mlsanityData to 7 Oct 2026

Differential Analysis of Triggers and Benign Features for Black-Box DNN Backdoor Detection

arXiv 2307.05422 ↗First posted 11 Jul 2023cs.CR cs.LGcited by 6

Not on the map. Why?

Abstract (arXiv)

This paper proposes a data-efficient detection method for deep neural networks against backdoor attacks under a black-box scenario. The proposed approach is motivated by the intuition that features corresponding to triggers have a higher influence in determining the backdoored network output than any other benign features. To quantitatively measure the effects of triggers and benign features on determining the backdoored network output, we introduce five metrics. To calculate the five-metric values for a given input, we first generate several synthetic samples by injecting the input's partial contents into clean validation samples. Then, the five metrics are computed by using the output labels of the corresponding synthetic samples. One contribution of this work is the use of a tiny clean validation dataset. Having the computed five metrics, five novelty detectors are trained from the validation dataset. A meta novelty detector fuses the output of the five trained novelty detectors to generate a meta confidence score. During online testing, our method determines if online samples are poisoned or not via assessing their meta confidence scores output by the meta novelty detector. We show the efficacy of our methodology through a broad range of backdoor attacks, including ablation studies and comparison to existing approaches. Our methodology is promising since the proposed five metrics quantify the inherent differences between clean and poisoned samples. Additionally, our detection method can be incrementally improved by appending more metrics that may be proposed to address future advanced attacks.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 39 of its 94 references that are in the map. First posted on arXiv 11 Jul 2023.

Builds on

39 of 94 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2016A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networkscited by 2,362
  5. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,472
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2016Universal adversarial perturbationscited by 774
  9. 2018How To Backdoor Federated Learningcited by 745
  10. 2013Network In Networkcited by 600
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  12. 2018Spectral Signatures in Backdoor Attackscited by 457
27 more
  1. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  2. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  3. 2019Hidden Trigger Backdoor Attackscited by 359
  4. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  5. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  6. 2015DeepDriving: Learning Affordance for Direct Perception in Autonomous Drivingcited by 229
  7. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  8. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  9. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  10. 2018Latent Space Autoregression for Novelty Detectioncited by 149
  11. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  12. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
  13. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  14. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  15. 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 82
  16. 2021Provable Guarantees for Understanding Out-of-distribution Detectioncited by 78
  17. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  18. 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 52
  19. 2020One-pixel Signature: Characterizing CNN Models for Backdoor Detectioncited by 34
  20. 2017Adversarial Example Defenses: Ensembles of Weak Defenses are not Strongcited by 32
  21. 2018Hierarchical Novelty Detection for Visual Object Recognitioncited by 26
  22. 2020Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansingcited by 11
  23. 2020NNoculation: Catching BadNets in the Wildcited by 9
  24. 2020Detecting Backdoors in Neural Networks Using Novel Feature-Based Anomaly Detectioncited by 8
  25. 2018Adversarial Learning-Based On-Line Anomaly Monitoring for Assured Autonomycited by 4
  26. 2021State Constrained Stochastic Optimal Control Using LSTMscited by 1
  27. 2023State Constrained Stochastic Optimal Control for Continuous and Hybrid Dynamical Systems Using DFBSDEcited by 1

Built on by

Cited by year

Citing papers per year: 2023: 1; 2024: 4; 2025: 1.

6 papers.

  1. 2024CLIPScope: Enhancing Zero-Shot OOD Detection with Bayesian Scoringcited by 13
  2. 2024Towards Robust Vision Transformer via Masked Adaptive Ensemblecited by 4
  3. 2023UCM-Net: A Lightweight and Efficient Solution for Skin Lesion Segmentation using MLP and CNNcited by 2
  4. 2024On the (In)feasibility of ML Backdoor Detection as an Hypothesis Testing Problemcited by 2
  5. 2025SifterNet: A Generalized and Model-Agnostic Trigger Purification Approachcited by 2
  6. 2024BeniFul: Backdoor Defense via Middle Feature Analysis for Deep Neural Networkscited by 0