{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T00:47:31Z","timestamp":1760316451010,"version":"build-2065373602"},"publisher-location":"Cham","reference-count":37,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032078834","type":"print"},{"value":"9783032078841","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T00:00:00Z","timestamp":1760313600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T00:00:00Z","timestamp":1760313600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-07884-1_16","type":"book-chapter","created":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T16:22:38Z","timestamp":1760286158000},"page":"309-327","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["DBBA: Diffusion-Based Backdoor Attacks on\u00a0Open-Set Face Recognition Models"],"prefix":"10.1007","author":[{"given":"Fuqi","family":"Qi","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haichang","family":"Gao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Boling","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Guangyu","family":"He","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuhong","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiacheng","family":"Luo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,10,13]]},"reference":[{"key":"16_CR1","doi-asserted-by":"publisher","first-page":"215","DOI":"10.1016\/j.neucom.2020.10.081","volume":"429","author":"M Wang","year":"2021","unstructured":"Wang, M., Deng, W.: Deep face recognition: a survey. Neurocomputing 429, 215\u2013244 (2021)","journal-title":"Neurocomputing"},{"key":"16_CR2","doi-asserted-by":"crossref","unstructured":"Liu, W., Wen, Y., Yu, Z., Li, M., Raj, B., Song, L.: SphereFace: deep hypersphere embedding for face recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 212\u2013220 (2017)","DOI":"10.1109\/CVPR.2017.713"},{"key":"16_CR3","doi-asserted-by":"crossref","unstructured":"Schroff, F., Kalenichenko, D., Philbin, J.: FaceNet: a unified embedding for face recognition and clustering. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 815\u2013823 (2015)","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"16_CR4","doi-asserted-by":"crossref","unstructured":"Wang, H., et al.: CosFace: large margin cosine loss for deep face recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 5265\u20135274 (2018)","DOI":"10.1109\/CVPR.2018.00552"},{"key":"16_CR5","doi-asserted-by":"crossref","unstructured":"Deng, J., Guo, J., Xue, N., Zafeiriou, S.: ArcFace: additive angular margin loss for deep face recognition. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 4690\u20134699 (2019)","DOI":"10.1109\/CVPR.2019.00482"},{"key":"16_CR6","doi-asserted-by":"crossref","unstructured":"Cao, Q., Shen, L., Xie, W., Parkhi, O.M., Zisserman, A.: VGGFace2: a dataset for recognising faces across pose and age. In: 2018 13th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2018), pp. 67\u201374. IEEE (2018)","DOI":"10.1109\/FG.2018.00020"},{"key":"16_CR7","doi-asserted-by":"crossref","unstructured":"Yin, X., Yu, X., Sohn, K., Liu, X., Chandraker, M.: Feature transfer learning for face recognition with under-represented data. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 5704\u20135713 (2019)","DOI":"10.1109\/CVPR.2019.00585"},{"key":"16_CR8","doi-asserted-by":"crossref","unstructured":"Talreja, V., Ferrett, T., Valenti, M.C., Ross, A.: Biometrics-as-a-service: a framework to promote innovative biometric recognition in the cloud. In: 2018 IEEE International Conference on Consumer Electronics (ICCE), pp.\u00a01\u20136. IEEE (2018)","DOI":"10.1109\/ICCE.2018.8326075"},{"key":"16_CR9","unstructured":"Tram\u00e8r, F., Zhang, F., Juels, A., Reiter, M.K., Ristenpart, T.: Stealing machine learning models via prediction APIs. In: 25th USENIX Security Symposium (USENIX Security 16), pp. 601\u2013618 (2016)"},{"issue":"8","key":"16_CR10","doi-asserted-by":"publisher","first-page":"3953","DOI":"10.3390\/app12083953","volume":"12","author":"M Humayun","year":"2022","unstructured":"Humayun, M., Niazi, M., Almufareh, M.F., Jhanjhi, N., Mahmood, S., Alshayeb, M.: Software-as-a-service security challenges and best practices: a multivocal literature review. Appl. Sci. 12(8), 3953 (2022)","journal-title":"Appl. Sci."},{"key":"16_CR11","doi-asserted-by":"crossref","unstructured":"Kurita, K., Michel, P., Neubig, G.: Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660 (2020)","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"16_CR12","unstructured":"Gu, T., Dolan-Gavitt, B., Garg, S.: BadNets: identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)"},{"key":"16_CR13","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)"},{"key":"16_CR14","doi-asserted-by":"publisher","first-page":"1458","DOI":"10.1007\/s12083-020-01031-z","volume":"14","author":"M Xue","year":"2021","unstructured":"Xue, M., He, C., Wang, J., Liu, W.: Backdoors hidden in facial features: a novel invisible backdoor attack against face recognition systems. Peer-to-Peer Network. Appl. 14, 1458\u20131474 (2021)","journal-title":"Peer-to-Peer Network. Appl."},{"key":"16_CR15","unstructured":"Sarkar, E., Benkraouda, H., Maniatakos, M.: FaceHack: triggering backdoored facial recognition systems using facial characteristics. arXiv preprint arXiv:2006.11623 (2020)"},{"key":"16_CR16","unstructured":"Shafahi, A., et al.: Poison frogs! Targeted clean-label poisoning attacks on neural networks. In: Advances in Neural Information Processing Systems, vol. 31 (2018)"},{"key":"16_CR17","unstructured":"Turner, A., Tsipras, D., Madry, A.: Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771 (2019)"},{"key":"16_CR18","unstructured":"Tran, B., Li, J., Madry, A.: Spectral signatures in backdoor attacks. In: Advances in Neural Information Processing Systems, vol. 31 (2018)"},{"key":"16_CR19","doi-asserted-by":"publisher","unstructured":"De\u00a0Gaspari, F., Hitaj, D., Mancini, L.V.: Have you poisoned my data? Defending neural networks against data poisoning. In: Garcia-Alfaro, J., Kozik, R., Chora\u015b, M., Katsikas, S. (eds.) ESORICS 2024. LNCS, vol. 14982, pp. 85\u2013104. Springer, Cham (2024). https:\/\/doi.org\/10.1007\/978-3-031-70879-4_5","DOI":"10.1007\/978-3-031-70879-4_5"},{"key":"16_CR20","unstructured":"Bagdasaryan, E., Shmatikov, V.: Blind backdoors in deep learning models. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 1505\u20131521 (2021)"},{"key":"16_CR21","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102726","volume":"118","author":"M Xue","year":"2022","unstructured":"Xue, M., et al.: PTB: robust physical backdoor attacks against deep neural networks in real world. Comput. Secur. 118, 102726 (2022)","journal-title":"Comput. Secur."},{"key":"16_CR22","doi-asserted-by":"publisher","unstructured":"Rawat, A., Levacher, K., Sinn, M.: The devil is in the GAN: backdoor attacks and defenses in deep generative models. In: Atluri, V., Di Pietro, R., Jensen, C.D., Meng, W. (eds.) ESORICS 2022. LNCS, vol. 13556, pp. 776\u2013783. Springer, Cham (2022). https:\/\/doi.org\/10.1007\/978-3-031-17143-7_41","DOI":"10.1007\/978-3-031-17143-7_41"},{"key":"16_CR23","doi-asserted-by":"publisher","unstructured":"Kang, C., et al.: DIFFender: diffusion-based adversarial defense against patch attacks. In: Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., Varol, G. (eds.) ECCV 2024. LNCS, vol. 15110, pp. 130\u2013147. Springer, Cham (2025). https:\/\/doi.org\/10.1007\/978-3-031-72943-0_8","DOI":"10.1007\/978-3-031-72943-0_8"},{"key":"16_CR24","doi-asserted-by":"crossref","unstructured":"Lin, J., Xu, L., Liu, Y., Zhang, X.: Composite backdoor attack for deep neural network by mixing existing benign features. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 113\u2013131 (2020)","DOI":"10.1145\/3372297.3423362"},{"key":"16_CR25","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"700","DOI":"10.1007\/978-3-031-54129-2_41","volume-title":"ESORICS 2023","author":"K Iwahana","year":"2023","unstructured":"Iwahana, K., Yanai, N., Fujiwara, T.: Backdoor attacks leveraging latent representation in competitive learning. In: Katsikas, S., et al. (eds.) ESORICS 2023. LNCS, vol. 14399, pp. 700\u2013718. Springer, Cham (2023). https:\/\/doi.org\/10.1007\/978-3-031-54129-2_41"},{"key":"16_CR26","doi-asserted-by":"crossref","unstructured":"Saha, A., Subramanya, A., Pirsiavash, H.: Hidden trigger backdoor attacks. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol.\u00a034, pp. 11957\u201311965 (2020)","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"16_CR27","doi-asserted-by":"crossref","unstructured":"Ning, R., Li, J., Xin, C., Wu, H.: Invisible poison: a blackbox clean label backdoor attack to deep neural networks. In: IEEE INFOCOM 2021-IEEE Conference on Computer Communications, pp. 1\u201310. IEEE (2021)","DOI":"10.1109\/INFOCOM42981.2021.9488902"},{"key":"16_CR28","doi-asserted-by":"crossref","unstructured":"Barni, M., Kallas, K., Tondi, B.: A new backdoor attack in CNNs by training set corruption without label poisoning. In: 2019 IEEE International Conference on Image Processing (ICIP), pp. 101\u2013105. IEEE (2019)","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"16_CR29","doi-asserted-by":"crossref","unstructured":"Pinheiro\u00a0Cinelli, L., Ara\u00fajo\u00a0Marins, M., Barros\u00a0da Silva, E.A., Lima\u00a0Netto, S.: Variational autoencoder. In: Variational Methods for Machine Learning with Applications to Deep Networks, pp. 111\u2013149. Springer, Cham (2021)","DOI":"10.1007\/978-3-030-70679-1_5"},{"key":"16_CR30","unstructured":"Goodfellow, I., et al.: Generative adversarial nets. In: Advances in Neural Information Processing Systems, vol. 27 (2014)"},{"key":"16_CR31","unstructured":"Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. In: Advances in Neural Information Processing Systems, vol. 33, pp. 6840\u20136851 (2020)"},{"key":"16_CR32","unstructured":"Song, J., Meng, C., Ermon, S.: Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502 (2020)"},{"key":"16_CR33","doi-asserted-by":"crossref","unstructured":"Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 10684\u201310695 (2022)","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"16_CR34","doi-asserted-by":"crossref","unstructured":"He, K., Chen, X., Xie, S., Li, Y., Doll\u00e1r, P., Girshick, R.: Masked autoencoders are scalable vision learners. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 16000\u201316009 (2022)","DOI":"10.1109\/CVPR52688.2022.01553"},{"issue":"2","key":"16_CR35","doi-asserted-by":"publisher","first-page":"233","DOI":"10.1007\/s11263-017-1009-7","volume":"126","author":"J Booth","year":"2018","unstructured":"Booth, J., Roussos, A., Ponniah, A., Dunaway, D., Zafeiriou, S.: Large scale 3D morphable models. Int. J. Comput. Vision 126(2), 233\u2013254 (2018)","journal-title":"Int. J. Comput. Vision"},{"key":"16_CR36","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1007\/978-3-319-46487-9_6","volume-title":"Computer Vision \u2013 ECCV 2016","author":"Y Guo","year":"2016","unstructured":"Guo, Y., Zhang, L., Hu, Y., He, X., Gao, J.: MS-Celeb-1M: a dataset and benchmark for large-scale face recognition. In: Leibe, B., Matas, J., Sebe, N., Welling, M. (eds.) ECCV 2016. LNCS, vol. 9907, pp. 87\u2013102. Springer, Cham (2016). https:\/\/doi.org\/10.1007\/978-3-319-46487-9_6"},{"key":"16_CR37","doi-asserted-by":"publisher","unstructured":"Lingenfelter, B., Davis, S.R., Hand, E.M.: A quantitative analysis of labeling issues in the Celeba dataset. In: Bebis, G., et al. (eds.) ISVC 2022. LNCS, vol. 13598, pp. 129\u2013141. Springer, Cham (2022). https:\/\/doi.org\/10.1007\/978-3-031-20713-6_10","DOI":"10.1007\/978-3-031-20713-6_10"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2025"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-07884-1_16","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T16:22:50Z","timestamp":1760286170000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-07884-1_16"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,13]]},"ISBN":["9783032078834","9783032078841"],"references-count":37,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-07884-1_16","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,13]]},"assertion":[{"value":"13 October 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Toulouse","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22 September 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24 September 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.esorics2025.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}