{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T17:30:39Z","timestamp":1783791039309,"version":"3.55.0"},"reference-count":100,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272486"],"award-info":[{"award-number":["62272486"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Changsha Municipal Natural Science Foundation","award":["kq2208283"],"award-info":[{"award-number":["kq2208283"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Open J. Comput. Soc."],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/ojcs.2023.3267221","type":"journal-article","created":{"date-parts":[[2023,4,14]],"date-time":"2023-04-14T17:34:55Z","timestamp":1681493695000},"page":"134-146","source":"Crossref","is-referenced-by-count":32,"title":["Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey"],"prefix":"10.1109","volume":"4","author":[{"given":"Yudong","family":"Li","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5351-7239","authenticated-orcid":false,"given":"Shigeng","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5255-5639","authenticated-orcid":false,"given":"Weiping","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1677-425X","authenticated-orcid":false,"given":"Hong","family":"Song","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3164073"},{"key":"ref56","article-title":"Subnet replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting","author":"qi","year":"2021","journal-title":"CoRR"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"ref58","first-page":"18021","article-title":"Manipulating SGD with data ordering attacks","volume":"34","author":"shumailov","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412130"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403064"},{"key":"ref54","article-title":"How to inject backdoors with better consistency: Logit anchoring on clean data","author":"zhang","year":"0","journal-title":"Proc 10th Int Conf Learn Representations"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/IJCB48548.2020.9304875"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102726"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00614"},{"key":"ref45","article-title":"Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch","author":"souri","year":"2021","journal-title":"CoRR"},{"key":"ref48","first-page":"1505","article-title":"Blind backdoors in deep learning models","author":"bagdasaryan","year":"0","journal-title":"Proc 30th USENIX Secur Symp"},{"key":"ref47","first-page":"2938","article-title":"How to backdoor federated learning","author":"bagdasaryan","year":"0","journal-title":"Proc Int Conf Artif Intell Statist"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01465"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3201472"},{"key":"ref44","article-title":"Weight poisoning attacks on pre-trained models","author":"kurita","year":"2020","journal-title":"CoRR"},{"key":"ref43","article-title":"Check your other door! establishing backdoor attacks in the frequency domain","author":"hammoud","year":"2021","journal-title":"CoRR"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/RO-MAN53752.2022.9900872"},{"key":"ref7","first-page":"19","article-title":"The Higgs boson machine learning challenge","author":"adam-bourdarios","year":"0","journal-title":"Proc NIPS Workshop High-Energy Phys Mach Learn"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1126\/science.1254806"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390177"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.312"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1038\/nature12346"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1021\/ci500747n"},{"key":"ref100","article-title":"Defending label inference and backdoor attacks in vertical federated learning","author":"liu","year":"2021","journal-title":"CoRR"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"ref34","first-page":"2088","article-title":"Invisible backdoor attacks on deep neural networks via steganography and regularization","volume":"18","author":"li","year":"2021","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01478"},{"key":"ref36","first-page":"18944","article-title":"Backdoor attack with imperceptible input and latent modification","volume":"34","author":"doan","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.41"},{"key":"ref33","article-title":"Label-consistent backdoor attacks","author":"turner","year":"2019","journal-title":"CoRR"},{"key":"ref32","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"chen","year":"2017","journal-title":"CoRR"},{"key":"ref39","article-title":"WaNet–imperceptible warping-based backdoor attack","author":"nguyen","year":"0","journal-title":"Proc 9th Int Conf Learn Representations"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3161477"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2009.5459250"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2011.5995566"},{"key":"ref26","article-title":"Labeled faces in the wild: A database forstudying face recognition in unconstrained environments","author":"huang","year":"0","journal-title":"Proc Workshop Faces ‘Real-Life’ Images Detection Alignment Recognit"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/FG.2018.00020"},{"key":"ref20","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2011.6033395"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref28","article-title":"Reading digits in natural images with unsupervised feature learning","author":"netzer","year":"0","journal-title":"Proc NeurIPS Workshop"},{"key":"ref27","article-title":"Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms","author":"xiao","year":"2017","journal-title":"CoRR"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2012.2209421"},{"key":"ref13","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"gu","year":"2017","journal-title":"CoRR"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3182979"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2021.3057071"},{"key":"ref97","article-title":"DBA: Distributed backdoor attacks against federated learning","author":"xie","year":"0","journal-title":"Proc 8th Int Conf Learn Representations"},{"key":"ref96","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","author":"bhagoji","year":"0","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref11","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"0","journal-title":"Proc 2nd Int Conf Learn Representations"},{"key":"ref99","article-title":"Backdoor attacks and defenses in feature-partitioned collaborative learning","author":"liu","year":"2020","journal-title":"CoRR"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/11856214_5"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/3523062"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-98795-4_13"},{"key":"ref16","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"gao","year":"2020"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00500"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/509"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218663"},{"key":"ref95","article-title":"Can you hear it? backdoor attacks via ultrasonic triggers","author":"koffas","year":"0","journal-title":"Proc 2022 ACM Workshop Wireless Secur Mach Learn"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413468"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01618"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00750"},{"key":"ref89","article-title":"Poisoning morphnet for clean-label backdoor attack to point clouds","author":"tian","year":"2021","journal-title":"CoRR"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.165"},{"key":"ref88","article-title":"Dyn-backdoor: Backdoor attack on dynamic link prediction","author":"chen","year":"2021","journal-title":"CoRR"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463560"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.431"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00068"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/206"},{"key":"ref77","article-title":"Trigger hunting with a topological prior for trojan detection","author":"hu","year":"0","journal-title":"Proc 10th Int Conf Learn Representations"},{"key":"ref76","first-page":"14004","article-title":"Defending neural backdoors via generative distribution modeling","author":"qiao","year":"0","journal-title":"Proc Adv Neural Inf Process Syst 32 Annu Conf Neural Inf Process Syst 2019 NeurIPS 2019"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref70","article-title":"Adversarial unlearning of backdoors via implicit hypergradient","author":"zeng","year":"0","journal-title":"Proc 10th Int Conf Learn Representations"},{"key":"ref73","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","author":"li","year":"0","journal-title":"Proc 9th Int Conf Learn Representations"},{"key":"ref72","first-page":"17258","article-title":"Topological detection of trojaned neural networks","volume":"34","author":"zheng","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref68","article-title":"Neuroninspect: Detecting backdoors in neural networks via output explanations","author":"huang","year":"2019","journal-title":"CoRR"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1611835114"},{"key":"ref64","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","volume":"2301","author":"chen","year":"0","journal-title":"Proc Workshop Artif Intell Safety 2019 30th AAAI Conf Artif Intell"},{"key":"ref63","first-page":"8011","article-title":"Spectral signatures in backdoor attacks","author":"tran","year":"0","journal-title":"Proc 32nd Int Conf Neural Inf Process Syst"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2022.3159784"},{"key":"ref61","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","author":"cohen","year":"0","journal-title":"Proc Int Conf Mach Learn"}],"container-title":["IEEE Open Journal of the Computer Society"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8782664\/10016900\/10102775.pdf?arnumber=10102775","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,6,26]],"date-time":"2023-06-26T18:58:49Z","timestamp":1687805929000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10102775\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":100,"URL":"https:\/\/doi.org\/10.1109\/ojcs.2023.3267221","relation":{},"ISSN":["2644-1268"],"issn-type":[{"value":"2644-1268","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}