Research map / Adversarial robustness and security / Backdoor and poisoning
Hibernated Backdoor: A Mutual Information Empowered Backdoor Attack to Deep Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Maximize mutual information between clean-data and malicious-data gradients | Hibernated Backdoor · CIFAR10, VGGFACE10, and IMAGENET10 | ASR: 90.23; 91.50; 98.20; 98.96; 95.43; 95.96 | Mixed |
| Fine-tune the hibernated model with clean data | Hibernated Backdoor · MNIST | ASR: 0.16 -> 98.22 | Helped |
| Add activation specificity by using specific data for targeted training | Targeted Hibernated Backdoor · MNIST | ASR: 0.14 -> 99.19 | Helped |
| Fine-tune with increasing proportions of specific data (ablation) | Targeted Hibernated Backdoor · MNIST blended fine-tuning data | ASR: 0.44; 4.97; 16.26; 57.34; 99.84 | Helped |
| Use only clean data instead of specific data to activate the targeted backdoor (ablation) | Targeted Hibernated Backdoor · MNIST | ASR: 99.84 -> 0.44 | Hurt |
| Fine-tune all layers rather than only dense layers (ablation) | Hibernated Backdoor · Fine-tuning | ASR: 97.12 -> 98.96 | Helped |
| Apply neural pruning at 60% and 85% (ablation) | Hibernated Backdoor · Pruning | ASR: 90.61; 58.71 | Hurt |
| Fine-tune with regular data after patching (ablation) | Hibernated Backdoor · MNIST | ASR: ASR rises drastically during fine-tuning | Helped |
| Increase the number of trainable layers during fine-tuning (ablation) | Hibernated Backdoor · IMAGENET10 | ASR | Helped |
| Vary the fine-tuning learning rate from 2 to 1e-5 (ablation) | Hibernated Backdoor · IMAGENET10 | ASR | No clear effect |
| Replace Hibernated Backdoor with BadNets | Backdoor attack comparison · CIFAR10, VGGFACE10, and IMAGENET10 | ASR: 95.91 vs 90.23; 95.14 vs 91.50; 97.82 vs 98.20; 98.96 vs 98.96; 95.38 vs 95.43; 96.20 vs 95.96 | Mixed |
Closest papers by meaning
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.87)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.86)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.86)
- Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios (ICLR 2024 · similarity 0.86)
- Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · similarity 0.86)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.