Data to 14 Oct 2026

BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learning

arXiv 2205.13383 ↗First posted 26 May 2022cs.CV cs.CR cs.LGcited by 86

Not on the map. Why?

Cited by 22 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks are vulnerable to Trojan attacks. Existing attacks use visible patterns (e.g., a patch or image transformations) as triggers, which are vulnerable to human inspection. In this paper, we propose stealthy and efficient Trojan attacks, BppAttack. Based on existing biology literature on human visual systems, we propose to use image quantization and dithering as the Trojan trigger, making imperceptible changes. It is a stealthy and efficient attack without training auxiliary models. Due to the small changes made to images, it is hard to inject such triggers during training. To alleviate this problem, we propose a contrastive learning based approach that leverages adversarial attacks to generate negative sample pairs so that the learned trigger is precise and accurate. The proposed method achieves high attack success rates on four benchmark datasets, including MNIST, CIFAR-10, GTSRB, and CelebA. It also effectively bypasses existing Trojan defenses and human inspection. Our code can be found in https://github.com/RU-System-Software-and-Security/BppAttack.

Key facts. Cited by 86 papers in the map (data through 14 Oct 2026). Builds on 43 of its 76 references that are in the map. First posted on arXiv 26 May 2022.

Builds on

43 of 76 references.

References · 43

2015Deep Residual Learning for Image Recognitioncited by 52,096
2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
2014Explaining and Harnessing Adversarial Examplescited by 7,364
2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
2016Densely Connected Convolutional Networkscited by 6,720
2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
2017Squeeze-and-Excitation Networkscited by 4,789
2014Deep Learning Face Attributes in the Wildcited by 3,693
2016DeepLab: Semantic Image Segmentation with Deep Convolutional Nets, Atrous Convolution, and Fully Connected CRFscited by 3,241
2020Supervised Contrastive Learningcited by 2,829
2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
2016Membership Inference Attacks against Machine Learning Modelscited by 2,281

31 more

2016Identity Mappings in Deep Residual Networkscited by 1,965
2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,628
2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
2018Spectral Signatures in Backdoor Attackscited by 484
2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
2020Input-Aware Dynamic Backdoor Attackcited by 313
2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 151
2021Poisoning and Backdooring Contrastive Learningcited by 151
2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 146
2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
2020Data-Free Model Extractioncited by 124
2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 123
2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 95
2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 95
2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 83
2019Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systemscited by 27
2020Deep Learning Backdoorscited by 19
2021EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetrycited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 4; 2023: 22; 2024: 29; 2025: 20; 2026: 11.

86 papers.

Sort:

By area:

2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
2023Stealthy Backdoor Attack for Code Modelscited by 49
2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 39
2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 37
2022TrojViT: Trojan Insertion in Vision Transformerscited by 31
2024How to Trace Latent Generative Model Generated Images without Artificial Watermark?cited by 26
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 18
2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 18

38 more

2022Backdoor Cleansing with Unlabeled Datacited by 17
2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
2024Uncertainty is Fragile: Manipulating Uncertainty in Large Language Modelscited by 13
2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11
2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 11
2023Progressive Poisoned Data Isolation for Training-time Backdoor Defensecited by 10
2025CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separationcited by 10
2023Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggerscited by 9
2023WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networkscited by 8
2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 8
2023Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognitioncited by 7
2024Semantic Shield: Defending Vision-Language Models Against Backdooring and Poisoning via Fine-grained Knowledge Alignmentcited by 7
2025Towards Backdoor Stealthiness in Model Parameter Spacecited by 7
2023SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classificationcited by 6
2024Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishabilitycited by 6
2024Invisible Backdoor Attack against Self-supervised Learningcited by 6
2024Data-centric NLP Backdoor Defense from the Lens of Memorizationcited by 6
2023Boosting Backdoor Attack with A Learnable Poisoning Sample Selection Strategycited by 5
2023Robust Backdoor Attacks on Object Detection in Real Worldcited by 5
2024Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearningcited by 5
2025Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attackcited by 5
2022Invisible Backdoor Attack with Dynamic Triggers against Person Re-identificationcited by 4
2023Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineeringcited by 4
2023Alteration-free and Model-agnostic Origin Attribution of Generated Imagescited by 4
2023Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Triggercited by 4
2024Model X-ray:Detecting Backdoored Models via Decision Boundarycited by 3
2024Augmented Neural Fine-Tuning for Efficient Backdoor Purificationcited by 3
2024Defending Deep Regression Models against Backdoor Attackscited by 3
2024BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluationcited by 3
2025Scanning Trojaned Models Using Out-of-Distribution Samplescited by 3
2025ReVeil: Unconstrained Concealed Backdoor Attack on Deep Neural Networks using Machine Unlearningcited by 3
2025Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalizationcited by 3
2026From Internal Diagnosis to External Auditing: A VLM-Driven Paradigm for Data-Free Online Backdoor Defensecited by 3
2024Clean-image Backdoor Attackscited by 2
2024Fisher Information guided Purification against Backdoor Attackscited by 2
2024Long-Tailed Backdoor Attack Using Dynamic Data Augmentation Operationscited by 2
2025Revisiting Training-Inference Trigger Intensity in Backdoor Attackscited by 2

50 most cited of 86 All 86 (JSON)

Similar, not cited

Close in wording, no citation either way