mlsanityData to 14 Oct 2026

Handcrafted Backdoors in Deep Neural Networks

arXiv 2106.04690 ↗First posted 8 Jun 2021cs.CR cs.LGcited by 63

Not on the map. Why?

Cited by 25 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

When machine learning training is outsourced to third parties, backdoor attacks become practical as the third party who trains the model may act maliciously to inject hidden behaviors into the otherwise accurate model. Until now, the mechanism to inject backdoors has been limited to poisoning. We argue that a supply-chain attacker has more attack techniques available by introducing a handcrafted attack that directly manipulates a model's weights. This direct modification gives our attacker more degrees of freedom compared to poisoning, and we show it can be used to evade many backdoor detection or removal defenses effectively. Across four datasets and four network architectures our backdoor attacks maintain an attack success rate above 96%. Our results suggest that further research is needed for understanding the complete space of supply-chain backdoor attacks.

Key facts. Cited by 63 papers in the map (data through 14 Oct 2026). Builds on 40 of its 69 references that are in the map. First posted on arXiv 8 Jun 2021.

Builds on

40 of 69 references.

References · 40

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2021Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsitycited by 3,073
  5. 2016Deep Learning with Differential Privacycited by 2,728
  6. 2018The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networkscited by 2,262
  7. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,512
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  9. 2016Pruning Filters for Efficient ConvNetscited by 1,143
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  11. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  12. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 744
28 more
  1. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  2. 2018Spectral Signatures in Backdoor Attackscited by 484
  3. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  4. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  5. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  6. 2015Deep Speech 2: End-to-End Speech Recognition in English and Mandarincited by 451
  7. 2021Gradient Descent on Neural Networks Typically Occurs at the Edge of Stabilitycited by 427
  8. 2019Hidden Trigger Backdoor Attackscited by 371
  9. 2014Deep Speech: Scaling up end-to-end speech recognitioncited by 354
  10. 2017Certified Defenses for Data Poisoning Attackscited by 303
  11. 2019Label-Consistent Backdoor Attackscited by 296
  12. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  13. 2020Blind Backdoors in Deep Learning Modelscited by 182
  14. 2019On the Turing Completeness of Modern Neural Network Architecturescited by 129
  15. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 124
  16. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  17. 2018Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardwarecited by 102
  18. 2018On the importance of single directions for generalizationcited by 99
  19. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  20. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 95
  21. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 95
  22. 2021Proof-of-Learning: Definitions and Practicecited by 84
  23. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 83
  24. 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 74
  25. 2018Training for Faster Adversarial Robustness Verification via Inducing ReLU Stabilitycited by 67
  26. 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 56
  27. 2019Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networkscited by 40
  28. 2020Poisoned classifiers are not only backdoored, they are fundamentally brokencited by 15

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 5; 2022: 4; 2023: 15; 2024: 19; 2025: 15; 2026: 5.

63 papers.

Sort:

By area:

  1. 2021Unsolved Problems in ML Safetycited by 292
  2. 2023FLIRT: Feedback Loop In-context Red Teamingcited by 83
  3. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 80
  4. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 73
  5. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 59
  6. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 45
  7. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 42
  8. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 40
  9. 2023Training-free Lexical Backdoor Attacks on Language Modelscited by 31
  10. 2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 30
  11. 2023Label Poisoning is All You Needcited by 29
  12. 2022Architectural Backdoors in Neural Networkscited by 25
38 more
  1. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  2. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 18
  3. 2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
  4. 2025BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Modelscited by 17
  5. 2022Quarantine: Sparsity Can Uncover the Trojan Attack Trigger for Freecited by 15
  6. 2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11
  7. 2024Architectural Neural Backdoors from First Principlescited by 11
  8. 2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 9
  9. 2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 8
  10. 2023Universal Backdoor Attackscited by 7
  11. 2024Data Free Backdoor Attackscited by 7
  12. 2023SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classificationcited by 6
  13. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 5
  14. 2025Exploiting Leaderboards for Large-Scale Distribution of Malicious Modelscited by 5
  15. 2023Facial Misrecognition Systems: Simple Weight Manipulations Force DNNs to Err Only on Specific Personscited by 4
  16. 2024Unelicitable Backdoors in Language Models via Cryptographic Transformer Circuitscited by 4
  17. 2024Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directionscited by 4
  18. 2026LoRA as Oraclecited by 4
  19. 2024The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networkscited by 3
  20. 2024Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Modelscited by 3
  21. 2024Backdoor in Seconds: Unlocking Vulnerabilities in Large Pre-trained Models via Model Editingcited by 3
  22. 2025TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Modelscited by 3
  23. 2024Let's Focus: Focused Backdoor Attack against Federated Transfer Learningcited by 2
  24. 2024Backdoor defense, learnability and obfuscationcited by 2
  25. 2024Context is the Key: Backdoor Attacks for In-Context Learning with Vision Transformerscited by 2
  26. 2025Seal Your Backdoor with Variational Defensecited by 2
  27. 2025THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Modelscited by 2
  28. 2025A Linear Approach to Data Poisoningcited by 2
  29. 2025Cryptographic Backdoor for Neural Networks: Boon and Banecited by 2
  30. 2021Certifiers Make Neural Networks Vulnerable to Availability Attackscited by 1
  31. 2023Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelinescited by 1
  32. 2023Pick your Poison: Undetectability versus Robustness in Data Poisoning Attackscited by 1
  33. 2023Invisible Threats: Backdoor Attack in OCR Systemscited by 1
  34. 2024Revocable Backdoor for Deep Model Tradingcited by 1
  35. 2025Large Language Models Can Verbatim Reproduce Long Malicious Sequencescited by 1
  36. 2025Covert Attacks on Machine Learning Training in Passively Secure MPCcited by 1
  37. 2025Backdoors in Code Summarizers: How Bad Is It?cited by 1
  38. 2025Lethe: Purifying Backdoored Large Language Models with Knowledge Dilutioncited by 1

50 most cited of 63 All 63 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Architectural Backdoors in Deep Learning: A Survey of Vulnerabilities, Detection, and Defense
  2. 2024Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishability
  3. 2023BackdoorBox: A Python Toolbox for Backdoor Learning
  4. 2024The Victim and The Beneficiary: Exploiting a Poisoned Model to Train a Clean Model on Poisoned Data
  5. 2026Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling
  6. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learning
  7. 2023Beating Backdoor Attack at Its Own Game
  8. 2021SGBA: A Stealthy Scapegoat Backdoor Attack against Deep Neural Networks