mlsanityData to 7 Oct 2026

On the Effectiveness of Adversarial Training against Backdoor Attacks

arXiv 2202.10627 ↗First posted 22 Feb 2022cs.LG cs.CRcited by 15

Not on the map. Why?

Abstract (arXiv)

DNNs' demand for massive data forces practitioners to collect data from the Internet without careful check due to the unacceptable cost, which brings potential risks of backdoor attacks. A backdoored model always predicts a target class in the presence of a predefined trigger pattern, which can be easily realized via poisoning a small amount of data. In general, adversarial training is believed to defend against backdoor attacks since it helps models to keep their prediction unchanged even if we perturb the input image (as long as within a feasible range). Unfortunately, few previous studies succeed in doing so. To explore whether adversarial training could defend against backdoor attacks or not, we conduct extensive experiments across different threat models and perturbation budgets, and find the threat model in adversarial training matters. For instance, adversarial training with spatial adversarial examples provides notable robustness against commonly-used patch-based backdoor attacks. We further propose a hybrid strategy which provides satisfactory robustness across different backdoor attacks.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Builds on 43 of its 56 references that are in the map. First posted on arXiv 22 Feb 2022.

Builds on

43 of 56 references.

References · 43

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  10. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  11. 2018Robustness May Be at Odds with Accuracycited by 873
  12. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
31 more
  1. 2020Dataset Condensation with Gradient Matchingcited by 510
  2. 2020Backdoor Learning: A Surveycited by 412
  3. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  4. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  5. 2019Label-Consistent Backdoor Attackscited by 285
  6. 2019Adversarial Examples Improve Image Recognitioncited by 283
  7. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  8. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  9. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  10. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  11. 2020Bag of Tricks for Adversarial Trainingcited by 199
  12. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  13. 2018Spatially Transformed Adversarial Examplescited by 195
  14. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  15. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  16. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  17. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  18. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  19. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  20. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  21. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  22. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  23. 2019Adversarial Robustness Against the Union of Multiple Perturbation Modelscited by 88
  24. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  25. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  26. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  27. 2019advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorchcited by 69
  28. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  29. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  30. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33
  31. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 4; 2024: 6; 2025: 1; 2026: 2.

15 papers.

Sort:

By area:

  1. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  2. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  3. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  4. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  5. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 12
  6. 2022RoCourseNet: Distributionally Robust Training of a Prediction Aware Recourse Modelcited by 11
  7. 2024Adversarial Backdoor Defense in CLIPcited by 10
  8. 2024Towards Unified Robustness Against Both Backdoor and Adversarial Attackscited by 9
  9. 2024Adversarial Training: A Surveycited by 6
  10. 2023Universal Detection of Backdoor Attacks via Density-based Clustering and Centroids Analysiscited by 5
  11. 2024DeTrigger: A Gradient-Centric Approach to Backdoor Attack Mitigation in Federated Learningcited by 5
  12. 2023Adversarial Robustness Unhardening via Backdoor Attacks in Federated Learningcited by 1
3 more
  1. 2026From Parameters to Feature Space: Task Arithmetic for Backdoor Mitigation in Model Mergingcited by 1
  2. 2025NT-ML: Backdoor Defense via Non-target Label Training and Mutual Learningcited by 0
  3. 2026Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learningcited by 0