mlsanityData to 14 Oct 2026

Backdoor Attacks on Self-Supervised Learning

arXiv 2105.10123 ↗First posted 21 May 2021cs.CVcited by 90

Not on the map. Why?

Cited by 36 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Large-scale unlabeled data has spurred recent progress in self-supervised learning methods that learn rich visual representations. State-of-the-art self-supervised methods for learning representations from images (e.g., MoCo, BYOL, MSF) use an inductive bias that random augmentations (e.g., random crops) of an image should produce similar embeddings. We show that such methods are vulnerable to backdoor attacks - where an attacker poisons a small part of the unlabeled data by adding a trigger (image patch chosen by the attacker) to the images. The model performance is good on clean test images, but the attacker can manipulate the decision of the model by showing the trigger at test time. Backdoor attacks have been studied extensively in supervised learning and to the best of our knowledge, we are the first to study them for self-supervised learning. Backdoor attacks are more practical in self-supervised learning, since the use of large unlabeled data makes data inspection to remove poisons prohibitive. We show that in our targeted attack, the attacker can produce many false positives for the target category by using the trigger at test time. We also propose a defense method based on knowledge distillation that succeeds in neutralizing the attack. Our code is available here: https://github.com/UMBCvision/SSL-Backdoor .

Key facts. Cited by 90 papers in the map (data through 14 Oct 2026). Builds on 29 of its 40 references that are in the map. First posted on arXiv 21 May 2021.

Builds on

29 of 40 references.

References · 29

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  4. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
  5. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,513
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  7. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,045
  8. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,750
  9. 2020Exploring Simple Siamese Representation Learningcited by 2,866
  10. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,287
  11. 2018Unsupervised Representation Learning by Predicting Image Rotationscited by 1,591
  12. 2016Context Encoders: Feature Learning by Inpaintingcited by 1,428
17 more
  1. 2020Understanding Contrastive Representation Learning through Alignment and Uniformity on the Hyperspherecited by 1,405
  2. 2016Unsupervised Learning of Visual Representations by Solving Jigsaw Puzzlescited by 1,382
  3. 2019Contrastive Multiview Codingcited by 1,301
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2015Unsupervised Visual Representation Learning by Context Predictioncited by 1,066
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  8. 2019Hidden Trigger Backdoor Attackscited by 371
  9. 2020Whitening for Self-Supervised Representation Learningcited by 279
  10. 2019Scaling and Benchmarking Self-Supervised Visual Representation Learningcited by 201
  11. 2021Self-supervised Pretraining of Visual Features in the Wildcited by 198
  12. 2017Neural Trojanscited by 153
  13. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 146
  14. 2020Intriguing Properties of Contrastive Lossescited by 130
  15. 2021Mean Shift for Self-Supervised Learningcited by 65
  16. 2020CompRess: Self-Supervised Learning by Compressing Representationscited by 62
  17. 2020Poisoned classifiers are not only backdoored, they are fundamentally brokencited by 15

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 3; 2022: 12; 2023: 29; 2024: 24; 2025: 14; 2026: 8.

90 papers.

Sort:

By area:

  1. 2022Backdoor Defense via Decoupling the Training Processcited by 153
  2. 2021Poisoning and Backdooring Contrastive Learningcited by 151
  3. 2023Leaving Reality to Imagination: Robust Classification via Generated Datasetscited by 91
  4. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 63
  5. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  6. 2023Detecting Backdoors in Pre-trained Encoderscited by 55
  7. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 40
  8. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  9. 2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 37
  10. 2022Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learningcited by 34
  11. 2023Fill-Up: Balancing Long-Tailed Data with Generative Modelscited by 34
  12. 2023Downstream-agnostic Adversarial Examplescited by 32
38 more
  1. 2022An Embarrassingly Simple Backdoor Attack on Self-supervised Learningcited by 31
  2. 2022CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learningcited by 29
  3. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  4. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 27
  5. 2023Analyzing And Editing Inner Mechanisms Of Backdoored Language Modelscited by 23
  6. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 21
  7. 2024Securely Fine-tuning Pre-trained Encoders Against Adversarial Examplescited by 21
  8. 2023Defending Against Patch-based Backdoor Attacks on Self-Supervised Learningcited by 20
  9. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 18
  10. 2022Backdoor Cleansing with Unlabeled Datacited by 17
  11. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  12. 2024Learning to Poison Large Language Models for Downstream Manipulationcited by 16
  13. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Modelscited by 14
  14. 2022Backdoor Attacks on Vision Transformerscited by 13
  15. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
  16. 2023TIJO: Trigger Inversion with Joint Optimization for Defending Multimodal Backdoored Modelscited by 12
  17. 2023SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learningcited by 11
  18. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11
  19. 2021Accumulative Poisoning Attacks on Real-time Datacited by 10
  20. 2023Single Image Backdoor Inversion via Robust Smoothed Classifierscited by 10
  21. 2022ESTAS: Effective and Stable Trojan Attacks in Self-supervised Encoders with One Target Unlabelled Samplecited by 9
  22. 2023On the Difficulty of Defending Contrastive Learning against Backdoor Attackscited by 9
  23. 2024A Unified Membership Inference Method for Visual Self-supervised Encoder via Part-aware Capabilitycited by 9
  24. 2023UOR: Universal Backdoor Attacks on Pre-trained Language Modelscited by 8
  25. 2024Mutual Information Guided Backdoor Mitigation for Pre-trained Encoderscited by 8
  26. 2022Backdoor Attacks in the Supply Chain of Masked Image Modelingcited by 7
  27. 2024Semantic Shield: Defending Vision-Language Models Against Backdooring and Poisoning via Fine-grained Knowledge Alignmentcited by 7
  28. 2024Data Free Backdoor Attackscited by 7
  29. 2023GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learningcited by 6
  30. 2023Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Datacited by 6
  31. 2024Invisible Backdoor Attack against Self-supervised Learningcited by 6
  32. 2024DeDe: Detecting Backdoor Samples for SSL Encoders via Decoderscited by 6
  33. 2025Backdooring Self-Supervised Contrastive Learning by Noisy Alignmentcited by 6
  34. 2022FUSSL: Fuzzy Uncertain Self Supervised Learningcited by 5
  35. 2023Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Modelscited by 5
  36. 2024Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformerscited by 5
  37. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 5
  38. 2023Prompt Backdoors in Visual Prompt Learningcited by 4

50 most cited of 90 All 90 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Towards Understanding How Self-training Tolerates Data Backdoor Poisoning
  2. 2022Training set cleansing of backdoor poisoning by self-supervised representation learning
  3. 2024Clean-image Backdoor Attacks
  4. 2024Backdoor Defense through Self-Supervised and Generative Learning
  5. 2025Backdoor Attacks and Defenses in Computer Vision Domain: A Survey
  6. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning
  7. 2023Trojaning semi-supervised learning model via poisoning wild images on the web
  8. 2023SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classification