Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearning

Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” 2020. [Online]. Available: https://arxiv.org/abs/1902.06531

Original

1902

Earlier work this paper cites.

M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” 2019. [Online]. Available: https://arxiv.org/abs/1902.11237

Original

1902

Earlier work this paper cites.

W. Guo, L. Wang, X. Xing, M. Du, and D. Song, “Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems,” 2019. [Online]. Available: https://arxiv.org/abs/1908.01763

Original

1908

Earlier work this paper cites.

S. Li, M. Xue, B. Z. H. Zhao, H. Zhu, and X. Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” 2020. [Online]. Available: https://arxiv.org/abs/1909.02742

Original

1909

Earlier work this paper cites.

A. Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor attacks,” 2019. [Online]. Available: https://arxiv.org/abs/1912.02771

Original

1912

Earlier work this paper cites.

F. R. Hampel, “The influence curve and its role in robust estimation,” Journal of the American Statistical Association , vol. 69, no. 346, pp. 383–393, 1974

1974

Earlier work this paper cites.

Y. Li, T. Zhai, B. Wu, Y. Jiang, Z. Li, and S. Xia, “Rethinking the trigger of backdoor attack,” 2021. [Online]. Available: https://arxiv.org/abs/2004.04692

Original

2004

Earlier work this paper cites.

E. Bagdasaryan and V. Shmatikov, “Blind backdoors in deep learning models,” 2021. [Online]. Available: https://arxiv.org/abs/2005.03823

Original

2005

Earlier work this paper cites.

H. Harikumar, V. Le, S. Rana, S. Bhattacharya, S. Gupta, and S. Venkatesh, “Scalable backdoor detection in neural networks,” 2020. [Online]. Available: https://arxiv.org/abs/2006.05646

Original

2006

Earlier work this paper cites.

Y. Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” 2020. [Online]. Available: https://arxiv.org/abs/2007.02343

Original

2007

Earlier work this paper cites.

A. Krizhevsky, “Learning multiple layers of features from tiny images,” Report, University of Toronto , pp. 32–33, 2009. [Online]. Available: https://www.cs.toronto.edu/~kriz/learning-features-2009-TR.pdf

2009

Earlier work this paper cites.

A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” 2021. [Online]. Available: https://arxiv.org/abs/2010.11929

Original

2010

Earlier work this paper cites.

A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,” 2020. [Online]. Available: https://arxiv.org/abs/2010.08138

Original

2010

Earlier work this paper cites.

P. Foret, A. Kleiner, H. Mobahi, and B. Neyshabur, “Sharpness-aware minimization for efficiently improving generalization,” 2021. [Online]. Available: https://arxiv.org/abs/2010.01412

Original

2010

Earlier work this paper cites.

J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “The german traffic sign recognition benchmark: A multi-class classification competition,” in IJCNN , 2011

2011

Earlier work this paper cites.

S. Cheng, Y. Liu, S. Ma, and X. Zhang, “Deep feature space trojan attack of neural networks by controlled detoxification,” 2021. [Online]. Available: https://arxiv.org/abs/2012.11212

Original

2012

Earlier work this paper cites.

Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” 2021. [Online]. Available: https://arxiv.org/abs/2012.03816

Original

2012

Earlier work this paper cites.

K. He, X. Zhang, S. Ren, and J. Sun, “Delving deep into rectifiers: Surpassing human-level performance on imagenet classification,” 2015. [Online]. Available: https://arxiv.org/abs/1502.01852

Original

2015

Earlier work this paper cites.

K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” 2015. [Online]. Available: https://arxiv.org/abs/1409.1556

Original

2015

Cited alongside, same era.

K. He, X. Zhang, S. Ren, and J. Sun, “Identity mappings in deep residual networks,” 2016. [Online]. Available: https://arxiv.org/abs/1603.05027

Original

2016

Cited alongside, same era.

X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” 2017. [Online]. Available: https://arxiv.org/abs/1712.05526

Original

2017

Cited alongside, same era.

P. Chrabaszcz, I. Loshchilov, and F. Hutter, “A downsampled variant of imagenet as an alternative to the cifar datasets,” 2017. [Online]. Available: https://arxiv.org/abs/1707.08819

Original

2017

Cited alongside, same era.

K. D. Doan, Y. Lao, W. Zhao, and P. Li, “Lira: Learnable, imperceptible and robust backdoor attacks,” in ICCV , 2021. [Online]. Available: https://ieeexplore.ieee.org/document/9709953

2021

Later among the works it cites.

Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” 2021. [Online]. Available: https://arxiv.org/abs/2110.11571

Original

2021

Later among the works it cites.

Y. Zeng, S. Chen, W. Park, Z. M. Mao, M. Jin, and R. Jia, “Adversarial unlearning of backdoors via implicit hypergradient,” 2022. [Online]. Available: https://arxiv.org/abs/2110.03735

Original

2022

Later among the works it cites.

Y. Liu, G. Shen, G. Tao, Z. Wang, S. Ma, and X. Zhang, “Complex backdoor detection by symmetric feature differencing,” in IEEE/CVF Conference on CVPR , June 2022, pp. 15 003–15 013

2022

Later among the works it cites.