mlsanityData to 7 Oct 2026

Trigger Hunting with a Topological Prior for Trojan Detection

arXiv 2110.08335 ↗First posted 15 Oct 2021cs.CV cs.CGcited by 39

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Despite their success and popularity, deep neural networks (DNNs) are vulnerable when facing backdoor attacks. This impedes their wider adoption, especially in mission critical applications. This paper tackles the problem of Trojan detection, namely, identifying Trojaned models -- models trained with poisoned data. One popular approach is reverse engineering, i.e., recovering the triggers on a clean image by manipulating the model's prediction. One major challenge of reverse engineering approach is the enormous search space of triggers. To this end, we propose innovative priors such as diversity and topological simplicity to not only increase the chances of finding the appropriate triggers but also improve the quality of the found triggers. Moreover, by encouraging a diverse set of trigger candidates, our method can perform effectively in cases with unknown target labels. We demonstrate that these priors can significantly improve the quality of the recovered triggers, resulting in substantially improved Trojan detection accuracy as validated on both synthetic and publicly available TrojAI benchmarks.

Key facts. Cited by 39 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 28 of its 49 references that are in the map. First posted on arXiv 15 Oct 2021.

Builds on

28 of 49 references.

References · 28

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  3. 2013Rich feature hierarchies for accurate object detection and semantic segmentationcited by 2,160
  4. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  5. 2018Spectral Signatures in Backdoor Attackscited by 457
  6. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  7. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  8. 2015Persistence Images: A Stable Vector Representation of Persistent Homologycited by 235
  9. 2019Topology-Preserving Deep Image Segmentationcited by 198
  10. 2017Neural Trojanscited by 151
  11. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  12. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
16 more
  1. 2019A Topological Loss Function for Deep-Learning based Image Segmentation using Persistent Homologycited by 134
  2. 2019PersLay: A Neural Network Layer for Persistence Diagrams and New Graph Topological Signaturescited by 125
  3. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  4. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  5. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  6. 2020A Topological Filter for Learning with Label Noisecited by 76
  7. 2021Topology-Aware Segmentation Using Discrete Morse Theorycited by 75
  8. 2019Graph Filtration Learningcited by 68
  9. 2020Localization in the Crowd with Topological Constraintscited by 68
  10. 2018A Topological Regularizer for Classifiers via Persistent Homologycited by 62
  11. 2019Connectivity-Optimized Representation Learning via Persistent Homologycited by 43
  12. 2021Link Prediction with Persistent Homology: An Interactive Viewcited by 37
  13. 2021Topological Detection of Trojaned Neural Networkscited by 34
  14. 2020Poisoned classifiers are not only backdoored, they are fundamentally brokencited by 15
  15. 2021TOP: Backdoor Detection in Neural Networks via Transferability of Perturbationcited by 13
  16. 2020Detecting Trojaned DNNs Using Counterfactual Attributionscited by 4

Built on by

Cited by year

Citing papers per year: 2021: 1; 2022: 8; 2023: 13; 2024: 13; 2025: 4.

39 papers.

Sort:

By area:

  1. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  2. 2024Position: Topological Deep Learning is the New Frontier for Relational Learningcited by 65
  3. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  4. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
  5. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  6. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  7. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  8. 2022Learning Topological Interactions for Multi-Class Medical Image Segmentationcited by 28
  9. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
  10. 2022Learning Probabilistic Topological Representations Using Discrete Morse Theorycited by 20
  11. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  12. 2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 17
27 more
  1. 2023Enhancing Modality-Agnostic Representations via Meta-Learning for Brain Tumor Segmentationcited by 14
  2. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  3. 2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
  4. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  5. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
  6. 2023TIJO: Trigger Inversion with Joint Optimization for Defending Multimodal Backdoored Modelscited by 11
  7. 2023Single Image Backdoor Inversion via Robust Smoothed Classifierscited by 10
  8. 2023Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognitioncited by 7
  9. 2022Attention Hijacking in Trojan Transformerscited by 6
  10. 2022Towards a Defense Against Federated Backdoor Attacks Under Continuous Trainingcited by 5
  11. 2024PSBD: Prediction Shift Uncertainty Unlocks Backdoor Detectioncited by 5
  12. 2024Spatial Diffusion for Cell Layout Generationcited by 5
  13. 2024Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearningcited by 4
  14. 2024Flatness-aware Sequential Learning Generates Resilient Backdoorscited by 3
  15. 2024TinyML Security: Exploring Vulnerabilities in Resource-Constrained Machine Learning Systemscited by 3
  16. 2025Scanning Trojaned Models Using Out-of-Distribution Samplescited by 3
  17. 2022On the Convergence of Optimizing Persistent-Homology-Based Lossescited by 2
  18. 2025Revisiting Training-Inference Trigger Intensity in Backdoor Attackscited by 2
  19. 2021CatchBackdoor: Backdoor Detection via Critical Trojan Neural Path Fuzzingcited by 1
  20. 2023Mask and Restore: Blind Backdoor Defense at Test Time with Masked Autoencodercited by 1
  21. 2024Rethinking Pruning for Backdoor Mitigation: An Optimization Perspectivecited by 1
  22. 2024Magnitude-based Neuron Pruning for Backdoor Defenscited by 1
  23. 2024Expose Before You Defend: Unifying and Enhancing Backdoor Defenses via Exposed Modelscited by 1
  24. 2024Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Modelscited by 1
  25. 2025DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusioncited by 1
  26. 2024Learning Topological Representations for Deep Image Understandingcited by 0
  27. 2025Prototype Guided Backdoor Defensecited by 0