mlsanityData to 7 Oct 2026

BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defense

arXiv 2301.06241 ↗First posted 16 Jan 2023cs.CR cs.LGcited by 15

Not on the map. Why?

Abstract (arXiv)

Deep Learning backdoor attacks have a threat model similar to traditional cyber attacks. Attack forensics, a critical counter-measure for traditional cyber attacks, is hence of importance for defending model backdoor attacks. In this paper, we propose a novel model backdoor forensics technique. Given a few attack samples such as inputs with backdoor triggers, which may represent different types of backdoors, our technique automatically decomposes them to clean inputs and the corresponding triggers. It then clusters the triggers based on their properties to allow automatic attack categorization and summarization. Backdoor scanners can then be automatically synthesized to find other instances of the same type of backdoor in other models. Our evaluation on 2,532 pre-trained models, 10 popular attacks, and comparison with 9 baselines show that our technique is highly effective. The decomposed clean inputs and triggers closely resemble the ground truth. The synthesized scanners substantially outperform the vanilla versions of existing scanners that can hardly generalize to different kinds of attacks.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Builds on 61 of its 126 references that are in the map. First posted on arXiv 16 Jan 2023.

Builds on

61 of 126 references.

References · 61

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2016Densely Connected Convolutional Networkscited by 6,691
  6. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  10. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,427
  11. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  12. 2014Deep Learning Face Attributes in the Wildcited by 3,679
38 more
  1. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  6. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  7. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  8. 2018Spectral Signatures in Backdoor Attackscited by 457
  9. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  10. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  11. 2019Hidden Trigger Backdoor Attackscited by 359
  12. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  13. 2020High-Fidelity Generative Image Compressioncited by 331
  14. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  15. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  16. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  17. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  18. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  19. 2017Neural Trojanscited by 151
  20. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  21. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  22. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  23. 2017Machine Learning of Linear Differential Equations using Gaussian Processescited by 139
  24. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  25. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  26. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  27. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  28. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  29. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  30. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  31. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  32. 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 82
  33. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  34. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 75
  35. 2019TBar: Revisiting Template-based Automated Program Repaircited by 64
  36. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  37. 2019NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanationscited by 49
  38. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37

50 most cited of 61 All 61 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 5; 2025: 5; 2026: 3.

15 papers.

Sort:

By area:

  1. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  2. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  3. 2025Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generationcited by 12
  4. 2025TracLLM: A Generic Framework for Attributing Long Context LLMscited by 11
  5. 2023Self-Deception: Reverse Penetrating the Semantic Firewall of Large Language Modelscited by 6
  6. 2024Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learningcited by 6
  7. 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completionscited by 4
  8. 2024UTrace: Poisoning Forensics for Private Collaborative Learningcited by 3
  9. 2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
  10. 2026AgentRAE: Remote Action Execution through Notification-based Visual Backdoors against Screenshots-based Mobile GUI Agentscited by 2
  11. 2025ChainMarks: Securing DNN Watermark with Cryptographic Chaincited by 1
  12. 2026Who Broke the System? Failure Localization in LLM-Based Multi-Agent Systemscited by 1
3 more
  1. 2024XSub: Explanation-Driven Adversarial Attack against Blackbox Classifiers via Feature Substitutioncited by 0
  2. 2025A Client-level Assessment of Collaborative Backdoor Poisoning in Non-IID Federated Learningcited by 0
  3. 2025HAMLOCK: HArdware-Model LOgically Combined attacKcited by 0