{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T02:30:42Z","timestamp":1775788242262,"version":"3.50.1"},"reference-count":74,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100016311","name":"Arm","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100016311","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833644","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"2043-2059","source":"Crossref","is-referenced-by-count":114,"title":["BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning"],"prefix":"10.1109","author":[{"given":"Jinyuan","family":"Jia","sequence":"first","affiliation":[{"name":"Duke University"}]},{"given":"Yupei","family":"Liu","sequence":"additional","affiliation":[{"name":"Duke University"}]},{"given":"Neil Zhenqiang","family":"Gong","sequence":"additional","affiliation":[{"name":"Duke University"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Bert: Pre-training of deep bidirectional transformers for language understanding","volume-title":"NAACL","author":"Devlin"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2006.100"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00975"},{"key":"ref4","article-title":"A simple framework for contrastive learning of visual representations","volume-title":"ICML","author":"Chen"},{"key":"ref5","article-title":"Learning deep representations by mutual information estimation and maximization","volume-title":"ICLR","author":"Hjelm"},{"key":"ref6","article-title":"Bootstrap your own latent: A new approach to self-supervised learning","volume-title":"NeurIPS","author":"Grill"},{"key":"ref7","article-title":"Learning transferable visual models from natural language supervision","author":"Radford","year":"2021","journal-title":"arXiv"},{"key":"ref8","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"IEEE Access"},{"key":"ref9","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv preprint arXiv:1712.05526"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref11","article-title":"Blind backdoors in deep learning models","author":"Bagdasaryan","year":"2021","journal-title":"Usenix Security"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref15","article-title":"Patchguard: Provable defense against adversarial patches using masks on small receptive fields","author":"Xiang","year":"2021","journal-title":"Usenix Security"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.278"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46466-4_5"},{"key":"ref18","article-title":"Multimodal learning with deep boltzmann machines","volume-title":"NeurIPS","author":"Srivastava"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46478-7_5"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/2812802"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6795"},{"key":"ref22","article-title":"Learning multiple layers of features from tiny images","volume-title":"Tech Report","author":"Krizhevsky","year":"2009"},{"key":"ref23","article-title":"An analysis of single-layer networks in unsupervised feature learning","volume-title":"AIS-TATS","author":"Coates"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.2118\/18761-MS"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10599-4_29"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref28","article-title":"SimCLR"},{"key":"ref29","article-title":"SimCLR PyTorch"},{"key":"ref30","article-title":"LBA"},{"key":"ref31","article-title":"CLIP"},{"key":"ref32","article-title":"Spectral signatures in backdoor attacks","volume-title":"NeurIPS","author":"Tran"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref37","article-title":"Certified defenses for adversarial patches","volume-title":"ICLR","author":"Chiang"},{"key":"ref38","article-title":"(de) randomized smoothing for certifiable defense against patch attacks","volume-title":"NeurIPS","author":"Levine"},{"key":"ref39","article-title":"Efficient certified defenses against patch attacks on image classifiers","volume-title":"ICLR","author":"Metzen"},{"key":"ref40","article-title":"On certifying robustness against backdoor attacks via randomized smoothing","volume-title":"CVPR 2020 Workshop on Adversarial Machine Learning in Computer Vision","author":"Wang"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463560"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref43","article-title":"MNTD"},{"key":"ref44","article-title":"PatchGuard"},{"key":"ref45","article-title":"Improving language understanding by generative pre-training","author":"Radford","year":"2018"},{"issue":"8","key":"ref46","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI blog"},{"key":"ref47","article-title":"Language models are few-shot learners","author":"Brown","year":"2020","journal-title":"Arxiv:2005.14165"},{"key":"ref48","article-title":"Xlnet: Generalized autoregressive pretraining for language understanding","volume-title":"NeurIPS","author":"Yang"},{"key":"ref49","article-title":"Strategies for pre-training graph neural networks","volume-title":"ICLR","author":"Hu"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403168"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref52","article-title":"How to backdoor federated learning","volume-title":"AISTATS","author":"Bagdasaryan"},{"key":"ref53","article-title":"Graph backdoor","author":"Xi","year":"2021","journal-title":"Usenix Security"},{"key":"ref54","article-title":"Backdoor embedding in convolutional neural network models via invisible perturbation","volume-title":"CODASPY","author":"Liao"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref56","article-title":"Label-consistent backdoor attacks","author":"Turner","year":"2019","journal-title":"arXiv preprint arXiv:1912.02771"},{"key":"ref57","article-title":"Invisible backdoor attacks against deep neural networks","author":"Li","year":"2019","journal-title":"arXiv preprint arXiv:1909.02742"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00019"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00049"},{"key":"ref61","article-title":"Poisoning and backdooring contrastive learning","author":"Carlini","year":"2021","journal-title":"arXiv preprint arXiv:2106.09667"},{"key":"ref62","article-title":"Badnl: Backdoor attacks against nlp models","author":"Chen","year":"2020","journal-title":"arXiv preprint arXiv:2006.01043"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00022"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2017.8228656"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243757"},{"key":"ref66","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","volume-title":"NeurIPS","author":"Shafahi"},{"key":"ref67","article-title":"Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems","author":"Guo","year":"2019","journal-title":"arXiv preprint arXiv:1908.01763"},{"key":"ref68","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","volume-title":"AAAI","author":"Chen"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref70","article-title":"Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection","author":"Tang","year":"2021","journal-title":"Usenix Security"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179451"},{"key":"ref73","article-title":"Certified robustness of nearest neighbors against data poisoning attacks","author":"Jia","year":"2020","journal-title":"arXiv preprint arXiv:2012.03765"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16971"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833644.pdf?arnumber=9833644","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,12]],"date-time":"2024-01-12T01:55:00Z","timestamp":1705024500000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833644\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":74,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833644","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}