mlsanityData to 7 Oct 2026

Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective

arXiv 2104.03413 ↗First posted 7 Apr 2021cs.LG cs.CRcited by 155

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks have been considered a severe security threat to deep learning. Such attacks can make models perform abnormally on inputs with predefined triggers and still retain state-of-the-art performance on clean data. While backdoor attacks have been thoroughly investigated in the image domain from both attackers' and defenders' sides, an analysis in the frequency domain has been missing thus far. This paper first revisits existing backdoor triggers from a frequency perspective and performs a comprehensive analysis. Our results show that many current backdoor attacks exhibit severe high-frequency artifacts, which persist across different datasets and resolutions. We further demonstrate these high-frequency artifacts enable a simple way to detect existing backdoor triggers at a detection rate of 98.50% without prior knowledge of the attack details and the target model. Acknowledging previous attacks' weaknesses, we propose a practical way to create smooth backdoor triggers without high-frequency artifacts and study their detectability. We show that existing defense works can benefit by incorporating these smooth triggers into their design consideration. Moreover, we show that the detector tuned over stronger smooth triggers can generalize well to unseen weak smooth triggers. In short, our work emphasizes the importance of considering frequency analysis when designing both backdoor attacks and defenses in deep learning.

Key facts. Cited by 155 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 24 of its 35 references that are in the map. First posted on arXiv 7 Apr 2021.

Builds on

24 of 35 references.

References · 24

  1. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  4. 2016Universal adversarial perturbationscited by 774
  5. 2020Leveraging Frequency Analysis for Deep Fake Image Recognitioncited by 501
  6. 2018Spectral Signatures in Backdoor Attackscited by 457
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  8. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  9. 2019Hidden Trigger Backdoor Attackscited by 359
  10. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  11. 2017Neural Trojanscited by 151
  12. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
12 more
  1. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
  2. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  3. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  4. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  5. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  6. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  7. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 75
  8. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  9. 2018Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detectioncited by 43
  10. 2020FaceHack: Triggering backdoored facial recognition systems using facial characteristicscited by 19
  11. 2019Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularizationcited by 17
  12. 2019SmoothFool: An Efficient Framework for Computing Smooth Adversarial Perturbationscited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 26; 2023: 47; 2024: 46; 2025: 21; 2026: 12.

155 papers.

Sort:

By area:

  1. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  2. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  3. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  4. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  5. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  6. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  7. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  8. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  9. 2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
  10. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 45
  11. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  12. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
38 more
  1. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  2. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  3. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  4. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  5. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  6. 2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 35
  7. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  8. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  9. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  10. 2022Imperceptible Backdoor Attack: From Input Space to Feature Representationcited by 27
  11. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  12. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  13. 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 25
  14. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
  15. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  16. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  17. 2022Just Rotate it: Deploying Backdoor Attacks via Rotation Transformationcited by 19
  18. 2023Defending Against Patch-based Backdoor Attacks on Self-Supervised Learningcited by 19
  19. 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
  20. 2022How to Sift Out a Clean Data Subset in the Presence of Data Poisoning?cited by 17
  21. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
  22. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  23. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 15
  24. 2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
  25. 2023Rethinking Backdoor Attackscited by 14
  26. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
  27. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  28. 2025Test-Time Backdoor Detection for Object Detection Modelscited by 14
  29. 2023A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectivescited by 13
  30. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
  31. 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
  32. 2024Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Triggercited by 12
  33. 2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11
  34. 2024Generalization Bound and New Algorithm for Clean-Label Backdoor Attackcited by 11
  35. 2024Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Priorcited by 11
  36. 2022Imperceptible and Multi-channel Backdoor Attack against Deep Neural Networkscited by 10
  37. 2023Temporal Robustness against Data Poisoningcited by 10
  38. 2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 10

50 most cited of 155 All 155 (JSON)