{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T03:28:07Z","timestamp":1777865287153,"version":"3.51.4"},"reference-count":58,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62125205,U23A20303"],"award-info":[{"award-number":["62125205,U23A20303"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100018925","name":"111 Center","doi-asserted-by":"publisher","award":["B16037"],"award-info":[{"award-number":["B16037"]}],"id":[{"id":"10.13039\/501100018925","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/iccv51701.2025.00384","type":"proceedings-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:45:49Z","timestamp":1777491949000},"page":"4029-4038","source":"Crossref","is-referenced-by-count":0,"title":["SPD: Shallow Backdoor Protecting Deep Backdoor Against Backdoor Detection"],"prefix":"10.1109","author":[{"given":"Shunjie","family":"Yuan","sequence":"first","affiliation":[{"name":"School of Cyber Engineering, Xidian University,China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xinghua","family":"Li","sequence":"additional","affiliation":[{"name":"School of Cyber Engineering, Xidian University,China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuelin","family":"Cao","sequence":"additional","affiliation":[{"name":"School of Cyber Engineering, Xidian University,China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haiyan","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyber Engineering, Xidian University,China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mengyao","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Cyber Engineering, Xidian University,China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Robert H.","family":"Deng","sequence":"additional","affiliation":[{"name":"School of Information Systems, Singapore Management University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-022-00520-5"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00051"},{"key":"ref4","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","volume":"abs\/1712.05526","author":"Chen","year":"2017","journal-title":"CoRR"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02342"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.24818\/ida-ql\/2019.5"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"ref10","first-page":"18944","article-title":"Backdoor attack with imperceptible input and latent modification","volume-title":"NeurIPS","author":"Doan","year":"2021"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.02021"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00390"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3239225"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref16","article-title":"Aeva: Black-box backdoor detection using adversarial extreme value analysis","volume-title":"ICLR","author":"Guo","year":"2022"},{"key":"ref17","article-title":"Scale-up: An efficient black-box inputlevel backdoor detection via analyzing scaled prediction consistency","volume-title":"ICLR","author":"Guo","year":"2023"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref19","article-title":"Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consistency","volume-title":"ICML","author":"Hou","year":"2024"},{"key":"ref20","article-title":"Backdoor defense via decoupling the training process","volume-title":"ICLR","author":"Huang","year":"2022"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00069"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00786"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref24","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"NeurIPS","author":"Li","year":"2021"},{"key":"ref25","first-page":"19837","article-title":"Reconstructive neuron pruning for backdoor defense","volume-title":"ICML","author":"Li","year":"2023"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00107"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01570"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560678"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.3012034"},{"key":"ref32","article-title":"Wanet-imperceptible warping-based backdoor attack","volume-title":"ICLR","author":"Nguyen","year":"2021"},{"key":"ref33","article-title":"Nguyen and Anh Tran. Input-aware dynamic backdoor attack","volume-title":"NeurIPS","author":"Anh","year":"2020"},{"key":"ref34","article-title":"Revisiting the assumption of latent separability for backdoor defenses","volume-title":"ICLR","author":"Qi","year":"2023"},{"key":"ref35","first-page":"1685","article-title":"Towards a proactive ml approach for detecting backdoor poison samples","volume-title":"USENIX Security","author":"Qi","year":"2023"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00049"},{"key":"ref39","volume-title":"Label-consistent backdoor attacks","author":"Turner","year":"2019"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00015"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19778-9_23"},{"key":"ref44","article-title":"Rethinking the reverse-engineering of trojan triggers","volume-title":"NeurIPS","author":"Wang","year":"2022"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01465"},{"key":"ref46","article-title":"Unicorn: A unified backdoor trigger inversion framework","volume-title":"ICLR","author":"Wang","year":"2023"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1126"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00614"},{"key":"ref49","first-page":"10546","article-title":"Backdoorbench: A comprehensive benchmark of backdoor learning","volume-title":"NeurIPS","author":"Wu","year":"2022"},{"key":"ref50","first-page":"16913","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume-title":"NeurIPS","author":"Wu","year":"2021"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10096034"},{"key":"ref52","article-title":"Towards reliable and efficient backdoor trigger inversion via decoupling benign features","volume-title":"ICLR","author":"Xu","year":"2024"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01210"},{"key":"ref54","article-title":"Adversarial unlearning of backdoors via implicit hypergradient","volume-title":"ICLR","author":"Zeng","year":"2022"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01177"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i3.20259"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01478"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00412"}],"event":{"name":"2025 IEEE\/CVF International Conference on Computer Vision (ICCV)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,25]]}},"container-title":["2025 IEEE\/CVF International Conference on Computer Vision (ICCV)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11443115\/11443287\/11444264.pdf?arnumber=11444264","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T06:11:27Z","timestamp":1777529487000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11444264\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":58,"URL":"https:\/\/doi.org\/10.1109\/iccv51701.2025.00384","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}