{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T15:29:01Z","timestamp":1772119741109,"version":"3.50.1"},"reference-count":36,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2024,3,19]],"date-time":"2024-03-19T00:00:00Z","timestamp":1710806400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,3,19]],"date-time":"2024-03-19T00:00:00Z","timestamp":1710806400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Neural Process Lett"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Deep learning has been widely used in many applications such as face recognition, autonomous driving, etc. However, deep learning models are vulnerable to various adversarial attacks, among which backdoor attack is emerging recently. Most of the existing backdoor attacks use the same trigger or the same trigger generation approach to generate the poisoned samples in the training and testing sets, which is also commonly adopted by many backdoor defense strategies. In this paper, we develop an enhanced backdoor attack (EBA) that aims to reveal the potential flaws of existing backdoor defense methods. We use a low-intensity trigger to embed the backdoor, while a high-intensity trigger to activate it. Furthermore, we propose an enhanced coalescence backdoor attack (ECBA) where multiple low-intensity incipient triggers are designed to train the backdoor model, and then, all incipient triggers are gathered on one sample and enhanced to launch the attack. Experiment results on three popular datasets show that our proposed attacks can achieve high attack success rates while maintaining the model classification accuracy of benign samples. Meanwhile, by hiding the incipient poisoned samples and preventing them from activating the backdoor, the proposed attack exhibits significant stealth and the ability to evade mainstream defense methods during the model training phase.<\/jats:p>","DOI":"10.1007\/s11063-024-11469-4","type":"journal-article","created":{"date-parts":[[2024,3,19]],"date-time":"2024-03-19T15:02:47Z","timestamp":1710860567000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Enhanced Coalescence Backdoor Attack Against DNN Based on Pixel Gradient"],"prefix":"10.1007","volume":"56","author":[{"given":"Jianyao","family":"Yin","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Honglong","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Junjian","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yudong","family":"Gao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,3,19]]},"reference":[{"key":"11469_CR1","doi-asserted-by":"publisher","first-page":"215","DOI":"10.1016\/j.neucom.2020.10.081","volume":"429","author":"M Wang","year":"2021","unstructured":"Wang M, Deng W (2021) Deep face recognition: a survey. Neurocomputing 429:215\u2013244","journal-title":"Neurocomputing"},{"key":"11469_CR2","doi-asserted-by":"crossref","unstructured":"Chen C, Seff A, Kornhauser A, Xiao J (2015) Deepdriving: Learning affordance for direct perception in autonomous driving. In: Proc. of IEEE international conference on computer vision, pp 2722\u20132730","DOI":"10.1109\/ICCV.2015.312"},{"key":"11469_CR3","doi-asserted-by":"crossref","unstructured":"Bae H-S, Lee H-J, Lee S-G (2016) Voice recognition based on adaptive mfcc and deep learning. In: Proc. of IEEE 11th conference on industrial electronics and applications (ICIEA) pp 1542\u20131546","DOI":"10.1109\/ICIEA.2016.7603830"},{"key":"11469_CR4","unstructured":"Gregor K, Danihelka I, Graves A, Rezende D, Wierstra D (2015) Draw: A recurrent neural network for image generation. In: Proc. of international conference on machine learning, pp 1462\u20131471"},{"key":"11469_CR5","doi-asserted-by":"crossref","unstructured":"Lin K, Chen H, Yan N, Ni Z, Wang Z, Yu J (2023) Double Polling-Based Tag Information Collection for Sensor-Augmented RFID Systems. IEEE Transactions on Mobile Computing, pp 1\u201314","DOI":"10.1109\/TMC.2023.3237716"},{"key":"11469_CR6","doi-asserted-by":"publisher","first-page":"714","DOI":"10.1109\/TIFS.2020.3023785","volume":"16","author":"X Ai","year":"2021","unstructured":"Ai X, Chen H, Lin K, Wang Z, Yu J (2021) Nowhere to hide: efficiently identifying probabilistic cloning attacks in large-scale RFID systems. IEEE Trans Inf Forens Secur 16:714\u2013727","journal-title":"IEEE Trans Inf Forens Secur"},{"key":"11469_CR7","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2023.3302917","author":"X Chi","year":"2023","unstructured":"Chi X, Chen H, Li G, Ni Z, Jiang N, Xia F (2023) EDSP-edge: efficient dynamic edge service entity placement for mobile virtual reality systems. IEEE Trans Wireless Commun. https:\/\/doi.org\/10.1109\/TWC.2023.3302917","journal-title":"IEEE Trans Wireless Commun"},{"key":"11469_CR8","first-page":"2476","volume":"18","author":"Y Huang","year":"2021","unstructured":"Huang Y, Chen H, Ma G, Lin K, Ni Z, Yan N, Wang Z (2021) OPAT: optimized allocation of time-dependent tasks for mobile crowdsensing. IEEE Trans Mob Comput 18:2476\u20132485","journal-title":"IEEE Trans Mob Comput"},{"key":"11469_CR9","doi-asserted-by":"crossref","unstructured":"Xi C, Wei G, Fan Z, Jiayu D (2022) Generate usable adversarial examples via simulating additional light sources. Neural Processing Letters pp 1\u20132","DOI":"10.1007\/s11063-022-11024-z"},{"key":"11469_CR10","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3551636","volume":"55","author":"Z Tian","year":"2022","unstructured":"Tian Z, Cui L, Liang J, Yu S (2022) A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Comput Surv 55:1\u201335","journal-title":"ACM Comput Surv"},{"key":"11469_CR11","doi-asserted-by":"publisher","first-page":"47230","DOI":"10.1109\/ACCESS.2019.2909068","volume":"7","author":"T Gu","year":"2019","unstructured":"Gu T, Liu K, Dolan-Gavitt B, Garg S (2019) Badnets: evaluating backdooring attacks on deep neural networks. IEEE Access 7:47230\u201347244","journal-title":"IEEE Access"},{"key":"11469_CR12","doi-asserted-by":"crossref","unstructured":"Yoshida K, Fujino T (2020) Disabling backdoor and identifying poison data by using knowledge distillation in backdoor attacks on deep neural networks. In: Proc. of the 13th ACM Workshop on Artificial Intelligence and Security pp 117\u2013127","DOI":"10.1145\/3411508.3421375"},{"key":"11469_CR13","doi-asserted-by":"crossref","unstructured":"Bisong E, Bisong E (2019) Google cloud machine learning engine (cloud mle). Building Machine Learning and Deep Learning Models on Google Cloud Platform: A Comprehensive Guide for Beginners, pp 545\u2013579","DOI":"10.1007\/978-1-4842-4470-8_41"},{"key":"11469_CR14","doi-asserted-by":"crossref","unstructured":"Salvaris M et\u00a0al (2018) Microsoft ai platform. Deep Learning with Azure: Building and Deploying Artificial Intelligence Solutions on the Microsoft AI Platform pp 79\u201398","DOI":"10.1007\/978-1-4842-3679-6_4"},{"key":"11469_CR15","doi-asserted-by":"crossref","unstructured":"Liu K, Dolan-Gavitt B, Garg S (2018) Fine-pruning: Defending against backdooring attacks on deep neural networks. In Proc. of Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21 pp 273\u2013294","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"11469_CR16","unstructured":"Chen B et\u00a0al (2018) Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728"},{"key":"11469_CR17","unstructured":"Soremekun E, Udeshi S, Chattopadhyay S (2020) Exposing backdoors in robust machine learning models. arXiv preprint arXiv:2003.00865"},{"key":"11469_CR18","doi-asserted-by":"crossref","unstructured":"Zeng Y, Park W, Mao ZM, Jia R (2021) Rethinking the backdoor attacks\u2019 triggers: A frequency perspective. In Proc. of the IEEE\/CVF international conference on computer vision pp 16473\u201316481","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"11469_CR19","doi-asserted-by":"publisher","first-page":"1562","DOI":"10.1109\/TDSC.2020.3028448","volume":"19","author":"M Xue","year":"2020","unstructured":"Xue M, He C, Wang J, Liu W (2020) One-to-n & n-to-one: two advanced backdoor attacks against deep learning models. IEEE Trans Dependable Secure Comput 19:1562\u20131578","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"11469_CR20","doi-asserted-by":"crossref","unstructured":"Wang B,Yao Y, Shan S, Zhao B, Li H, Viswanath B, Zheng H (2019) Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proc. of IEEE symposium on security and privacy (SP) pp 707\u2013723","DOI":"10.1109\/SP.2019.00031"},{"key":"11469_CR21","unstructured":"Chen X, Liu C, Li B, Lu K, Song D (2017) Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526"},{"key":"11469_CR22","doi-asserted-by":"crossref","unstructured":"Barni M, Kallas K, Tondi B (2019) A new backdoor attack in cnns by training set corruption without label poisoning. In Proc. of IEEE international conference on image processing (ICIP) pp 101\u2013105","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"11469_CR23","doi-asserted-by":"crossref","unstructured":"Lovisotto G, Eberz S, Martinovic I (2020) Biometric backdoors: A poisoning attack against unsupervised template updating. In Proc. of IEEE European Symposium on Security and Privacy (EuroS &P) pp 184\u2013197","DOI":"10.1109\/EuroSP48549.2020.00020"},{"key":"11469_CR24","doi-asserted-by":"publisher","first-page":"4117","DOI":"10.1007\/s11063-021-10584-w","volume":"53","author":"H Liu","year":"2021","unstructured":"Liu H, Li D, Li Y (2021) Poisonous label attack: black-box data poisoning attack with enhanced conditional dcgan. Neural Process Lett 53:4117\u20134142","journal-title":"Neural Process Lett"},{"key":"11469_CR25","doi-asserted-by":"crossref","unstructured":"Zhong H, Liao C, Squicciarini AC, Zhu S, Miller D (2020) Backdoor embedding in convolutional neural network models via invisible perturbation. In Proc. of the Tenth ACM conference on data and application security and privacy pp 97\u2013108","DOI":"10.1145\/3374664.3375751"},{"key":"11469_CR26","unstructured":"Zou M et\u00a0al (2018) Potrojan: powerful neural-level trojan designs in deep learning models. arXiv preprint arXiv:1802.03043"},{"key":"11469_CR27","doi-asserted-by":"crossref","unstructured":"Wang Z, Zhai J, Ma S (2022) Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In Proc. of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition pp 15074\u201315084","DOI":"10.1109\/CVPR52688.2022.01465"},{"key":"11469_CR28","doi-asserted-by":"crossref","unstructured":"Tang R, Du M, Liu N, Yang F, Hu X (2020) An embarrassingly simple approach for trojan attack in deep neural networks. In Proc. of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pp 218\u2013228","DOI":"10.1145\/3394486.3403064"},{"key":"11469_CR29","doi-asserted-by":"crossref","unstructured":"Liu Y et\u00a0al (2018) Trojaning attack on neural networks. In Proc. of the 25th Annual network and distributed system security symposium (NDSS 2018) pp 1\u201315","DOI":"10.14722\/ndss.2018.23291"},{"key":"11469_CR30","doi-asserted-by":"crossref","unstructured":"Zhong N, Qian Z, Zhang X (2022) Imperceptible backdoor attack: From input space to feature representation. arXiv preprint arXiv:2205.03190","DOI":"10.24963\/ijcai.2022\/242"},{"key":"11469_CR31","doi-asserted-by":"crossref","unstructured":"Selvaraju RR et\u00a0al (2017) Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proc. of the IEEE international conference on computer vision pp 618\u2013626","DOI":"10.1109\/ICCV.2017.74"},{"key":"11469_CR32","doi-asserted-by":"crossref","unstructured":"Dong Y et\u00a0al (2021) Black-box detection of backdoor attacks with limited information and data. In Proc. of the IEEE\/CVF international conference on computer vision pp 16482\u201316491","DOI":"10.1109\/ICCV48922.2021.01617"},{"key":"11469_CR33","doi-asserted-by":"crossref","unstructured":"Gao Y et\u00a0al (2019) Strip: A defence against trojan attacks on deep neural networks. In Proc. of the 35th annual computer security applications conference, pp 113\u2013125","DOI":"10.1145\/3359789.3359790"},{"key":"11469_CR34","unstructured":"LeCun Y (1998) The mnist database of handwritten digits. http:\/\/yann. lecun. com\/exdb\/mnist\/"},{"key":"11469_CR35","doi-asserted-by":"publisher","first-page":"323","DOI":"10.1016\/j.neunet.2012.02.016","volume":"32","author":"J Stallkamp","year":"2012","unstructured":"Stallkamp J, Schlipsing M, Salmen J, Igel C (2012) Benchmarking machine learning algorithms for traffic sign recognition Man vs computer. Neural Netw 32:323\u2013332","journal-title":"Neural Netw"},{"key":"11469_CR36","unstructured":"Alessio C (2018) Animals-10. https:\/\/www. kaggle. com\/alessiocorrado99\/animals10"}],"container-title":["Neural Processing Letters"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11063-024-11469-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11063-024-11469-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11063-024-11469-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,14]],"date-time":"2024-11-14T11:58:36Z","timestamp":1731585516000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11063-024-11469-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,3,19]]},"references-count":36,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2024,4]]}},"alternative-id":["11469"],"URL":"https:\/\/doi.org\/10.1007\/s11063-024-11469-4","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-3089692\/v1","asserted-by":"object"}]},"ISSN":["1573-773X"],"issn-type":[{"value":"1573-773X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,3,19]]},"assertion":[{"value":"14 October 2023","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 March 2024","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"114"}}