mlsanityData to 7 Oct 2026

Backdoor Attack in the Physical World

arXiv 2104.02361 ↗First posted 6 Apr 2021cs.CR cs.AI cs.CVcited by 82

Not on the map. Why?

Cited by 20 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs), such that the prediction of infected models will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger. Currently, most existing backdoor attacks adopted the setting of static trigger, i.e., triggers across the training and testing images follow the same appearance and are located in the same area. In this paper, we revisit this attack paradigm by analyzing trigger characteristics. We demonstrate that this attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training. As such, those attacks are far less effective in the physical world, where the location and appearance of the trigger in the digitized image may be different from that of the one used for training. Moreover, we also discuss how to alleviate such vulnerability. We hope that this work could inspire more explorations on backdoor properties, to help the design of more advanced backdoor attack and defense methods.

Key facts. Cited by 82 papers in the map (data through 7 Oct 2026). Builds on 11 of its 16 references that are in the map. First posted on arXiv 6 Apr 2021.

Builds on

11 of 16 references.

References · 11

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  6. 2019Label-Consistent Backdoor Attackscited by 285
  7. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  8. 2017Neural Trojanscited by 151
  9. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  10. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 120
  11. 2020Backdoor Attack against Speaker Verificationcited by 62

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 18; 2023: 19; 2024: 20; 2025: 14; 2026: 6.

82 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  2. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  3. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  4. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  5. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  6. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  7. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  8. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  9. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  10. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  11. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  12. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
38 more
  1. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  2. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  3. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 28
  4. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  5. 2021Robust Backdoor Attacks against Deep Neural Networks in Real Physical Worldcited by 20
  6. 2022Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical Worldcited by 20
  7. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  8. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  9. 2022PolicyCleanse: Backdoor Detection and Mitigation in Reinforcement Learningcited by 18
  10. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 15
  11. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  12. 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
  13. 2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11
  14. 2024Persistent Backdoor Attacks in Continual Learningcited by 11
  15. 2022Backdoor Defense via Suppressing Model Shortcutscited by 10
  16. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
  17. 2022Backdoor Attacks on Crowd Countingcited by 9
  18. 2022BATT: Backdoor Attack with Transformation-based Triggerscited by 9
  19. 2022TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-Worldcited by 8
  20. 2023Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggerscited by 8
  21. 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
  22. 2023Salient Conditional Diffusion for Defending Against Backdoor Attackscited by 7
  23. 2023BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Liftingcited by 7
  24. 2022VSVC: Backdoor attack against Keyword Spotting based on Voiceprint Selection and Voice Conversioncited by 6
  25. 2025GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusioncited by 6
  26. 2022Dynamic Backdoors with Global Average Poolingcited by 5
  27. 2024Imperceptible Rhythm Backdoor Attacks: Exploring Rhythm Transformation for Embedding Undetectable Vulnerabilities on Speech Recognitioncited by 5
  28. 2024DeTrigger: A Gradient-Centric Approach to Backdoor Attack Mitigation in Federated Learningcited by 5
  29. 2022Be Careful with Rotation: A Uniform Backdoor Pattern for 3D Shapecited by 4
  30. 2023Towards Understanding How Self-training Tolerates Data Backdoor Poisoningcited by 4
  31. 2023Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Triggercited by 4
  32. 2024Physical Backdoor: Towards Temperature-based Backdoor Attacks in the Physical Worldcited by 4
  33. 2023PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modificationcited by 3
  34. 2024The last Dance : Robust backdoor attack via diffusion models and bayesian approachcited by 3
  35. 2024DiffPhysBA: Diffusion-based Physical Backdoor Attack against Person Re-Identification in Real-Worldcited by 3
  36. 2024VFLIP: A Backdoor Defense for Vertical Federated Learning via Identification and Purificationcited by 3
  37. 2024BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluationcited by 3
  38. 2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3

50 most cited of 82 All 82 (JSON)