{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,2]],"date-time":"2026-01-02T07:40:52Z","timestamp":1767339652723,"version":"build-2065373602"},"reference-count":81,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,21]],"date-time":"2023-05-21T00:00:00Z","timestamp":1684627200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,21]],"date-time":"2023-05-21T00:00:00Z","timestamp":1684627200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5,21]]},"DOI":"10.1109\/sp46215.2023.10351028","type":"proceedings-article","created":{"date-parts":[[2023,12,11]],"date-time":"2023-12-11T19:01:53Z","timestamp":1702321313000},"page":"1-19","source":"Crossref","is-referenced-by-count":10,"title":["Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Models"],"prefix":"10.1109","author":[{"given":"Rui","family":"Zhu","sequence":"first","affiliation":[{"name":"Indiana University Bloomington"}]},{"given":"Di","family":"Tang","sequence":"additional","affiliation":[{"name":"Indiana University Bloomington"}]},{"given":"Siyuan","family":"Tang","sequence":"additional","affiliation":[{"name":"Indiana University Bloomington"}]},{"given":"XiaoFeng","family":"Wang","sequence":"additional","affiliation":[{"name":"Indiana University Bloomington"}]},{"given":"Haixu","family":"Tang","sequence":"additional","affiliation":[{"name":"Indiana University Bloomington"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Papers with code - the latest in machine learning"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102277"},{"key":"ref3","first-page":"32","article-title":"On exact computation with an infinitely wide neural net","author":"Arora","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"article-title":"Generalisation guarantees for continual learning with orthogonal gradient descent","year":"2020","author":"Bennani","key":"ref4"},{"article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","year":"2018","author":"Chen","key":"ref5"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"article-title":"On lazy training in differentiable programming","year":"2018","author":"Chizat","key":"ref7"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/W14-4012"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/n19\u20131423"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"ref12","first-page":"1072","article-title":"A theoretical analysis of catastrophic forgetting through the ntk overlap matrix","volume-title":"International Conference on Artificial Intelligence and Statistics","author":"Doan"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01617"},{"key":"ref14","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"Gao","year":"2020","journal-title":"CoRR"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412130"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"article-title":"Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems","year":"2019","author":"Guo","key":"ref19"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM50108.2020.00025"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.3115\/1614049.1614064"},{"article-title":"Overcoming catastrophic forgetting for continual learning via model adaptation","volume-title":"International Conference on Learning Representations","author":"Hu","key":"ref24"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"article-title":"Top: Backdoor detection in neural networks via transferability of perturbation","year":"2021","author":"Huster","key":"ref26"},{"journal-title":"Squeezenet: Alexnet-level accuracy with 50x fewer parameters and <1mb model size","year":"2016","author":"Iandola","key":"ref27"},{"key":"ref28","article-title":"Trojai competition"},{"key":"ref29","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","volume-title":"Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019","author":"Ilyas"},{"key":"ref30","first-page":"31","article-title":"Neural tangent kernel: Convergence and generalization in neural networks","author":"Jacot","year":"2018","journal-title":"Advances in neural information processing systems"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref32","first-page":"1937","article-title":"Entangled watermarks as a defense against model extraction","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Jia"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11651"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1611835114"},{"key":"ref35","first-page":"3519","article-title":"Similarity of neural network representations revisited","volume-title":"International Conference on Machine Learning","author":"Kornblith"},{"article-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"ref36"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","volume-title":"9th International Conference on Learning Representations, ICLR 2021, Virtual Event","author":"Li","key":"ref38"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref43","article-title":"Roberta: A robustly optimized BERT pretraining approach","author":"Liu","year":"2019","journal-title":"CoRR"},{"key":"ref44","article-title":"Roberta: A robustly optimized BERT pretraining approach","author":"Liu","year":"2019","journal-title":"CoRR"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.5555\/2002472.2002491"},{"article-title":"Variational continual learning","year":"2017","author":"Nguyen","key":"ref47"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1018"},{"key":"ref49","article-title":"TROJANZOO: everything you ever wanted to know about neural backdoors (but were afraid to ask)","author":"Pang","year":"2020","journal-title":"CoRR"},{"article-title":"Circumventing backdoor defenses that are based on latent separability","year":"2022","author":"Qi","key":"ref50"},{"article-title":"Language models are unsupervised multitask learners","year":"2019","author":"Radford","key":"ref51"},{"key":"ref52","article-title":"Distilbert, a distilled version of BERT: smaller, faster, cheaper and lighter","author":"Sanh","year":"2019","journal-title":"CoRR"},{"article-title":"Backdoor scanning for deep neural networks through k-arm optimization","year":"2021","author":"Shen","key":"ref53"},{"article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings","author":"Simonyan","key":"ref54"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICRCICN.2018.8718718"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.195"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref59","first-page":"1541","article-title":"Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection","volume-title":"30th USENIX Security Symposium, USENIX Security 2021","author":"Tang"},{"key":"ref60","first-page":"1541","article-title":"Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection","volume-title":"30th USENIX Security Symposium, USENIX Security 2021","author":"Tang"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403064"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403064"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.3115\/1119176.1119195"},{"key":"ref64","first-page":"8011","article-title":"Spectral signatures in backdoor attacks","volume-title":"Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018","author":"Tran"},{"key":"ref65","article-title":"Label- consistent backdoor attacks","author":"Turner","year":"2019","journal-title":"CoRR"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6459"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.35111\/9fx9-gz10"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00614"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-demos.6"},{"article-title":"Backdoorbench: A comprehensive benchmark of backdoor learning","year":"2022","author":"Wu","key":"ref71"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.3041202"},{"article-title":"Reinforced continual learning","year":"2018","author":"Xu","key":"ref73"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00040"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"article-title":"Adversarial unlearning of backdoors via implicit hypergradient","year":"2021","author":"Zeng","key":"ref77"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00716"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-acl.271"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3331184.3331212"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413546"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","start":{"date-parts":[[2023,5,21]]},"location":"San Francisco, CA, USA","end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10351028.pdf?arnumber=10351028","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:16:19Z","timestamp":1721452579000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10351028\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5,21]]},"references-count":81,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10351028","relation":{},"subject":[],"published":{"date-parts":[[2023,5,21]]}}}