Data to 7 Oct 2026

Backdoor Defense via Adaptively Splitting Poisoned Dataset

arXiv 2303.12993 ↗First posted 23 Mar 2023cs.CV cs.CRcited by 43

Not on the map. Why?

Abstract (arXiv)

Backdoor defenses have been studied to alleviate the threat of deep neural networks (DNNs) being backdoor attacked and thus maliciously altered. Since DNNs usually adopt some external training data from an untrusted third party, a robust backdoor defense strategy during the training stage is of importance. We argue that the core of training-time defense is to select poisoned samples and to handle them properly. In this work, we summarize the training-time defenses from a unified framework as splitting the poisoned dataset into two data pools. Under our framework, we propose an adaptively splitting dataset-based defense (ASD). Concretely, we apply loss-guided split and meta-learning-inspired split to dynamically update two data pools. With the split clean data pool and polluted data pool, ASD successfully defends against backdoor attacks during training. Extensive experiments on multiple benchmark datasets and DNN models against six state-of-the-art backdoor attacks demonstrate the superiority of our ASD. Our code is available at https://github.com/KuofengGao/ASD.

Key facts. Cited by 43 papers in the map (data through 7 Oct 2026). Builds on 60 of its 84 references that are in the map. First posted on arXiv 23 Mar 2023.

Builds on

60 of 84 references.

References · 60

2015Deep Residual Learning for Image Recognitioncited by 51,809
2014Adam: A Method for Stochastic Optimizationcited by 36,960
2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
2016Densely Connected Convolutional Networkscited by 6,691
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
2017Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networkscited by 4,861
2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
2020FixMatch: Simplifying Semi-Supervised Learning with Consistency and Confidencecited by 2,080
2019MixMatch: A Holistic Approach to Semi-Supervised Learningcited by 1,390
2019Unsupervised Data Augmentation for Consistency Trainingcited by 1,057

38 more

2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
2020Meta-Learning in Neural Networks: A Surveycited by 944
2017VGGFace2: A dataset for recognising faces across pose and agecited by 911
2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
2019Symmetric Cross Entropy for Robust Learning with Noisy Labelscited by 499
2018Spectral Signatures in Backdoor Attackscited by 457
2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
2019Unlabeled Data Improves Adversarial Robustnesscited by 415
2020Backdoor Learning: A Surveycited by 412
2019ReMixMatch: Semi-Supervised Learning with Distribution Alignment and Augmentation Anchoringcited by 349
2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
2020Input-Aware Dynamic Backdoor Attackcited by 304
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
2019Are Labels Required for Improving Adversarial Robustness?cited by 162
2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2022Backdoor Defense via Decoupling the Training Processcited by 149
2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
2022SimMatch: Semi-supervised Learning with Similarity Matchingcited by 118
2020RAB: Provable Robustness Against Backdoor Attackscited by 115
2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
2021Backdoor Attack in the Physical Worldcited by 82
2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
2022Improving Vision Transformers by Revisiting High-frequency Componentscited by 75
2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
2021Few-shot Backdoor Defense Using Shapley Estimationcited by 40

50 most cited of 60 All 60 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 8; 2024: 18; 2025: 10; 2026: 7.

43 papers.

Sort:

By area:

2024Follow-Your-Emoji: Fine-Controllable and Expressive Freestyle Portrait Animationcited by 172
2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
2024Adversarial Robustness for Visual Grounding of Multimodal Large Language Modelscited by 23
2024Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas: A Surveycited by 23
2024PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermarkcited by 19
2023Defenses in Adversarial Machine Learning: A Surveycited by 14

31 more

2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
2025CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separationcited by 9
2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
2024FLARE: Toward Universal Dataset Purification against Backdoor Attackscited by 7
2024Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformerscited by 5
2024Make Your Home Safe: Time-aware Unsupervised User Behavior Anomaly Detection in Smart Homes via Loss-guided Maskcited by 5
2025Retrievals Can Be Detrimental: Unveiling the Backdoor Vulnerability of Retrieval-Augmented Diffusion Modelscited by 5
2024Perturb and Recover: Fine-tuning for Effective Backdoor Removal from CLIPcited by 4
2023PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modificationcited by 3
2024VFLIP: A Backdoor Defense for Vertical Federated Learning via Identification and Purificationcited by 3
2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3
2025Pre-training CLIP against Data Poisoning with Optimal Transport-based Matching and Alignmentcited by 3
2024On the (In)feasibility of ML Backdoor Detection as an Hypothesis Testing Problemcited by 2
2024Backdoor Defense through Self-Supervised and Generative Learningcited by 2
2024LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithmcited by 2
2025Seal Your Backdoor with Variational Defensecited by 2
2025Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Modelscited by 2
2024Boundary-aware Decoupled Flow Networks for Realistic Extreme Rescalingcited by 1
2024Invertible Residual Rescaling Modelscited by 1
2023Mendata: A Framework to Purify Manipulated Training Datacited by 0
2024CBPF: Filtering Poisoned Data Based on Composite Backdoor Attackcited by 0
2025NT-ML: Backdoor Defense via Non-target Label Training and Mutual Learningcited by 0
2025SMS: Self-supervised Model Seeding for Verification of Machine Unlearningcited by 0
2025Enhancing All-to-X Backdoor Attacks with Optimized Target Class Mappingcited by 0
2026PASTA: A Patch-Agnostic Twofold-Stealthy Backdoor Attack on Vision Transformerscited by 0
2026CSC: Turning the Adversary's Poison against Itselfcited by 0
2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0
2026TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecastingcited by 0
2026Anti-Backdoor Coreset Selection via Cumulative Entropycited by 0
2026Mitigating Backdoors via Decoy Shortcuts and Knowledge Decouplingcited by 0
2026Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggerscited by 0