# Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamics

arXiv: https://arxiv.org/abs/2312.02673 · HTML: https://mlsanity.com/paper/2312.02673/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Dec 2023.

## Built on by (most cited first, 26 of 26)

- [IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency](https://mlsanity.com/paper/2405.09786/) (2024)
- [BAN: Detecting Backdoors Activated by Adversarial Neuron Noise](https://mlsanity.com/paper/2405.19928/) (2024)
- [Towards Backdoor Stealthiness in Model Parameter Space](https://mlsanity.com/paper/2501.05928/) (2025)
- [Lie Detector: Unified Backdoor Detection via Cross-Examination Framework](https://mlsanity.com/paper/2503.16872/) (2025)
- [Beyond Black-Box Obfuscation: Mechanistic Analysis and Defense of White-Box Monitors](https://mlsanity.com/paper/2505.14300/) (2025)
- [Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack](https://mlsanity.com/paper/2509.23871/) (2025)
- [iBA: Backdoor Attack on 3D Point Cloud via Reconstructing Itself](https://mlsanity.com/paper/2403.05847/) (2024)
- [Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasets](https://mlsanity.com/paper/2504.11990/) (2025)
- [Rounding-Guided Backdoor Injection in Deep Learning Model Quantization](https://mlsanity.com/paper/2510.09647/) (2025)
- [Detector Collapse: Physical-World Backdooring Object Detection to Catastrophic Overload or Blindness in Autonomous Driving](https://mlsanity.com/paper/2404.11357/) (2024)
- [TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screening](https://mlsanity.com/paper/2510.14299/) (2025)
- [BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learning](https://mlsanity.com/paper/2602.17168/) (2026)
- [Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning](https://mlsanity.com/paper/2405.06206/) (2024)
- [Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Models](https://mlsanity.com/paper/2411.09540/) (2024)
- [STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profiling](https://mlsanity.com/paper/2603.18103/) (2026)
- [Mechanistic Anomaly Detection via Functional Attribution](https://mlsanity.com/paper/2604.18970/) (2026)
- [Model-agnostic clean-label backdoor mitigation in cybersecurity environments](https://mlsanity.com/paper/2407.08159/) (2024)
- [TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attacks](https://mlsanity.com/paper/2506.10722/) (2025)
- [CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration](https://mlsanity.com/paper/2506.13160/) (2025)
- [HAMLOCK: HArdware-Model LOgically Combined attacK](https://mlsanity.com/paper/2510.19145/) (2025)
- [Provable Repair of Deep Neural Network Defects by Preimage Synthesis and Property Refinement](https://mlsanity.com/paper/2511.07741/) (2025)
- [RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance](https://mlsanity.com/paper/2602.00183/) (2026)
- [Fast and Lightweight Backdoor Detection via Head Random Probing](https://mlsanity.com/paper/2605.18908/) (2026)
- [TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting](https://mlsanity.com/paper/2605.22365/) (2026)
- [(A)iSpy: Parasitic Trojans for Machine Learning Infrastructure](https://mlsanity.com/paper/2607.17550/) (2026)
- [FIDA: Feature Instability-Driven Attack on Self-Supervised Facial Representation](https://mlsanity.com/paper/2608.26861/) (2026)

## Abstract (arXiv)

A backdoor attack in deep learning inserts a hidden backdoor in the model to trigger malicious behavior upon specific input patterns. Existing detection approaches assume a metric space (for either the original inputs or their latent representations) in which normal samples and malicious samples are separable. We show that this assumption has a severe limitation by introducing a novel SSDT (Source-Specific and Dynamic-Triggers) backdoor, which obscures the difference between normal samples and malicious samples. To overcome this limitation, we move beyond looking for a perfect metric space that would work for different deep-learning models, and instead resort to more robust topological constructs. We propose TED (Topological Evolution Dynamics) as a model-agnostic basis for robust backdoor detection. The main idea of TED is to view a deep-learning model as a dynamical system that evolves inputs to outputs. In such a dynamical system, a benign input follows a natural evolution trajectory similar to other benign inputs. In contrast, a malicious sample displays a distinct trajectory, since it starts close to benign samples but eventually shifts towards the neighborhood of attacker-specified target samples to activate the backdoor. Extensive evaluations are conducted on vision and natural language datasets across different network architectures. The results demonstrate that TED not only achieves a high detection rate, but also significantly outperforms existing state-of-the-art detection approaches, particularly in addressing the sophisticated SSDT attack. The code to reproduce the results is made public on GitHub.