mlsanityData to 7 Oct 2026

BackdoorBox: A Python Toolbox for Backdoor Learning

arXiv 2302.01762 ↗First posted 1 Feb 2023cs.CR cs.CV cs.LGcited by 25

Not on the map. Why?

Abstract (arXiv)

Third-party resources (e.g., samples, backbones, and pre-trained models) are usually involved in the training of deep neural networks (DNNs), which brings backdoor attacks as a new training-phase threat. In general, backdoor attackers intend to implant hidden backdoor in DNNs, so that the attacked DNNs behave normally on benign samples whereas their predictions will be maliciously changed to a pre-defined target label if hidden backdoors are activated by attacker-specified trigger patterns. To facilitate the research and development of more secure training schemes and defenses, we design an open-sourced Python toolbox that implements representative and advanced backdoor attacks and defenses under a unified and flexible framework. Our toolbox has four important and promising characteristics, including consistency, simplicity, flexibility, and co-development. It allows researchers and developers to easily implement and compare different methods on benchmark or their local datasets. This Python toolbox, namely textttBackdoorBox, is available at urlhttps://github.com/THUYimingLi/BackdoorBox.

Key facts. Cited by 25 papers in the map (data through 7 Oct 2026). Builds on 43 of its 54 references that are in the map. First posted on arXiv 1 Feb 2023.

Builds on

43 of 54 references.

References · 43

  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  2. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  3. 2018Spectral Signatures in Backdoor Attackscited by 457
  4. 2020Backdoor Learning: A Surveycited by 412
  5. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  6. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  7. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  8. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  9. 2019Label-Consistent Backdoor Attackscited by 285
  10. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  11. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  12. 2020Blind Backdoors in Deep Learning Modelscited by 174
31 more
  1. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  2. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  3. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  4. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  5. 2017Neural Trojanscited by 151
  6. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  7. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  8. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  9. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 120
  10. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  11. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  12. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  13. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  14. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  15. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  16. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 92
  17. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  18. 2021Backdoor Attack in the Physical Worldcited by 82
  19. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  20. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 75
  21. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  22. 2020Backdoor Attack against Speaker Verificationcited by 62
  23. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  24. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  25. 2021A Backdoor Attack against 3D Point Cloud Classifierscited by 50
  26. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  27. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  28. 2020TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoorscited by 30
  29. 2022Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarioscited by 29
  30. 2021End2End Occluded Face Recognition by Masking Corrupted Featurescited by 24
  31. 2022Hardly Perceptible Trojan Attack against Neural Networks with Bit Flipscited by 21

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 9; 2024: 9; 2025: 5; 2026: 2.

25 papers.

Sort:

By area:

  1. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  2. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  3. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  4. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  5. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  6. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  7. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 15
  8. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 14
  9. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
  10. 2023APBench: A Unified Benchmark for Availability Poisoning Attacks and Defensescited by 7
  11. 2024FLARE: Toward Universal Dataset Purification against Backdoor Attackscited by 7
  12. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Modelcited by 7
13 more
  1. 2023Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Triggercited by 4
  2. 2024Testing autonomous vehicles and AI: perspectives and challenges from cybersecurity, transparency, robustness and fairnesscited by 3
  3. 2024Trading Devil: Robust backdoor attack via Stochastic investment models and Bayesian approachcited by 3
  4. 2024BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluationcited by 3
  5. 2025Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attackcited by 3
  6. 2025Holmes: Towards Effective and Harmless Model Ownership Verification to Personalized Large Vision Models via Decoupling Common Featurescited by 2
  7. 2024Be Persistent: Towards a Unified Solution for Mitigating Shortcuts in Deep Learningcited by 1
  8. 2024Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformerscited by 1
  9. 2026APEX: Probing Neural Networks via Activation Perturbationcited by 1
  10. 2024Let the Noise Speak: Harnessing Noise for a Unified Defense Against Adversarial and Backdoor Attackscited by 0
  11. 2025Defending against Backdoor Attacks via Module Switchingcited by 0
  12. 2025CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibrationcited by 0
  13. 2026Certification of Machine Learning Models via Directional Sharpnesscited by 0