mlsanityData to 7 Oct 2026

SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics

arXiv 2104.11315 ↗First posted 22 Apr 2021cs.LG cs.AI stat.MLcited by 123

Not on the map. Why?

Cited by 31 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Modern machine learning increasingly requires training on a large collection of data from multiple sources, not all of which can be trusted. A particularly concerning scenario is when a small fraction of poisoned data changes the behavior of the trained model when triggered by an attacker-specified watermark. Such a compromised model will be deployed unnoticed as the model is accurate otherwise. There have been promising attempts to use the intermediate representations of such a model to separate corrupted examples from clean ones. However, these defenses work only when a certain spectral signature of the poisoned examples is large enough for detection. There is a wide range of attacks that cannot be protected against by the existing defenses. We propose a novel defense algorithm using robust covariance estimation to amplify the spectral signature of corrupted data. This defense provides a clean model, completely removing the backdoor, even in regimes where previous methods have no hope of detecting the poisoned examples. Code and pre-trained models are available at https://github.com/SewoongLab/spectre-defense .

Key facts. Cited by 123 papers in the map (data through 7 Oct 2026). Builds on 43 of its 57 references that are in the map. First posted on arXiv 22 Apr 2021.

Builds on

43 of 57 references.

References · 43

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2019Advances and Open Problems in Federated Learningcited by 3,021
  3. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,472
  4. 2017Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networkscited by 1,325
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  8. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  9. 2018Spectral Signatures in Backdoor Attackscited by 457
  10. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  11. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  12. 2019Hidden Trigger Backdoor Attackscited by 359
31 more
  1. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  2. 2019Robust Aggregation for Federated Learningcited by 314
  3. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  4. 2017Certified Defenses for Data Poisoning Attackscited by 288
  5. 2019Label-Consistent Backdoor Attackscited by 285
  6. 2019Can You Really Backdoor Federated Learning?cited by 250
  7. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  8. 2016Robust Estimators in High Dimensions without the Computational Intractabilitycited by 209
  9. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  10. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  11. 2016Agnostic Estimation of Mean and Covariancecited by 131
  12. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  13. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  14. 2016Statistical Query Lower Bounds for Robust Estimation of High-dimensional Gaussians and Gaussian Mixturescited by 114
  15. 2018Is feature selection secure against training data poisoning?cited by 88
  16. 2017Being Robust (in High Dimensions) Can Be Practicalcited by 83
  17. 2018Byzantine Stochastic Gradient Descentcited by 81
  18. 2018DRACO: Byzantine-resilient Distributed Training via Redundant Gradientscited by 74
  19. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  20. 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 69
  21. 2021Robust and Differentially Private Mean Estimationcited by 66
  22. 2017Generative Poisoning Attack Method Against Neural Networkscited by 49
  23. 2015Robust Covariance and Scatter Matrix Estimation under Huber's Contamination Modelcited by 47
  24. 2019Quantum Entropy Scoring for Fast Robust Mean Estimation and Improved Outlier Detectioncited by 41
  25. 2020Robust Meta-learning for Mixed Linear Regression with Small Batchescited by 41
  26. 2020Robust Sub-Gaussian Principal Component Analysis and Width-Independent Schatten Packingcited by 35
  27. 2019Faster Algorithms for High-Dimensional Robust Covariance Estimationcited by 28
  28. 2020Backdooring and Poisoning Neural Networks with Image-Scaling Attackscited by 28
  29. 2018Poisoning Behavioral Malware Clusteringcited by 14
  30. 2020Adversarial robustness via robust low rank representationscited by 14
  31. 2020Robust Gaussian Covariance Estimation in Nearly-Matrix Multiplication Timecited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 19; 2023: 29; 2024: 35; 2025: 19; 2026: 16.

123 papers.

Sort:

By area:

  1. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  2. 2023Dataset Distillation: A Comprehensive Reviewcited by 126
  3. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  4. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  5. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  6. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  7. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
  8. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  9. 2022Measuring the Effect of Training Data on Deep Learning Predictions via Randomized Experimentscited by 50
  10. 2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
  11. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  12. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
38 more
  1. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  2. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  3. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  4. 2023On the Vulnerability of Backdoor Defenses for Federated Learningcited by 27
  5. 2023Label Poisoning is All You Needcited by 27
  6. 2023Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMscited by 26
  7. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  8. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  9. 2021Enhancing Backdoor Attacks with Multi-Level MMD Regularizationcited by 15
  10. 2022Few-shot Backdoor Attacks via Neural Tangent Kernelscited by 15
  11. 2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
  12. 2023Rethinking Backdoor Attackscited by 14
  13. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  14. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  15. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12
  16. 2022Data Isotopes for Data Provenance in DNNscited by 11
  17. 2023Beating Backdoor Attack at Its Own Gamecited by 11
  18. 2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11
  19. 2024Generalization Bound and New Algorithm for Clean-Label Backdoor Attackcited by 11
  20. 2021Accumulative Poisoning Attacks on Real-time Datacited by 10
  21. 2022Progressive Backdoor Erasing via connecting Backdoor and Adversarial Attackscited by 10
  22. 2023Demystifying Poisoning Backdoor Attacks from a Statistical Perspectivecited by 10
  23. 2025Unlearning Isn't Invisible: Detecting Unlearning Traces in LLMs from Model Outputscited by 10
  24. 2021Check Your Other Door! Creating Backdoor Attacks in the Frequency Domaincited by 9
  25. 2023Revisiting Data-Free Knowledge Distillation with Poisoned Teacherscited by 9
  26. 2023VDC: Versatile Data Cleanser based on Visual-Linguistic Inconsistency by Multimodal Large Language Modelscited by 9
  27. 2024Towards Unified Robustness Against Both Backdoor and Adversarial Attackscited by 9
  28. 2024BadCM: Invisible Backdoor Attack Against Cross-Modal Learningcited by 9
  29. 2023Don't FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNscited by 8
  30. 2023WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networkscited by 8
  31. 2023On the Difficulty of Defending Contrastive Learning against Backdoor Attackscited by 8
  32. 2023Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognitioncited by 7
  33. 2023Manipulating Transfer Learning for Property Inferencecited by 7
  34. 2023Universal Backdoor Attackscited by 7
  35. 2024Semantic Shield: Defending Vision-Language Models Against Backdooring and Poisoning via Fine-grained Knowledge Alignmentcited by 7
  36. 2023XGBD: Explanation-Guided Graph Backdoor Detectioncited by 6
  37. 2022Towards a Defense Against Federated Backdoor Attacks Under Continuous Trainingcited by 5
  38. 2023Universal Detection of Backdoor Attacks via Density-based Clustering and Centroids Analysiscited by 5

50 most cited of 123 All 123 (JSON)