{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T18:34:00Z","timestamp":1784399640903,"version":"3.55.0"},"reference-count":194,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62171248"],"award-info":[{"award-number":["62171248"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"PCNL Key Project","award":["PCL2021A07"],"award-info":[{"award-number":["PCL2021A07"]}]},{"DOI":"10.13039\/501100010877","name":"Shenzhen Science and Technology Innovation Commission (Research Center for Computer Network","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100010877","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100015803","name":"Tencent Rhino-Bird Research Program","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100015803","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Neural Netw. Learning Syst."],"published-print":{"date-parts":[[2024,1]]},"DOI":"10.1109\/tnnls.2022.3182979","type":"journal-article","created":{"date-parts":[[2022,6,22]],"date-time":"2022-06-22T19:36:06Z","timestamp":1655926566000},"page":"5-22","source":"Crossref","is-referenced-by-count":448,"title":["Backdoor Learning: A Survey"],"prefix":"10.1109","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2258-265X","authenticated-orcid":false,"given":"Yiming","family":"Li","sequence":"first","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4260-1395","authenticated-orcid":false,"given":"Yong","family":"Jiang","sequence":"additional","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9653-7907","authenticated-orcid":false,"given":"Zhifeng","family":"Li","sequence":"additional","affiliation":[{"name":"Tencent Data Platform, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8639-982X","authenticated-orcid":false,"given":"Shu-Tao","family":"Xia","sequence":"additional","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. ICLR","author":"Goodfellow"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58452-8_36"},{"key":"ref4","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. NeurIPS","author":"Wu"},{"key":"ref5","article-title":"Improving adversarial robustness via channel-wise activation suppressing","volume-title":"Proc. ICLR","author":"Bai"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2021.108472"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref9","article-title":"Backdoor attack in the physical world","volume-title":"Proc. ICLR Workshop","author":"Li"},{"key":"ref10","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3021407"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref13","article-title":"Label-consistent backdoor attacks","author":"Turner","year":"2019","journal-title":"arXiv:1912.02771"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01445"},{"key":"ref16","first-page":"2793","article-title":"Weight poisoning attacks on pre-trained models","volume-title":"Proc. ACL","author":"Kurita"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2020.3000900"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475254"},{"key":"ref19","article-title":"Backdooring convolutional neural networks via targeted weight perturbations","author":"Dumford","year":"2018","journal-title":"arXiv:1812.03128"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00762"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403064"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00035"},{"key":"ref24","article-title":"Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting","volume-title":"Proc. ICLR Workshop","author":"Qi"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref27","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"Proc. NeurIPS","author":"Li"},{"key":"ref28","article-title":"On certifying robustness against backdoor attacks via randomized smoothing","volume-title":"Proc. CVPR Workshop","author":"Wang"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179451"},{"key":"ref30","first-page":"11372","article-title":"Crfl: Certifiably robust federated learning against backdoor attacks","volume-title":"Proc. ICML","author":"Xie"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ISQED48828.2020.9137011"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3162397"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.07.133"},{"key":"ref34","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"Gao","year":"2020","journal-title":"arXiv:2007.10760"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-98795-4_13"},{"key":"ref36","article-title":"An overview of backdoor attacks against deep neural networks and possible defences","author":"Guo","year":"2021","journal-title":"arXiv:2111.08429"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3374664.3375751"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"ref40","first-page":"18944","article-title":"Backdoor attack with imperceptible input and latent modification","volume-title":"Proc. NeurIPS","author":"Doan"},{"key":"ref41","article-title":"WaNet\u2013imperceptible warping-based backdoor attack","volume-title":"Proc. ICLR","author":"Nguyen"},{"key":"ref42","first-page":"1505","article-title":"Blind backdoors in deep learning models","volume-title":"Proc. USENIX Secur.","author":"Bagdasaryan"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16201"},{"key":"ref44","article-title":"Check your other door! Creating backdoor attacks in the frequency domain","author":"Abed Al Kader Hammoud","year":"2021","journal-title":"arXiv:2109.05507"},{"key":"ref45","article-title":"Backdoor attack through frequency domain","author":"Wang","year":"2021","journal-title":"arXiv:2111.10991"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00024"},{"key":"ref47","first-page":"443","article-title":"Seeing is not believing: Camouflage attacks on image scaling algorithms","volume-title":"Proc. USENIX Secur.","author":"Xiao"},{"key":"ref48","article-title":"Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch","author":"Souri","year":"2021","journal-title":"arXiv:2106.08970"},{"key":"ref49","article-title":"Investigating bi-level optimization for learning and vision from a unified perspective: A survey and beyond","author":"Liu","year":"2021","journal-title":"arXiv:2101.11517"},{"key":"ref50","first-page":"18021","article-title":"Manipulating SGD with data ordering attacks","volume-title":"Proc. NeurIPS","author":"Shumailov"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412130"},{"key":"ref53","article-title":"Witches\u2019 brew: Industrial scale data poisoning via gradient matching","volume-title":"Proc. ICLR","author":"Geiping"},{"key":"ref54","first-page":"2938","article-title":"How to backdoor federated learning","volume-title":"Proc. AISTATS","author":"Bagdasaryan"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM50108.2020.00025"},{"key":"ref58","article-title":"Backdoor scanning for deep neural networks through K-arm optimization","author":"Shen","year":"2021","journal-title":"arXiv:2102.05123"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01617"},{"key":"ref60","article-title":"NeuronInspect: Detecting backdoors in neural networks via output explanations","author":"Huang","year":"2019","journal-title":"arXiv:1911.07399"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref62","first-page":"3454","article-title":"Input-aware dynamic backdoor attack","author":"Nguyen","year":"2020","journal-title":"NeurIPS"},{"key":"ref63","article-title":"Poison ink: Robust and invisible backdoor attack","author":"Zhang","year":"2021","journal-title":"arXiv:2108.02488"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00614"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.431"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.165"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463560"},{"key":"ref74","first-page":"1523","article-title":"Graph backdoor","author":"Xi","year":"2021","journal-title":"USENIX Secur."},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2023.3301673"},{"key":"ref76","article-title":"Poisoning MorphNet for clean-label backdoor attack to point clouds","author":"Tian","year":"2021","journal-title":"arXiv:2105.04839"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00750"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01618"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3116431"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"ref81","article-title":"Poisoning and backdooring contrastive learning","volume-title":"Proc. ICLR","author":"Carlini"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218663"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/509"},{"key":"ref84","article-title":"Poisoning deep reinforcement learning agents with in-distribution triggers","volume-title":"Proc. ICLR Workshop","author":"Ashcraft"},{"key":"ref85","article-title":"Quantization backdoors to deep learning commercial frameworks","author":"Ma","year":"2021","journal-title":"arXiv:2108.09187"},{"key":"ref86","first-page":"9303","article-title":"Qu-ANTI-zation: Exploiting quantization artifacts for achieving adversarial outcomes","volume-title":"Proc. NeurIPS","author":"Hong"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485881"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413468"},{"key":"ref89","article-title":"Can you hear it? Backdoor attacks via ultrasonic triggers","author":"Koffas","year":"2021","journal-title":"arXiv:2107.14569"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3094824"},{"key":"ref91","first-page":"1487","article-title":"Explanation-guided backdoor poisoning attacks against malware classifiers","volume-title":"Proc. USENIX Secur.","author":"Severi"},{"key":"ref92","article-title":"Hidden backdoor attack against semantic segmentation models","volume-title":"Proc. ICLR Workshop","author":"Li"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i1.19935"},{"key":"ref94","article-title":"Few-shot backdoor attacks on visual object tracking","volume-title":"Proc. ICLR","author":"Li"},{"key":"ref95","first-page":"634","article-title":"Analyzing federated learning through an adversarial lens","volume-title":"Proc. ICML","author":"Bhagoji"},{"key":"ref96","article-title":"DBA: Distributed backdoor attacks against federated learning","volume-title":"Proc. ICLR","author":"Xie"},{"key":"ref97","first-page":"16070","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","volume-title":"Proc. NeurIPS","author":"Wang"},{"key":"ref98","article-title":"Backdoor attacks on federated meta-learning","author":"Chen","year":"2020","journal-title":"arXiv:2006.07026"},{"key":"ref99","article-title":"Backdoor attacks and defenses in feature-partitioned collaborative learning","volume-title":"Proc. ICML Workshop","author":"Liu"},{"key":"ref100","article-title":"Defending label inference and backdoor attacks in vertical federated learning","volume-title":"Proc. AAAI","author":"Liu"},{"key":"ref101","article-title":"Can you really backdoor federated learning?","volume-title":"Proc. NeurIPS Workshop","author":"Sun"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i10.17118"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3108434"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref105","article-title":"Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models","volume-title":"Proc. ICLR","author":"Chen"},{"key":"ref106","first-page":"1615","article-title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","volume-title":"Proc. USENIX Secur.","author":"Adi"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i2.20036"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2022-0072"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417231"},{"key":"ref110","article-title":"Open-sourced dataset protection via backdoor watermarking","volume-title":"Proc. NeurIPS Workshop","author":"Li"},{"key":"ref111","article-title":"What do deep nets learn? Class-wise patterns revealed in the input space","author":"Zhao","year":"2021","journal-title":"arXiv:2101.06898"},{"key":"ref112","first-page":"1027","article-title":"What do you see? Evaluation of explainable artificial intelligence (XAI) interpretability through neural backdoors","volume-title":"Proc. KDD","author":"Lin"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref114","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref115","article-title":"How to inject backdoors with better consistency: Logit anchoring on clean data","author":"Zhang","year":"2021","journal-title":"arXiv:2109.01300"},{"key":"ref116","article-title":"On hiding neural networks inside neural networks","author":"Guo","year":"2020","journal-title":"arXiv:2002.10078"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2861800"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref121","article-title":"Model agnostic defence against backdoor attacks in machine learning","author":"Udeshi","year":"2019","journal-title":"arXiv:1908.02203"},{"key":"ref122","article-title":"ConFoc: Content-focus protection against trojan attacks on neural networks","author":"Villarreal-Vasquez","year":"2020","journal-title":"arXiv:2007.00711"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453108"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref125","article-title":"Bridging mode connectivity in loss landscapes and adversarial robustness","volume-title":"Proc. ICLR","author":"Zhao"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1145\/3411508.3421375"},{"key":"ref127","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","volume-title":"Proc. ICLR","author":"Li"},{"key":"ref128","first-page":"16913","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume-title":"Proc. NeurIPS","author":"Wu"},{"key":"ref129","article-title":"Adversarial unlearning of backdoors via implicit hypergradient","volume-title":"Proc. ICLR","author":"Zeng"},{"key":"ref130","first-page":"14027","article-title":"Defending neural backdoors via generative distribution modeling","volume-title":"Proc. NeurIPS","author":"Qiao"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413546"},{"key":"ref132","article-title":"Defending against backdoor attack on deep neural networks","volume-title":"Proc. KDD Workshop","author":"Cheng"},{"key":"ref133","article-title":"Neural network laundering: Removing black-box backdoor watermarks from deep neural networks","author":"Aiken","year":"2020","journal-title":"arXiv:2004.11368"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-67661-2_18"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.3041202"},{"key":"ref136","article-title":"Aeva: Black-box backdoor detection using adversarial extreme value analysis","volume-title":"Proc. ICLR","author":"Guo"},{"key":"ref137","article-title":"Trigger hunting with a topological prior for trojan detection","volume-title":"Proc. ICLR","author":"Hu"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58583-9_20"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_14"},{"key":"ref141","first-page":"17258","article-title":"Topological detection of trojaned neural networks","volume-title":"Proc. NeurIPS","author":"Zheng"},{"key":"ref142","article-title":"Post-training detection of backdoor attacks for two-class and multi-attack scenarios","volume-title":"Proc. ICLR","author":"Xiang"},{"key":"ref143","article-title":"Robust anomaly detection and backdoor attack detection via differential privacy","volume-title":"Proc. ICLR","author":"Du"},{"key":"ref144","article-title":"On the effectiveness of mitigating data poisoning attacks with gradient shaping","author":"Hong","year":"2020","journal-title":"arXiv:2002.11497"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9414862"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412684"},{"key":"ref147","article-title":"Backdoor defense via decoupling the training process","volume-title":"Proc. ICLR","author":"Huang"},{"key":"ref148","first-page":"8011","article-title":"Spectral signatures in backdoor attacks","volume-title":"Proc. NeurIPS","author":"Tran"},{"key":"ref149","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","volume-title":"Proc. AAAI Workshop","author":"Chen"},{"key":"ref150","first-page":"1541","article-title":"Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection","volume-title":"Proc. USENIX Secur.","author":"Tang"},{"key":"ref151","article-title":"Exposing backdoors in robust machine learning models","author":"Soremekun","year":"2020","journal-title":"arXiv:2003.00865"},{"key":"ref152","article-title":"Poison as a cure: Detecting >neutralizing variable-sized backdoor attacks in deep neural networks","author":"Chan","year":"2019","journal-title":"arXiv:1911.08040"},{"key":"ref153","first-page":"1","article-title":"SPECTRE: Defending against backdoor attacks using robust covariance estimation","volume-title":"Proc. ICML","author":"Hayase"},{"key":"ref154","article-title":"A unified framework for task-driven data quality management","author":"Wang","year":"2021","journal-title":"arXiv:2106.05484"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref157","article-title":"Deep probabilistic models to detect data poisoning attacks","volume-title":"Proc. NeurIPS Workshop","author":"Subedar"},{"key":"ref158","article-title":"A unified framework for analyzing and detecting malicious examples of DNN models","author":"Jin","year":"2020","journal-title":"arXiv:2006.14871"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1145\/3400302.3415671"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00790"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58555-6_17"},{"key":"ref162","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. NeurIPS","author":"Tramer"},{"key":"ref163","first-page":"11973","article-title":"On the trade-off between adversarial and backdoor robustness","author":"Weng","year":"2020","journal-title":"NeurIPS"},{"key":"ref164","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. ICML","author":"Cohen"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1611835114"},{"key":"ref167","first-page":"8803","article-title":"Loss surfaces, mode connectivity, and fast ensembling of DNNs","volume-title":"Proc. NeurIPS","author":"Garipov"},{"key":"ref168","article-title":"Distilling the knowledge in a neural network","volume-title":"Proc. NeurIPS Workshop","author":"Hinton"},{"issue":"2","key":"ref169","doi-asserted-by":"crossref","first-page":"235","DOI":"10.1023\/A:1013689704352","article-title":"Finite-time analysis of the multiarmed bandit problem","volume":"47","author":"Auer","year":"2002","journal-title":"Mach. Learn."},{"key":"ref170","article-title":"Improved regularization of convolutional neural networks with cutout","author":"DeVries","year":"2017","journal-title":"arXiv:1708.04552"},{"key":"ref171","article-title":"Detecting adversarial samples from artifacts","author":"Feinman","year":"2017","journal-title":"arXiv:1703.00410"},{"key":"ref172","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","volume-title":"Proc. ICLR","author":"Ma"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00126"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN48605.2020.9206809"},{"key":"ref176","article-title":"Analyzing accuracy loss in randomized smoothing defenses","author":"Gao","year":"2020","journal-title":"arXiv:2003.01595"},{"key":"ref177","article-title":"Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms","author":"Xiao","year":"2017","journal-title":"arXiv:1708.07747"},{"key":"ref178","article-title":"NNoculation: Catching BadNets in the wild","author":"Kumar Veldanda","year":"2020","journal-title":"arXiv:2002.08313"},{"key":"ref179","article-title":"Reading digits in natural images with unsupervised feature learning","volume-title":"Proc. NeurIPS Workshop","author":"Netzer"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2012.2209421"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2011.5995566"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2009.5459250"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.41"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/FG.2018.00020"},{"key":"ref187","article-title":"Labeled faces in the wild: A database for studying face recognition in unconstrained environments","author":"Huang","year":"2007"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00019"},{"key":"ref189","first-page":"8230","article-title":"Certified robustness to label-flipping attacks via randomized smoothing","volume-title":"Proc. ICML","author":"Rosenfeld"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16971"},{"key":"ref191","article-title":"Deep partition aggregation: Provable defenses against general poisoning attacks","volume-title":"Proc. ICLR","author":"Levine"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i9.21191"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1007\/bf00058655"},{"key":"ref194","volume-title":"Introduction to Statistical Machine Learning","author":"Sugiyama","year":"2015"}],"container-title":["IEEE Transactions on Neural Networks and Learning Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/5962385\/10381493\/09802938.pdf?arnumber=9802938","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,12]],"date-time":"2024-01-12T01:13:18Z","timestamp":1705021998000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9802938\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1]]},"references-count":194,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tnnls.2022.3182979","relation":{},"ISSN":["2162-237X","2162-2388"],"issn-type":[{"value":"2162-237X","type":"print"},{"value":"2162-2388","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1]]}}}