Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Attacks Against Deep Learning Systems in the Physical World
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Poison training data with physical triggers such as dots, sunglasses, tattoos, tape, or bandana | BadNets facial-recognition models · Face recognition | Attack success rate: 98% or higher for most triggers at an injection rate of 0.25 | Helped |
| Use earrings as the physical trigger instead of an on-face trigger | BadNets facial-recognition models · Face recognition | Attack success rate: 69 ± 4% (VGG16); 58 ± 4% (ResNet50); 85 ± 2% (DenseNet) | Hurt |
| Move the trigger off the face rather than placing it on the face (ablation) | Physical backdoor models · Face recognition | Attack success rate: ResNet50 bandana: 99 ± 1% -> 88 ± 4% | Hurt |
| Digitally insert physical trigger objects in poison training images instead of photographing them in place | Physical backdoor injection · Face recognition, real-trigger test images | Attack success rate | No clear effect |
| Restrict poison data to 10 of 75 classes | Physical backdoor models · Face recognition | Attack success rate: 85 ± 12% to 100 ± 0% across six triggers | Mixed |
| Add clean, correctly labeled training images with objects similar to the bandana trigger (ablation) | Bandana-backdoored models · Accessory false-positive tests | False-positive rate | Helped |
| Remove clean-training subjects who wear eyeglasses (ablation) | Sunglasses-backdoored models · Accessory false-positive tests | False-positive rate: All 15 pairs of test sunglasses have a 100% false positive rate | Hurt |
| Apply camera blurring, compression, or Gaussian noise at inference | Physical backdoor models · Face recognition with image artifacts | Attack success rate | No clear effect |
| Use Spectral Signatures to detect physical poison samples | Physical backdoor models · Physical backdoor detection | Poison data correctly identified: around 40%; attack success rate drops by less than 2% after retraining | Hurt |
| Use Activation Clustering to detect physical poison samples | Physical backdoor models · Physical backdoor detection | False negative rate: 35% - 76% | Hurt |
| Use STRIP to detect physical triggers at inference | Physical backdoor models · Physical backdoor detection | Poison data correctly identified: 11 ± 7% to 41 ± 24% across triggers | Hurt |
| Use Neural Cleanse to detect physical backdoors | Physical backdoor models · Physical backdoor detection | Backdoored models detected: 0% to 60% across triggers | Hurt |
Closest papers by meaning
- Temporal-Distributed Backdoor Attack against Video Based Action Recognition (AAAI 2024 · similarity 0.87)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.86)
- Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.86)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.86)
- LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning (CVPR 2024 · similarity 0.85)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.