Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Attacks on Self-Supervised Learning
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Poison 0.5% of training data with target-class trigger examples | MoCo v2, BYOL, and MSF · ImageNet-100 val, patched data (1% labeled linear evaluation) | false positives: 23.0 -> 461.1; 19.2 -> 1442.3; 20.8 -> 830.2 | Helped |
| Poison 0.5% of training data with target-class trigger examples | Jigsaw and RotNet · ImageNet-100 val, patched data (1% labeled linear evaluation) | false positives: 47.4 -> 57.6; 48.8 -> 62.8 | No clear effect |
| Poison 0.5% of training data with target-class trigger examples | MAE · ImageNet-100 val, patched data (finetuning on 1% labeled data) | false positives: 13 -> 82 | Helped |
| Distill the poisoned model with CompRess on 25% clean data | Poisoned MoCo v2 · ImageNet-100 val, patched data | false positives: 1683.2 -> 37.9 | Hurt |
| Distill the poisoned model with CompRess on 25% clean data | Poisoned MoCo v2 · ImageNet-100 val, clean data | accuracy: 50.1 -> 44.6 | Hurt |
| Reduce clean distillation data from 25% to 5% (ablation) | CompRess defense for poisoned MoCo v2 · ImageNet-100 val, clean data | accuracy: 44.6 -> 32.1 | Hurt |
| Use 5% random poison injection rather than targeted poisoning | MoCo v2 · ImageNet-100 val, patched data | accuracy: 46.63 -> 41.70 | Hurt |
| Restrict target-class trigger appearance to one augmented view (ablation) | MoCo v2 targeted attack · ImageNet-100 val, patched data | false positives: 461.1 -> 52.0 | Hurt |
| Add 0.5% random poisons with triggers in both views alongside one-view target poisons (ablation) | MoCo v2 targeted attack · ImageNet-100 val, patched data | false positives: 461.1 -> 46.8 | Hurt |
| Lower poison injection rate toward 0.05% (ablation) | MoCo v2 targeted attack · ImageNet-100 val, patched data | false positives | Hurt |
| Increase poison injection rate to 1% (ablation) | MoCo v2 targeted attack · ImageNet-100 val, patched data | false positives: 1683.2 | Helped |
| Use target-class poisoning at 0.1% rate | MoCo v2 · ImageNet-1k val, patched data | false positives: 52 -> 1013 | Helped |
Closest papers by meaning
- Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.92)
- Universal Backdoor Attacks (ICLR 2024 · similarity 0.88)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.87)
- Data Free Backdoor Attacks (NeurIPS 2024 · similarity 0.87)
- Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse (NeurIPS 2026 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.