Log in

Relevant bibliographies by topics / Backdoor attacks / Journal articles

To see the other types of publications on this topic, follow the link: Backdoor attacks.

Journal articles on the topic 'Backdoor attacks'

Author: Grafiati

Published: 25 May 2024

Last updated: 31 July 2025

Create a spot-on reference in APA, MLA, Chicago, Harvard, and other styles

Select a source type:

Consult the top 50 journal articles for your research on the topic 'Backdoor attacks.'

Next to every source in the list of references, there is an 'Add to bibliography' button. Press on it, and we will generate automatically the bibliographic reference to the chosen work in the citation style you need: APA, MLA, Harvard, Chicago, Vancouver, etc.

You can also download the full text of the academic publication as pdf and read online its abstract whenever available in the metadata.

Browse journal articles on a wide variety of disciplines and organise your bibliography correctly.

1

Duan, Qiuyu, Zhongyun Hua, Qing Liao, Yushu Zhang, and Leo Yu Zhang. "Conditional Backdoor Attack via JPEG Compression." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 18 (2024): 19823–31. http://dx.doi.org/10.1609/aaai.v38i18.29957.

Full text

Abstract:

Deep neural network (DNN) models have been proven vulnerable to backdoor attacks. One trend of backdoor attacks is developing more invisible and dynamic triggers to make attacks stealthier. However, these invisible and dynamic triggers can be inadvertently mitigated by some widely used passive denoising operations, such as image compression, making the efforts under this trend questionable. Another trend is to exploit the full potential of backdoor attacks by proposing new triggering paradigms, such as hibernated or opportunistic backdoors. In line with these trends, our work investigates the

APA, Harvard, Vancouver, ISO, and other styles

2

Zhu, Biru, Ganqu Cui, Yangyi Chen, et al. "Removing Backdoors in Pre-trained Models by Regularized Continual Pre-training." Transactions of the Association for Computational Linguistics 11 (2023): 1608–23. http://dx.doi.org/10.1162/tacl_a_00622.

Full text

Abstract:

Abstract Recent research has revealed that pre-trained models (PTMs) are vulnerable to backdoor attacks before the fine-tuning stage. The attackers can implant transferable task-agnostic backdoors in PTMs, and control model outputs on any downstream task, which poses severe security threats to all downstream applications. Existing backdoor-removal defenses focus on task-specific classification models and they are not suitable for defending PTMs against task-agnostic backdoor attacks. To this end, we propose the first task-agnostic backdoor removal method for PTMs. Based on the selective activa

APA, Harvard, Vancouver, ISO, and other styles

3

Wang, Qingya, Yi Wu, Haojun Xuan, and Huishu Wu. "FLARE: A Backdoor Attack to Federated Learning with Refined Evasion." Mathematics 12, no. 23 (2024): 3751. http://dx.doi.org/10.3390/math12233751.

Full text

Abstract:

Federated Learning (FL) is vulnerable to backdoor attacks in which attackers inject malicious behaviors into the global model. To counter these attacks, existing works mainly introduce sophisticated defenses by analyzing model parameters and utilizing robust aggregation strategies. However, we find that FL systems can still be attacked by exploiting their inherent complexity. In this paper, we propose a novel three-stage backdoor attack strategy named FLARE: A Backdoor Attack to Federated Learning with Refined Evasion, which is designed to operate under the radar of conventional defense strate

APA, Harvard, Vancouver, ISO, and other styles

4

Yuan, Guotao, Hong Huang, and Xin Li. "Self-supervised learning backdoor defense mixed with self-attention mechanism." Journal of Computing and Electronic Information Management 12, no. 2 (2024): 81–88. http://dx.doi.org/10.54097/7hx9afkw.

Full text

Abstract:

Recent studies have shown that Deep Neural Networks (DNNs) are vulnerable to backdoor attacks, where attackers embed hidden backdoors into the DNN models by poisoning a small number of training samples. The attacked models perform normally on benign samples, but when the backdoor is activated, their prediction results will be maliciously altered. To address the issues of suboptimal backdoor defense effectiveness and limited generality, a hybrid self-attention mechanism-based self-supervised learning method for backdoor defense is proposed. This method defends against backdoor attacks by levera

APA, Harvard, Vancouver, ISO, and other styles

5

Zhang, Fan, Jianpeng Li, Wei Huang, and Xi Chen. "BMAIU: Backdoor Mitigation in Self-Supervised Learning Through Active Implantation and Unlearning." Electronics 14, no. 8 (2025): 1587. https://doi.org/10.3390/electronics14081587.

Full text

Abstract:

Self-supervised learning (SSL) is vulnerable to backdoor attacks, while the downstream classifiers based on SSL models inevitably inherit these backdoors, even when they are trained on clean samples. Despite the proposal of several methods of backdoor defense against backdoor attacks, few methods remain that can be used to effectively defend against various backdoor attacks while maintaining the high performance of the model. In this paper, based on the discovery that unlearning any trigger enhances the overall backdoor robustness of the model, a novel, efficient, and straightforward approach

APA, Harvard, Vancouver, ISO, and other styles

6

Yin, Jia-Li, Weijian Wang, Lyhwa, Wei Lin, and Ximeng Liu. "Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 9 (2025): 9508–16. https://doi.org/10.1609/aaai.v39i9.33030.

Full text

Abstract:

Backdoor attacks and adversarial attacks are two major security threats to deep neural networks (DNNs), with the former one is a training-time data poisoning attack that aims to implant backdoor triggers into models by injecting trigger patterns into training samples, and the latter one is a testing-time attack trying to generate adversarial examples (AEs) from benign images to mislead a well-trained model. While previous works generally treat these two attacks separately, the inherent connection between these two attacks is rarely explored. In this paper, we focus on bridging backdoor and adv

APA, Harvard, Vancouver, ISO, and other styles

7

Wang, Tong, Yuan Yao, Feng Xu, Miao Xu, Shengwei An, and Ting Wang. "Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 1 (2024): 274–82. http://dx.doi.org/10.1609/aaai.v38i1.27780.

Full text

Abstract:

Backdoor attacks have been shown to be a serious security threat against deep learning models, and various defenses have been proposed to detect whether a model is backdoored or not. However, as indicated by a recent black-box attack, existing defenses can be easily bypassed by implanting the backdoor in the frequency domain. To this end, we propose a new defense DTInspector against black-box backdoor attacks, based on a new observation related to the prediction confidence of learning models. That is, to achieve a high attack success rate with a small amount of poisoned data, backdoor attacks

APA, Harvard, Vancouver, ISO, and other styles

8

Jiang, Peihai, Xixiang Lyu, Yige Li, and Jing Ma. "Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 23 (2025): 24285–93. https://doi.org/10.1609/aaai.v39i23.34605.

Full text

Abstract:

Supervised fine-tuning has become the predominant method for adapting large pretrained models to downstream tasks. However, recent studies have revealed that these models are vulnerable to backdoor attacks, where even a small number of malicious samples can successfully embed backdoor triggers into the model. While most existing defense methods focus on post-training backdoor defense, efficiently defending against backdoor attacks during training phase remains largely unexplored. To address this gap, we propose a novel defense method called Backdoor Token Unlearning (BTU), which proactively de

APA, Harvard, Vancouver, ISO, and other styles

9

Saha, Aniruddha, Akshayvarun Subramanya, and Hamed Pirsiavash. "Hidden Trigger Backdoor Attacks." Proceedings of the AAAI Conference on Artificial Intelligence 34, no. 07 (2020): 11957–65. http://dx.doi.org/10.1609/aaai.v34i07.6871.

Full text

Abstract:

With the success of deep learning algorithms in various domains, studying adversarial attacks to secure deep models in real world applications has become an important research topic. Backdoor attacks are a form of adversarial attacks on deep networks where the attacker provides poisoned data to the victim to train the model with, and then activates the attack by showing a specific small trigger pattern at the test time. Most state-of-the-art backdoor attacks either provide mislabeled poisoning data that is possible to identify by visual inspection, reveal the trigger in the poisoned data, or u

APA, Harvard, Vancouver, ISO, and other styles

10

Zhang, Xianda, Baolin Zheng, Jianbao Hu, Chengyang Li, and Xiaoying Bai. "From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 15 (2024): 16873–80. http://dx.doi.org/10.1609/aaai.v38i15.29629.

Full text

Abstract:

Despite the tremendous success of deep neural networks (DNNs) across various fields, their susceptibility to potential backdoor attacks seriously threatens their application security, particularly in safety-critical or security-sensitive ones. Given this growing threat, there is a pressing need for research into purging backdoors from DNNs. However, prior efforts on erasing backdoor triggers not only failed to withstand increasingly powerful attacks but also resulted in reduced model performance. In this paper, we propose From Toxic to Trustworthy (FTT), an innovative approach to eliminate bac

APA, Harvard, Vancouver, ISO, and other styles

11

Chen, Lucheng, Xiaoshuang Liu, Ailing Wang, Weiwei Zhai, and Xiang Cheng. "FLSAD: Defending Backdoor Attacks in Federated Learning via Self-Attention Distillation." Symmetry 16, no. 11 (2024): 1497. http://dx.doi.org/10.3390/sym16111497.

Full text

Abstract:

Federated Learning (FL), as a distributed machine learning framework, can effectively learn symmetric and asymmetric patterns from large-scale participants. However, FL is susceptible to malicious backdoor attacks through attackers injecting triggers into the backdoored model, resulting in backdoor samples being misclassified as target classes. Due to the stealthy nature of backdoor attacks in FL, it is difficult for users to discover the symmetric and asymmetric backdoor properties. Currently, backdoor defense methods in FL cause model performance degradation while reducing backdoors. In addi

APA, Harvard, Vancouver, ISO, and other styles

12

Liu, Tao, Yuhang Zhang, Zhu Feng, et al. "Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 19 (2024): 21359–67. http://dx.doi.org/10.1609/aaai.v38i19.30131.

Full text

Abstract:

Backdoors on federated learning will be diluted by subsequent benign updates. This is reflected in the significant reduction of attack success rate as iterations increase, ultimately failing. We use a new metric to quantify the degree of this weakened backdoor effect, called attack persistence. Given that research to improve this performance has not been widely noted, we propose a Full Combination Backdoor Attack (FCBA) method. It aggregates more combined trigger information for a more complete backdoor pattern in the global model. Trained backdoored global model is more resilient to benign up

APA, Harvard, Vancouver, ISO, and other styles

13

Li, Haoran, Yulin Chen, Zihao Zheng, et al. "Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 1 (2025): 397–405. https://doi.org/10.1609/aaai.v39i1.32018.

Full text

Abstract:

With rapid advances, generative large language models (LLMs) dominate various Natural Language Processing (NLP) tasks from understanding to reasoning. Yet, language models' inherent vulnerabilities may be exacerbated due to increased accessibility and unrestricted model training on massive data. A malicious adversary may publish poisoned data online and conduct backdoor attacks on the victim LLMs pre-trained on the poisoned data. Backdoored LLMs behave innocuously for normal queries and generate harmful responses when the backdoor trigger is activated. Despite significant efforts paid to LLMs'

APA, Harvard, Vancouver, ISO, and other styles

14

Zhang, Yihong, Guojia Li, Yihui Zhang, Yan Cao, Mingyue Cao, and Chengyao Xue. "BASK: Backdoor Attack for Self-Supervised Encoders with Knowledge Distillation Survivability." Electronics 14, no. 13 (2025): 2724. https://doi.org/10.3390/electronics14132724.

Full text

Abstract:

Backdoor attacks in self-supervised learning pose an increasing threat. Recent studies have shown that knowledge distillation can mitigate these attacks by altering feature representations. In response, we propose BASK, a novel backdoor attack that remains effective after distillation. BASK uses feature weighting and representation alignment strategies to implant persistent backdoors into the encoder’s feature space. This enables transferability to student models. We evaluated BASK on the CIFAR-10 and STL-10 datasets and compared it with existing self-supervised backdoor attacks under four adv

APA, Harvard, Vancouver, ISO, and other styles

15

Huang, Yihao, Felix Juefei-Xu, Qing Guo, et al. "Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 19 (2024): 21169–78. http://dx.doi.org/10.1609/aaai.v38i19.30110.

Full text

Abstract:

Although recent personalization methods have democratized high-resolution image synthesis by enabling swift concept acquisition with minimal examples and lightweight computation, they also present an exploitable avenue for highly accessible backdoor attacks. This paper investigates a critical and unexplored aspect of text-to-image (T2I) diffusion models - their potential vulnerability to backdoor attacks via personalization. By studying the prompt processing of popular personalization methods (epitomized by Textual Inversion and DreamBooth), we have devised dedicated personalization-based back

APA, Harvard, Vancouver, ISO, and other styles

16

Sun, Weisong, Yuchen Chen, Chunrong Fang, et al. "Eliminating Backdoors in Neural Code Models for Secure Code Understanding." Proceedings of the ACM on Software Engineering 2, FSE (2025): 1386–408. https://doi.org/10.1145/3715782.

Full text

Abstract:

Neural code models (NCMs) have been widely used to address various code understanding tasks, such as defect detection. However, numerous recent studies reveal that such models are vulnerable to backdoor attacks. Backdoored NCMs function normally on normal/clean code snippets, but exhibit adversary-expected behavior on poisoned code snippets injected with the adversary-crafted trigger. It poses a significant security threat. For example, a backdoored defect detection model may misclassify user-submitted defective code as non-defective. If this insecure code is then integrated into critical syst

APA, Harvard, Vancouver, ISO, and other styles

17

Rah, Yeongrok, and Youngho Cho. "Reliable backdoor attack detection for various size of backdoor triggers." IAES International Journal of Artificial Intelligence (IJ-AI) 14, no. 1 (2025): 650. http://dx.doi.org/10.11591/ijai.v14.i1.pp650-657.

Full text

Abstract:

Backdoor attack techniques have evolved toward compromising the integrity of deep learning (DL) models. To defend against backdoor attacks, neural cleanse (NC) has been proposed as a promising backdoor attack detection method. NC detects the existence of a backdoor trigger by inserting perturbation into a benign image and then capturing the abnormality of inserted perturbation. However, NC has a significant limitation such that it fails to detect a backdoor trigger when its size exceeds a certain threshold that can be measured in anomaly index (AI). To overcome such limitation, in this paper,

APA, Harvard, Vancouver, ISO, and other styles

18

Yeongrok, Rah, and Cho Youngho. "Reliable backdoor attack detection for various size of backdoor triggers." IAES International Journal of Artificial Intelligence (IJ-AI) 14, no. 1 (2025): 650–57. https://doi.org/10.11591/ijai.v14.i1.pp650-657.

Full text

Abstract:

Backdoor attack techniques have evolved toward compromising the integrity of deep learning (DL) models. To defend against backdoor attacks, neural cleanse (NC) has been proposed as a promising backdoor attack detection method. NC detects the existence of a backdoor trigger by inserting perturbation into a benign image and then capturing the abnormality of inserted perturbation. However, NC has a significant limitation such that it fails to detect a backdoor trigger when its size exceeds a certain threshold that can be measured in anomaly index (AI). To overcome such limitation, in this paper,

APA, Harvard, Vancouver, ISO, and other styles

19

Huynh, Tran, Dang Nguyen, Tung Pham, and Anh Tran. "COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 3 (2024): 2436–44. http://dx.doi.org/10.1609/aaai.v38i3.28019.

Full text

Abstract:

Backdoor attacks pose a critical concern to the practice of using third-party data for AI development. The data can be poisoned to make a trained model misbehave when a predefined trigger pattern appears, granting the attackers illegal benefits. While most proposed backdoor attacks are dirty-label, clean-label attacks are more desirable by keeping data labels unchanged to dodge human inspection. However, designing a working clean-label attack is a challenging task, and existing clean-label attacks show underwhelming performance. In this paper, we propose a novel mechanism to develop clean-labe

APA, Harvard, Vancouver, ISO, and other styles

20

Zeng, Tong. "Mixed training backdoor attack method improves generalization of backdoor attacks: An empirical study based on multiple models and datasets." Applied and Computational Engineering 88, no. 1 (2024): 187–94. http://dx.doi.org/10.54254/2755-2721/88/20241677.

Full text

Abstract:

In recent years, backdoor attacks have posed significant security threats to the training process of deep neural networks (DNNs). Attackers attempt to embed triggers in the training set, causing the victim model to behave normally when processing benign samples, but maliciously alter predictions when the hidden backdoor is activated by these triggers. However, our research found that when the trigger locations differ between the training and test data, the success rate of backdoor attacks decreases. This finding was consistent across different models and datasets through our experiments. To ad

APA, Harvard, Vancouver, ISO, and other styles

21

Liu, Zihao, Tianhao Wang, Mengdi Huai, and Chenglin Miao. "Backdoor Attacks via Machine Unlearning." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 13 (2024): 14115–23. http://dx.doi.org/10.1609/aaai.v38i13.29321.

Full text

Abstract:

As a new paradigm to erase data from a model and protect user privacy, machine unlearning has drawn significant attention. However, existing studies on machine unlearning mainly focus on its effectiveness and efficiency, neglecting the security challenges introduced by this technique. In this paper, we aim to bridge this gap and study the possibility of conducting malicious attacks leveraging machine unlearning. Specifically, we consider the backdoor attack via machine unlearning, where an attacker seeks to inject a backdoor in the unlearned model by submitting malicious unlearning requests, s

APA, Harvard, Vancouver, ISO, and other styles

22

Hartono, Susilo, Hartono Hartono, and Khusnul Khotimah. "Deteksi dan Mitigasi Serangan Backdoor Menggunakan Python Watchdog." Sienna 3, no. 1 (2022): 11–20. http://dx.doi.org/10.47637/sienna.v3i1.672.

Full text

Abstract:

The number of cyber attacks is increasing. This happens thoroughly, both at the international and national levels. Technology, techniques, and methods of carrying out cyber attacks are also increasingly sophisticated and up-to-date. Responding to this phenomenon, this research was conducted to implement an application for detecting and mitigating backdoor-based attacks using Python Watchdog. The method used in this study is the experimental method. This research is a case study of backdoor attacks that have been experienced by Universitas Muhammadiyah Kotabumi. In August – December 2021, one o

APA, Harvard, Vancouver, ISO, and other styles

23

Doan, Khoa D., Yingjie Lao, Peng Yang, and Ping Li. "Defending Backdoor Attacks on Vision Transformer via Patch Processing." Proceedings of the AAAI Conference on Artificial Intelligence 37, no. 1 (2023): 506–15. http://dx.doi.org/10.1609/aaai.v37i1.25125.

Full text

Abstract:

Vision Transformers (ViTs) have a radically different architecture with significantly less inductive bias than Convolutional Neural Networks. Along with the improvement in performance, security and robustness of ViTs are also of great importance to study. In contrast to many recent works that exploit the robustness of ViTs against adversarial examples, this paper investigates a representative causative attack, i.e., backdoor. We first examine the vulnerability of ViTs against various backdoor attacks and find that ViTs are also quite vulnerable to existing attacks. However, we observe that the

APA, Harvard, Vancouver, ISO, and other styles

24

Li, Yiming. "Poisoning-Based Backdoor Attacks in Computer Vision." Proceedings of the AAAI Conference on Artificial Intelligence 37, no. 13 (2023): 16121–22. http://dx.doi.org/10.1609/aaai.v37i13.26921.

Full text

Abstract:

Recent studies demonstrated that the training process of deep neural networks (DNNs) is vulnerable to backdoor attacks if third-party training resources (e.g., samples) are adopted. Specifically, the adversaries intend to embed hidden backdoors into DNNs, where the backdoor can be activated by pre-defined trigger patterns and leading malicious model predictions. My dissertation focuses on poisoning-based backdoor attacks in computer vision. Firstly, I study and propose more stealthy and effective attacks against image classification tasks in both physical and digital spaces. Secondly, I reveal

APA, Harvard, Vancouver, ISO, and other styles

25

Jiahao Luo. "Frequency Domain Backdoor Attacks for Visual Object Tracking." Journal of Electrical Systems 20, no. 10s (2024): 181–97. http://dx.doi.org/10.52783/jes.5089.

Full text

Abstract:

Visual object tracking（VOT）is a key topic in computer vision tasks. It serves as an essential component of various advanced problems in the field, such as motion analysis, event detection, and activity understanding. VOT finds extensive applications, including human-computer interaction in video, video surveillance, and autonomous driving. Due to the rapid development of deep neural networks（DNNs）, VOT has achieved unprecedented progress. However, the lack of interpretability in DNNs has introduced certain security risks, notably backdoor attacks. A neural network backdoor attack involves an a

APA, Harvard, Vancouver, ISO, and other styles

26

Liu, Xinwei, Xiaojun Jia, Jindong Gu, Yuan Xun, Siyuan Liang, and Xiaochun Cao. "Does Few-Shot Learning Suffer from Backdoor Attacks?" Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 18 (2024): 19893–901. http://dx.doi.org/10.1609/aaai.v38i18.29965.

Full text

Abstract:

The field of few-shot learning (FSL) has shown promising results in scenarios where training data is limited, but its vulnerability to backdoor attacks remains largely unexplored. We first explore this topic by first evaluating the performance of the existing backdoor attack methods on few-shot learning scenarios. Unlike in standard supervised learning, existing backdoor attack methods failed to perform an effective attack in FSL due to two main issues. Firstly, the model tends to overfit to either benign features or trigger features, causing a tough trade-off between attack success rate and b

APA, Harvard, Vancouver, ISO, and other styles

27

An, Shengwei, Sheng-Yen Chou, Kaiyuan Zhang, et al. "Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 10 (2024): 10847–55. http://dx.doi.org/10.1609/aaai.v38i10.28958.

Full text

Abstract:

Diffusion models (DM) have become state-of-the-art generative models because of their capability of generating high-quality images from noises without adversarial training. However, they are vulnerable to backdoor attacks as reported by recent studies. When a data input (e.g., some Gaussian noise) is stamped with a trigger (e.g., a white patch), the backdoored model always generates the target image (e.g., an improper photo). However, effective defense strategies to mitigate backdoors from DMs are underexplored. To bridge this gap, we propose the first backdoor detection and removal framework

APA, Harvard, Vancouver, ISO, and other styles

28

Qiao, Yanqi, Dazhuang Liu, Rui Wang, and Kaitai Liang. "Stealthy Backdoor Attack Against Federated Learning Through Frequency Domain by Backdoor Neuron Constraint and Model Camouflage." IEEE Journal on Emerging and Selected Topics in Circuits and Systems 2024 14, no. 4 (2024): 661–72. https://doi.org/10.1109/JETCAS.2024.3450527.

Full text

Abstract:

Federated Learning (FL) is a beneficial decentralized learning approach for preserving the privacy of local datasets of distributed agents. However, the distributed property of FL and untrustworthy data introducing the vulnerability to backdoor attacks. In this attack scenario, an adversary manipulates its local data with a specific trigger and trains a malicious local model to implant the backdoor. During inference, the global model would misbehave for any input with the trigger to the attacker-chosen prediction. Most existing backdoor attacks against FL focus on bypassing defense mechanisms,

APA, Harvard, Vancouver, ISO, and other styles

29

Zhang, Shengchuan, and Suhang Ye. "Backdoor Attack against Face Sketch Synthesis." Entropy 25, no. 7 (2023): 974. http://dx.doi.org/10.3390/e25070974.

Full text

Abstract:

Deep neural networks (DNNs) are easily exposed to backdoor threats when training with poisoned training samples. Models using backdoor attack have normal performance for benign samples, and possess poor performance for poisoned samples manipulated with pre-defined trigger patterns. Currently, research on backdoor attacks focuses on image classification and object detection. In this article, we investigated backdoor attacks in facial sketch synthesis, which can be beneficial for many applications, such as animation production and assisting police in searching for suspects. Specifically, we prop

APA, Harvard, Vancouver, ISO, and other styles

30

Xu, Yixiao, Xiaolei Liu, Kangyi Ding, and Bangzhou Xin. "IBD: An Interpretable Backdoor-Detection Method via Multivariate Interactions." Sensors 22, no. 22 (2022): 8697. http://dx.doi.org/10.3390/s22228697.

Full text

Abstract:

Recent work has shown that deep neural networks are vulnerable to backdoor attacks. In comparison with the success of backdoor-attack methods, existing backdoor-defense methods face a lack of theoretical foundations and interpretable solutions. Most defense methods are based on experience with the characteristics of previous attacks, but fail to defend against new attacks. In this paper, we propose IBD, an interpretable backdoor-detection method via multivariate interactions. Using information theory techniques, IBD reveals how the backdoor works from the perspective of multivariate interactio

APA, Harvard, Vancouver, ISO, and other styles

31

Xiang, Zhen, David J. Miller, Hang Wang, and George Kesidis. "Detecting Scene-Plausible Perceptible Backdoors in Trained DNNs Without Access to the Training Set." Neural Computation 33, no. 5 (2021): 1329–71. http://dx.doi.org/10.1162/neco_a_01376.

Full text

Abstract:

Abstract Backdoor data poisoning attacks add mislabeled examples to the training set, with an embedded backdoor pattern, so that the classifier learns to classify to a target class whenever the backdoor pattern is present in a test sample. Here, we address posttraining detection of scene-plausible perceptible backdoors, a type of backdoor attack that can be relatively easily fashioned, particularly against DNN image classifiers. A post-training defender does not have access to the potentially poisoned training set, only to the trained classifier, as well as some unpoisoned examples that need n

APA, Harvard, Vancouver, ISO, and other styles

32

Sun, Xiaofei, Xiaoya Li, Yuxian Meng, et al. "Defending against Backdoor Attacks in Natural Language Generation." Proceedings of the AAAI Conference on Artificial Intelligence 37, no. 4 (2023): 5257–65. http://dx.doi.org/10.1609/aaai.v37i4.25656.

Full text

Abstract:

The frustratingly fragile nature of neural network models make current natural language generation (NLG) systems prone to backdoor attacks and generate malicious sequences that could be sexist or offensive. Unfortunately, little effort has been invested to how backdoor attacks can affect current NLG models and how to defend against these attacks. In this work, by giving a formal definition of backdoor attack and defense, we investigate this problem on two important NLG tasks, machine translation and dialog generation. Tailored to the inherent nature of NLG models (e.g., producing a sequence of

APA, Harvard, Vancouver, ISO, and other styles

33

Zheng, Jingyi, Tianyi Hu, Tianshuo Cong, and Xinlei He. "CL-Attack: Textual Backdoor Attacks via Cross-Lingual Triggers." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 25 (2025): 26427–35. https://doi.org/10.1609/aaai.v39i25.34842.

Full text

Abstract:

Backdoor attacks significantly compromise the security of large language models by triggering them to output specific and controlled content. Currently, triggers for textual backdoor attacks fall into two categories: fixed-token triggers and sentence-pattern triggers. However, the former are typically easy to identify and filter, while the latter, such as syntax and style, do not apply to all original samples and may lead to semantic shifts. In this paper, inspired by cross-lingual (CL) prompts of LLMs in real-world scenarios, we propose a higher-dimensional trigger method at the paragraph lev

APA, Harvard, Vancouver, ISO, and other styles

34

Zhao, Yue, Congyi Li, and Kai Chen. "UMA: Facilitating Backdoor Scanning via Unlearning-Based Model Ablation." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 19 (2024): 21823–31. http://dx.doi.org/10.1609/aaai.v38i19.30183.

Full text

Abstract:

Recent advances in backdoor attacks, like leveraging complex triggers or stealthy implanting techniques, have introduced new challenges in backdoor scanning, limiting the usability of Deep Neural Networks (DNNs) in various scenarios. In this paper, we propose Unlearning-based Model Ablation (UMA), a novel approach to facilitate backdoor scanning and defend against advanced backdoor attacks. UMA filters out backdoor-irrelevant features by ablating the inherent features of the target class within the model and subsequently reveals the backdoor through dynamic trigger optimization. We evaluate ou

APA, Harvard, Vancouver, ISO, and other styles

35

Fan, Linkun, Fazhi He, Tongzhen Si, Wei Tang, and Bing Li. "Invisible Backdoor Attack against 3D Point Cloud Classifier in Graph Spectral Domain." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 19 (2024): 21072–80. http://dx.doi.org/10.1609/aaai.v38i19.30099.

Full text

Abstract:

3D point cloud has been wildly used in security crucial domains, such as self-driving and 3D face recognition. Backdoor attack is a serious threat that usually destroy Deep Neural Networks (DNN) in the training stage. Though a few 3D backdoor attacks are designed to achieve guaranteed attack efficiency, their deformation will alarm human inspection. To obtain invisible backdoored point cloud, this paper proposes a novel 3D backdoor attack, named IBAPC, which generates backdoor trigger in the graph spectral domain. The effectiveness is grounded by the advantage of graph spectral signal that it

APA, Harvard, Vancouver, ISO, and other styles

36

Miao, Lu, Weibo Li, Jia Zhao, Xin Zhou, and Yao Wu. "Differential Private Defense Against Backdoor Attacks in Federated Learning." Frontiers in Computing and Intelligent Systems 9, no. 2 (2024): 31–39. http://dx.doi.org/10.54097/dyt1nn60.

Full text

Abstract:

Federated learning has been applied in a wide variety of applications, in which clients upload their local updates instead of providing their datasets to jointly train a global model. However, the training process of federated learning is vulnerable to adversarial attacks (e.g., backdoor attack) in presence of malicious clients. Previous works showed that differential privacy (DP) can be used to defend against backdoor attacks, at the cost of vastly losing model utility. In this work, we study two kinds of backdoor attacks and propose a method based on differential privacy, called Clip Norm De

APA, Harvard, Vancouver, ISO, and other styles

37

Mohd Nasharuddin, Muhammad Zafran Syahmi, and Adamu Abubakar. "Analyzing Threat Level of the Backdoor Attack Method for an Organization’s Operation." International Journal on Perceptive and Cognitive Computing 10, no. 2 (2024): 51–59. http://dx.doi.org/10.31436/ijpcc.v10i2.484.

Full text

Abstract:

Backdoor attacks played a critical part in the catastrophe, as well as the overall impact of cyberattacks. Backdoor assaults are additionally influencing the landscape of malware and threats, forcing companies to concentrate more on detecting and establishing vulnerability tactics in order to avoid hostile backdoor threats. Despite advances in cybersecurity systems, backdoor assaults remain a source of concern because of their propensity to remain undetected long after the attack vector has been started. This research is aimed to examine the threats of backdoor attack methods in an organizatio

APA, Harvard, Vancouver, ISO, and other styles

38

Lin, Weilin, Li Liu, Jianze Li, and Hui Xiong. "Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 25 (2025): 26299–307. https://doi.org/10.1609/aaai.v39i25.34828.

Full text

Abstract:

Backdoor attacks present a serious security threat to deep neuron networks (DNNs). Although numerous effective defense techniques have been proposed in recent years, they inevitably rely on the availability of either clean or poisoned data. In contrast, data-free defense techniques have evolved slowly and still lag significantly in performance. To address this issue, different from the traditional approach of pruning followed by fine-tuning, we propose a novel data-free defense method named Optimal Transport-based Backdoor Repairing (OTBR) in this work. This method, based on our findings on ne

APA, Harvard, Vancouver, ISO, and other styles

39

Chen, Yang, Zhonglin Ye, Haixing Zhao, and Ying Wang. "Feature-Based Graph Backdoor Attack in the Node Classification Task." International Journal of Intelligent Systems 2023 (February 21, 2023): 1–13. http://dx.doi.org/10.1155/2023/5418398.

Full text

Abstract:

Graph neural networks (GNNs) have shown significant performance in various practical applications due to their strong learning capabilities. Backdoor attacks are a type of attack that can produce hidden attacks on machine learning models. GNNs take backdoor datasets as input to produce an adversary-specified output on poisoned data but perform normally on clean data, which can have grave implications for applications. Backdoor attacks are under-researched in the graph domain, and almost existing graph backdoor attacks focus on the graph-level classification task. To close this gap, we propose

APA, Harvard, Vancouver, ISO, and other styles

40

Zhang, Lei, Ya Peng, Lifei Wei, Congcong Chen, and Xiaoyu Zhang. "DeepDefense: A Steganalysis-Based Backdoor Detecting and Mitigating Protocol in Deep Neural Networks for AI Security." Security and Communication Networks 2023 (May 9, 2023): 1–12. http://dx.doi.org/10.1155/2023/9308909.

Full text

Abstract:

Backdoor attacks have been recognized as a major AI security threat in deep neural networks (DNNs) recently. The attackers inject backdoors into DNNs during the model training such as federated learning. The infected model behaves normally on the clean samples in AI applications while the backdoors are only activated by the predefined triggers and resulted in the specified results. Most of the existing defensing approaches assume that the trigger settings on different poisoned samples are visible and identical just like a white square in the corner of the image. Besides, the sample-specific tr

APA, Harvard, Vancouver, ISO, and other styles

41

Wang, Zhishen, Rui Wang, and Lihua Jing. "Attention-Imperceptible Backdoor Attacks on Vision Transformers." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 8 (2025): 8241–49. https://doi.org/10.1609/aaai.v39i8.32889.

Full text

Abstract:

With the successful transition of Transformers from natural language processing (NLP) to computer vision (CV) domains, Vision Transformers (ViTs) have achieved state-of-the-art performance in many CV tasks. However, backdoor attacks, a significant threat in deep learning, also pose a risk to the security of ViT models. Recently, several backdoor attack methods targeting the patch-level self-attention mechanism in ViTs have been proposed, but they are relatively naive in terms of stealthiness and robustness against defensive measures, lacking in-depth investigation. In this paper, we explore th

APA, Harvard, Vancouver, ISO, and other styles

42

Cui, Jing, Yufei Han, Yuzhe Ma, Jianbin Jiao, and Junge Zhang. "BadRL: Sparse Targeted Backdoor Attack against Reinforcement Learning." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 10 (2024): 11687–94. http://dx.doi.org/10.1609/aaai.v38i10.29052.

Full text

Abstract:

Backdoor attacks in reinforcement learning (RL) have previously employed intense attack strategies to ensure attack success. However, these methods suffer from high attack costs and increased detectability. In this work, we propose a novel approach, BadRL, which focuses on conducting highly sparse backdoor poisoning efforts during training and testing while maintaining successful attacks. Our algorithm, BadRL, strategically chooses state observations with high attack values to inject triggers during training and testing, thereby reducing the chances of detection. In contrast to the previous me

APA, Harvard, Vancouver, ISO, and other styles

43

Hu, Bin, Kehua Guo, Sheng Ren, and Hui Fang. "Enhancing robustness of backdoor attacks against backdoor defenses." Expert Systems with Applications 269 (April 2025): 126355. https://doi.org/10.1016/j.eswa.2024.126355.

Full text

APA, Harvard, Vancouver, ISO, and other styles

44

Tang, Weixuan, Haoke Xie, Yuan Rao, Min Long, Tao Qi, and Zhili Zhou. "BATG: A Backdoor Attack Method Based on Trigger Generation." Electronics 13, no. 24 (2024): 5031. https://doi.org/10.3390/electronics13245031.

Full text

Abstract:

Backdoor attacks aim to implant hidden backdoors into Deep Neural Networks (DNNs) so that the victim models perform well on clean images, whereas their predictions would be maliciously changed on poisoned images. However, most existing backdoor attacks lack the invisibility and robustness required for real-world applications, especially when it comes to resisting image compression techniques, such as JPEG and WEBP. To address these issues, in this paper, we propose a Backdoor Attack Method based on Trigger Generation (BATG). Specifically, a deep convolutional generative network is utilized as

APA, Harvard, Vancouver, ISO, and other styles

45

Zhu, Shuwen, Ge Luo, Ping Wei, Sheng Li, Xinpeng Zhang, and Zhenxing Qian. "Image-imperceptible backdoor attacks." Journal of Image and Graphics 28, no. 3 (2023): 864–77. http://dx.doi.org/10.11834/jig.220550.

Full text

APA, Harvard, Vancouver, ISO, and other styles

46

Guan, Zihan, Mengxuan Hu, Sheng Li, and Anil Kumar Vullikanti. "UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 26 (2025): 27312–20. https://doi.org/10.1609/aaai.v39i26.34941.

Full text

Abstract:

Diffusion models are vulnerable to backdoor attacks, where malicious attackers inject backdoors by poisoning certain training samples during the training stage. This poses a significant threat to real-world applications in the Model-as-a-Service (MaaS) scenario, where users query diffusion models through APIs or directly download them from the internet. To mitigate the threat of backdoor attacks under MaaS, black-box input-level backdoor detection has drawn recent interest, where defenders aim to build a firewall that filters out backdoor samples in the inference stage, with access only to inp

APA, Harvard, Vancouver, ISO, and other styles

47

Wang, Yixu, Tianle Gu, Yan Teng, Yingchun Wang, and Xingjun Ma. "HoneypotNet: Backdoor Attacks Against Model Extraction." Proceedings of the AAAI Conference on Artificial Intelligence 39, no. 8 (2025): 8087–95. https://doi.org/10.1609/aaai.v39i8.32872.

Full text

Abstract:

Model extraction attacks are one type of inference-time attacks that approximate the functionality and performance of a black-box victim model by launching a certain number of queries to the model and then leveraging the model's predictions to train a substitute model. These attacks pose severe security threats to production models and MLaaS platforms and could cause significant monetary losses to the model owners. A body of work has proposed to defend machine learning models against model extraction attacks, including both active defense methods that modify the model's outputs or increase the

APA, Harvard, Vancouver, ISO, and other styles

48

Li, Xi, Songhe Wang, Ruiquan Huang, Mahanth Gowda, and George Kesidis. "Temporal-Distributed Backdoor Attack against Video Based Action Recognition." Proceedings of the AAAI Conference on Artificial Intelligence 38, no. 4 (2024): 3199–207. http://dx.doi.org/10.1609/aaai.v38i4.28104.

Full text

Abstract:

Deep neural networks (DNNs) have achieved tremendous success in various applications including video action recognition, yet remain vulnerable to backdoor attacks (Trojans). The backdoor-compromised model will mis-classify to the target class chosen by the attacker when a test instance (from a non-target class) is embedded with a specific trigger, while maintaining high accuracy on attack-free instances. Although there are extensive studies on backdoor attacks against image data, the susceptibility of video-based systems under backdoor attacks remains largely unexplored. Current studies are di

APA, Harvard, Vancouver, ISO, and other styles

49

Ozdayi, Mustafa Safa, Murat Kantarcioglu, and Yulia R. Gel. "Defending against Backdoors in Federated Learning with Robust Learning Rate." Proceedings of the AAAI Conference on Artificial Intelligence 35, no. 10 (2021): 9268–76. http://dx.doi.org/10.1609/aaai.v35i10.17118.

Full text

Abstract:

Federated learning (FL) allows a set of agents to collaboratively train a model without sharing their potentially sensitive data. This makes FL suitable for privacy-preserving applications. At the same time, FL is susceptible to adversarial attacks due to decentralized and unvetted data. One important line of attacks against FL is the backdoor attacks. In a backdoor attack, an adversary tries to embed a backdoor functionality to the model during training that can later be activated to cause a desired misclassification. To prevent backdoor attacks, we propose a lightweight defense that requires

APA, Harvard, Vancouver, ISO, and other styles

50

Wu, Yalun, Yanfeng Gu, Yuanwan Chen, et al. "Camouflage Backdoor Attack against Pedestrian Detection." Applied Sciences 13, no. 23 (2023): 12752. http://dx.doi.org/10.3390/app132312752.

Full text

Abstract:

Pedestrian detection models in autonomous driving systems heavily rely on deep neural networks (DNNs) to perceive their surroundings. Recent research has unveiled the vulnerability of DNNs to backdoor attacks, in which malicious actors manipulate the system by embedding specific triggers within the training data. In this paper, we propose a tailored camouflaged backdoor attack method designed for pedestrian detection in autonomous driving systems. Our approach begins with the construction of a set of trigger-embedded images. Subsequently, we employ an image scaling function to seamlessly integ

APA, Harvard, Vancouver, ISO, and other styles

We offer discounts on all premium plans for authors whose works are included in thematic literature selections. Contact us to get a unique promo code!