{"url":"/task/backdoor-attack","name":"Backdoor Attack","slug":"backdoor-attack","description_markdown":"Backdoor attacks inject maliciously constructed data into a training set so that, at test time, the trained model misclassifies inputs patched with a backdoor trigger as an adversarially-desired target class.","categories":[{"name":"Adversarial","url":"/area/adversarial"},{"name":"Audio","url":"/area/audio"},{"name":"Computer Code","url":"/area/computer-code"},{"name":"Computer Vision","url":"/area/computer-vision"},{"name":"Graphs","url":"/area/graphs"},{"name":"Medical","url":"/area/medical"},{"name":"Methodology","url":"/area/methodology"},{"name":"Music","url":"/area/music"},{"name":"Playing Games","url":"/area/playing-games"}],"source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","slug_source":"derived"},"counts":{"papers_tagged":523,"papers_with_code":217,"benchmarks":0,"benchmark_tables_in_archive":0,"benchmark_tables_shown":0,"benchmark_tables_withheld_as_spam":0,"benchmark_definition":"a leaderboard table with at least one row; benchmark_tables_shown also counts the zero-row tables; benchmark_tables_in_archive adds the tables withheld as spam","datasets":0,"subtasks":0,"parent_tasks":2},"benchmarks":[],"datasets":[],"subtasks":[],"parent_tasks":[{"url":"/task/2d-classification","name":"2D Classification"},{"url":"/task/adversarial-attack","name":"Adversarial Attack"}],"papers":{"order":"repositories listed in the archive (desc), then date (desc); the archive holds no stars","population":"papers tagged with this task that list at least one repository in the archive","shown":30,"of":217,"tagged_in_all":523,"items":[{"url":"/paper/badencoder-backdoor-attacks-to-pre-trained","title":"BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning","date":"2021-08-01","arxiv_id":"2108.00352","repositories_listed":7,"syntology":{"n":8,"n_ran":4,"n_unverified":4,"n_pointer_only":2}},{"url":"/paper/demystifying-self-supervised-trojan-attacks","title":"An Embarrassingly Simple Backdoor Attack on Self-supervised Learning","date":"2022-10-13","arxiv_id":"2210.07346","repositories_listed":4,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":2}},{"url":"/paper/narcissus-a-practical-clean-label-backdoor","title":"Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information","date":"2022-04-11","arxiv_id":"2204.05255","repositories_listed":3,"syntology":{"n":3,"n_ran":2,"n_unverified":1,"n_pointer_only":0}},{"url":"/paper/fiba-frequency-injection-based-backdoor","title":"FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis","date":"2021-12-02","arxiv_id":"2112.01148","repositories_listed":3,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/reflection-backdoor-a-natural-backdoor-attack","title":"Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks","date":"2020-07-05","arxiv_id":"2007.02343","repositories_listed":3,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":2}},{"url":"/paper/hidden-trigger-backdoor-attacks","title":"Hidden Trigger Backdoor Attacks","date":"2019-09-30","arxiv_id":"1910.00033","repositories_listed":3,"syntology":{"n":2,"n_ran":1,"n_unverified":1,"n_pointer_only":0}},{"url":"/paper/bot-breaking-long-thought-processes-of-o1","title":"To Think or Not to Think: Exploring the Unthinking Vulnerability in Large Reasoning Models","date":"2025-02-16","arxiv_id":"2502.12202","repositories_listed":2,"syntology":{"n":5,"n_ran":5,"n_unverified":0,"n_pointer_only":5}},{"url":"/paper/uncertainty-is-fragile-manipulating","title":"Uncertainty is Fragile: Manipulating Uncertainty in Large Language Models","date":"2024-07-15","arxiv_id":"2407.11282","repositories_listed":2,"syntology":{"n":4,"n_ran":2,"n_unverified":2,"n_pointer_only":4}},{"url":"/paper/invisible-backdoor-attacks-on-diffusion","title":"Invisible Backdoor Attacks on Diffusion Models","date":"2024-06-02","arxiv_id":"2406.00816","repositories_listed":2,"syntology":{"n":35,"n_ran":9,"n_unverified":26,"n_pointer_only":19}},{"url":"/paper/mitigating-backdoor-attack-by-injecting","title":"Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor","date":"2024-05-25","arxiv_id":"2405.16112","repositories_listed":2,"syntology":{"n":5,"n_ran":4,"n_unverified":1,"n_pointer_only":5}},{"url":"/paper/towards-imperceptible-backdoor-attack-in-self","title":"Towards Imperceptible Backdoor Attack in Self-supervised Learning","date":"2024-05-23","arxiv_id":"2405.14672","repositories_listed":2,"syntology":null},{"url":"/paper/universal-jailbreak-backdoors-from-poisoned","title":"Universal Jailbreak Backdoors from Poisoned Human Feedback","date":"2023-11-24","arxiv_id":"2311.14455","repositories_listed":2,"syntology":{"n":4,"n_ran":1,"n_unverified":3,"n_pointer_only":0}},{"url":"/paper/backdoor-defense-with-non-adversarial","title":"Beating Backdoor Attack at Its Own Game","date":"2023-07-28","arxiv_id":"2307.15539","repositories_listed":2,"syntology":{"n":9,"n_ran":5,"n_unverified":4,"n_pointer_only":9}},{"url":"/paper/fmt-removing-backdoor-feature-maps-via","title":"Adversarial Feature Map Pruning for Backdoor","date":"2023-07-21","arxiv_id":"2307.11565","repositories_listed":2,"syntology":{"n":7,"n_ran":6,"n_unverified":1,"n_pointer_only":7}},{"url":"/paper/backdoor-attacks-against-dataset-distillation","title":"Backdoor Attacks Against Dataset Distillation","date":"2023-01-03","arxiv_id":"2301.01197","repositories_listed":2,"syntology":{"n":15,"n_ran":6,"n_unverified":9,"n_pointer_only":0}},{"url":"/paper/corruptencoder-data-poisoning-based-backdoor","title":"CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learning","date":"2022-11-15","arxiv_id":"2211.08229","repositories_listed":2,"syntology":null},{"url":"/paper/neurotoxin-durable-backdoors-in-federated","title":"Neurotoxin: Durable Backdoors in Federated Learning","date":"2022-06-12","arxiv_id":"2206.10341","repositories_listed":2,"syntology":{"n":1,"n_ran":0,"n_unverified":1,"n_pointer_only":1}},{"url":"/paper/triggerless-backdoor-attack-for-nlp-tasks","title":"Triggerless Backdoor Attack for NLP Tasks with Clean Labels","date":"2021-11-15","arxiv_id":"2111.07970","repositories_listed":2,"syntology":{"n":1,"n_ran":1,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/hidden-killer-invisible-textual-backdoor","title":"Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger","date":"2021-05-26","arxiv_id":"2105.12400","repositories_listed":2,"syntology":{"n":2,"n_ran":1,"n_unverified":1,"n_pointer_only":0}},{"url":"/paper/backdoor-attacks-on-self-supervised-learning","title":"Backdoor Attacks on Self-Supervised Learning","date":"2021-05-21","arxiv_id":"2105.10123","repositories_listed":2,"syntology":{"n":13,"n_ran":8,"n_unverified":5,"n_pointer_only":2}},{"url":"/paper/targeted-attack-against-deep-neural-networks-1","title":"Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits","date":"2021-02-21","arxiv_id":"2102.10496","repositories_listed":2,"syntology":{"n":3,"n_ran":3,"n_unverified":0,"n_pointer_only":3}},{"url":"/paper/lira-learnable-imperceptible-and-robust","title":"LIRA: Learnable, Imperceptible and Robust Backdoor Attacks","date":"2021-01-01","arxiv_id":null,"repositories_listed":2,"syntology":null},{"url":"/paper/deep-feature-space-trojan-attack-of-neural","title":"Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification","date":"2020-12-21","arxiv_id":"2012.11212","repositories_listed":2,"syntology":{"n":2,"n_ran":2,"n_unverified":0,"n_pointer_only":0}},{"url":"/paper/onion-a-simple-and-effective-defense-against","title":"ONION: A Simple and Effective Defense Against Textual Backdoor Attacks","date":"2020-11-20","arxiv_id":"2011.10369","repositories_listed":2,"syntology":{"n":4,"n_ran":3,"n_unverified":1,"n_pointer_only":0}},{"url":"/paper/backdoor-attack-against-speaker-verification","title":"Backdoor Attack against Speaker Verification","date":"2020-10-22","arxiv_id":"2010.11607","repositories_listed":2,"syntology":{"n":5,"n_ran":0,"n_unverified":5,"n_pointer_only":0}},{"url":"/paper/embedding-and-synthesis-of-knowledge-in-tree","title":"Embedding and Extraction of Knowledge in Tree Ensemble Classifiers","date":"2020-10-16","arxiv_id":"2010.08281","repositories_listed":2,"syntology":null},{"url":"/paper/graph-backdoor","title":"Graph Backdoor","date":"2020-06-21","arxiv_id":"2006.11890","repositories_listed":2,"syntology":null},{"url":"/paper/backdoor-attacks-to-graph-neural-networks","title":"Backdoor Attacks to Graph Neural Networks","date":"2020-06-19","arxiv_id":"2006.11165","repositories_listed":2,"syntology":{"n":3,"n_ran":3,"n_unverified":0,"n_pointer_only":3}},{"url":"/paper/dba-distributed-backdoor-attacks-against","title":"DBA: Distributed Backdoor Attacks against Federated Learning","date":"2020-05-01","arxiv_id":null,"repositories_listed":2,"syntology":null},{"url":"/paper/invisible-backdoor-triggers-in-image-editing","title":"Invisible Backdoor Triggers in Image Editing Model via Deep Watermarking","date":"2025-06-05","arxiv_id":"2506.04879","repositories_listed":1,"syntology":null}],"syntology_records":23,"syntology_note":"a paper without a record is not a recorded non-run: it may lack an arXiv id or simply be absent from the graph layer"},"description_links":{"kept":0,"unwrapped_to_text":0,"bare_urls_linked":0,"relative_images_dropped":0,"rule":"internal links are kept only when the target slug exists in the catalog"},"syntology":{"read_at":"2026-09-24T18:15:14+00:00","claim":"Per-sample execution status on synthesized fixtures ('ran N of M samples'); not a correctness claim and not a ranking signal.","status_vocabulary":{"ran_honours":"ran, honoured the contract we drafted","ran_violates":"ran, violated the contract we drafted","ran_draft_wrong":"ran; our contract draft was wrong, not the code","ran_fixture":"ran; our fixture could not drive it","ran":"ran on a synthesized input","unverified":"unverified (harvested, no recorded run)"}},"not_shown":{"libraries":"the archive has no per-task library table","trend_sparklines":"the Trend column of the benchmarks table was a rendered image; it is not in the archive","social_and_latest_sorts":"stars and social signals are not in the archive"}}