{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T16:39:01Z","timestamp":1783183141892,"version":"3.54.6"},"reference-count":96,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179347","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"719-736","source":"Crossref","is-referenced-by-count":24,"title":["Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers"],"prefix":"10.1109","author":[{"given":"Limin","family":"Yang","sequence":"first","affiliation":[{"name":"University of Illinois at Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhi","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Illinois at Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jacopo","family":"Cortellazzi","sequence":"additional","affiliation":[{"name":"King’s College London"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Feargus","family":"Pendlebury","sequence":"additional","affiliation":[{"name":"University College London"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kevin","family":"Tu","sequence":"additional","affiliation":[{"name":"University of Illinois at Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fabio","family":"Pierazzi","sequence":"additional","affiliation":[{"name":"King’s College London"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lorenzo","family":"Cavallaro","sequence":"additional","affiliation":[{"name":"University College London"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gang","family":"Wang","sequence":"additional","affiliation":[{"name":"University of Illinois at Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Kaspersky lab report: Iot malware grew three-fold in h1 2018","year":"2018"},{"key":"ref2","volume-title":"Avast: Ai and machine learning","year":"2022"},{"key":"ref3","volume-title":"Ai-driven edr.","year":"2022"},{"key":"ref4","volume-title":"Strip implementation","year":"2022"},{"key":"ref5","volume-title":"Deep instinct","year":"2022"},{"key":"ref6","volume-title":"Explanation guided backdoor implementation","year":"2022"},{"key":"ref7","volume-title":"Virustotal","year":"2022"},{"key":"ref8","volume-title":"Supplementary materials","year":"2023"},{"key":"ref9","doi-asserted-by":"crossref","DOI":"10.1145\/2901739.2903508","article-title":"Androzoo: Collecting millions of android apps for the research community","author":"Allix","year":"2016","journal-title":"MSR"},{"key":"ref10","article-title":"Ember: an open dataset for training static pe malware machine learning models","author":"Anderson","year":"2018"},{"key":"ref11","article-title":"Learning to evade static pe machine learning malware models via reinforcement learning","author":"Anderson","year":"2018"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594299"},{"key":"ref14","article-title":"T-miner: A generative approach to defend against trojan attacks on dnn-based text classification","author":"Azizi","year":"2021","journal-title":"USENIX Security"},{"key":"ref15","article-title":"Blind backdoors in deep learning models","author":"Bagdasaryan","year":"2021","journal-title":"USENIX Security"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833572"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"ref18","article-title":"De-anonymizing programmers via code stylometry","author":"Caliskan-Islam","year":"2015","journal-title":"USENIX Security"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2885512"},{"key":"ref20","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","volume-title":"AAAI Workshop","author":"Chen"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00762"},{"key":"ref23","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017"},{"key":"ref24","article-title":"Badnl: Backdoor attacks against nlp models","author":"Chen","year":"2021","journal-title":"ICML"},{"key":"ref25","article-title":"On training robust PDF malware classifiers","author":"Chen","year":"2020","journal-title":"USENIX Security"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2017.2700270"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref30","article-title":"Backdoor attack with imperceptible input and latent modification","author":"Doan","year":"2021","journal-title":"NeurIPS"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3141077"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref34","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2019","journal-title":"IEEE Access"},{"key":"ref35","article-title":"Trojannet: Embedding hidden trojan horse models in neural networks","author":"Guo","year":"2020"},{"key":"ref36","article-title":"Sorel-20m: A large scale benchmark dataset for malicious pe detection","author":"Harang","year":"2020"},{"key":"ref37","article-title":"Spectre: Defending against backdoor attacks using robust statistics","author":"Hayase","year":"2021","journal-title":"ICML"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58583-9_20"},{"key":"ref39","article-title":"Neuroninspect: Detecting backdoors in neural networks via output explanations","author":"Huang","year":"2019"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2017.57"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485368"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"ref43","article-title":"Malwareguard: Fireeye\u2019s machine learning model to detect and prevent malware","author":"Johns","year":"2018"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485355"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3374664.3375741"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.02.003"},{"key":"ref48","article-title":"Backdoor attack on machine learning based android malware detectors","author":"Li","year":"2021","journal-title":"IEEE TDSC"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450044"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref51","article-title":"Anti-backdoor learning: Training clean models on poisoned data","author":"Li","year":"2021","journal-title":"NeurIPS"},{"key":"ref52","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","author":"Li","year":"2021","journal-title":"ICLR"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833579"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01458"},{"key":"ref59","article-title":"A unified approach to interpreting model predictions","author":"Lundberg","year":"2017","journal-title":"NeurIPS"},{"key":"ref60","article-title":"Input-aware dynamic backdoor attack","author":"Nguyen","year":"2020","journal-title":"NeurIPS"},{"key":"ref61","article-title":"Wanet\u2013imperceptible warping-based backdoor attack","author":"Nguyen","year":"2020","journal-title":"ICLR"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417253"},{"key":"ref63","article-title":"Trojanzoo: Everything you ever wanted to know about neural backdoors (but were afraid to ask)","author":"Pang","year":"2022","journal-title":"Euro S&P"},{"key":"ref64","article-title":"TESSERACT: Eliminating experimental bias in malware classification across space and time","author":"Pendlebury","year":"2019","journal-title":"USENIX Security"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00073"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3411508.3421372"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.3390\/s21165671"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_23"},{"key":"ref70","article-title":"Certified robustness to label-flipping attacks via randomized smoothing","author":"Rosenfeld","year":"2020","journal-title":"ICML"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/eurosp53844.2022.00049"},{"key":"ref72","article-title":"Explanation-guided backdoor poisoning attacks against malware classifiers","author":"Severi","year":"2021","journal-title":"USENIX Security"},{"key":"ref73","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","author":"Shafahi","year":"2018","journal-title":"NeurIPS"},{"key":"ref74","article-title":"Backdoor scanning for deep neural networks through k-arm optimization","author":"Shen","year":"2021","journal-title":"ICML"},{"key":"ref75","article-title":"Manipulating sgd with data ordering attacks","author":"Shumailov","year":"2021","journal-title":"NeurIPS"},{"key":"ref76","article-title":"When does machine learning FAIL? Generalized transferability for evasion and poisoning attacks","author":"Suciu","year":"2018","journal-title":"USENIX Security"},{"key":"ref77","article-title":"Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection","author":"Tang","year":"2021","journal-title":"USENIX Security"},{"key":"ref78","article-title":"Spectral signatures in backdoor attacks","author":"Tran","year":"2018","journal-title":"NeurIPS"},{"key":"ref79","article-title":"Clean-label backdoor attacks","author":"Turner","year":"2018","journal-title":"Technical Report"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1221"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref82","article-title":"On certifying robustness against backdoor attacks via randomized smoothing","volume-title":"CVPR Workshop","author":"Wang"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01465"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/sp46215.2023.10179451"},{"key":"ref85","article-title":"Adversarial neuron pruning purifies backdoored deep models","author":"Wu","year":"2021","journal-title":"NeurIPS"},{"key":"ref86","article-title":"Post-training detection of backdoor attacks for two-class and multi-attack scenarios","author":"Xiang","year":"2022","journal-title":"ICLR"},{"key":"ref87","article-title":"DBA: Distributed backdoor attacks against federated learning","author":"Xie","year":"2020","journal-title":"ICLR"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00040"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref92","article-title":"Adversarial unlearning of backdoors via implicit hypergradient","author":"Zeng","year":"2022","journal-title":"ICLR"},{"key":"ref93","article-title":"Bridging mode connectivity in loss landscapes and adversarial robustness","author":"Zhao","year":"2020","journal-title":"ICLR"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01478"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_11"},{"key":"ref96","article-title":"Transferable clean-label poisoning attacks on deep neural nets","author":"Zhu","year":"2019","journal-title":"ICML"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179347.pdf?arnumber=10179347","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:17:05Z","timestamp":1721452625000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179347\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":96,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179347","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}