mlsanityData to 7 Oct 2026

Mudjacking: Patching Backdoor Vulnerabilities in Foundation Models

arXiv 2402.14977 ↗First posted 22 Feb 2024cs.CR cs.CV cs.LGcited by 4

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Foundation model has become the backbone of the AI ecosystem. In particular, a foundation model can be used as a general-purpose feature extractor to build various downstream classifiers. However, foundation models are vulnerable to backdoor attacks and a backdoored foundation model is a single-point-of-failure of the AI ecosystem, e.g., multiple downstream classifiers inherit the backdoor vulnerabilities simultaneously. In this work, we propose Mudjacking, the first method to patch foundation models to remove backdoors. Specifically, given a misclassified trigger-embedded input detected after a backdoored foundation model is deployed, Mudjacking adjusts the parameters of the foundation model to remove the backdoor. We formulate patching a foundation model as an optimization problem and propose a gradient descent based method to solve it. We evaluate Mudjacking on both vision and language foundation models, eleven benchmark datasets, five existing backdoor attacks, and thirteen adaptive backdoor attacks. Our results show that Mudjacking can remove backdoor from a foundation model while maintaining its utility.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 43 of its 60 references that are in the map. First posted on arXiv 22 Feb 2024.

Builds on

43 of 60 references.

Closest ancestors · 5

Same direction, newest first

  1. 2022CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learning15 Nov
  2. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks17 Jun
  3. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning13 May
  4. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networks13 Oct
  5. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning1 Aug

Other references · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  4. 2020Language Models are Few-Shot Learnerscited by 32,199
  5. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  6. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  7. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2016Pointer Sentinel Mixture Modelscited by 2,992
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,348
  12. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
26 more
  1. 2013Visualizing and Understanding Convolutional Networkscited by 2,278
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  4. 2014Striving for Simplicity: The All Convolutional Netcited by 983
  5. 2017Automated Hate Speech Detection and the Problem of Offensive Languagecited by 724
  6. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  8. 2020Modifying Memories in Transformer Modelscited by 222
  9. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  10. 2020Editable Neural Networkscited by 154
  11. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  12. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  13. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  14. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
  15. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  16. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  17. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  18. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  19. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  20. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  21. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  22. 2022Backdoor Defense with Machine Unlearningcited by 61
  23. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  24. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  25. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  26. 2022Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Modelscited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 2.

4 papers.

  1. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Datacited by 5
  2. 2025AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruptioncited by 5
  3. 2026Patcher: Post-Hoc Patching of Backdoored Large Language Modelscited by 2
  4. 2026The Platonic Defense: Backdoor Defense for Self-Supervised Encoders in the Era of Large Scale Pre-trainingcited by 0