{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T10:21:22Z","timestamp":1777890082808,"version":"3.51.4"},"reference-count":81,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/iccv51701.2025.00212","type":"proceedings-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:45:49Z","timestamp":1777491949000},"page":"2195-2205","source":"Crossref","is-referenced-by-count":0,"title":["Prototype Guided Backdoor Defense via Activation Space Manipulation"],"prefix":"10.1109","author":[{"given":"Venkat Adithya","family":"Amula","sequence":"first","affiliation":[{"name":"IIIT Hyderabad,India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sunayana","family":"Samavedam","sequence":"additional","affiliation":[{"name":"IIIT Hyderabad,India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Saurabh","family":"Saini","sequence":"additional","affiliation":[{"name":"IIIT Hyderabad,India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Avani","family":"Gupta","sequence":"additional","affiliation":[{"name":"IIIT Hyderabad,India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"P J","family":"Narayanan","sequence":"additional","affiliation":[{"name":"IIIT Hyderabad,India"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-21557-5_37"},{"key":"ref3","article-title":"Concept-level debugging of part-prototype networks","author":"Bontempelli","year":"2022","journal-title":"arXiv preprint"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9414862"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00951"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i5.25736"},{"key":"ref7","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"Chen","year":"2018","journal-title":"arXiv preprint"},{"key":"ref8","article-title":"On instahide, phase retrieval, and sparse matrix factorization","volume-title":"9th International Conference on Learning Representations, ICLR. OpenReview.net","author":"Chen","year":"2021"},{"key":"ref9","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"ArXiv"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1777"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3585385"},{"key":"ref14","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proceedings of the 36th International Conference on Machine Learning. PMLR","author":"Cohen","year":"2019"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2024.112390"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/BIOSIG52210.2021.9548293"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01569"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/tpami.2022.3162397"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM50108.2020.00025"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2783"},{"key":"ref23","article-title":"Spectre: defending against backdoor attacks using robust statistics","volume-title":"Proceedings of the 38th International Conference on Machine Learning","author":"Hayase","year":"2021"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3393527.3393567"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"ref26","article-title":"Deepobliviate: A powerful charm for erasing data residual memory in deep neural networks","author":"He","year":"2021","journal-title":"ArXiv"},{"key":"ref27","article-title":"Trigger hunting with a topological prior for trojan detection","author":"Hu","year":"2021","journal-title":"arXiv preprint"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16971"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00999"},{"key":"ref30","article-title":"Interpretability beyond feature attribution: Quantitative testing with concept activation vectors (tcav)","volume-title":"Proceedings of Machine Learning Research","author":"Kim","year":"2018"},{"key":"ref31","article-title":"Concept bottleneck models. In International conference on machine learning","volume-title":"PMLR","author":"Koh","year":"2020"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref33","volume-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"issue":"7","key":"ref34","article-title":"Tiny imagenet visual recognition challenge","volume":"7","author":"Le","year":"2015","journal-title":"CS 231N"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00403"},{"key":"ref36","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","author":"Li","year":"2021","journal-title":"ArXiv"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref38","article-title":"Anti-backdoor learning: Training clean models on poisoned data","author":"Li","year":"2021","journal-title":"NeurIPS"},{"key":"ref39","article-title":"Reconstructive neuron pruning for backdoor defense","volume-title":"Proceedings of the 40th International Conference on Machine Learning. PMLR","author":"Li","year":"2023"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796974"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.52202\/075280-3290"},{"key":"ref44","article-title":"Input-aware dynamic backdoor attack","volume":"33","author":"Nguyen","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref45","article-title":"Wanet - imperceptible warping-based backdoor attack","volume-title":"International Conference on Learning Representations","author":"Nguyen","year":"2021"},{"key":"ref46","volume-title":"Dinov2: Learning robust visual features without supervision","author":"Oquab"},{"key":"ref47","volume-title":"Automatic differentiation in pytorch","author":"Paszke","year":"2017"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-13453-2_1"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01298"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00049"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TBIOM.2021.3132132"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-025-02474-8"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1393"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-020-04831-9"},{"key":"ref57","article-title":"An embarrassingly simple approach for trojan attack in deep neural networks. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining","volume-title":"Association for Computing Machinery","author":"Tang","year":"2020"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01301"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01178"},{"key":"ref60","article-title":"Spectral signatures in backdoor attacks","author":"Tran","year":"2018","journal-title":"Neural Information Processing Systems"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/3DV57658.2022.00056"},{"issue":"86","key":"ref62","article-title":"Visualizing data using t -sne","volume":"9","author":"van der Maaten","year":"2008","journal-title":"Journal of Machine Learning Research"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/509"},{"key":"ref65","article-title":"Improved certified defenses against data poisoning with (Deterministic) finite aggregation","volume-title":"Proceedings of the 39th International Conference on Machine Learning. PMLR","author":"Wang","year":"2022"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51701.2025.00425"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00614"},{"key":"ref68","article-title":"Backdoorbench: A comprehensive benchmark of backdoor learning","volume-title":"Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track","author":"Wu","year":"2022"},{"key":"ref69","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume-title":"Advances in Neural Information Processing Systems","author":"Wu","year":"2021"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3161477"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.3041202"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102280"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.52202\/075280-0219"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612415"},{"key":"ref77","volume-title":"Adversarial unlearning of backdoors via implicit hypergradient","author":"Zeng","year":"2021"},{"key":"ref78","article-title":"Towards robustness certification against universal perturbations. In International Conference on Learning Representation","volume-title":"ICLR","author":"Zeng","year":"2023"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_11"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413546"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00412"}],"event":{"name":"2025 IEEE\/CVF International Conference on Computer Vision (ICCV)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,25]]}},"container-title":["2025 IEEE\/CVF International Conference on Computer Vision (ICCV)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11443115\/11443287\/11444012.pdf?arnumber=11444012","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T05:29:01Z","timestamp":1777613341000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11444012\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":81,"URL":"https:\/\/doi.org\/10.1109\/iccv51701.2025.00212","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}