{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T16:31:20Z","timestamp":1781022680208,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":70,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"CSIRO ? National Science Foundation (US) AI Research Collaboration Program"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3670361","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"4465-4479","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Watch Out! Simple Horizontal Class Backdoor Can Trivially Evade Defense"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7132-9258","authenticated-orcid":false,"given":"Hua","family":"Ma","sequence":"first","affiliation":[{"name":"CSIRO's Data61, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5114-4659","authenticated-orcid":false,"given":"Shang","family":"Wang","sequence":"additional","affiliation":[{"name":"University of Technology Sydney, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6029-5064","authenticated-orcid":false,"given":"Yansong","family":"Gao","sequence":"additional","affiliation":[{"name":"CSIRO's Data61, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1496-7293","authenticated-orcid":false,"given":"Zhi","family":"Zhang","sequence":"additional","affiliation":[{"name":"The University of Western Australia, Perth, WA, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-5385-9414","authenticated-orcid":false,"given":"Huming","family":"Qiu","sequence":"additional","affiliation":[{"name":"Fudan University, ShangHai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9172-4252","authenticated-orcid":false,"given":"Minhui","family":"Xue","sequence":"additional","affiliation":[{"name":"CSIRO's Data61, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9695-7947","authenticated-orcid":false,"given":"Alsharif","family":"Abuadbba","sequence":"additional","affiliation":[{"name":"CSIRO's Data61, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1632-5737","authenticated-orcid":false,"given":"Anmin","family":"Fu","sequence":"additional","affiliation":[{"name":"Nanjing University of Science and Technology, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3289-6599","authenticated-orcid":false,"given":"Surya","family":"Nepal","sequence":"additional","affiliation":[{"name":"CSIRO's Data61, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0945-2674","authenticated-orcid":false,"given":"Derek","family":"Abbott","sequence":"additional","affiliation":[{"name":"The University of Adelaide, Adelaide, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Yolov4: Optimal speed and accuracy of object detection. arXiv preprint arXiv:2004.10934","author":"Bochkovskiy Alexey","year":"2020","unstructured":"Alexey Bochkovskiy, Chien-Yao Wang, and Hong-Yuan Mark Liao. 2020. Yolov4: Optimal speed and accuracy of object detection. arXiv preprint arXiv:2004.10934 (2020)."},{"key":"e_1_3_2_1_2_1","volume-title":"Poisoning web-scale training datasets is practical. arXiv preprint arXiv:2302.10149","author":"Carlini Nicholas","year":"2023","unstructured":"Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tram\u00e8r. 2023. Poisoning web-scale training datasets is practical. arXiv preprint arXiv:2302.10149 (2023)."},{"key":"e_1_3_2_1_3_1","unstructured":"Bryant Chen Wilka Carvalho Nathalie Baracaldo Heiko Ludwig Benjamin Edwards Taesung Lee Ian Molloy and Biplav Srivastava. 2019. Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering. In SafeAI@ AAAI."},{"key":"e_1_3_2_1_4_1","first-page":"4658","article-title":"DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks","volume":"2","author":"Chen Huili","year":"2019","unstructured":"Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. 2019. DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks.. In IJCAI, Vol. 2. 4658--4664.","journal-title":"IJCAI"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3175616"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Noel CF Codella David Gutman M Emre Celebi Brian Helba Michael A Marchetti Stephen W Dusza Aadi Kalloo Konstantinos Liopyris Nabin Mishra Harald Kittler et al. 2018. Skin lesion analysis toward melanoma detection: A challenge at the 2017 international symposium on biomedical imaging (isbi) hosted by the international skin imaging collaboration (isic). In ISBI. IEEE 168--172.","DOI":"10.1109\/ISBI.2018.8363547"},{"key":"e_1_3_2_1_8_1","volume-title":"Veronica Rotemberg, Brian Helba, Veronica Vilaplana, Ofer Reiter, Cristina Carrera, Alicia Barreiro, Allan C Halpern, Susana Puig, et al.","author":"Combalia Marc","year":"2019","unstructured":"Marc Combalia, Noel CF Codella, Veronica Rotemberg, Brian Helba, Veronica Vilaplana, Ofer Reiter, Cristina Carrera, Alicia Barreiro, Allan C Halpern, Susana Puig, et al. 2019. Bcn20000: Dermoscopic lesions in the wild. arXiv preprint arXiv:1908.02288 (2019)."},{"key":"e_1_3_2_1_9_1","volume-title":"Nature","volume":"600","author":"Davies Alex","year":"2021","unstructured":"Alex Davies, Petar Velivckovi\u0107, Lars Buesing, Sam Blackwell, Daniel Zheng, Nenad Tomavsev, Richard Tanburn, Peter Battaglia, Charles Blundell, Andr\u00e1s Juh\u00e1sz, et al. 2021. Advancing mathematics by guiding human intuition with AI. Nature, Vol. 600, 7887 (2021), 70--74."},{"key":"e_1_3_2_1_10_1","volume-title":"Februus: Input purification defense against Trojan attacks on deep neural network systems. In ACSAC. 897--912.","author":"Doan Bao Gia","year":"2020","unstructured":"Bao Gia Doan, Ehsan Abbasnejad, and Damith C Ranasinghe. 2020. Februus: Input purification defense against Trojan attacks on deep neural network systems. In ACSAC. 897--912."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01617"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.02021"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW54120.2021.00008"},{"key":"e_1_3_2_1_14_1","volume-title":"Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim.","author":"Gao Yansong","year":"2020","unstructured":"Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. 2020. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760 (2020)."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"e_1_3_2_1_16_1","volume-title":"REDEEM MYSELF: Purifying backdoors in deep learning models using self attention distillation. In S&P","author":"Gong Xueluan","year":"2023","unstructured":"Xueluan Gong, Yanjiao Chen, Wang Yang, Qian Wang, Yuzhe Gu, Huayang Huang, and Chao Shen. 2023. REDEEM MYSELF: Purifying backdoors in deep learning models using self attention distillation. In S&P. IEEE Computer Society, 755--772."},{"key":"e_1_3_2_1_17_1","volume-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733","author":"Gu Tianyu","year":"2017","unstructured":"Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)."},{"key":"e_1_3_2_1_18_1","volume-title":"Towards inspecting and eliminating trojan backdoors in deep neural networks","author":"Guo Wenbo","unstructured":"Wenbo Guo, Lun Wang, Yan Xu, Xinyu Xing, Min Du, and Dawn Song. 2020. Towards inspecting and eliminating trojan backdoors in deep neural networks. In ICDM. IEEE, 162--171."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3548272"},{"key":"e_1_3_2_1_21_1","unstructured":"Kunzhe Huang Yiming Li Baoyuan Wu Zhan Qin and Kui Ren. 2021. Backdoor Defense via Decoupling the Training Process. In ICLR."},{"key":"e_1_3_2_1_22_1","volume-title":"Anna Potapenko, et al.","author":"Jumper John","year":"2021","unstructured":"John Jumper, Richard Evans, Alexander Pritzel, Tim Green, Michael Figurnov, Olaf Ronneberger, Kathryn Tunyasuvunakool, Russ Bates, Augustin vZ\u00eddek, Anna Potapenko, et al. 2021. Highly accurate protein structure prediction with AlphaFold. Nature, Vol. 596, 7873 (2021), 583--589."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"e_1_3_2_1_25_1","first-page":"2088","article-title":"Invisible backdoor attacks on deep neural networks via steganography and regularization","volume":"18","author":"Li Shaofeng","year":"2020","unstructured":"Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. 2020. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, Vol. 18, 5 (2020), 2088--2105.","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"e_1_3_2_1_27_1","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume":"34","author":"Li Yige","year":"2021","unstructured":"Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, Vol. 34 (2021), 14900--14912.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_28_1","unstructured":"Yige Li Xixiang Lyu Nodens Koren Lingjuan Lyu Bo Li and Xingjun Ma. 2021. Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks. In ICLR."},{"key":"e_1_3_2_1_29_1","volume-title":"Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692","author":"Li Yiming","year":"2020","unstructured":"Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. 2020. Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692 (2020)."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"e_1_3_2_1_31_1","volume-title":"Fine-Pruning: Defending against backdooring attacks on deep neural networks","author":"Liu Kang","unstructured":"Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-Pruning: Defending against backdooring attacks on deep neural networks. In RAID. Springer, 273--294."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"e_1_3_2_1_33_1","volume-title":"Reflection backdoor: A natural backdoor attack on deep neural networks","author":"Liu Yunfei","unstructured":"Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. In ECCV. Springer, 182--199."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01458"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"e_1_3_2_1_36_1","volume-title":"Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical World. arXiv preprint arXiv:2201.08619","author":"Ma Hua","year":"2022","unstructured":"Hua Ma, Yinshan Li, Yansong Gao, Alsharif Abuadbba, Zhi Zhang, Anmin Fu, Hyoungshick Kim, Said F Al-Sarawi, Nepal Surya, and Derek Abbott. 2022. Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical World. arXiv preprint arXiv:2201.08619 (2022)."},{"key":"e_1_3_2_1_37_1","volume-title":"TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-World","author":"Ma Hua","unstructured":"Hua Ma, Yinshan Li, Yansong Gao, Zhi Zhang, Alsharif Abuadbba, Anmin Fu, Said F Al-Sarawi, Surya Nepal, and Derek Abbott. 2023. TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-World. In SRDS. IEEE, 82--92."},{"key":"e_1_3_2_1_38_1","volume-title":"Quantization backdoors to deep learning models","author":"Ma Hua","year":"2023","unstructured":"Hua Ma, Huming Qiu, Yansong Gao, Zhi Zhang, Alsharif Abuadbba, Anmin Fu, Said Al-Sarawi, and Derek Abbott. 2023. Quantization backdoors to deep learning models. IEEE Transactions on Dependable and Secure Computing (2023)."},{"key":"e_1_3_2_1_39_1","volume-title":"arXiv preprint arXiv:2310.00542","author":"Ma Hua","year":"2023","unstructured":"Hua Ma, Shang Wang, Yansong Gao, Zhi Zhang, Huming Qiu, Minhui Xue, Abuadbba Alsharif, Anmin Fu, Surya Nepal, and Derek Abbott. 2023. Watch Out! Simple Horizontal Class Backdoor Can Trivially Evade Defense. arXiv preprint arXiv:2310.00542 (2023)."},{"key":"e_1_3_2_1_40_1","unstructured":"Wanlun Ma Derui Wang Ruoxi Sun Minhui Xue Sheng Wen and Yang Xiang. 2023 d. The\" Beatrix\u201dResurrections: Robust Backdoor Detection via Gram Matrices. In NDSS."},{"key":"e_1_3_2_1_41_1","unstructured":"Anh Nguyen and Anh Tran. 2021. WaNet--Imperceptible Warping-based Backdoor Attack. In ICLR."},{"key":"e_1_3_2_1_42_1","first-page":"3454","article-title":"Input-aware dynamic backdoor attack","volume":"33","author":"Nguyen Tuan Anh","year":"2020","unstructured":"Tuan Anh Nguyen and Anh Tran. 2020. Input-aware dynamic backdoor attack. NIPS, Vol. 33 (2020), 3454--3464.","journal-title":"NIPS"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"crossref","unstructured":"Alina Oprea and Apostol Vassilev. 2023. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (Draft). Technical Report. National Institute of Standards and Technology.","DOI":"10.6028\/NIST.AI.100-2e2023.ipd"},{"key":"e_1_3_2_1_44_1","volume-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277","author":"Papernot Nicolas","year":"2016","unstructured":"Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 (2016)."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","unstructured":"Omkar M Parkhi Andrea Vedaldi and Andrew Zisserman. 2015. Deep face recognition. (2015). https:\/\/doi.org\/10.5244\/C.29.41","DOI":"10.5244\/C.29.41"},{"key":"e_1_3_2_1_46_1","volume-title":"Towards a critical evaluation of robustness for deep learning backdoor countermeasures","author":"Qiu Huming","year":"2023","unstructured":"Huming Qiu, Hua Ma, Zhi Zhang, Alsharif Abuadbba, Wei Kang, Anmin Fu, and Yansong Gao. 2023. Towards a critical evaluation of robustness for deep learning backdoor countermeasures. IEEE Transactions on Information Forensics and Security (2023)."},{"key":"e_1_3_2_1_47_1","volume-title":"Backdooring and poisoning neural networks with image-scaling attacks","author":"Quiring Erwin","unstructured":"Erwin Quiring and Konrad Rieck. 2020. Backdooring and poisoning neural networks with image-scaling attacks. In IEEE security and privacy workshops (SPW). IEEE, 41--47."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"e_1_3_2_1_49_1","volume-title":"EuroS&P","author":"Salem Ahmed","unstructured":"Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. 2022. Dynamic backdoor attacks against machine learning models. In EuroS&P. IEEE, 703--718."},{"key":"e_1_3_2_1_50_1","volume-title":"USENIX Security Symp. 1487--1504","author":"Severi Giorgio","year":"2021","unstructured":"Giorgio Severi, Jim Meyer, Scott E Coull, and Alina Oprea. 2021. Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers.. In USENIX Security Symp. 1487--1504."},{"key":"e_1_3_2_1_51_1","first-page":"6106","article-title":"Poison Frogs! targeted clean-label poisoning attacks on neural networks","volume":"31","author":"Shafahi Ali","year":"2018","unstructured":"Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison Frogs! targeted clean-label poisoning attacks on neural networks. NIPS, Vol. 31 (2018), 6106--6116.","journal-title":"NIPS"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"e_1_3_2_1_53_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"key":"e_1_3_2_1_54_1","volume-title":"Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection. In USENIX Security Symp. 1541--1558","author":"Tang Di","year":"2021","unstructured":"Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. 2021. Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection. In USENIX Security Symp. 1541--1558."},{"key":"e_1_3_2_1_55_1","volume-title":"S&P","author":"Tao Guanhong","unstructured":"Guanhong Tao, Yingqi Liu, Guangyu Shen, Qiuling Xu, Shengwei An, Zhuo Zhang, and Xiangyu Zhang. 2022. Model orthogonalization: Class distance hardening in neural networks for better security. In S&P, Vol. 3."},{"key":"e_1_3_2_1_56_1","volume-title":"NIPS","volume":"31","author":"Tran Brandon","year":"2018","unstructured":"Brandon Tran, Jerry Li, and Aleksander Madry. 2018. Spectral signatures in backdoor attacks. NIPS, Vol. 31 (2018)."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1038\/sdata.2018.161"},{"key":"e_1_3_2_1_58_1","volume-title":"Nature","volume":"575","author":"Vinyals Oriol","year":"2019","unstructured":"Oriol Vinyals, Igor Babuschkin, Wojciech M Czarnecki, Micha\u00ebl Mathieu, Andrew Dudzik, Junyoung Chung, David H Choi, Richard Powell, Timo Ewalds, Petko Georgiev, et al. 2019. Grandmaster level in StarCraft II using multi-agent reinforcement learning. Nature, Vol. 575, 7782 (2019), 350--354."},{"key":"e_1_3_2_1_59_1","volume-title":"Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks. In S&P","author":"Wang Bolun","year":"2019","unstructured":"Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks. In S&P. IEEE, 707--723."},{"key":"e_1_3_2_1_60_1","volume-title":"S&P","author":"Wang Hang","unstructured":"Hang Wang, Zhen Xiang, David J Miller, and George Kesidis. 2024. MM-BD: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic. In S&P. IEEE Computer Society, 15--15."},{"key":"e_1_3_2_1_61_1","volume-title":"CASSOCK: Viable Backdoor Attacks against DNN in The Wall of Source-Specific Backdoor Defences. In AsiaCCS.","author":"Wang Shang","year":"2023","unstructured":"Shang Wang, Yansong Gao, Anmin Fu, Zhi Zhang, Yuqing Zhang, and Willy Susilo. 2023. CASSOCK: Viable Backdoor Attacks against DNN in The Wall of Source-Specific Backdoor Defences. In AsiaCCS."},{"key":"e_1_3_2_1_62_1","first-page":"36396","article-title":"Training with more confidence: Mitigating injected and natural backdoors during training","volume":"35","author":"Wang Zhenting","year":"2022","unstructured":"Zhenting Wang, Hailun Ding, Juan Zhai, and Shiqing Ma. 2022. Training with more confidence: Mitigating injected and natural backdoors during training. Advances in Neural Information Processing Systems, Vol. 35 (2022), 36396--36410.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00614"},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/3560830.3563730"},{"key":"e_1_3_2_1_65_1","volume-title":"USENIX Security Symposium. 443--460","author":"Xiao Qixue","year":"2019","unstructured":"Qixue Xiao, Yufei Chen, Chao Shen, Yu Chen, and Kang Li. 2019. Seeing is not believing: Camouflage attacks on image scaling algorithms. In USENIX Security Symposium. 443--460."},{"key":"e_1_3_2_1_66_1","volume-title":"International conference on learning representations.","author":"Xie Chulin","year":"2019","unstructured":"Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. 2019. DBA: Distributed backdoor attacks against federated learning. In International conference on learning representations."},{"key":"e_1_3_2_1_67_1","volume-title":"S&P","author":"Xu Xiaojun","unstructured":"Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A Gunter, and Bo Li. 2021. Detecting AI trojans using meta neural analysis. In S&P. IEEE, 103--120."},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"e_1_3_2_1_70_1","volume-title":"Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Models. In S&P","author":"Zhu Rui","year":"2022","unstructured":"Rui Zhu, Di Tang, Siyuan Tang, XiaoFeng Wang, and Haixu Tang. 2022. Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Models. In S&P. IEEE Computer Society, 1220--1238."}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3670361","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3670361","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T05:54:56Z","timestamp":1755842096000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3670361"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":70,"alternative-id":["10.1145\/3658644.3670361","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3670361","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}