{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T07:04:38Z","timestamp":1780988678883,"version":"3.54.1"},"reference-count":45,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472396"],"award-info":[{"award-number":["62472396"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003995","name":"Anhui Provincial Natural Science Foundation","doi-asserted-by":"crossref","award":["2508085QF212"],"award-info":[{"award-number":["2508085QF212"]}],"id":[{"id":"10.13039\/501100003995","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Advanced Computing Resources provided by the Supercomputing Center of University of Science and Technology of China"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3684819","type":"journal-article","created":{"date-parts":[[2026,4,16]],"date-time":"2026-04-16T19:51:58Z","timestamp":1776369118000},"page":"5455-5468","source":"Crossref","is-referenced-by-count":0,"title":["ABDP: Adversarial Backdoor Detection and Purification"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3027-3109","authenticated-orcid":false,"given":"Haojie","family":"Yuan","sequence":"first","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3571-7808","authenticated-orcid":false,"given":"Bin Benjamin","family":"Zhu","sequence":"additional","affiliation":[{"name":"Microsoft Research Asia, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3028-0755","authenticated-orcid":false,"given":"Qi","family":"Chu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0026-6813","authenticated-orcid":false,"given":"Tao","family":"Gong","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4417-9316","authenticated-orcid":false,"given":"Nenghai","family":"Yu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9230-2799","authenticated-orcid":false,"given":"Dongmei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Microsoft Research Asia, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1002\/rob.21918"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1093\/bib\/bbx044"},{"key":"ref3","first-page":"1667","article-title":"Meta-Sift: How to sift out a clean subset in the presence of data poisoning?","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Zeng"},{"key":"ref4","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"139","author":"Radford"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00028"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3374664.3375751"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00390"},{"key":"ref8","first-page":"1685","article-title":"Towards a proactive ML approach for detecting backdoor poison samples","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Qi"},{"key":"ref9","article-title":"Backdoor defense via decoupling the training process","author":"Huang","year":"2022","journal-title":"arXiv:2202.03423"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref11","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","author":"Li","year":"2021","journal-title":"arXiv:2101.05930"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01963"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3392760"},{"key":"ref14","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"arXiv:1708.06733"},{"key":"ref15","article-title":"Wanet-imperceptible warping-based backdoor attack","author":"Nguyen","year":"2021","journal-title":"arXiv:2102.10369"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.07.133"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3404885"},{"key":"ref18","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01465"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3182979"},{"key":"ref23","article-title":"Vdc: Versatile data cleanser for detecting dirty samples via visual-linguistic inconsistency","author":"Zhu","year":"2023","journal-title":"arXiv:2309.16211"},{"key":"ref24","article-title":"Label-consistent backdoor attacks","author":"Turner","year":"2019","journal-title":"arXiv:1912.02771"},{"key":"ref25","article-title":"IBD-PSC: Input-level backdoor detection via parameter-oriented scaling consistency","author":"Hou","year":"2024","journal-title":"arXiv:2405.09786"},{"key":"ref26","article-title":"Badexpert: Extracting backdoor functionality for accurate backdoor input detection","author":"Xie","year":"2023","journal-title":"arXiv:2308.12439"},{"key":"ref27","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"Proc. NIPS","volume":"34","author":"Li"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690250"},{"key":"ref29","article-title":"Cert-SSB: Toward certified sample-specific backdoor defense","author":"Qiao","year":"2025","journal-title":"arXiv:2504.21730"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417231"},{"key":"ref31","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10351028"},{"key":"ref33","article-title":"Enhancing the reliability of out-of-distribution image detection in neural networks","author":"Liang","year":"2017","journal-title":"arXiv:1706.02690"},{"key":"ref34","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-73003-5_196"},{"key":"ref36","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2013.6706807"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0766"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670361"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"ref44","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11482646.pdf?arnumber=11482646","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T06:21:28Z","timestamp":1780986088000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11482646\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":45,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3684819","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}