mlsanityData to 7 Oct 2026

Rethinking Backdoor Attacks

arXiv 2307.10163 ↗First posted 19 Jul 2023cs.CR cs.LG stat.MLcited by 14

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

In a backdoor attack, an adversary inserts maliciously constructed backdoor examples into a training set to make the resulting model vulnerable to manipulation. Defending against such attacks typically involves viewing these inserted examples as outliers in the training set and using techniques from robust statistics to detect and remove them. In this work, we present a different approach to the backdoor attack problem. Specifically, we show that without structural information about the training data distribution, backdoor attacks are indistinguishable from naturally-occurring features in the data--and thus impossible to "detect" in a general sense. Then, guided by this observation, we revisit existing defenses against backdoor attacks and characterize the (often latent) assumptions they make and on which they depend. Finally, we explore an alternative perspective on backdoor attacks: one that assumes these attacks correspond to the strongest feature in the training data. Under this assumption (which we make formal) we develop a new primitive for detecting backdoor attacks. Our primitive naturally gives rise to a detection algorithm that comes with theoretical guarantees and is effective in practice.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 33 of its 45 references that are in the map. First posted on arXiv 19 Jul 2023.

Builds on

33 of 45 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoning18 Oct
  2. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks14 Aug
  3. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation5 Feb
  4. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective7 Apr

Other references · 29

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  4. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  5. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  6. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  9. 2018Spectral Signatures in Backdoor Attackscited by 457
  10. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
  11. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  12. 2020Backdoor Learning: A Surveycited by 412
17 more
  1. 2019Hidden Trigger Backdoor Attackscited by 359
  2. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  3. 2019Label-Consistent Backdoor Attackscited by 285
  4. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  5. 2022Datamodels: Predicting Predictions from Training Datacited by 186
  6. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  7. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  8. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  9. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  10. 2018Interactive Supercomputing on 40,000 Cores for Machine Learning and Data Analysiscited by 110
  11. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  12. 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 69
  13. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
  14. 2022Measuring the Effect of Training Data on Deep Learning Predictions via Randomized Experimentscited by 50
  15. 2017Sub-Gaussian estimators of the mean of a random vectorcited by 47
  16. 20213DB: A Framework for Debugging Computer Vision Modelscited by 31
  17. 2017Mining a Sub-Matrix of Maximal Sumcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 8; 2025: 4; 2026: 2.

14 papers.

Sort:

By area:

  1. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  2. 2024Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learningcited by 5
  3. 2024iBA: Backdoor Attack on 3D Point Cloud via Reconstructing Itselfcited by 4
  4. 2024Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directionscited by 4
  5. 2025Rescaled Influence Functions: Accurate Data Attribution in High Dimensioncited by 3
  6. 2024Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Modelscited by 2
  7. 2024Backdoor Defense through Self-Supervised and Generative Learningcited by 2
  8. 2024Backdoor defense, learnability and obfuscationcited by 2
  9. 2025Seal Your Backdoor with Variational Defensecited by 2
  10. 2025Adversarial Robustness in Distributed Quantum Machine Learningcited by 2
  11. 2024Protecting against simultaneous data poisoning attackscited by 1
  12. 2025Robust Defense Strategies for Multimodal Contrastive Learning: Efficient Fine-tuning Against Backdoor Attackscited by 0
2 more
  1. 2026Graph-Aware Stealthy Poison-Text Backdoors for Text-Attributed Graphscited by 0
  2. 2026Why Backdooring Neural Networks is so Easy?cited by 0