mlsanityData to 7 Oct 2026

Stealthy Backdoors as Compression Artifacts

arXiv 2104.15129 ↗First posted 30 Apr 2021cs.CR cs.AIcited by 17

Not on the map. Why?

Abstract (arXiv)

In a backdoor attack on a machine learning model, an adversary produces a model that performs well on normal inputs but outputs targeted misclassifications on inputs containing a small trigger pattern. Model compression is a widely-used approach for reducing the size of deep learning models without much accuracy loss, enabling resource-hungry models to be compressed for use on resource-constrained devices. In this paper, we study the risk that model compression could provide an opportunity for adversaries to inject stealthy backdoors. We design stealthy backdoor attacks such that the full-sized model released by adversaries appears to be free from backdoors (even when tested using state-of-the-art techniques), but when the model is compressed it exhibits highly effective backdoors. We show this can be done for two common model compression techniques -- model pruning and model quantization. Our findings demonstrate how an adversary may be able to hide a backdoor as a compression artifact, and show the importance of performing security tests on the models that will actually be deployed not their precompressed version.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Builds on 45 of its 70 references that are in the map. First posted on arXiv 30 Apr 2021.

Builds on

45 of 70 references.

References · 45

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2020Language Models are Few-Shot Learnerscited by 32,199
  4. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  5. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  6. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  7. 2016Densely Connected Convolutional Networkscited by 6,691
  8. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  9. 2013Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computationcited by 2,031
  10. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 1,998
  11. 2017Quantization and Training of Neural Networks for Efficient Integer-Arithmetic-Only Inferencecited by 1,548
  12. 2019Self-training with Noisy Student improves ImageNet classificationcited by 1,304
33 more
  1. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,286
  2. 2016Pruning Filters for Efficient ConvNetscited by 1,129
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2019Big Transfer (BiT): General Visual Representation Learningcited by 766
  6. 2016Learning Structured Sparsity in Deep Neural Networkscited by 538
  7. 2018Quantizing deep convolutional networks for efficient inference: A whitepapercited by 507
  8. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  9. 2018AMC: AutoML for Model Compression and Acceleration on Mobile Devicescited by 375
  10. 2018Filter Pruning via Geometric Median for Deep Convolutional Neural Networks Accelerationcited by 365
  11. 2016Dynamic Network Surgery for Efficient DNNscited by 233
  12. 2017Learning to Prune Deep Neural Networks via Layer-wise Optimal Brain Surgeoncited by 219
  13. 2015Quantized Convolutional Neural Networks for Mobile Devicescited by 212
  14. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  15. 2014Compressing Deep Convolutional Networks using Vector Quantizationcited by 189
  16. 2020Blind Backdoors in Deep Learning Modelscited by 174
  17. 2017Machine Learning Models that Remember Too Muchcited by 165
  18. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  19. 2016Designing Energy-Efficient Convolutional Neural Networks using Energy-Aware Pruningcited by 133
  20. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  21. 2015Data-free parameter pruning for Deep Neural Networkscited by 112
  22. 2019Adversarial Robustness vs Model Compression, or Both?cited by 98
  23. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 92
  24. 2019Model Compression with Adversarial Robustness: A Unified Optimization Frameworkcited by 71
  25. 2016Learning the Number of Neurons in Deep Networkscited by 69
  26. 2020DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environmentscited by 57
  27. 2016Towards the Limit of Network Quantizationcited by 49
  28. 2019AutoCompress: An Automatic DNN Structured Pruning Framework for Ultra-High Compression Ratescited by 49
  29. 2019NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanationscited by 49
  30. 2020Fixing the train-test resolution discrepancy: FixEfficientNetcited by 31
  31. 2015PerforatedCNNs: Acceleration through Elimination of Redundant Convolutionscited by 17
  32. 2018Synaptic Strength For Convolutional Neural Networkcited by 5
  33. 2017Compression of Deep Neural Networks for Image Instance Retrievalcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 3; 2023: 1; 2024: 3; 2025: 5; 2026: 3.

17 papers.

Sort:

By area:

  1. 2024Exploiting LLM Quantizationcited by 61
  2. 2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 25
  3. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  4. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 14
  5. 2022PublicCheck: Public Integrity Verification for Services of Run-time Deep Modelscited by 5
  6. 2022Mind Your Heart: Stealthy Backdoor Attack on Dynamic Deep Neural Network in Edge Computingcited by 5
  7. 2022RIBAC: Towards Robust and Imperceptible Backdoor Attack against Compact DNNcited by 4
  8. 2021NTD: Non-Transferability Enabled Backdoor Detectioncited by 3
  9. 2025Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attackcited by 3
  10. 2024You Never Know: Quantization Induces Inconsistent Biases in Vision-Language Foundation Modelscited by 2
  11. 2025Rounding-Guided Backdoor Injection in Deep Learning Model Quantizationcited by 1
  12. 2026Theory of Minimal Weight Perturbations in Deep Networks and its Applications for Low-Rank Activated Backdoor Attackscited by 1
5 more
  1. 2026FloatDoor: Platform-Triggered Backdoors in LLMscited by 1
  2. 2025Surveying the Operational Cybersecurity and Supply Chain Threat Landscape when Developing and Deploying AI Systemscited by 0
  3. 2025HAMLOCK: HArdware-Model LOgically Combined attacKcited by 0
  4. 2025Quantization Blindspots: How Model Compression Breaks Backdoor Defensescited by 0
  5. 2026FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attackscited by 0