mlsanityData to 7 Oct 2026

Backdoor Scanning for Deep Neural Networks through K-Arm Optimization

arXiv 2102.05123 ↗First posted 9 Feb 2021cs.LG cs.AI cs.CRcited by 96

Not on the map. Why?

Cited by 20 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Back-door attack poses a severe threat to deep learning systems. It injects hidden malicious behaviors to a model such that any input stamped with a special pattern can trigger such behaviors. Detecting back-door is hence of pressing need. Many existing defense techniques use optimization to generate the smallest input pattern that forces the model to misclassify a set of benign inputs injected with the pattern to a target label. However, the complexity is quadratic to the number of class labels such that they can hardly handle models with many classes. Inspired by Multi-Arm Bandit in Reinforcement Learning, we propose a K-Arm optimization method for backdoor detection. By iteratively and stochastically selecting the most promising labels for optimization with the guidance of an objective function, we substantially reduce the complexity, allowing to handle models with many classes. Moreover, by iteratively refining the selection of labels to optimize, it substantially mitigates the uncertainty in choosing the right labels, improving detection accuracy. At the time of submission, the evaluation of our method on over 4000 models in the IARPA TrojAI competition from round 1 to the latest round 4 achieves top performance on the leaderboard. Our technique also supersedes three state-of-the-art techniques in terms of accuracy and the scanning time needed.

Key facts. Cited by 96 papers in the map (data through 7 Oct 2026). Builds on 39 of its 59 references that are in the map. First posted on arXiv 9 Feb 2021.

Builds on

39 of 59 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2016Densely Connected Convolutional Networkscited by 6,691
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  6. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,427
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2018How To Backdoor Federated Learningcited by 745
  9. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  11. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  12. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
27 more
  1. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  2. 2020Backdoor Learning: A Surveycited by 412
  3. 2019Hidden Trigger Backdoor Attackscited by 359
  4. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  5. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  6. 2019Label-Consistent Backdoor Attackscited by 285
  7. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  8. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  9. 2017Neural Trojanscited by 151
  10. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  11. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  12. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  13. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  14. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  15. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  16. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  17. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  18. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  19. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  20. 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 82
  21. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  22. 2020One-pixel Signature: Characterizing CNN Models for Backdoor Detectioncited by 34
  23. 2019Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networkscited by 21
  24. 2020Deep Learning Backdoorscited by 19
  25. 2020Natural Backdoor Attack on Text Datacited by 18
  26. 2019A Target-Agnostic Attack on Deep Models: Exploiting Security Vulnerabilities of Transfer Learningcited by 15
  27. 2020Cassandra: Detecting Trojaned Networks from Adversarial Perturbationscited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 26; 2023: 28; 2024: 21; 2025: 10; 2026: 5.

96 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  2. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  3. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  4. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  5. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  6. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  7. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  8. 2023Detecting Backdoors in Pre-trained Encoderscited by 53
  9. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
  10. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  11. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
  12. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
38 more
  1. 2021Trigger Hunting with a Topological Prior for Trojan Detectioncited by 39
  2. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  3. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  4. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  5. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  6. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  7. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  8. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 20
  9. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  10. 2022PolicyCleanse: Backdoor Detection and Mitigation in Reinforcement Learningcited by 18
  11. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 18
  12. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
  13. 2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 17
  14. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
  15. 2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
  16. 2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
  17. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  18. 2024Preference Poisoning Attacks on Reward Model Learningcited by 14
  19. 2021TOP: Backdoor Detection in Neural Networks via Transferability of Perturbationcited by 13
  20. 2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
  21. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  22. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  23. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 12
  24. 2022Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Modelscited by 11
  25. 2024CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Modelscited by 11
  26. 2023Single Image Backdoor Inversion via Robust Smoothed Classifierscited by 10
  27. 2024Mutual Information Guided Backdoor Mitigation for Pre-trained Encoderscited by 8
  28. 2023Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognitioncited by 7
  29. 2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 7
  30. 2022Attention Hijacking in Trojan Transformerscited by 6
  31. 2023XGBD: Explanation-Guided Graph Backdoor Detectioncited by 6
  32. 2023GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learningcited by 6
  33. 2024Invisible Backdoor Attack against Self-supervised Learningcited by 5
  34. 2024PSBD: Prediction Shift Uncertainty Unlocks Backdoor Detectioncited by 5
  35. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Datacited by 5
  36. 2021MISA: Online Defense of Trojaned Models using Misattributionscited by 4
  37. 2022DECK: Model Hardening for Defending Pervasive Backdoorscited by 4
  38. 2023Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineeringcited by 4

50 most cited of 96 All 96 (JSON)