mlsanityData to 14 Oct 2026

BackdoorBench: A Comprehensive Benchmark of Backdoor Learning

arXiv 2206.12654 ↗First posted 25 Jun 2022cs.LG cs.CRcited by 128

Not on the map. Why?

Cited by 44 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor learning is an emerging and vital topic for studying deep neural networks' vulnerability (DNNs). Many pioneering backdoor attack and defense methods are being proposed, successively or concurrently, in the status of a rapid arms race. However, we find that the evaluations of new methods are often unthorough to verify their claims and accurate performance, mainly due to the rapid development, diverse settings, and the difficulties of implementation and reproducibility. Without thorough evaluations and comparisons, it is not easy to track the current progress and design the future development roadmap of the literature. To alleviate this dilemma, we build a comprehensive benchmark of backdoor learning called BackdoorBench. It consists of an extensible modular-based codebase (currently including implementations of 8 state-of-the-art (SOTA) attacks and 9 SOTA defense algorithms) and a standardized protocol of complete backdoor learning. We also provide comprehensive evaluations of every pair of 8 attacks against 9 defenses, with 5 poisoning ratios, based on 5 models and 4 datasets, thus 8,000 pairs of evaluations in total. We present abundant analysis from different perspectives about these 8,000 evaluations, studying the effects of different factors in backdoor learning. All codes and evaluations of BackdoorBench are publicly available at urlhttps://backdoorbench.github.io.

Key facts. Cited by 128 papers in the map (data through 14 Oct 2026). Builds on 50 of its 86 references that are in the map. First posted on arXiv 25 Jun 2022.

Builds on

50 of 86 references.

References · 50

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  7. 2016Densely Connected Convolutional Networkscited by 6,720
  8. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  9. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,442
  10. 2019Searching for MobileNetV3cited by 1,994
  11. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  12. 2016Adversarial examples in the physical worldcited by 1,769
38 more
  1. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  2. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  3. 2018An Empirical Study of Example Forgetting during Deep Neural Network Learningcited by 678
  4. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  7. 2018Spectral Signatures in Backdoor Attackscited by 484
  8. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  9. 2020Backdoor Learning: A Surveycited by 426
  10. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  11. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  12. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  13. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  14. 2019Label-Consistent Backdoor Attackscited by 296
  15. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 271
  16. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  17. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  18. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
  19. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  20. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 222
  21. 2018Adversarial Robustness Toolbox v1.0.0cited by 215
  22. 2019Full-Gradient Representation for Neural Network Visualizationcited by 191
  23. 2020Blind Backdoors in Deep Learning Modelscited by 182
  24. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  25. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  26. 2017Neural Trojanscited by 153
  27. 2022Backdoor Defense via Decoupling the Training Processcited by 153
  28. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 123
  29. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 102
  30. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  31. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 79
  32. 2019Model Agnostic Defence against Backdoor Attacks in Machine Learningcited by 52
  33. 2020The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Modelscited by 42
  34. 2020Understanding Why Neural Networks Generalize Well Through GSNR of Parameterscited by 40
  35. 2020TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoorscited by 30
  36. 2020ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networkscited by 28
  37. 2020FaceHack: Triggering backdoored facial recognition systems using facial characteristicscited by 20
  38. 2020Advbox: a toolbox to generate adversarial examples that fool neural networkscited by 17

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 7; 2023: 29; 2024: 42; 2025: 30; 2026: 20.

128 papers.

Sort:

By area:

  1. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 422
  2. 2024Model Merging in LLMs, MLLMs, and Beyond: Methods, Theories, Applications and Opportunitiescited by 254
  3. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 126
  4. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 115
  5. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 88
  6. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 87
  7. 2023BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPTcited by 76
  8. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
  9. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 67
  10. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 64
  11. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 63
  12. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 50
38 more
  1. 2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 46
  2. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 45
  3. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  4. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 43
  5. 2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 38
  6. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 37
  7. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 35
  8. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 32
  9. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 28
  10. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 26
  11. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 26
  12. 2024Towards Robust Physical-world Backdoor Attacks on Lane Detectioncited by 26
  13. 2022Imperceptible and Robust Backdoor Attack in 3D Point Cloudcited by 25
  14. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
  15. 2025To Think or Not to Think: Exploring the Unthinking Vulnerability in Large Reasoning Modelscited by 22
  16. 2023Red Teaming Deep Neural Networks with Feature Synthesis Toolscited by 21
  17. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  18. 2022Exploring Inconsistent Knowledge Distillation for Object Detection with Data Augmentationcited by 19
  19. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
  20. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 18
  21. 2025BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Modelscited by 17
  22. 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
  23. 2023Quantifying Bias in Text-to-Image Generative Modelscited by 16
  24. 2024Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspacecited by 14
  25. 2022Versatile Weight Attack via Flipping Limited Bitscited by 13
  26. 2022Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Modelscited by 11
  27. 2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 11
  28. 2023Sharpness-Aware Data Poisoning Attackcited by 10
  29. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputscited by 10
  30. 2025CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separationcited by 10
  31. 2023Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggerscited by 9
  32. 2023VDC: Versatile Data Cleanser based on Visual-Linguistic Inconsistency by Multimodal Large Language Modelscited by 9
  33. 2023DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Modelscited by 9
  34. 2024Reliable Model Watermarking: Defending Against Theft without Compromising on Evasioncited by 9
  35. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 9
  36. 2024Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retrainingcited by 9
  37. 2024Acquiring Clean Language Models from Backdoor Poisoned Datasets by Downscaling Frequency Spacecited by 8
  38. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Modelcited by 8

50 most cited of 128 All 128 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Data
  2. 2025SoK: The Last Line of Defense: On Backdoor Defense Evaluation
  3. 2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection
  4. 2025Architectural Backdoors in Deep Learning: A Survey of Vulnerabilities, Detection, and Defense
  5. 2024Countering Backdoor Attacks in Image Recognition: A Survey and Evaluation of Mitigation Strategies
  6. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Models
  7. 2022Architectural Backdoors in Neural Networks
  8. 2021Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functions