. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  6. 2018Spectral Signatures in Backdoor Attackscited by 457
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  8. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  9. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  10. 2019Variational Information Distillation for Knowledge Transfercited by 321
  11. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  12. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  13. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  14. 2018Knowledge Transfer via Distillation of Activation Boundaries Formed by Hidden Neuronscited by 235
  15. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  16. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 151
  17. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  18. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  19. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  20. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  21. 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 82
  22. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  23. 2018Label Refinery: Improving ImageNet Classification through Label Progressioncited by 65
  24. 2019Black-box Adversarial Attacks on Video Recognition Modelscited by 58
  25. 2019Hearing Lips: Improving Lip Reading by Distilling Speech Recognizerscited by 39
  26. 2020Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifierscited by 23
  27. 2020Removing Backdoor-Based Watermarks in Neural Networks with Limited Datacited by 23
  28. 2018Neural Compatibility Modeling with Attentive Knowledge Distillationcited by 17
  29. 2019Pay attention to the activations: a modular attention mechanism for fine-grained image recognitioncited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 17; 2022: 62; 2023: 71; 2024: 94; 2025: 38; 2026: 31.

313 papers.

Sort:

By area:

  1. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
  2. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  3. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  4. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  5. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  6. 2023Dataset Distillation: A Comprehensive Reviewcited by 126
  7. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  8. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  9. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  10. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  11. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  12. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
38 more
  1. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  2. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 74
  3. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 66
  4. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  5. 2022Backdoor Defense with Machine Unlearningcited by 61
  6. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
  7. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  8. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
  9. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  10. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  11. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  12. 2023Detecting Backdoors in Pre-trained Encoderscited by 53
  13. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
  14. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
  15. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  16. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  17. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  18. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
  19. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  20. 2023Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomycited by 44
  21. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 44
  22. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  23. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  24. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  25. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  26. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  27. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  28. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  29. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  30. 2024Securing Large Language Models: Threats, Vulnerabilities and Responsible Practicescited by 36
  31. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  32. 2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 35
  33. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  34. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 34
  35. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  36. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  37. 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 32
  38. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32

50 most cited of 313 All 313 (JSON)