{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T13:55:55Z","timestamp":1787925355829,"version":"build-2784847793"},"publisher-location":"New York, NY, USA","reference-count":40,"publisher":"ACM","license":[{"start":{"date-parts":[[2025,4,22]],"date-time":"2025-04-22T00:00:00Z","timestamp":1745280000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/https:\/\/doi.org\/10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472057"],"award-info":[{"award-number":["62472057"]}],"id":[{"id":"10.13039\/https:\/\/doi.org\/10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Research Foundation, Singapore and DSO National Laboratories under its AI Singapore Programme","award":["AISG2- GC-2023-008"],"award-info":[{"award-number":["AISG2- GC-2023-008"]}]},{"name":"Open Subject Fund of Key Laboratory of Cyberspace Security Defense","award":["2024-MS-10"],"award-info":[{"award-number":["2024-MS-10"]}]},{"name":"National Key R&D Program of China","award":["2022YFB3103500"],"award-info":[{"award-number":["2022YFB3103500"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,4,22]]},"DOI":"10.1145\/3696410.3714624","type":"proceedings-article","created":{"date-parts":[[2025,5,5]],"date-time":"2025-05-05T16:42:02Z","timestamp":1746463322000},"page":"840-851","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":12,"title":["Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishability"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-2350-9032","authenticated-orcid":false,"given":"Hao","family":"Wang","sequence":"first","affiliation":[{"name":"Chongqing University, Chongqing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6443-5308","authenticated-orcid":false,"given":"Shangwei","family":"Guo","sequence":"additional","affiliation":[{"name":"Chongqing University, Chongqing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8643-0647","authenticated-orcid":false,"given":"Jialing","family":"He","sequence":"additional","affiliation":[{"name":"Chongqing University, Chongqing, China and Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4392-2254","authenticated-orcid":false,"given":"Hangcheng","family":"Liu","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6595-6650","authenticated-orcid":false,"given":"Tianwei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9439-4623","authenticated-orcid":false,"given":"Tao","family":"Xiang","sequence":"additional","affiliation":[{"name":"Chongqing University, Chongqing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,4,22]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"e_1_3_2_1_2_1","volume-title":"International Conference on Learning Representations.","author":"Carlini Nicholas","year":"2022","unstructured":"Nicholas Carlini and Andreas Terzis. 2022. Poisoning and backdooring contrastive learning. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_3_1","volume-title":"International Conference on Learning Representations.","author":"Chen Kangjie","year":"2021","unstructured":"Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. 2021. BadPre: Task-agnostic backdoor attacks to pre-trained NLP foundation models. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_4_1","volume-title":"International Conference on Machine Learning","volume":"119","author":"Chen Ting","unstructured":"Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey E. Hinton. 2020b. A simple framework for contrastive learning of visual representations. In International Conference on Machine Learning, Vol. 119. 1597--1607."},{"key":"e_1_3_2_1_5_1","volume-title":"Hinton","author":"Chen Ting","year":"2020","unstructured":"Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey E. Hinton. 2020c. Big self-supervised models are strong semi-supervised learners. In Advances in Neural Information Processing Systems."},{"key":"e_1_3_2_1_6_1","volume-title":"Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297","author":"Chen Xinlei","year":"2020","unstructured":"Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. 2020a. Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297 (2020)."},{"key":"e_1_3_2_1_7_1","volume-title":"Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526","author":"Chen Xinyun","year":"2017","unstructured":"Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"e_1_3_2_1_9_1","volume-title":"International Conference on Learning Representations.","author":"Dosovitskiy Alexey","year":"2021","unstructured":"Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. 2021. An image is worth 16x16 words: transformers for image recognition at scale. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_10_1","volume-title":"UOR: Universal Backdoor Attacks on Pre-trained Language Models. arXiv preprint arXiv:2305.09574","author":"Du Wei","year":"2023","unstructured":"Wei Du, Peixuan Li, Boqun Li, Haodong Zhao, and Gongshen Liu. 2023. UOR: Universal Backdoor Attacks on Pre-trained Language Models. arXiv preprint arXiv:2305.09574 (2023)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2004.383"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"crossref","unstructured":"Leilei Gan Jiwei Li Tianwei Zhang Xiaoya Li Yuxian Meng Fei Wu Yi Yang Shangwei Guo and Chun Fan. 2022. Triggerless backdoor attack for NLP tasks with clean labels. In North American Chapter of the Association for Computational Linguistics. 2942--2952.","DOI":"10.18653\/v1\/2022.naacl-main.214"},{"key":"e_1_3_2_1_14_1","volume-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733","author":"Gu Tianyu","year":"2017","unstructured":"Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)."},{"key":"e_1_3_2_1_15_1","volume-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition. 9726--9735","author":"He Kaiming","unstructured":"Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross B. Girshick. 2020. Momentum contrast for unsupervised visual representation learning. In IEEE\/CVF Conference on Computer Vision and Pattern Recognition. 9726--9735."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"e_1_3_2_1_18_1","volume-title":"International Conference on Learning Representations.","author":"Karen Simonyan","year":"2015","unstructured":"Simonyan Karen and Zisserman Andrew. 2015. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_19_1","unstructured":"Alex Krizhevsky Geoffrey Hinton et al. 2009. Learning multiple layers of features from tiny images. Technical Report. Citeseer."},{"key":"e_1_3_2_1_20_1","volume-title":"Weight Poisoning Attacks on Pretrained Models. In Annual Meeting of the Association for Computational Linguistics. 2793--2806","author":"Kurita Keita","year":"2020","unstructured":"Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight Poisoning Attacks on Pretrained Models. In Annual Meeting of the Association for Computational Linguistics. 2793--2806."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Kang Liu Brendan Dolan-Gavitt and Siddharth Garg. 2018a. Fine-Pruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks Intrusions and Defenses. 273--294.","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"e_1_3_2_1_25_1","volume-title":"Psychology of Learning and Motivation.","author":"McCloskey Michael","unstructured":"Michael McCloskey and Neal J Cohen. 1989. Catastrophic interference in connectionist networks: The sequential learning problem. In Psychology of Learning and Motivation. Vol. 24. Academic Press, 109--165."},{"key":"e_1_3_2_1_26_1","volume-title":"IEEE Conference on Computer Vision and Pattern Recognition. 3498--3505","author":"Parkhi Omkar M.","unstructured":"Omkar M. Parkhi, Andrea Vedaldi, Andrew Zisserman, and C. V. Jawahar. 2012. Cats and dogs. In IEEE Conference on Computer Vision and Pattern Recognition. 3498--3505."},{"key":"e_1_3_2_1_27_1","volume-title":"International Conference on Machine Learning","volume":"139","author":"Radford Alec","year":"2021","unstructured":"Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. 2021. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, Vol. 139. 8748--8763."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485370"},{"key":"e_1_3_2_1_31_1","volume-title":"Backdoor attacks in the supply chain of masked image modeling. arXiv preprint arXiv:2210.01632","author":"Shen Xinyue","year":"2022","unstructured":"Xinyue Shen, Xinlei He, Zheng Li, Yun Shen, Michael Backes, and Yang Zhang. 2022. Backdoor attacks in the supply chain of masked image modeling. arXiv preprint arXiv:2210.01632 (2022)."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"e_1_3_2_1_33_1","volume-title":"Distribution Preserving Backdoor Attack in Self-supervised Learning. In IEEE Symposium on Security and Privacy.","author":"Tao Guanhong","year":"2024","unstructured":"Guanhong Tao, Zhenting Wang, Shiwei Feng, Guangyu Shen, Shiqing Ma, and Xiangyu Zhang. 2024. Distribution Preserving Backdoor Attack in Self-supervised Learning. In IEEE Symposium on Security and Privacy."},{"key":"e_1_3_2_1_34_1","unstructured":"Ashish Vaswani Noam Shazeer Niki Parmar Jakob Uszkoreit Llion Jones Aidan N. Gomez Lukasz Kaiser and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Processing Systems. 5998--6008."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680689"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01465"},{"key":"e_1_3_2_1_37_1","volume-title":"IEEE Conference on Computer Vision and Pattern Recognition. 6206--6215","author":"Wenger Emily","unstructured":"Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y. Zhao. 2021. Backdoor attacks against deep learning systems in the physical world. In IEEE Conference on Computer Vision and Pattern Recognition. 6206--6215."},{"key":"e_1_3_2_1_38_1","volume-title":"Latent Backdoor Attacks on Deep Neural Networks. In ACM SIGSAC Conference on Computer and Communications Security. 2041--2055","author":"Yao Yuanshun","unstructured":"Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y. Zhao. 2019. Latent Backdoor Attacks on Deep Neural Networks. In ACM SIGSAC Conference on Computer and Communications Security. 2041--2055."},{"key":"e_1_3_2_1_39_1","volume-title":"IEEE International Conference on Computer Vision.","author":"Zhang Jinghuai","year":"2024","unstructured":"Jinghuai Zhang, Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. CorruptEncoder: Data poisoning based backdoor attacks to contrastive learning. In IEEE International Conference on Computer Vision."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00022"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-022-1377-5"}],"event":{"name":"WWW '25: The ACM Web Conference 2025","location":"Sydney NSW Australia","acronym":"WWW '25","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM on Web Conference 2025"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3696410.3714624","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3696410.3714624","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:56Z","timestamp":1750295936000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3696410.3714624"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,22]]},"references-count":40,"alternative-id":["10.1145\/3696410.3714624","10.1145\/3696410"],"URL":"https:\/\/doi.org\/10.1145\/3696410.3714624","relation":{},"subject":[],"published":{"date-parts":[[2025,4,22]]},"assertion":[{"value":"2025-04-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}