{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T14:34:18Z","timestamp":1785335658264,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":51,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,3,16]],"date-time":"2020-03-16T00:00:00Z","timestamp":1584316800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,3,16]]},"DOI":"10.1145\/3374664.3375751","type":"proceedings-article","created":{"date-parts":[[2020,3,13]],"date-time":"2020-03-13T17:06:53Z","timestamp":1584119213000},"page":"97-108","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":144,"title":["Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation"],"prefix":"10.1145","author":[{"given":"Haoti","family":"Zhong","sequence":"first","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cong","family":"Liao","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Anna Cinzia","family":"Squicciarini","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sencun","family":"Zhu","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Miller","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,3,16]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2014.2339736"},{"key":"e_1_3_2_1_2_1","volume-title":"Proceedings of ICML Workshop on Unsupervised and Transfer Learning. 17--36","author":"Bengio Yoshua","year":"2012","unstructured":"Yoshua Bengio. 2012. Deep learning of representations for unsupervised and transfer learning. In Proceedings of ICML Workshop on Unsupervised and Transfer Learning. 17--36."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"e_1_3_2_1_4_1","volume-title":"Proceedings of the 29th International Conference on Machine Learning, ICML 2012","author":"Biggio Battista","year":"2012","unstructured":"Battista Biggio, Blaine Nelson, and Pavel Laskov. 2012. Poisoning Attacks against Support Vector Machines. In Proceedings of the 29th International Conference on Machine Learning, ICML 2012, Edinburgh, Scotland, UK, June 26 - July 1, 2012 ."},{"key":"e_1_3_2_1_5_1","volume-title":"Davide Del Testa","author":"Bojarski Mariusz","year":"2016","unstructured":"Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et almbox. 2016. End to end learning for self-driving cars. arXiv preprint arXiv:1604.07316 (2016)."},{"key":"e_1_3_2_1_6_1","volume-title":"Neural networks: Tricks of the trade","author":"Bottou L\u00e9on","unstructured":"L\u00e9on Bottou. 2012. Stochastic gradient descent tricks. In Neural networks: Tricks of the trade . Springer, 421--436."},{"key":"e_1_3_2_1_7_1","volume-title":"The OpenCV Library . Dr. Dobb's Journal of Software Tools","author":"Bradski G.","year":"2000","unstructured":"G. Bradski. 2000. The OpenCV Library . Dr. Dobb's Journal of Software Tools (2000)."},{"key":"e_1_3_2_1_8_1","volume-title":"Digital image steganography: Survey and analysis of current methods. Signal processing","author":"Cheddad Abbas","year":"2010","unstructured":"Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. 2010. Digital image steganography: Survey and analysis of current methods. Signal processing , Vol. 90, 3 (2010), 727--752."},{"key":"e_1_3_2_1_9_1","volume-title":"Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. arXiv preprint arXiv:1712.05526","author":"Chen Xinyun","year":"2017","unstructured":"Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. arXiv preprint arXiv:1712.05526 (2017)."},{"key":"e_1_3_2_1_10_1","unstructured":"Andrew Cotter Ohad Shamir Nati Srebro and Karthik Sridharan. 2011. Better mini-batch algorithms via accelerated gradient methods. In Advances in neural information processing systems. 1647--1655."},{"key":"e_1_3_2_1_11_1","unstructured":"Ingemar Cox Matthew Miller Jeffrey Bloom Jessica Fridrich and Ton Kalker. 2007. Digital watermarking and steganography .Morgan Kaufmann."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"e_1_3_2_1_13_1","volume-title":"Catastrophic forgetting in connectionist networks. Trends in cognitive sciences","author":"French Robert M","year":"1999","unstructured":"Robert M French. 1999. Catastrophic forgetting in connectionist networks. Trends in cognitive sciences , Vol. 3, 4 (1999), 128--135."},{"key":"e_1_3_2_1_14_1","volume-title":"Deep Learning","author":"Goodfellow Ian","unstructured":"Ian Goodfellow, Yoshua Bengio, and Aaron Courville. 2016. Deep Learning .MIT Press. 71--73 pages. http:\/\/www.deeplearningbook.org."},{"key":"e_1_3_2_1_15_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow Ian J","year":"2014","unstructured":"Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)."},{"key":"e_1_3_2_1_16_1","unstructured":"Google. 2018. A Guide to TF Layers: Building a Convolutional Neural Network. https:\/\/www.tensorflow.org\/tutorials\/layers . (2018)."},{"key":"e_1_3_2_1_17_1","volume-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733","author":"Gu Tianyu","year":"2017","unstructured":"Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_20"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134635"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2017.8228656"},{"key":"e_1_3_2_1_22_1","volume-title":"Computer","volume":"31","author":"Johnson Neil F","year":"1998","unstructured":"Neil F Johnson and Sushil Jajodia. 1998. Exploring steganography: Seeing the unseen. Computer , Vol. 31, 2 (1998)."},{"key":"e_1_3_2_1_23_1","volume-title":"Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980","author":"Kingma Diederik P","year":"2014","unstructured":"Diederik P Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)."},{"key":"e_1_3_2_1_24_1","unstructured":"Evan Klinger and David Starkweather. 2008. pHash. http:\/\/www.phash.org\/. (2008)."},{"key":"e_1_3_2_1_25_1","unstructured":"Ivan Krasin and Tom Duerig. 2016. Google Open Images Dataset. https:\/\/research.googleblog.com\/2016\/09\/introducing-open-images-dataset.html . (2016)."},{"key":"e_1_3_2_1_26_1","unstructured":"Alex Krizhevsky. 2009. Learning multiple layers of features from tiny images. (2009)."},{"key":"e_1_3_2_1_27_1","unstructured":"Alex Krizhevsky Ilya Sutskever and Geoffrey E Hinton. 2012. Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems. 1097--1105."},{"key":"e_1_3_2_1_28_1","volume-title":"Proceedings of the 29th International Conference on Machine Learning, ICML 2012","author":"Le Quoc V.","year":"2012","unstructured":"Quoc V. Le, Marc'Aurelio Ranzato, Rajat Monga, Matthieu Devin, Greg Corrado, Kai Chen, Jeffrey Dean, and Andrew Y. Ng. 2012. Building high-level features using large scale unsupervised learning. In Proceedings of the 29th International Conference on Machine Learning, ICML 2012, Edinburgh, Scotland, UK, June 26 - July 1, 2012 ."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"e_1_3_2_1_30_1","volume-title":"Neural networks: Tricks of the trade","author":"LeCun Yann","unstructured":"Yann LeCun, L\u00e9on Bottou, Genevieve B Orr, and Klaus-Robert M\u00fcller. 1998 b. Efficient backprop. In Neural networks: Tricks of the trade . Springer, 9--50."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACPR.2015.7486599"},{"key":"e_1_3_2_1_33_1","volume-title":"Trojaning Attack on Neural Networks. In 25nd Annual Network and Distributed System Security Symposium, NDSS 2018","author":"Liu Yingqi","year":"2018","unstructured":"Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning Attack on Neural Networks. In 25nd Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18--21, 2018 . The Internet Society."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"e_1_3_2_1_35_1","unstructured":"Bryan McCann James Bradbury Caiming Xiong and Richard Socher. 2017. Learned in translation: Contextualized word vectors. In Advances in Neural Information Processing Systems. 6297--6308."},{"key":"e_1_3_2_1_36_1","volume-title":"Psychology of learning and motivation .","author":"McCloskey Michael","unstructured":"Michael McCloskey and Neal J Cohen. 1989. Catastrophic interference in connectionist networks: The sequential learning problem. In Psychology of learning and motivation . Vol. 24. Elsevier, 109--165."},{"key":"e_1_3_2_1_37_1","volume-title":"Universal Adversarial Perturbations. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2017","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. Universal Adversarial Perturbations. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21--26, 2017 . 86--94."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"e_1_3_2_1_39_1","volume-title":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. ACM, 27--38","author":"Gonz\u00e1lez Luis Mu","year":"2017","unstructured":"Luis Mu noz-Gonz\u00e1lez, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. 2017. Towards poisoning of deep learning algorithms with back-gradient optimization. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. ACM, 27--38."},{"key":"e_1_3_2_1_40_1","unstructured":"Kaushik Narayan. 2018. Insider Threat in the Cloud. https:\/\/www.skyhighnetworks.com\/cloud-security-blog\/5-devious-instances-insider-threat-cloud\/. (2018)."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_2_1_42_1","volume-title":"2016 IEEE European Symposium on. IEEE, 372--387","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. The limitations of deep learning in adversarial settings. In Security and Privacy (EuroS&P), 2016 IEEE European Symposium on. IEEE, 372--387."},{"key":"e_1_3_2_1_43_1","volume-title":"Hide and seek: An introduction to steganography","author":"Provos Niels","year":"2003","unstructured":"Niels Provos and Peter Honeyman. 2003. Hide and seek: An introduction to steganography. IEEE security & privacy , Vol. 99, 3 (2003), 32--44."},{"key":"e_1_3_2_1_44_1","volume-title":"A three-layer back-propagation neural network for spam detection using artificial immune concentration. Soft computing","author":"Ruan Guangchen","year":"2010","unstructured":"Guangchen Ruan and Ying Tan. 2010. A three-layer back-propagation neural network for spam detection using artificial immune concentration. Soft computing , Vol. 14, 2 (2010), 139--150."},{"key":"e_1_3_2_1_45_1","volume-title":"The 2011 International Joint Conference on. IEEE, 2809--2813","author":"Sermanet Pierre","year":"2011","unstructured":"Pierre Sermanet and Yann LeCun. 2011. Traffic sign recognition with multi-scale convolutional networks. In Neural Networks (IJCNN), The 2011 International Joint Conference on. IEEE, 2809--2813."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991125"},{"key":"e_1_3_2_1_47_1","volume-title":"Digital watermarking and steganography: fundamentals and techniques","author":"Shih Frank Y","unstructured":"Frank Y Shih. 2017. Digital watermarking and steganography: fundamentals and techniques .CRC press."},{"key":"e_1_3_2_1_48_1","volume-title":"Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556","author":"Simonyan Karen","year":"2014","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)."},{"key":"e_1_3_2_1_49_1","volume-title":"et almbox","author":"Szegedy Christian","year":"2015","unstructured":"Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, Andrew Rabinovich, et almbox. 2015. Going deeper with convolutions. CVPR."},{"key":"e_1_3_2_1_50_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.220"}],"event":{"name":"CODASPY '20: Tenth ACM Conference on Data and Application Security and Privacy","location":"New Orleans LA USA","acronym":"CODASPY '20","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3374664.3375751","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3374664.3375751","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:33:08Z","timestamp":1750199588000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3374664.3375751"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,3,16]]},"references-count":51,"alternative-id":["10.1145\/3374664.3375751","10.1145\/3374664"],"URL":"https:\/\/doi.org\/10.1145\/3374664.3375751","relation":{},"subject":[],"published":{"date-parts":[[2020,3,16]]},"assertion":[{"value":"2020-03-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}