mlsanityData to 14 Oct 2026

CBD: A Certified Backdoor Detector Based on Local Dominant Probability

arXiv 2310.17498 ↗First posted 26 Oct 2023cs.LG cs.CRcited by 13

Not on the map. Why?

Abstract (arXiv)

Backdoor attack is a common threat to deep neural networks. During testing, samples embedded with a backdoor trigger will be misclassified as an adversarial target by a backdoored model, while samples without the backdoor trigger will be correctly classified. In this paper, we present the first certified backdoor detector (CBD), which is based on a novel, adjustable conformal prediction scheme based on our proposed statistic local dominant probability. For any classifier under inspection, CBD provides 1) a detection inference, 2) the condition under which the attacks are guaranteed to be detectable for the same classification domain, and 3) a probabilistic upper bound for the false positive rate. Our theoretical results show that attacks with triggers that are more resilient to test-time noise and have smaller perturbation magnitudes are more likely to be detected with guarantees. Moreover, we conduct extensive experiments on four benchmark datasets considering various backdoor types, such as BadNet, CB, and Blend. CBD achieves comparable or even higher detection accuracy than state-of-the-art detectors, and it in addition provides detection certification. Notably, for backdoor attacks with random perturbation triggers bounded by ℓ2≤0.75 which achieves more than 90% attack success rate, CBD achieves 100% (98%), 100% (84%), 98% (98%), and 72% (40%) empirical (certified) detection true positive rates on the four benchmark datasets GTSRB, SVHN, CIFAR-10, and TinyImageNet, respectively, with low false positive rates.

Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Builds on 55 of its 86 references that are in the map. First posted on arXiv 26 Oct 2023.

Builds on

55 of 86 references.

References · 55

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  8. 2021A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty Quantificationcited by 792
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  11. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  12. 2018Spectral Signatures in Backdoor Attackscited by 484
38 more
  1. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  2. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  3. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  4. 2020Backdoor Learning: A Surveycited by 426
  5. 2019Hidden Trigger Backdoor Attackscited by 371
  6. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  7. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  8. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  9. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  10. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  11. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  12. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  13. 2022Backdoor Defense via Decoupling the Training Processcited by 153
  14. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 152
  15. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 146
  16. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 134
  17. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 122
  18. 2020RAB: Provable Robustness Against Backdoor Attackscited by 118
  19. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 108
  20. 2020SoK: Certified Robustness for Deep Neural Networkscited by 105
  21. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  22. 2019Defensive Quantization: When Efficiency Meets Robustnesscited by 95
  23. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 95
  24. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 95
  25. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 86
  26. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 83
  27. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
  28. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 73
  29. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 63
  30. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 60
  31. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 55
  32. 2021Few-shot Backdoor Defense Using Shapley Estimationcited by 41
  33. 2021Trigger Hunting with a Topological Prior for Trojan Detectioncited by 39
  34. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 34
  35. 2022Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarioscited by 29
  36. 2022BagFlip: A Certified Defense against Data Poisoningcited by 19
  37. 2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 18
  38. 2019Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attackscited by 11

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 5; 2025: 6; 2026: 2.

13 papers.

Sort:

By area:

  1. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 369
  2. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
  3. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 80
  4. 2025A Survey of Scaling in Large Language Model Reasoningcited by 10
  5. 2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
  6. 2025Scanning Trojaned Models Using Out-of-Distribution Samplescited by 3
  7. 2024Backdoor Defense through Self-Supervised and Generative Learningcited by 2
  8. 2025Seal Your Backdoor with Variational Defensecited by 2
  9. 2025A Linear Approach to Data Poisoningcited by 2
  10. 2024Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Modelscited by 1
  11. 2025Prototype Guided Backdoor Defensecited by 0
  12. 2026RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalancecited by 0
1 more
  1. 2026When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024CEPA: Consensus Embedded Perturbation for Agnostic Detection and Inversion of Backdoors
  2. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency
  3. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency
  4. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learning
  5. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning
  6. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Data
  7. 2023Test-Time Backdoor Defense via Detecting and Repairing ↗
  8. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning