mlsanityData to 7 Oct 2026

IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency

arXiv 2405.09786 ↗First posted 16 May 2024cs.LG cs.CRcited by 38

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) are vulnerable to backdoor attacks, where adversaries can maliciously trigger model misclassifications by implanting a hidden backdoor during model training. This paper proposes a simple yet effective input-level backdoor detection (dubbed IBD-PSC) as a `firewall' to filter out malicious testing images. Our method is motivated by an intriguing phenomenon, i.e., parameter-oriented scaling consistency (PSC), where the prediction confidences of poisoned samples are significantly more consistent than those of benign ones when amplifying model parameters. In particular, we provide theoretical analysis to safeguard the foundations of the PSC phenomenon. We also design an adaptive method to select BN layers to scale up for effective detection. Extensive experiments are conducted on benchmark datasets, verifying the effectiveness and efficiency of our IBD-PSC method and its resistance to adaptive attacks. Codes are available at hrefhttps://github.com/THUYimingLi/BackdoorBoxBackdoorBox.

Key facts. Cited by 38 papers in the map (data through 7 Oct 2026). Builds on 47 of its 71 references that are in the map. First posted on arXiv 16 May 2024.

Builds on

47 of 71 references.

References · 47

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2015Deep Learning and the Information Bottleneck Principlecited by 793
  6. 2020Prevalence of Neural Collapse during the terminal phase of deep learning trainingcited by 713
  7. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  8. 2020Backdoor Learning: A Surveycited by 412
  9. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  10. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  11. 2019Label-Consistent Backdoor Attackscited by 285
  12. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
35 more
  1. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  2. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  3. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  4. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
  5. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  6. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  7. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  8. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  9. 2021Backdoor Attack in the Physical Worldcited by 82
  10. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  11. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  12. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  13. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  14. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  15. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  16. 2021Learning Gaussian Mixtures with Generalised Linear Models: Precise Asymptotics in High-dimensionscited by 52
  17. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  18. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  19. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  20. 2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
  21. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  22. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  23. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  24. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  25. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  26. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  27. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  28. 2023Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamicscited by 24
  29. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  30. 2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 17
  31. 2023Gaussian Mixture Solvers for Diffusion Modelscited by 17
  32. 2021Enhancing Backdoor Attacks with Multi-Level MMD Regularizationcited by 15
  33. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 15
  34. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  35. 2022BATT: Backdoor Attack with Transformation-based Triggerscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 7; 2025: 20; 2026: 11.

38 papers.

Sort:

By area:

  1. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  2. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  3. 2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Modelscited by 15
  4. 2025Test-Time Backdoor Detection for Object Detection Modelscited by 14
  5. 2025Efficient Input-level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variationcited by 8
  6. 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
  7. 2024FLARE: Toward Universal Dataset Purification against Backdoor Attackscited by 7
  8. 2025Towards Backdoor Stealthiness in Model Parameter Spacecited by 6
  9. 2024Invisible Backdoor Attack against Self-supervised Learningcited by 5
  10. 2024Test-Time Multimodal Backdoor Detection by Contrastive Promptingcited by 5
  11. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  12. 2024Clean-Label Physical Backdoor Attacks with Data Distillationcited by 4
26 more
  1. 2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
  2. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 4
  3. 2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3
  4. 2025Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attackcited by 3
  5. 2025FFCBA: Feature-based Full-target Clean-label Backdoor Attackscited by 2
  6. 2025TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screeningcited by 2
  7. 2024Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Modelscited by 1
  8. 2024Unlearn to Relearn Backdoors: Deferred Backdoor Functionality Attacks on Deep Learning Modelscited by 1
  9. 2025Class-Conditional Neural Polarizer: A Lightweight and Effective Backdoor Defense by Purifying Poisoned Featurescited by 1
  10. 2025Poison in the Well: Feature Embedding Disruption in Backdoor Attackscited by 1
  11. 2025Circumventing Backdoor Space via Weight Symmetrycited by 1
  12. 2024Let the Noise Speak: Harnessing Noise for a Unified Defense Against Adversarial and Backdoor Attackscited by 0
  13. 2025Defending against Backdoor Attacks via Module Switchingcited by 0
  14. 2025HAMLOCK: HArdware-Model LOgically Combined attacKcited by 0
  15. 2025Enhancing All-to-X Backdoor Attacks with Optimized Target Class Mappingcited by 0
  16. 2025The Eminence in Shadow: Exploiting Feature Boundary Ambiguity for Robust Backdoor Attackscited by 0
  17. 2026TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuningcited by 0
  18. 2026RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalancecited by 0
  19. 2026Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistencycited by 0
  20. 2026IU: Imperceptible Universal Backdoor Attackcited by 0
  21. 2026STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profilingcited by 0
  22. 2026Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scalingcited by 0
  23. 2026Checkerboard: Closed-Form and Data-Independent Trigger Design for Clean-Label Backdoor Attackscited by 0
  24. 2026TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecastingcited by 0
  25. 2026Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attackscited by 0
  26. 2026Lilith: Backdoor Generalization under Training-Inference Trigger Shiftcited by 0