{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T21:56:55Z","timestamp":1781301415281,"version":"3.54.1"},"reference-count":54,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,4,5]],"date-time":"2026-04-05T00:00:00Z","timestamp":1775347200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62571298"],"award-info":[{"award-number":["62571298"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62441238"],"award-info":[{"award-number":["62441238"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2441240"],"award-info":[{"award-number":["U2441240"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["2024C01169"],"award-info":[{"award-number":["2024C01169"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004853","name":"Chinese University of Hong Kong","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004853","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004147","name":"Tsinghua University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004147","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Pattern Recognition"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.patcog.2026.113665","type":"journal-article","created":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T13:07:31Z","timestamp":1775135251000},"page":"113665","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":2,"special_numbering":"PB","title":["Rethinking the trigger of backdoor attacks: Towards physical backdoor threats"],"prefix":"10.1016","volume":"179","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2258-265X","authenticated-orcid":false,"given":"Yiming","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingyan","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shu-Tao","family":"Xia","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhifeng","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhan","family":"Qin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dacheng","family":"Tao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.patcog.2026.113665_bib0001","doi-asserted-by":"crossref","first-page":"388","DOI":"10.1016\/j.patcog.2018.06.006","article-title":"Reimagining the central challenge of face recognition: turning a problem into an advantage","volume":"83","author":"Arandjelovi\u0107","year":"2018","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113665_bib0002","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1016\/j.patcog.2025.111381","article-title":"Local sliced Wasserstein feature sets for illumination invariant face recognition","volume":"162","author":"Zhuang","year":"2025","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113665_bib0003","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1016\/j.patcog.2023.109636","article-title":"BDNet: a BERT-based dual-path network for text-to-image cross-modal person re-identification","volume":"141","author":"Liu","year":"2023","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113665_bib0004","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1016\/j.patcog.2025.111486","article-title":"CLEAR: cross-transformers with pre-trained language model for person attribute recognition and retrieval","volume":"164","author":"Bui","year":"2025","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113665_bib0005","doi-asserted-by":"crossref","first-page":"108","DOI":"10.1016\/j.patcog.2022.108979","article-title":"Adaptive momentum variance for attention-guided sparse adversarial attacks","volume":"133","author":"Li","year":"2023","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113665_bib0006","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1016\/j.patcog.2025.111983","article-title":"Staircase sign method: boosting adversarial attacks by mitigating gradient distortion","volume":"170","author":"Zeng","year":"2026","journal-title":"Pattern Recognit."},{"issue":"1","key":"10.1016\/j.patcog.2026.113665_bib0007","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1109\/TNNLS.2022.3182979","article-title":"Backdoor learning: a survey","volume":"35","author":"Li","year":"2022","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"10.1016\/j.patcog.2026.113665_bib0008","series-title":"NDSS","article-title":"Trojaning attack on neural networks","author":"Liu","year":"2017"},{"key":"10.1016\/j.patcog.2026.113665_bib0009","series-title":"ECCV","first-page":"104","article-title":"Hardly perceptible trojan attack against neural networks with bit flips","author":"Bai","year":"2022"},{"key":"10.1016\/j.patcog.2026.113665_bib0010","doi-asserted-by":"crossref","first-page":"47230","DOI":"10.1109\/ACCESS.2019.2909068","article-title":"BadNets: evaluating backdooring attacks on deep neural networks","volume":"7","author":"Gu","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.patcog.2026.113665_bib0011","series-title":"ICCV","article-title":"Invisible backdoor attack with sample-specific triggers","author":"Li","year":"2021"},{"key":"10.1016\/j.patcog.2026.113665_bib0012","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2023.109512","article-title":"Not all samples are born equal: towards effective clean-label backdoor attacks","volume":"139","author":"Gao","year":"2023","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113665_bib0013","first-page":"6364","article-title":"Backdoor attack with sparse and invisible trigger","author":"Gao","year":"2024","journal-title":"TIFS"},{"key":"10.1016\/j.patcog.2026.113665_bib0014","series-title":"CVPR","article-title":"TBT: targeted neural network attack with bit trojan","author":"Rakin","year":"2020"},{"key":"10.1016\/j.patcog.2026.113665_bib0015","series-title":"ICCV","article-title":"One-bit flip is all you need: when bit-flip attack meets model training","author":"Dong","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0016","series-title":"ICLR","article-title":"Few-shot backdoor attacks on visual object tracking","author":"Li","year":"2022"},{"key":"10.1016\/j.patcog.2026.113665_bib0017","series-title":"ICASSP","article-title":"Untargeted backdoor attack against object detection","author":"Luo","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0018","series-title":"EMNLP","article-title":"Prompt as triggers for backdoor attack: examining the vulnerability in language models","author":"Zhao","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0019","series-title":"USENIX Security","article-title":"Poisoning the unlabeled dataset of semi-Supervised learning","author":"Carlini","year":"2021"},{"key":"10.1016\/j.patcog.2026.113665_bib0020","unstructured":"X. Chen, C. Liu, B. Li, K. Lu, D. Song, Targeted backdoor attacks on deep learning systems using data poisoning, (2017) arXiv preprint arXiv: 1712.05526."},{"key":"10.1016\/j.patcog.2026.113665_bib0021","unstructured":"A. Turner, D. Tsipras, A. Madry, Label-consistent backdoor attacks, (2019) arXiv preprint arXiv: 1912.02771."},{"key":"10.1016\/j.patcog.2026.113665_bib0022","series-title":"NeurIPS","first-page":"13238","article-title":"Untargeted backdoor watermark: towards harmless and stealthy dataset copyright protection","author":"Li","year":"2022"},{"key":"10.1016\/j.patcog.2026.113665_bib0023","series-title":"ICLR","article-title":"Revisiting the assumption of latent separability for backdoor defenses","author":"Qi","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0024","series-title":"ICLR","article-title":"WaNet-imperceptible warping-based backdoor attack","author":"Nguyen","year":"2021"},{"issue":"5","key":"10.1016\/j.patcog.2026.113665_bib0025","doi-asserted-by":"crossref","first-page":"4685","DOI":"10.1109\/TDSC.2025.3552234","article-title":"Towards sample-specific backdoor attack with clean labels via attribute trigger","volume":"22","author":"Zhu","year":"2025","journal-title":"IEEE Trans. Dependable Secure. Comput."},{"key":"10.1016\/j.patcog.2026.113665_bib0026","series-title":"ICIP","article-title":"Identifying physically realizable triggers for backdoored face recognition networks","author":"Raj","year":"2021"},{"key":"10.1016\/j.patcog.2026.113665_bib0027","series-title":"ICLR","article-title":"Scale-up: an efficient black-box input-level backdoor detection via analyzing scaled prediction consistency","author":"Guo","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0028","series-title":"ICML","first-page":"18992","article-title":"IBD-PSC: input-level backdoor detection via parameter-oriented scaling consistency","author":"Hou","year":"2024"},{"key":"10.1016\/j.patcog.2026.113665_bib0029","series-title":"RAID","article-title":"Fine-pruning: defending against backdooring attacks on deep neural networks","author":"Liu","year":"2018"},{"key":"10.1016\/j.patcog.2026.113665_bib0030","series-title":"IEEE S&P","article-title":"Neural cleanse: identifying and mitigating backdoor attacks in neural networks","author":"Wang","year":"2019"},{"key":"10.1016\/j.patcog.2026.113665_bib0031","series-title":"ICLR","article-title":"UNICORN: a unified backdoor trigger inversion framework","author":"Wang","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0032","series-title":"ICLR","article-title":"Towards reliable and efficient backdoor trigger inversion via decoupling benign features","author":"Xu","year":"2024"},{"key":"10.1016\/j.patcog.2026.113665_bib0033","series-title":"ICCD","article-title":"Neural trojans","author":"Liu","year":"2017"},{"key":"10.1016\/j.patcog.2026.113665_bib0034","series-title":"NeurIPS","article-title":"Black-box backdoor defense via zero-shot image purification","author":"Shi","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0035","series-title":"IEEE S&P","article-title":"RAB: provable robustness against backdoor attacks","author":"Weber","year":"2023"},{"key":"10.1016\/j.patcog.2026.113665_bib0036","series-title":"ICLR","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2015"},{"key":"10.1016\/j.patcog.2026.113665_bib0037","series-title":"CVPR","article-title":"Deep residual learning for image recognition","author":"He","year":"2016"},{"key":"10.1016\/j.patcog.2026.113665_bib0038","series-title":"Technical Report","article-title":"Learning Multiple Layers of Features From Tiny Images","author":"Krizhevsky","year":"2009"},{"issue":"11","key":"10.1016\/j.patcog.2026.113665_bib0039","doi-asserted-by":"crossref","first-page":"665","DOI":"10.1038\/s42256-020-00257-z","article-title":"Shortcut learning in deep neural networks","volume":"2","author":"Geirhos","year":"2020","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patcog.2026.113665_bib0040","series-title":"NAACL","first-page":"483","article-title":"From shortcuts to triggers: backdoor defense with denoised poe","author":"Liu","year":"2024"},{"key":"10.1016\/j.patcog.2026.113665_bib0041","series-title":"ICML","article-title":"Synthesizing robust adversarial examples","author":"Athalye","year":"2018"},{"key":"10.1016\/j.patcog.2026.113665_bib0042","series-title":"CVPR","article-title":"Backdoor attacks against deep learning systems in the physical world","author":"Wenger","year":"2021"},{"issue":"1","key":"10.1016\/j.patcog.2026.113665_bib0043","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s40537-019-0197-0","article-title":"A survey on image data augmentation for deep learning","volume":"6","author":"Shorten","year":"2019","journal-title":"J. Big Data"},{"key":"10.1016\/j.patcog.2026.113665_bib0044","series-title":"ICML","article-title":"A kernel theory of modern data augmentation","author":"Dao","year":"2019"},{"key":"10.1016\/j.patcog.2026.113665_bib0045","series-title":"ICLR Workshop","article-title":"BackdoorBox: a python toolbox for backdoor learning","author":"Li","year":"2023"},{"issue":"1","key":"10.1016\/j.patcog.2026.113665_bib0046","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1109\/TIP.2018.2867198","article-title":"Learning rotation-invariant and fisher discriminative convolutional neural networks for object detection","volume":"28","author":"Cheng","year":"2018","journal-title":"IEEE Trans. Image Process."},{"key":"10.1016\/j.patcog.2026.113665_bib0047","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2021.108472","article-title":"Semi-supervised robust training with generalized perturbed neighborhood","volume":"124","author":"Li","year":"2022","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113665_bib0048","doi-asserted-by":"crossref","first-page":"323","DOI":"10.1016\/j.neunet.2012.02.016","article-title":"Man vs. computer: benchmarking machine learning algorithms for traffic sign recognition","volume":"32","author":"Stallkamp","year":"2012","journal-title":"Neural Netw."},{"issue":"11","key":"10.1016\/j.patcog.2026.113665_bib0049","doi-asserted-by":"crossref","first-page":"2351","DOI":"10.1109\/LGRS.2015.2478256","article-title":"High-resolution SAR image classification via deep convolutional autoencoders","volume":"12","author":"Geng","year":"2015","journal-title":"IEEE Geosci. Remote Sens. Lett."},{"key":"10.1016\/j.patcog.2026.113665_bib0050","series-title":"ISSTA","article-title":"AdvDoor: adversarial backdoor attack of deep learning system","author":"Zhang","year":"2021"},{"key":"10.1016\/j.patcog.2026.113665_bib0051","series-title":"CCS","article-title":"Narcissus: a practical clean-label backdoor attack with limited information","author":"Zeng","year":"2023"},{"issue":"2","key":"10.1016\/j.patcog.2026.113665_bib0052","doi-asserted-by":"crossref","first-page":"336","DOI":"10.1007\/s11263-019-01228-7","article-title":"Grad-CAM: visual explanations from deep networks via gradient-based localization","volume":"128","author":"Selvaraju","year":"2020","journal-title":"Int. J. Comput. Vis."},{"key":"10.1016\/j.patcog.2026.113665_bib0053","doi-asserted-by":"crossref","first-page":"6707","DOI":"10.1109\/TIP.2020.2993098","article-title":"Interpret neural networks by extracting critical subnetworks","volume":"29","author":"Wang","year":"2020","journal-title":"IEEE Trans. Image Process."},{"key":"10.1016\/j.patcog.2026.113665_bib0054","series-title":"ICLR","article-title":"An image is worth 16x16 words: transformers for image recognition at scale","author":"Dosovitskiy","year":"2020"}],"container-title":["Pattern Recognition"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0031320326006308?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0031320326006308?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T21:16:18Z","timestamp":1781298978000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0031320326006308"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":54,"alternative-id":["S0031320326006308"],"URL":"https:\/\/doi.org\/10.1016\/j.patcog.2026.113665","relation":{},"ISSN":["0031-3203"],"issn-type":[{"value":"0031-3203","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Rethinking the trigger of backdoor attacks: Towards physical backdoor threats","name":"articletitle","label":"Article Title"},{"value":"Pattern Recognition","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.patcog.2026.113665","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"113665"}}