Data to 14 Oct 2026

Detecting Backdoors in Pre-trained Encoders

arXiv 2303.15180 ↗First posted 23 Mar 2023cs.CV cs.AI cs.CRcited by 55

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Self-supervised learning in computer vision trains on unlabeled data, such as images or (image, text) pairs, to obtain an image encoder that learns high-quality embeddings for input data. Emerging backdoor attacks towards encoders expose crucial vulnerabilities of self-supervised learning, since downstream classifiers (even further trained on clean data) may inherit backdoor behaviors from encoders. Existing backdoor detection methods mainly focus on supervised learning settings and cannot handle pre-trained encoders especially when input labels are not available. In this paper, we propose DECREE, the first backdoor detection approach for pre-trained encoders, requiring neither classifier headers nor input labels. We evaluate DECREE on over 400 encoders trojaned under 3 paradigms. We show the effectiveness of our method on image encoders pre-trained on ImageNet and OpenAI's CLIP 400 million image-text pairs. Our method consistently has a high detection accuracy even if we have only limited or no access to the pre-training dataset.

Key facts. Cited by 55 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 37 of its 63 references that are in the map. First posted on arXiv 23 Mar 2023.

Builds on

37 of 63 references.

Closest ancestors · 2

Same direction, newest first

Other references · 35

2015Deep Residual Learning for Image Recognitioncited by 52,096
2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,513
2021Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervisioncited by 3,864
2020Improved Baselines with Momentum Contrastive Learningcited by 2,287
2020Big Self-Supervised Models are Strong Semi-Supervised Learnerscited by 1,380
2016Understanding intermediate layers using linear classifier probescited by 1,353
2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
2019Hidden Trigger Backdoor Attackscited by 371

23 more

2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
2020Input-Aware Dynamic Backdoor Attackcited by 313
2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 151
2021Poisoning and Backdooring Contrastive Learningcited by 151
2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 146
2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 122
2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 95
2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 95
2021Backdoor Attacks on Self-Supervised Learningcited by 90
2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 89
2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 77
2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 60
2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
2021EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetrycited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 5; 2024: 17; 2025: 21; 2026: 12.

55 papers.

Sort:

By area:

2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 115
2024Advances and Open Challenges in Federated Foundation Modelscited by 36
2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
2024Moderator: Moderating Text-to-Image Diffusion Models through Fine-grained Context-based Policiescited by 15
2023Defenses in Adversarial Machine Learning: A Surveycited by 14
2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Modelscited by 14
2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
2024Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuningcited by 12
2024Adversarial Backdoor Defense in CLIPcited by 10
2023TrojFSP: Trojan Insertion in Few-shot Prompt Tuningcited by 9
2025TAI3: Testing Agent Integrity in Interpreting User Intentcited by 9
2024Mutual Information Guided Backdoor Mitigation for Pre-trained Encoderscited by 8

38 more

2023GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learningcited by 6
2024Can Distillation Mitigate Backdoor Attacks in Pre-trained Encoders?cited by 6
2024Invisible Backdoor Attack against Self-supervised Learningcited by 6
2024Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threatscited by 6
2024DeDe: Detecting Backdoor Samples for SSL Encoders via Decoderscited by 6
2025Are Your LLM-based Text-to-SQL Models Secure? Exploring SQL Injection via Backdoor Attackscited by 6
2025Lie Detector: Unified Backdoor Detection via Cross-Examination Frameworkcited by 6
2025Backdooring Self-Supervised Contrastive Learning by Noisy Alignmentcited by 6
2024Test-Time Multimodal Backdoor Detection by Contrastive Promptingcited by 5
2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 5
2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Modelscited by 5
2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
2025Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Drivingcited by 4
2025A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Modelscited by 3
2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3
2025Pre-training CLIP against Data Poisoning with Optimal Transport-based Matching and Alignmentcited by 3
2024EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspectioncited by 2
2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
2024New Emerged Security and Privacy of Pre-trained Model: a Survey and Outlookcited by 2
2024On the Fairness, Diversity and Reliability of Text-to-Image Generative Modelscited by 2
2025Circumventing Backdoor Space via Weight Symmetrycited by 2
2026BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learningcited by 2
2024Defense Against Syntactic Textual Backdoor Attacks with Token Substitutioncited by 1
2025PersGuard: Preventing Malicious Personalization in Text-to-Image Diffusion Models via Model Backdoorscited by 1
2025Backdooring CLIP through Concept Confusioncited by 1
2025InverTune: Removing Backdoors from Multimodal Contrastive Learning Models via Trigger Inversion and Activation Tuningcited by 1
2025CUBA: Controlled Untargeted Backdoor Attack against Deep Neural Networkscited by 1
2025IPBA: Imperceptible Perturbation Backdoor Attack in Federated Self-Supervised Learningcited by 1
2025Backdoor Unlearning by Linear Task Decompositioncited by 1
2026BackdoorIDS: Zero-shot Backdoor Detection for Pretrained Vision Encodercited by 1
2023Trustworthy Large Models in Vision: A Surveycited by 0
2025TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learningcited by 0
2025Prototype Guided Backdoor Defensecited by 0
2025Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Modelscited by 0
2026Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanningcited by 0
2026Hidden Ads: Behavior Triggered Semantic Backdoors for Advertisement Injection in Vision Language Modelscited by 0
2026CLIP-Inspector: Model-Level Backdoor Detection for Prompt-Tuned CLIP via OOD Trigger Inversioncited by 0
2026ArmSSL: Adversarial Robust Black-Box Watermarking for Self-Supervised Learning Pre-trained Encoderscited by 0

50 most cited of 55 All 55 (JSON)

Similar, not cited

Close in wording, no citation either way