{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T19:26:08Z","timestamp":1793129168138,"version":"4.5.0"},"reference-count":315,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/access.2024.3355816","type":"journal-article","created":{"date-parts":[[2024,1,18]],"date-time":"2024-01-18T13:34:01Z","timestamp":1705584841000},"page":"29004-29023","source":"Crossref","is-referenced-by-count":31,"title":["Backdoor Attacks to Deep Neural Networks: A Survey of the Literature, Challenges, and Future Research Directions"],"prefix":"10.1109","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-4022-3499","authenticated-orcid":false,"given":"Orson","family":"Mengara","sequence":"first","affiliation":[{"name":"INRS-EMT, University of Quebec, Montreal, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Anderson","family":"Avila","sequence":"additional","affiliation":[{"name":"INRS-EMT, University of Quebec, Montreal, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5739-2514","authenticated-orcid":false,"given":"Tiago H.","family":"Falk","sequence":"additional","affiliation":[{"name":"INRS-EMT, University of Quebec, Montreal, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390177"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.312"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1021\/ci500747n"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1038\/nature12346"},{"key":"ref7","first-page":"19","article-title":"The Higgs boson machine learning challenge","volume-title":"Proc. NIPS Workshop High-Energy Phys. Mach. Learn.","author":"Adam-Bourdarios"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1126\/science.1254806"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/RO-MAN53752.2022.9900872"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1049\/cit2.12028"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/NCA.2017.8171381"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/EISIC.2017.21"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3261327"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3460231.3474275"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179406"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.2000196"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3497753"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3523273"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.07.133"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3182979"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_1"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ISQED48828.2020.9137011"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/OJSP.2022.3190213"},{"key":"ref26","article-title":"Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective","author":"Wu","year":"2023","journal-title":"arXiv:2302.09457"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.6028\/nist.ai.100-2"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2019.100199"},{"key":"ref29","first-page":"1299","article-title":"When does machine learning FAIL? Generalized transferability for evasion and poisoning attacks","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Security)","author":"Suciu"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00402"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3162397"},{"key":"ref32","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv:1312.6199"},{"key":"ref33","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref35","article-title":"Poisoning attacks against support vector machines","author":"Biggio","year":"2012","journal-title":"arXiv:1206.6389"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2017.8228656"},{"key":"ref39","article-title":"Adversarial attacks and defenses in machine learning-powered networks: A contemporary survey","author":"Wang","year":"2023","journal-title":"arXiv:2303.06302"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3208131"},{"key":"ref41","article-title":"Can you really backdoor federated learning?","author":"Sun","year":"2019","journal-title":"arXiv:1911.07963"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2019.2933524"},{"key":"ref43","article-title":"Poisoning attacks and defenses on artificial intelligence: A survey","author":"Ramirez","year":"2022","journal-title":"arXiv:2202.10276"},{"key":"ref44","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty","year":"2018","journal-title":"arXiv:1810.00069"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453079"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-68238-5_32"},{"key":"ref49","article-title":"Privacy in deep learning: A survey","author":"Mireshghallah","year":"2020","journal-title":"arXiv:2004.12254"},{"key":"ref50","first-page":"1","article-title":"How secure are deep learning algorithms from side-channel based reverse engineering?","volume-title":"Proc. 56th ACM\/IEEE Design Autom. Conf. (DAC)","author":"Alam"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2965016"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1504\/IJACT.2014.062722"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3465377"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1016\/j.microrel.2021.114116"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3164392"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3522783.3529523"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3585385"},{"key":"ref58","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"ref60","first-page":"1487","article-title":"Explanation-guided backdoor poisoning attacks against malware classifiers","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Severi"},{"key":"ref61","first-page":"10546","article-title":"Backdoorbench: A comprehensive benchmark of backdoor learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Wu"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484576"},{"key":"ref63","first-page":"3611","article-title":"Hidden trigger backdoor attack on NLP models via linguistic style manipulation","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Security)","author":"Pan"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i1.19935"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00020"},{"key":"ref66","first-page":"36396","article-title":"Training with more confidence: Mitigating injected and natural backdoors during training","volume":"35","author":"Wang","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3326410"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1016\/j.softx.2023.101387"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00049"},{"key":"ref70","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"Gao","year":"2020","journal-title":"arXiv:2007.10760"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.3005434"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/s13748-021-00269-9"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/OJCS.2023.3267221"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3045078"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/MWC.017.2100714"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1002\/ett.4142"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i13.17385"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr46437.2021.00614"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9747582"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403064"},{"key":"ref81","article-title":"A survey of neural Trojan attacks and defenses in deep learning","author":"Wang","year":"2022","journal-title":"arXiv:2202.07183"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_7"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00068"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW54120.2021.00008"},{"key":"ref85","article-title":"The art of deception: Robust backdoor attack using dynamic stacking of triggers","author":"Mengara","year":"2024","journal-title":"arXiv:2401.01537"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00762"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1049\/cje.2021.00.126"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3021407"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref91","article-title":"FaceHack: Triggering backdoored facial recognition systems using facial characteristics","author":"Sarkar","year":"2020","journal-title":"arXiv:2006.11623"},{"key":"ref92","article-title":"WaNet\u2014Imperceptible warping-based backdoor attack","author":"Nguyen","year":"2021","journal-title":"arXiv:2102.10369"},{"key":"ref93","article-title":"Rethinking the trigger of backdoor attack","author":"Li","year":"2020","journal-title":"arXiv:2004.04692"},{"key":"ref94","article-title":"Backdoor embedding in convolutional neural network models via invisible perturbation","author":"Liao","year":"2018","journal-title":"arXiv:1808.10307"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00019"},{"key":"ref96","first-page":"3454","article-title":"Input-aware dynamic backdoor attack","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Nguyen"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412130"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23300"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref101","article-title":"Blind backdoors in deep learning models","volume-title":"Proc. Usenix Secur.","author":"Bagdasaryan"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3574159"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2017.12.041"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3233424"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.3390\/s23084086"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3037705"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/MCE.2021.3066828"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2022.3198481"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2014.08.081"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v29i1.9569"},{"key":"ref112","article-title":"Learning to confuse: Generating training time adversarial data with auto-encoder","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Feng"},{"key":"ref113","article-title":"Poisoning web-scale training datasets is practical","author":"Carlini","year":"2023","journal-title":"arXiv:2302.10149"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1063\/5.0169396"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3470817"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_32"},{"key":"ref118","article-title":"Robust deep reinforcement learning with adversarial attacks","author":"Pattanaik","year":"2017","journal-title":"arXiv:1712.03632"},{"key":"ref119","first-page":"10842","article-title":"Data valuation using reinforcement learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yoon"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01562"},{"key":"ref121","first-page":"7614","article-title":"Transferable clean-label poisoning attacks on deep neural nets","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhu"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/ICTAI.2019.00137"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2962525"},{"key":"ref124","article-title":"Efficient backdoor attacks for deep neural networks in real-world scenarios","author":"Sun","year":"2023","journal-title":"arXiv:2306.08386"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103212"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.3390\/app11209556"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413468"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1145\/3551636"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/BigData55660.2022.10020431"},{"key":"ref130","first-page":"1086","article-title":"Moderate-fitting as a natural backdoor defender for pre-trained language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Zhu"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1145\/3494109.3527192"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3233519"},{"key":"ref133","article-title":"Silent killer: A stealthy, cleanlabel, black-box backdoor attack","author":"Lederer","year":"2023","journal-title":"arXiv:2301.02615"},{"key":"ref134","article-title":"Narcissus: A practical clean-label backdoor attack with limited information","author":"Zeng","year":"2022","journal-title":"arXiv:2204.05255"},{"key":"ref135","article-title":"Explore the effect of data selection on poison efficiency in backdoor attacks","author":"Li","year":"2023","journal-title":"arXiv:2310.09744"},{"key":"ref136","article-title":"Poisoning MorphNet for cleanlabel backdoor attack to point clouds","author":"Tian","year":"2021","journal-title":"arXiv:2105.04839"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP46576.2022.9897413"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3265535"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1145\/3437880.3460401"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00072"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103102"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6976"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.3389\/fdata.2021.729663"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00412"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/96"},{"key":"ref146","article-title":"Fine-tuning is all you need to mitigate backdoor attacks","author":"Sha","year":"2022","journal-title":"arXiv:2212.09067"},{"key":"ref147","article-title":"Efficient backdoor removal through natural gradient fine-tuning","author":"Karim","year":"2023","journal-title":"arXiv:2306.17441"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2020.3000900"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.3390\/app122412564"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/BDCAT56447.2022.00013"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/SmartWorld-UIC-ATC-ScalCom-DigitalTwin-PriComp-Metaverse56740.2022.00246"},{"key":"ref152","first-page":"3593","article-title":"Teacher model fingerprinting attacks against transfer learning","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Security)","author":"Chen"},{"key":"ref153","article-title":"On certifying robustness against backdoor attacks via randomized smoothing","author":"Wang","year":"2020","journal-title":"arXiv:2002.11750"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1109\/sp46215.2023.10179451"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2022.3159784"},{"key":"ref156","article-title":"ConFoc: Content-focus protection against Trojan attacks on neural networks","author":"Villarreal-Vasquez","year":"2020","journal-title":"arXiv:2007.00711"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3086529"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453108"},{"key":"ref159","article-title":"Backdoor attack in the physical world","author":"Li","year":"2021","journal-title":"arXiv:2104.02361"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref161","article-title":"Bridging mode connectivity in loss landscapes and adversarial robustness","author":"Zhao","year":"2020","journal-title":"arXiv:2005.00060"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1145\/3411508.3421375"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1049\/ipr2.12325"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2021.3111123"},{"key":"ref165","first-page":"18667","article-title":"Pre-activation distributions expose backdoor neurons","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Zheng"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_11"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref168","article-title":"Defending neural backdoors via generative distribution modeling","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Qiao"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP42928.2021.9506564"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1109\/MLSP49062.2020.9231861"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-91356-4_18"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-67661-2_18"},{"key":"ref174","first-page":"9525","article-title":"Backdoor scanning for deep neural networks through K-Arm optimization","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Shen"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM50108.2020.00025"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413546"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.3041202"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01617"},{"key":"ref179","first-page":"22285","article-title":"One-shot neural backdoor erasing via adversarial weight masking","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Chai"},{"key":"ref180","first-page":"9738","article-title":"Rethinking the reverseengineering of Trojan triggers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Wang"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01300"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01301"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58583-9_20"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_14"},{"key":"ref186","first-page":"33876","article-title":"Randomized channel shuffling: Minimal-overhead backdoor attack detection without clean datasets","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Cai"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/BIOSIG55365.2022.9897044"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2022.3201586"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref190","first-page":"17258","article-title":"Topological detection of Trojaned neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Zheng"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3032411"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1109\/ICAA58325.2023.00019"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3101289"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3108407"},{"key":"ref195","article-title":"Spectral signatures in backdoor attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Tran"},{"key":"ref196","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"Chen","year":"2018","journal-title":"arXiv:1811.03728"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref198","article-title":"Incompatibility clustering as a defense against backdoor poisoning attacks","volume-title":"Proc. 11th Int. Conf. Learn. Represent.","author":"Jin"},{"key":"ref199","first-page":"9727","article-title":"Effective backdoor defense by exploiting sensitivity of poisoned samples","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Chen"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_17"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3194642"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3175616"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2022.04.003"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3141077"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref206","first-page":"1541","article-title":"Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Tang"},{"key":"ref207","first-page":"4129","article-title":"SPECTRE: Defending against backdoor attacks using robust statistics","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Hayase"},{"key":"ref208","first-page":"1","article-title":"CleaNN: Accelerated Trojan shield for embedded neural networks","volume-title":"Proc. IEEE\/ACM Int. Conf. Comput. Aided Design (ICCAD)","author":"Javaheripi"},{"key":"ref209","article-title":"Simple, attack-agnostic defense against targeted training set attacks using cosine similarity","volume-title":"Proc. ICML Workshop Uncertainty Robustness Deep Learn.","author":"Hammoudeh"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2022.3204283"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485908"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.03.112"},{"key":"ref214","article-title":"Robust anomaly detection and backdoor attack detection via differential privacy","author":"Du","year":"2019","journal-title":"arXiv:1911.07116"},{"key":"ref215","article-title":"On the effectiveness of mitigating data poisoning attacks with gradient shaping","author":"Hong","year":"2020","journal-title":"arXiv:2002.11497"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-demos.16"},{"key":"ref217","article-title":"Backdoor vulnerabilities in normally trained deep learning models","author":"Tao","year":"2022","journal-title":"arXiv:2211.15929"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1109\/LSP.2023.3330126"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2956591"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.1360\/nso\/20220023"},{"key":"ref221","first-page":"15","article-title":"MM-BD: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic","volume-title":"Proc. IEEE Symp. Secur. Privacy (SP)","author":"Wang"},{"key":"ref222","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"ref225","first-page":"19165","article-title":"Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Souri"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01445"},{"key":"ref227","article-title":"Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection","author":"Li","year":"2022","journal-title":"arXiv:2210.00875"},{"key":"ref228","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","author":"Li","year":"2021","journal-title":"arXiv:2101.05930"},{"key":"ref229","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Li"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9414862"},{"key":"ref231","article-title":"Backdoor defense via decoupling the training process","author":"Huang","year":"2022","journal-title":"arXiv:2202.03423"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref233","article-title":"TABOR: A highly accurate approach to inspecting and restoring Trojan backdoors in AI systems","author":"Guo","year":"2019","journal-title":"arXiv:1908.01763"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58583-9_9"},{"key":"ref235","first-page":"10000","article-title":"Modeltargeted poisoning attacks with provable convergence","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Suya"},{"key":"ref236","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00144"},{"key":"ref237","first-page":"2507","article-title":"LaVAN: Localized and visible adversarial noise","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Karmon"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24450"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.3390\/app12125786"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR56361.2022.9956521"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1145\/3191789.3191799"},{"key":"ref242","doi-asserted-by":"publisher","DOI":"10.1145\/3081333.3081366"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.1109\/LSP.2023.3293429"},{"key":"ref244","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00035"},{"key":"ref245","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10096332"},{"key":"ref246","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.012.2200596"},{"key":"ref247","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.02021"},{"key":"ref248","doi-asserted-by":"publisher","DOI":"10.2196\/38440"},{"key":"ref249","article-title":"Explainability matters: Backdoor attacks on medical imaging","author":"Nwadike","year":"2020","journal-title":"arXiv:2101.00008"},{"key":"ref250","article-title":"Machine learning with electronic health records is vulnerable to backdoor trigger attacks","author":"Joe","year":"2021","journal-title":"arXiv:2106.07925"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-021-3455-1"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1109\/sp46215.2023.10179347"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00750"},{"key":"ref254","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01618"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2023.3333687"},{"key":"ref256","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9747194"},{"key":"ref257","first-page":"1415","article-title":"FLAME: Taming backdoors in federated learning","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Security)","author":"Nguyen"},{"key":"ref258","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23156"},{"key":"ref259","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2022.3192121"},{"key":"ref260","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9747653"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i10.17118"},{"key":"ref262","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.2000783"},{"key":"ref263","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i12.17291"},{"key":"ref264","doi-asserted-by":"publisher","DOI":"10.1145\/3488560.3498386"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.2000265"},{"key":"ref266","article-title":"FLIP: A provable defense framework for backdoor mitigation in federated learning","author":"Zhang","year":"2022","journal-title":"arXiv:2210.12873"},{"key":"ref267","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i10.26393"},{"key":"ref268","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i7.26083"},{"key":"ref269","article-title":"IBA: Towards irreversible backdoor attacks in federated learning","volume-title":"Proc. 37th Conf. Neural Inf. Process. Syst.","author":"Nguyen"},{"key":"ref270","article-title":"A3FL: Adversarially adaptive backdoor attacks to federated learning","volume-title":"Proc. 37th Conf. Neural Inf. Process. Syst.","author":"Zhang"},{"key":"ref271","doi-asserted-by":"publisher","DOI":"10.1145\/3539618.3591722"},{"key":"ref272","first-page":"26429","article-title":"Neurotoxin: Durable backdoors in federated learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref273","first-page":"2938","article-title":"How to backdoor federated learning","volume-title":"Proc. 23rd Int. Conf. Artif. Intell. Stat.","author":"Bagdasaryan"},{"key":"ref274","first-page":"16070","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Wang"},{"key":"ref275","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3201234"},{"key":"ref276","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2022.08.123"},{"key":"ref277","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475254"},{"key":"ref278","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref279","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"ref280","article-title":"Architectural backdoors in neural networks","author":"Bober-Irizar","year":"2022","journal-title":"arXiv:2206.07840"},{"key":"ref281","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-022-1377-5"},{"key":"ref282","first-page":"14704","article-title":"Provable defense against backdoor policies in reinforcement learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Bharti"},{"key":"ref283","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3207429"},{"key":"ref284","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/509"},{"key":"ref285","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3114024"},{"key":"ref286","doi-asserted-by":"publisher","DOI":"10.1007\/s10489-022-03882-w"},{"key":"ref287","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218663"},{"key":"ref288","article-title":"Poisoning deep reinforcement learning agents with in-distribution triggers","author":"Ashcraft","year":"2021","journal-title":"arXiv:2106.07798"},{"key":"ref289","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM48099.2022.10000751"},{"key":"ref290","article-title":"PolicyCleanse: Backdoor detection and mitigation in reinforcement learning","author":"Guo","year":"2022","journal-title":"arXiv:2202.03609"},{"key":"ref291","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833579"},{"key":"ref292","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102730"},{"key":"ref293","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102433"},{"key":"ref294","article-title":"T-miner: A generative approach to defend against Trojan attacks on DNN-based text classification","author":"Azizi","year":"2021","journal-title":"arXiv:2103.04264"},{"key":"ref295","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.659"},{"key":"ref296","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3103064"},{"key":"ref297","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.373"},{"key":"ref298","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.165"},{"key":"ref299","article-title":"TrojText: Test-time invisible textual Trojan insertion","author":"Lou","year":"2023","journal-title":"arXiv:2303.02242"},{"key":"ref300","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i4.25656"},{"key":"ref301","article-title":"TrojLLM: A black-box Trojan prompt attack on large language models","author":"Xue","year":"2023","journal-title":"arXiv:2306.06815"},{"key":"ref302","article-title":"Poisoning language models during instruction tuning","author":"Wan","year":"2023","journal-title":"arXiv:2305.00944"},{"key":"ref303","article-title":"BadGPT: Exploring security vulnerabilities of ChatGPT via backdoor attacks to InstructGPT","author":"Shi","year":"2023","journal-title":"arXiv:2304.12298"},{"key":"ref304","article-title":"Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models","author":"Chen","year":"2021","journal-title":"arXiv preprint arXiv:2110.02467"},{"key":"ref305","first-page":"37068","article-title":"BadPrompt: Backdoor attacks on continuous prompts","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Cai"},{"key":"ref306","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref307","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.431"},{"key":"ref308","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"ref309","article-title":"PaLM: Scaling language modeling with pathways","author":"Chowdhery","year":"2022","journal-title":"arXiv:2204.02311"},{"key":"ref310","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref311","article-title":"PanGu-\u03a3: Towards trillion parameter language model with sparse heterogeneous computing","author":"Ren","year":"2023","journal-title":"arXiv:2303.10845"},{"key":"ref312","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3300381"},{"key":"ref313","article-title":"A survey of large language models","author":"Xin Zhao","year":"2023","journal-title":"arXiv:2303.18223"},{"key":"ref314","doi-asserted-by":"publisher","DOI":"10.1145\/3641289"},{"key":"ref315","doi-asserted-by":"publisher","DOI":"10.1109\/ICTS58770.2023.10330833"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/10380310\/10403914.pdf?arnumber=10403914","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,13]],"date-time":"2024-03-13T17:09:08Z","timestamp":1710349748000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10403914\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":315,"URL":"https:\/\/doi.org\/10.1109\/access.2024.3355816","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}