Data to 7 Oct 2026

UNICORN: A Unified Backdoor Trigger Inversion Framework

arXiv 2304.02786 ↗First posted 5 Apr 2023cs.LG cs.AI cs.CRcited by 44

Not on the map. Why?

Abstract (arXiv)

The backdoor attack, where the adversary uses inputs stamped with triggers (e.g., a patch) to activate pre-planted malicious behaviors, is a severe threat to Deep Neural Network (DNN) models. Trigger inversion is an effective way of identifying backdoor models and understanding embedded adversarial behaviors. A challenge of trigger inversion is that there are many ways of constructing the trigger. Existing methods cannot generalize to various types of triggers by making certain assumptions or attack-specific constraints. The fundamental reason is that existing work does not consider the trigger's design space in their formulation of the inversion problem. This work formally defines and analyzes the triggers injected in different spaces and the inversion problem. Then, it proposes a unified framework to invert backdoor triggers based on the formalization of triggers and the identified inner behaviors of backdoor models from our analysis. Our prototype UNICORN is general and effective in inverting backdoor triggers in DNNs. The code can be found at https://github.com/RU-System-Software-and-Security/UNICORN.

Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Builds on 67 of its 91 references that are in the map. First posted on arXiv 5 Apr 2023.

Builds on

67 of 91 references.

References · 67

2015Deep Residual Learning for Image Recognitioncited by 51,809
2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
2016Densely Connected Convolutional Networkscited by 6,691
2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
2016Wide Residual Networkscited by 3,057
2017Mixed Precision Trainingcited by 1,135

38 more

2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
2013Network In Networkcited by 600
2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
2018Spectral Signatures in Backdoor Attackscited by 457
2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
2020Input-Aware Dynamic Backdoor Attackcited by 304
2019Label-Consistent Backdoor Attackscited by 285
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
2022Backdoor Defense via Decoupling the Training Processcited by 149
2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
2020Backdoor Attack against Speaker Verificationcited by 62

50 most cited of 67 All 67 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 7; 2024: 17; 2025: 10; 2026: 10.

44 papers.

Sort:

By area:

2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
2024How to Trace Latent Generative Model Generated Images without Artificial Watermark?cited by 25
2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 17
2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Modelscited by 15
2023Defenses in Adversarial Machine Learning: A Surveycited by 14
2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 14
2024Uncertainty is Fragile: Manipulating Uncertainty in Large Language Modelscited by 13
2026The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggerscited by 13

32 more

2024A Study of Backdoors in Instruction Fine-tuned Language Modelscited by 11
2024Mutual Information Guided Backdoor Mitigation for Pre-trained Encoderscited by 8
2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 7
2024Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defensecited by 6
2025Towards Backdoor Stealthiness in Model Parameter Spacecited by 6
2025Lie Detector: Unified Backdoor Detection via Cross-Examination Frameworkcited by 6
2023Boosting Backdoor Attack with A Learnable Poisoning Sample Selection Strategycited by 5
2024Invisible Backdoor Attack against Self-supervised Learningcited by 5
2024Securing Multi-turn Conversational Language Models From Distributed Backdoor Triggerscited by 5
2024Data-centric NLP Backdoor Defense from the Lens of Memorizationcited by 5
2023Alteration-free and Model-agnostic Origin Attribution of Generated Imagescited by 4
2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
2023Temporal-Distributed Backdoor Attack Against Video Based Action Recognitioncited by 3
2024Unelicitable Backdoors in Language Models via Cryptographic Transformer Circuitscited by 3
2025Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalizationcited by 3
2026LoRA as Oraclecited by 3
2025Seal Your Backdoor with Variational Defensecited by 2
2024CEPA: Consensus Embedded Perturbation for Agnostic Detection and Inversion of Backdoorscited by 1
2024NoiseAttack: An Evasive Sample-Specific Multi-Targeted Backdoor Attack Through White Gaussian Noisecited by 1
2025InverTune: Removing Backdoors from Multimodal Contrastive Learning Models via Trigger Inversion and Activation Tuningcited by 1
2025DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusioncited by 1
2026Backdoor Directions in Vision Transformerscited by 1
2024Hypnopaedia-Aware Machine Unlearning via Psychometrics of Artificial Mental Imagerycited by 0
2024Cut the Deadwood Out: Backdoor Purification via Guided Module Substitutioncited by 0
2025Defending against Backdoor Attacks via Module Switchingcited by 0
2025Quantization Blindspots: How Model Compression Breaks Backdoor Defensescited by 0
2026BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generatorcited by 0
2026STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profilingcited by 0
2026CLIP-Inspector: Model-Level Backdoor Detection for Prompt-Tuned CLIP via OOD Trigger Inversioncited by 0
2026CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMscited by 0
2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
2026Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoEcited by 0