mlsanityData to 7 Oct 2026

SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learning

arXiv 2303.09079 ↗First posted 16 Mar 2023cs.CR cs.CV cs.LGcited by 11

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Self-supervised learning (SSL) is a prevalent approach for encoding data representations. Using a pre-trained SSL image encoder and subsequently training a downstream classifier, impressive performance can be achieved on various tasks with very little labeled data. The growing adoption of SSL has led to an increase in security research on SSL encoders and associated Trojan attacks. Trojan attacks embedded in SSL encoders can operate covertly, spreading across multiple users and devices. The presence of backdoor behavior in Trojaned encoders can inadvertently be inherited by downstream classifiers, making it even more difficult to detect and mitigate the threat. Although current Trojan detection methods in supervised learning can potentially safeguard SSL downstream classifiers, identifying and addressing triggers in the SSL encoder before its widespread dissemination is a challenging task. This challenge arises because downstream tasks might be unknown, dataset labels may be unavailable, and the original unlabeled training dataset might be inaccessible during Trojan detection in SSL encoders. We introduce SSL-Cleanse as a solution to identify and mitigate backdoor threats in SSL encoders. We evaluated SSL-Cleanse on various datasets using 1200 encoders, achieving an average detection success rate of 82.2% on ImageNet-100. After mitigating backdoors, on average, backdoored encoders achieve 0.3% attack success rate without great accuracy loss, proving the effectiveness of SSL-Cleanse. The source code of SSL-Cleanse is available at https://github.com/UCF-ML-Research/SSL-Cleanse.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 28 of its 51 references that are in the map. First posted on arXiv 16 Mar 2023.

Builds on

28 of 51 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learning15 Nov
  2. 2022TrojViT: Trojan Insertion in Vision Transformers27 Aug
  3. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning13 May
  4. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning1 Aug

Other references · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  3. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  4. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,712
  5. 2020Exploring Simple Siamese Representation Learningcited by 2,853
  6. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,772
  7. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
  8. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2020A Survey on Contrastive Self-supervised Learningcited by 553
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  12. 2019Hidden Trigger Backdoor Attackscited by 359
12 more
  1. 2021Graph Self-Supervised Learning: A Surveycited by 289
  2. 2020Blind Backdoors in Deep Learning Modelscited by 174
  3. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  4. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  5. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  6. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  7. 2021Zero-Shot Self-Supervised Learning for MRI Reconstructioncited by 53
  8. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  9. 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 26
  10. 2020Cassandra: Detecting Trojaned Networks from Adversarial Perturbationscited by 15
  11. 2022ESTAS: Effective and Stable Trojan Attacks in Self-supervised Encoders with One Target Unlabelled Samplecited by 9
  12. 2021A Framework using Contrastive Learning for Classification with Noisy Labelscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 1; 2025: 4; 2026: 2.

11 papers.

  1. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  2. 2023TrojLLM: A Black-box Trojan Prompt Attack on Large Language Modelscited by 29
  3. 2023GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learningcited by 6
  4. 2024DeDe: Detecting Backdoor Samples for SSL Encoders via Decoderscited by 6
  5. 2025Backdooring Self-Supervised Contrastive Learning by Noisy Alignmentcited by 6
  6. 2023TrojFair: Trojan Fairness Attackscited by 2
  7. 2025Dataset Ownership Verification for Pre-trained Masked Modelscited by 2
  8. 2025Backdooring CLIP through Concept Confusioncited by 1
  9. 2025Circumventing Backdoor Space via Weight Symmetrycited by 1
  10. 2026REALM: A Unified Red-Teaming Benchmark for Physical-World VLMscited by 0
  11. 2026The Platonic Defense: Backdoor Defense for Self-Supervised Encoders in the Era of Large Scale Pre-trainingcited by 0