mlsanityData to 7 Oct 2026

SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classification

arXiv 2302.01740 ↗First posted 3 Feb 2023cs.CV cs.CR cs.LGcited by 6

Not on the map. Why?

Abstract (arXiv)

Deep learning achieves outstanding results in many machine learning tasks. Nevertheless, it is vulnerable to backdoor attacks that modify the training set to embed a secret functionality in the trained model. The modified training samples have a secret property, i. e., a trigger. At inference time, the secret functionality is activated when the input contains the trigger, while the model functions correctly in other cases. While there are many known backdoor attacks (and defenses), deploying a stealthy attack is still far from trivial. Successfully creating backdoor triggers depends on numerous parameters. Unfortunately, research has not yet determined which parameters contribute most to the attack performance. This paper systematically analyzes the most relevant parameters for the backdoor attacks, i.e., trigger size, position, color, and poisoning rate. Using transfer learning, which is very common in computer vision, we evaluate the attack on state-of-the-art models (ResNet, VGG, AlexNet, and GoogLeNet) and datasets (MNIST, CIFAR10, and TinyImageNet). Our attacks cover the majority of backdoor settings in research, providing concrete directions for future works. Our code is publicly available to facilitate the reproducibility of our results.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 49 of its 84 references that are in the map. First posted on arXiv 3 Feb 2023.

Builds on

49 of 84 references.

References · 49

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  5. 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
  6. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,040
  7. 2014Going Deeper with Convolutionscited by 4,231
  8. 2015Learning Deep Features for Discriminative Localizationcited by 2,430
  9. 2016Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translationcited by 1,471
  10. 2017Learning Important Features Through Propagating Activation Differencescited by 1,454
  11. 2019A Comprehensive Survey on Transfer Learningcited by 1,154
  12. 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,097
37 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  2. 2018How To Backdoor Federated Learningcited by 745
  3. 2013Speech Recognition with Deep Recurrent Neural Networkscited by 666
  4. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  5. 2018Explaining Explanations: An Overview of Interpretability of Machine Learningcited by 508
  6. 2020Backdoor Learning: A Surveycited by 412
  7. 2019Hidden Trigger Backdoor Attackscited by 359
  8. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  9. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  10. 2014CNN Features off-the-shelf: an Astounding Baseline for Recognitioncited by 316
  11. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  12. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  13. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  14. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  15. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  16. 2020Blind Backdoors in Deep Learning Modelscited by 174
  17. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  18. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  19. 2020On Translation Invariance in CNNs: Convolutional Layers can Exploit Absolute Spatial Locationcited by 141
  20. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  21. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  22. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 120
  23. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  24. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  25. 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 69
  26. 2020Backdoor Attack against Speaker Verificationcited by 62
  27. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  28. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
  29. 2022Avoiding Overfitting: A Survey on Regularization Methods for Convolutional Neural Networkscited by 55
  30. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  31. 2021Can You Hear It? Backdoor Attacks via Ultrasonic Triggerscited by 41
  32. 2020Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifierscited by 23
  33. 2020Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networkscited by 19
  34. 2022Going In Style: Audio Backdoors Through Stylistic Transformationscited by 19
  35. 2022Neural Networks are Decision Treescited by 16
  36. 2022Dynamic Backdoors with Global Average Poolingcited by 5
  37. 2022Sniper Backdoor: Single Client Targeted Backdoor Attack in Federated Learningcited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 1; 2025: 2; 2026: 1.

6 papers.

  1. 2024Context is the Key: Backdoor Attacks for In-Context Learning with Vision Transformerscited by 2
  2. 2023Invisible Threats: Backdoor Attack in OCR Systemscited by 1
  3. 2023Backdoor Attacks on Transformers for Tabular Data: An Empirical Studycited by 0
  4. 2025ConSeg: Contextual Backdoor Attack Against Semantic Segmentationcited by 0
  5. 2025CatBack: Universal Backdoor Attacks on Tabular Data via Categorical Encodingcited by 0
  6. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0