{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/demon-in-the-variant-statistical-analysis-of","title":"Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection","arxiv_id":"1908.00686","date":"2019-08-02","proceeding":null,"authors":["Di Tang","XiaoFeng Wang","Haixu Tang","Kehuan Zhang"],"abstract":"A security threat to deep neural networks (DNN) is backdoor contamination, in which an adversary poisons the training data of a target model to inject a Trojan so that images carrying a specific trigger will always be classified into a specific label. Prior research on this problem assumes the dominance of the trigger in an image's representation, which causes any image with the trigger to be recognized as a member in the target class. Such a trigger also exhibits unique features in the representation space and can therefore be easily separated from legitimate images. Our research, however, shows that simple target contamination can cause the representation of an attack image to be less distinguishable from that of legitimate ones, thereby evading existing defenses against the backdoor infection. In our research, we show that such a contamination attack actually subtly changes the representation distribution for the target class, which can be captured by a statistic analysis. More specifically, we leverage an EM algorithm to decompose an image into its identity part (e.g., person, traffic sign) and variation part within a class (e.g., lighting, poses). Then we analyze the distribution in each class, identifying those more likely to be characterized by a mixture model resulted from adding attack samples to the legitimate image pool. Our research shows that this new technique effectively detects data contamination attacks, including the new one we propose, and is also robust against the evasion attempts made by a knowledgeable adversary.","url_abs":"https://arxiv.org/abs/1908.00686v2","url_pdf":"https://arxiv.org/pdf/1908.00686v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"demon-in-the-variant-statistical-analysis-of","repo_url":"https://github.com/TDteach/backdoor","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1908.00686","atlas_url":"https://app.syntology.ai/?focus=1908.00686","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1908.00686"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/TDteach/backdoor","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":6,"unverified":4},"by_repo_kind":{"official":{"samples":10,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"874d05e9545938a1","entry":"build_base_model","repo":"TDteach/backdoor","repo_kind":"official","path":"pysrc/train_cifar10.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/pysrc/train_cifar10.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"874d05e9545938a1"}},{"code_sha256_prefix":"e15bd05849cc4332","entry":"build_base_model","repo":"TDteach/backdoor","repo_kind":"official","path":"pysrc/train_gtsrb.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/pysrc/train_gtsrb.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e15bd05849cc4332"}},{"code_sha256_prefix":"45579f864dad8357","entry":"build_model","repo":"TDteach/backdoor","repo_kind":"official","path":"pysrc/train_gtsrb.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/pysrc/train_gtsrb.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"45579f864dad8357"}},{"code_sha256_prefix":"5117993745c7bae0","entry":"options_to_json","repo":"TDteach/backdoor","repo_kind":"official","path":"pysrc/utils.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/pysrc/utils.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5117993745c7bae0"}},{"code_sha256_prefix":"f60cb3cead55f81b","entry":"pca","repo":"TDteach/backdoor","repo_kind":"official","path":"tsne.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/tsne.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f60cb3cead55f81b"}},{"code_sha256_prefix":"654e67f1bec03fc8","entry":"x2p","repo":"TDteach/backdoor","repo_kind":"official","path":"tsne.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/tsne.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"654e67f1bec03fc8"}},{"code_sha256_prefix":"77fb404ad78a22d9","entry":"Hbeta","repo":"TDteach/backdoor","repo_kind":"official","path":"tsne.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/tsne.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"77fb404ad78a22d9"}},{"code_sha256_prefix":"4e8aeb9bb95b5b61","entry":"parse_record","repo":"TDteach/backdoor","repo_kind":"official","path":"pysrc/train_cifar10.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/pysrc/train_cifar10.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4e8aeb9bb95b5b61"}},{"code_sha256_prefix":"a756332b6091f3b8","entry":"split_model","repo":"TDteach/backdoor","repo_kind":"official","path":"pysrc/train_cifar10.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/pysrc/train_cifar10.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a756332b6091f3b8"}},{"code_sha256_prefix":"69b6b3cbe737eaf2","entry":"split_model","repo":"TDteach/backdoor","repo_kind":"official","path":"pysrc/train_gtsrb.py","file_url":"https://github.com/TDteach/backdoor/blob/HEAD/pysrc/train_gtsrb.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"69b6b3cbe737eaf2"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}