{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T02:13:29Z","timestamp":1773713609196,"version":"3.50.1"},"reference-count":77,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372227"],"award-info":[{"award-number":["62372227"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62402214"],"award-info":[{"award-number":["62402214"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004608","name":"Natural Science Foundation of Jiangsu Province","doi-asserted-by":"publisher","award":["BK20241194"],"award-info":[{"award-number":["BK20241194"]}],"id":[{"id":"10.13039\/501100004608","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"publisher","award":["2025T180420"],"award-info":[{"award-number":["2025T180420"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"publisher","award":["2025M781473"],"award-info":[{"award-number":["2025M781473"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Postdoctoral Fellowship Program of CPSF","award":["GZB20250386"],"award-info":[{"award-number":["GZB20250386"]}]},{"name":"Jiangsu Funding Program for Excellent Postdoctoral Talent","award":["2025ZB317"],"award-info":[{"award-number":["2025ZB317"]}]},{"name":"Postgraduate Research & Practice Innovation Program of Jiangsu Province","award":["KYCX25_0368"],"award-info":[{"award-number":["KYCX25_0368"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tdsc.2025.3644371","type":"journal-article","created":{"date-parts":[[2025,12,15]],"date-time":"2025-12-15T18:41:09Z","timestamp":1765824069000},"page":"4269-4283","source":"Crossref","is-referenced-by-count":0,"title":["Trap: Mitigating Poisoning-Based Backdoor Attacks by Treating Poison With Poison"],"prefix":"10.1109","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-9787-3586","authenticated-orcid":false,"given":"Chun","family":"Li","sequence":"first","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3849-3416","authenticated-orcid":false,"given":"Zhong","family":"Li","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4011-5350","authenticated-orcid":false,"given":"Minxue","family":"Pan","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuandong","family":"Li","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2020.113816"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1038\/s41591-018-0316-z"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2020.106384"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3538707"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2022.3182979"},{"key":"ref7","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Li","year":"2021"},{"key":"ref8","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Li","year":"2021"},{"key":"ref9","article-title":"On the effectiveness of mitigating data poisoning attacks with gradient shaping","author":"Hong","year":"2020"},{"key":"ref10","article-title":"Backdoor defense via decoupling the training process","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Huang","year":"2022"},{"key":"ref11","article-title":"Training with more confidence: Mitigating injected and natural backdoors during training","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Wang","year":"2022"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0707"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01177"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00390"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"ref16","article-title":"Label-consistent backdoor attacks","author":"Turner","year":"2019"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363226"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref20","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017"},{"key":"ref21","article-title":"Revisiting the assumption of latent separability for backdoor defenses","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Qi","year":"2023"},{"key":"ref22","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy","year":"2014"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.5555\/2969033.2969125"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref26","article-title":"Input-aware dynamic backdoor attack","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Nguyen","year":"2020"},{"key":"ref27","article-title":"WANET - Imperceptible warping-based backdoor attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Nguyen","year":"2021"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref29","first-page":"2069","article-title":"Hiding images in plain sight: Deep steganography","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Baluja","year":"2017"},{"key":"ref30","first-page":"1541","article-title":"Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection","volume-title":"Proc. USENIX Secur. Symp.","author":"Tang","year":"2021"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.5555\/3524938.3525087"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00041"},{"key":"ref33","article-title":"Deep compression: Compressing deep neural network with pruning, trained quantization and huffman coding","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Han","year":"2016"},{"key":"ref34","first-page":"8011","article-title":"Spectral signatures in backdoor attacks","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Tran","year":"2018"},{"key":"ref35","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","volume-title":"Proc. SafeAI AAAI","author":"Chen","year":"2019"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.5555\/3001460.3001507"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1982.1056489"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3068335"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICADIWT.2014.6814687"},{"issue":"86","key":"ref40","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4757-1904-8"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1137\/090771806"},{"key":"ref43","first-page":"323","article-title":"Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition","volume-title":"Neural Netw.","volume":"32","author":"Stallkamp","year":"2012"},{"key":"ref44","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref47","article-title":"Supervised contrastive learning","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Khosla","year":"2020"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2019.04.008"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/satml54575.2023.00034"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00614"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"ref53","first-page":"18021","article-title":"Manipulating SGD with data ordering attacks","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Shumailov","year":"2021"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00049"},{"key":"ref55","first-page":"6106","article-title":"Poison frogs! Targeted clean-label poisoning attacks on neural networks","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Shafahi","year":"2018"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412130"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref59","article-title":"Backdoor attack in the physical world","author":"Li","year":"2021"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58548-8_42"},{"key":"ref61","first-page":"9525","article-title":"Backdoor scanning for deep neural networks through k-arm optimization","volume-title":"Proc. Eur. Conf. Comput. Vis.","volume":"139","author":"Shen","year":"2021"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00684"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00271"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3538266"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2025.113339"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2024.3349784"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/304181.304187"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW56347.2022.00033"},{"key":"ref70","article-title":"Moderate-fitting as a natural backdoor defender for pre-trained language models","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Zhu","year":"2022"},{"key":"ref71","first-page":"3629","article-title":"PoisonedEncoder: Poisoning the unlabeled pre-training data in contrastive learning","volume-title":"Proc. USENIX Secur. Symp.","author":"Liu","year":"2022"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.13"},{"key":"ref73","article-title":"An image is worth 16x16 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dosovitskiy","year":"2021"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00403"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.00768"},{"key":"ref76","article-title":"ShadowCast: Stealthy data poisoning attacks against vision-language models","volume-title":"Proc. Adv. Neural Inf. Process.","author":"Xu","year":"2024"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00207"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11434575\/11300825.pdf?arnumber=11300825","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T01:16:44Z","timestamp":1773710204000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11300825\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":77,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2025.3644371","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}