mlsanityData to 7 Oct 2026

Backdoor Vulnerabilities in Normally Trained Deep Learning Models

arXiv 2211.15929 ↗First posted 29 Nov 2022cs.CR cs.LGcited by 12

Not on the map. Why?

Abstract (arXiv)

We conduct a systematic study of backdoor vulnerabilities in normally trained Deep Learning models. They are as dangerous as backdoors injected by data poisoning because both can be equally exploited. We leverage 20 different types of injected backdoor attacks in the literature as the guidance and study their correspondences in normally trained models, which we call natural backdoor vulnerabilities. We find that natural backdoors are widely existing, with most injected backdoor attacks having natural correspondences. We categorize these natural backdoors and propose a general detection framework. It finds 315 natural backdoors in the 56 normally trained models downloaded from the Internet, covering all the different categories, while existing scanners designed for injected backdoors can at most detect 65 backdoors. We also study the root causes and defense of natural backdoors.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 48 of its 91 references that are in the map. First posted on arXiv 29 Nov 2022.

Builds on

48 of 91 references.

References · 48

  1. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2016Universal adversarial perturbationscited by 774
  8. 2018How To Backdoor Federated Learningcited by 745
  9. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  11. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  12. 2018Spectral Signatures in Backdoor Attackscited by 457
36 more
  1. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  2. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  3. 2020Backdoor Learning: A Surveycited by 412
  4. 2019Hidden Trigger Backdoor Attackscited by 359
  5. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  6. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  7. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  8. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  9. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  10. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  11. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  12. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  13. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  14. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  15. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  16. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  17. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  18. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  19. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  20. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  21. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 120
  22. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  23. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  24. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  25. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  26. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  27. 2020Trojaning Language Models for Fun and Profitcited by 80
  28. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  29. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  30. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
  31. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  32. 2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
  33. 2018SAFE: Self-Attentive Function Embeddings for Binary Similaritycited by 33
  34. 2020Deep Learning Backdoorscited by 19
  35. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 15
  36. 2022DECK: Model Hardening for Defending Pervasive Backdoorscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 6; 2024: 3; 2025: 2; 2026: 1.

12 papers.

  1. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  2. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  3. 2024How to Trace Latent Generative Model Generated Images without Artificial Watermark?cited by 25
  4. 2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
  5. 2024Invisible Backdoor Attack against Self-supervised Learningcited by 5
  6. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Datacited by 5
  7. 2023Alteration-free and Model-agnostic Origin Attribution of Generated Imagescited by 4
  8. 2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
  9. 2026Rendering-Aware Bayesian 3D Gaussian Splatting with Native Uncertainty and Adaptive Complexity Controlcited by 2
  10. 2023Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelinescited by 1
  11. 2025Backdoor Vectors: a Task Arithmetic View on Backdoor Attacks and Defensescited by 1
  12. 2023DIAGNOSIS: Detecting Unauthorized Data Usages in Text-to-image Diffusion Modelscited by 0