{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T15:57:36Z","timestamp":1780502256972,"version":"3.54.1"},"reference-count":69,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179375","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"755-772","source":"Crossref","is-referenced-by-count":25,"title":["Redeem Myself: Purifying Backdoors in Deep Learning Models using Self Attention Distillation"],"prefix":"10.1109","author":[{"given":"Xueluan","family":"Gong","sequence":"first","affiliation":[{"name":"Wuhan University,School of Computer Science,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanjiao","family":"Chen","sequence":"additional","affiliation":[{"name":"Zhejiang University,College of Electrical Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wang","family":"Yang","sequence":"additional","affiliation":[{"name":"Wuhan University,School of Cyber Science and Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qian","family":"Wang","sequence":"additional","affiliation":[{"name":"Wuhan University,School of Cyber Science and Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuzhe","family":"Gu","sequence":"additional","affiliation":[{"name":"Wuhan University,School of Cyber Science and Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Huayang","family":"Huang","sequence":"additional","affiliation":[{"name":"Wuhan University,School of Cyber Science and Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chao","family":"Shen","sequence":"additional","affiliation":[{"name":"Xi’an Jiaotong University,School of Cyber Science and Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"2938","article-title":"How to backdoor federated learning","volume-title":"International Conference on Artificial Intelligence and Statistics","author":"Bagdasaryan"},{"key":"ref2","article-title":"End to end learning for self-driving cars","author":"Bojarski","year":"2016"},{"key":"ref3","article-title":"Language models are few-shot learners","author":"Brown","year":"2020"},{"key":"ref4","article-title":"How to configure the learning rate when training deep learning neural networks","volume":"23","author":"Brownlee","year":"2019","journal-title":"Machine Learning Mastery"},{"key":"ref5","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"Chen","year":"2018"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref7","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.1900577"},{"key":"ref9","article-title":"Sentinet: Detecting physical attacks against deep learning systems","author":"Chou","year":"2018"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2211477"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref13","article-title":"Imagenette: A smaller subset of 10 easily classified classes from imagenet"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref15","article-title":"Loss surfaces, mode connectivity, and fast ensembling of DNNs","volume":"31","author":"Garipov","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475254"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24012"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2021.3087237"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref21","article-title":"Distilling the knowledge in a neural network","author":"Hinton","year":"2015"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00110"},{"key":"ref23","article-title":"NeuronInspect: Detecting backdoors in neural networks via output explanations","author":"Huang","year":"2019"},{"key":"ref24","article-title":"Densenet: Implementing efficient convnet descriptor pyramids","author":"Iandola","year":"2014"},{"key":"ref25","article-title":"Squeezenet: Alexnet-level accuracy with 50x fewer parameters and\u00a1 0.5 mb model size","author":"Iandola","year":"2016"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243757"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2017.8228656"},{"key":"ref28","article-title":"Paying more attention to attention: improving the performance of convolutional neural networks via attention transfer","volume-title":"International Conference on Learning Representations","author":"Komodakis"},{"key":"ref29","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref31","article-title":"Invisible backdoor attacks on deep neural networks via steganography and regularization","author":"Li","year":"2019"},{"key":"ref32","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","volume-title":"International Conference on Learning Representations","author":"Li"},{"key":"ref33","article-title":"Rethinking the trigger of backdoor attack","author":"Li","year":"2020"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref35","article-title":"Backdoor embedding in convolutional neural network models via invisible perturbation","author":"Liao","year":"2018"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref38","article-title":"Backdoor attacks and defenses in feature-partitioned collaborative learning","author":"Liu","year":"2020"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475290"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5963"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243855"},{"key":"ref44","article-title":"Input-aware dynamic backdoor attack","volume-title":"Annual Conference on Neural Information Processing Systems","author":"Nguyen"},{"key":"ref45","article-title":"Wanet\u2013imperceptible warping-based backdoor attack","volume-title":"International Conference on Learning Representations","author":"Nguyen"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00409"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.41"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2019.2928494"},{"key":"ref50","article-title":"Fitnets: Hints for thin deep nets","author":"Romero","year":"2014"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref52","article-title":"Dynamic backdoor attacks against machine learning models","author":"Salem","year":"2020"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3209978.3209996"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref56","article-title":"Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection","volume-title":"USENIX Security Symposium","author":"Tang"},{"key":"ref57","first-page":"8000","article-title":"Spectral signatures in backdoor attacks","volume-title":"Advances in Neural Information Processing Systems","author":"Tran","year":"2018"},{"key":"ref58","article-title":"Model agnostic defence against backdoor attacks in machine learning","author":"Udeshi","year":"2019"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref60","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","volume-title":"Annual Conference on Neural Information Processing Systems","author":"Wang"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2020.3000900"},{"key":"ref62","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume-title":"Advances in Neural Information Processing Systems","author":"Wu","year":"2021"},{"key":"ref63","article-title":"Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking","volume-title":"30th USENIX Security Symposium","author":"Xiang"},{"key":"ref64","article-title":"DBA: Distributed backdoor attacks against federated learning","volume-title":"International Conference on Learning Representations","author":"Xie"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1117\/12.2558255"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00716"},{"key":"ref69","article-title":"Bridging mode connectivity in loss landscapes and adversarial robustness","volume-title":"International Conference on Learning Representations","author":"Zhao"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179375.pdf?arnumber=10179375","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:14:39Z","timestamp":1721452479000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179375\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":69,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179375","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}