mlsanityData to 14 Oct 2026

PECAN: A Deterministic Certified Defense Against Backdoor Attacks

arXiv 2301.11824 ↗First posted 27 Jan 2023cs.CR cs.LGcited by 5

Not on the map. Why?

Abstract (arXiv)

Neural networks are vulnerable to backdoor poisoning attacks, where the attackers maliciously poison the training set and insert triggers into the test input to change the prediction of the victim model. Existing defenses for backdoor attacks either provide no formal guarantees or come with expensive-to-compute and ineffective probabilistic guarantees. We present PECAN, an efficient and certified approach for defending against backdoor attacks. The key insight powering PECAN is to apply off-the-shelf test-time evasion certification techniques on a set of neural networks trained on disjoint partitions of the data. We evaluate PECAN on image classification and malware detection datasets. Our results demonstrate that PECAN can (1) significantly outperform the state-of-the-art certified backdoor defense, both in defense strength and efficiency, and (2) on real back-door attacks, PECAN can reduce attack success rate by order of magnitude when compared to a range of baselines from the literature.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 42 of its 64 references that are in the map. First posted on arXiv 27 Jan 2023.

Builds on

42 of 64 references.

References · 42

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  2. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  4. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  5. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  6. 2017Adversarial Patchcited by 517
  7. 2018Spectral Signatures in Backdoor Attackscited by 484
  8. 2019Hidden Trigger Backdoor Attackscited by 371
  9. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
  10. 2019Label-Consistent Backdoor Attackscited by 296
  11. 2019Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNetcited by 260
  12. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 228
30 more
  1. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 205
  2. 2018EMBER: An Open Dataset for Training Static PE Malware Machine Learning Modelscited by 165
  3. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 163
  4. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 151
  5. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 135
  6. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 131
  7. 2020RAB: Provable Robustness Against Backdoor Attackscited by 118
  8. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 115
  9. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 108
  10. 2022General Cutting Planes for Bound-Propagation-Based Neural Network Verificationcited by 103
  11. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 94
  12. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  13. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 78
  14. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 77
  15. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 66
  16. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  17. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 60
  18. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregationcited by 52
  19. 2022Certified Training: Small Boxes are All You Needcited by 52
  20. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  21. 2021Certifying Robustness to Programmable Data Bias in Decision Treescited by 21
  22. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 21
  23. 2022BagFlip: A Certified Defense against Data Poisoningcited by 19
  24. 2021Certified Robustness to Programmable Transformations in LSTMscited by 18
  25. 2022On Collective Robustness of Bagging Against Data Poisoningcited by 16
  26. 2022Certified Defences Against Adversarial Patch Attacks on Semantic Segmentationcited by 16
  27. 2020A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attackscited by 12
  28. 2022Lethal Dose Conjecture on Data Poisoningcited by 12
  29. 2022XRand: Differentially Private Defense against Explanation-Guided Attackscited by 11
  30. 2021Shared Certificates for Neural Network Verificationcited by 10

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 2; 2025: 1; 2026: 2.

5 papers.

  1. 2024Provably Unlearnable Data Examplescited by 18
  2. 2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
  3. 2024UTrace: Poisoning Forensics for Private Collaborative Learningcited by 3
  4. 2026Inference-Time Consensus for Mitigating Hidden Behaviors from LLM Fine-Tuningcited by 1
  5. 2026Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learning
  2. 2025Backdoor Attacks and Defenses in Computer Vision Domain: A Survey
  3. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning
  4. 2021Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functions
  5. 2024PAD-FT: A Lightweight Defense for Backdoor Attacks via Data Purification and Fine-Tuning
  6. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samples
  7. 2021Test-Time Detection of Backdoor Triggers for Poisoned Deep Neural Networks
  8. 2024CEPA: Consensus Embedded Perturbation for Agnostic Detection and Inversion of Backdoors