# Test-Time Detection of Backdoor Triggers for Poisoned Deep Neural Networks

arXiv: https://arxiv.org/abs/2112.03350 · HTML: https://mlsanity.com/paper/2112.03350/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 26 references that are in the map.
- First posted on arXiv 6 Dec 2021.

## Builds on (most cited first, 16 of 16)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning](https://mlsanity.com/paper/1712.05526/) (2017)
- [Spectral Signatures in Backdoor Attacks](https://mlsanity.com/paper/1811.00636/) (2018)
- [STRIP: A Defence Against Trojan Attacks on Deep Neural Networks](https://mlsanity.com/paper/1902.06531/) (2019)
- [Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering](https://mlsanity.com/paper/1811.03728/) (2018)
- [Backdoor Learning: A Survey](https://mlsanity.com/paper/2007.08745/) (2020)
- [Hidden Trigger Backdoor Attacks](https://mlsanity.com/paper/1910.00033/) (2019)
- [A backdoor attack against LSTM-based text classification systems](https://mlsanity.com/paper/1905.12457/) (2019)
- [TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems](https://mlsanity.com/paper/1908.01763/) (2019)
- [Black-box Detection of Backdoor Attacks with Limited Information and Data](https://mlsanity.com/paper/2103.13127/) (2021)
- [A Backdoor Attack against 3D Point Cloud Classifiers](https://mlsanity.com/paper/2104.05808/) (2021)
- [Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization](https://mlsanity.com/paper/1909.02742/) (2019)
- [Detection of Backdoors in Trained Classifiers Without Access to the Training Set](https://mlsanity.com/paper/1908.10498/) (2019)
- [Backdoor Attack and Defense for Deep Regression](https://mlsanity.com/paper/2109.02381/) (2021)

## Built on by (most cited first, 10 of 10)

- [MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic](https://mlsanity.com/paper/2205.06900/) (2022)
- [Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey](https://mlsanity.com/paper/2312.08667/) (2023)
- [CBD: A Certified Backdoor Detector Based on Local Dominant Probability](https://mlsanity.com/paper/2310.17498/) (2023)
- [BATT: Backdoor Attack with Transformation-based Triggers](https://mlsanity.com/paper/2211.01806/) (2022)
- [Backdoor Defense via Suppressing Model Shortcuts](https://mlsanity.com/paper/2211.05631/) (2022)
- [Improved Activation Clipping for Universal Backdoor Mitigation and Test-Time Detection](https://mlsanity.com/paper/2308.04617/) (2023)
- [Temporal-Distributed Backdoor Attack Against Video Based Action Recognition](https://mlsanity.com/paper/2308.11070/) (2023)
- [Backdoor Mitigation by Correcting the Distribution of Neural Activations](https://mlsanity.com/paper/2308.09850/) (2023)
- [TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors](https://mlsanity.com/paper/2607.12571/) (2026)
- [Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguards](https://mlsanity.com/paper/2608.07535/) (2026)

## Abstract (arXiv)

Backdoor (Trojan) attacks are emerging threats against deep neural networks (DNN). A DNN being attacked will predict to an attacker-desired target class whenever a test sample from any source class is embedded with a backdoor pattern; while correctly classifying clean (attack-free) test samples. Existing backdoor defenses have shown success in detecting whether a DNN is attacked and in reverse-engineering the backdoor pattern in a "post-training" regime: the defender has access to the DNN to be inspected and a small, clean dataset collected independently, but has no access to the (possibly poisoned) training set of the DNN. However, these defenses neither catch culprits in the act of triggering the backdoor mapping, nor mitigate the backdoor attack at test-time. In this paper, we propose an "in-flight" defense against backdoor attacks on image classification that 1) detects use of a backdoor trigger at test-time; and 2) infers the class of origin (source class) for a detected trigger example. The effectiveness of our defense is demonstrated experimentally against different strong backdoor attacks.