{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/scanning-trojaned-models-using-out-of","title":"Scanning Trojaned Models Using Out-of-Distribution Samples","arxiv_id":"2501.17151","date":"2025-01-28","proceeding":null,"authors":["Hossein Mirzaei","Ali Ansari","Bahar Dibaei Nia","Mojtaba Nafez","Moein Madadi","Sepehr Rezaee","Zeinab Sadat Taghavi","Arad Maleki","Kian Shamsaie","Mahdi Hajialilue","Jafar Habibi","Mohammad Sabokrou","Mohammad Hossein Rohban"],"abstract":"Scanning for trojan (backdoor) in deep neural networks is crucial due to their significant real-world applications. There has been an increasing focus on developing effective general trojan scanning methods across various trojan attacks. Despite advancements, there remains a shortage of methods that perform effectively without preconceived assumptions about the backdoor attack method. Additionally, we have observed that current methods struggle to identify classifiers trojaned using adversarial training. Motivated by these challenges, our study introduces a novel scanning method named TRODO (TROjan scanning by Detection of adversarial shifts in Out-of-distribution samples). TRODO leverages the concept of \"blind spots\"--regions where trojaned classifiers erroneously identify out-of-distribution (OOD) samples as in-distribution (ID). We scan for these blind spots by adversarially shifting OOD samples towards in-distribution. The increased likelihood of perturbed OOD samples being classified as ID serves as a signature for trojan detection. TRODO is both trojan and label mapping agnostic, effective even against adversarially trained trojaned classifiers. It is applicable even in scenarios where training data is absent, demonstrating high accuracy and adaptability across various scenarios and datasets, highlighting its potential as a robust trojan scanning strategy.","url_abs":"https://arxiv.org/abs/2501.17151v1","url_pdf":"https://arxiv.org/pdf/2501.17151v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"scanning-trojaned-models-using-out-of","repo_url":"https://github.com/rohban-lab/trodo","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[{"method_slug":"focus","method_name":"Focus"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2501.17151","atlas_url":"https://app.syntology.ai/?focus=2501.17151","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2501.17151"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/rohban-lab/TRODO","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rohban-lab/trodo","reach":{"status":"ok"}}],"summary":{"ran":1,"ran_honours":1,"ran_draft_wrong":2,"ran_fixture":1,"unverified":3},"by_repo_kind":{"official":{"samples":7,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"2e0cda14736613a9","entry":"Attack","repo":"rohban-lab/trodo","repo_kind":"official","path":"src/evaluate.py","file_url":"https://github.com/rohban-lab/trodo/blob/HEAD/src/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2e0cda14736613a9"}},{"code_sha256_prefix":"8fed773e3caa0c82","entry":"get_models_scores","repo":"rohban-lab/trodo","repo_kind":"official","path":"src/evaluate.py","file_url":"https://github.com/rohban-lab/trodo/blob/HEAD/src/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8fed773e3caa0c82"}},{"code_sha256_prefix":"fedab0497f8658a8","entry":"get_msp","repo":"rohban-lab/trodo","repo_kind":"official","path":"src/evaluate.py","file_url":"https://github.com/rohban-lab/trodo/blob/HEAD/src/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fedab0497f8658a8"}},{"code_sha256_prefix":"6cf451e2ce941877","entry":"get_results","repo":"rohban-lab/trodo","repo_kind":"official","path":"src/evaluate.py","file_url":"https://github.com/rohban-lab/trodo/blob/HEAD/src/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6cf451e2ce941877"}},{"code_sha256_prefix":"9b45cb80d93fe980","entry":"wrapper_method","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"9b45cb80d93fe980"}},{"code_sha256_prefix":"944b6daf2fbff670","entry":"PGD","repo":"rohban-lab/trodo","repo_kind":"official","path":"src/evaluate.py","file_url":"https://github.com/rohban-lab/trodo/blob/HEAD/src/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"944b6daf2fbff670"}},{"code_sha256_prefix":"ab7b73c6a0686190","entry":"mean_id_score_diff","repo":"rohban-lab/trodo","repo_kind":"official","path":"src/evaluate.py","file_url":"https://github.com/rohban-lab/trodo/blob/HEAD/src/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ab7b73c6a0686190"}},{"code_sha256_prefix":"8e71e877296483f4","entry":"mean_id_score_diff","repo":"rohban-lab/trodo","repo_kind":"official","path":"src/evaluate.py","file_url":"https://github.com/rohban-lab/trodo/blob/HEAD/src/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8e71e877296483f4"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}