Research map / Adversarial robustness and security / Backdoor and poisoning
Detecting poisoned samples
Identify backdoor data or inputs and unlearn triggers, including in pretrained language models.
54 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Backdoor and poisoning, keyword cluster “backdoor defense · backdoored · clean”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
17 papers in 2023–24 and 30 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 15.9% to 20.1%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Optimal Personalized Defense Strategy Against Man-In-The-Middle Attack (AAAI 2017 · 10 citations)
- 2021 · SPECTRE: defending against backdoor attacks using robust statistics (ICML 2021 · 12 citations)
- 2022 · Adversarial Unlearning of Backdoors via Implicit Hypergradient (ICLR 2022 · 36 citations)
- 2023 · Defending Against Patch-Based Backdoor Attacks on Self-Supervised Learning (CVPR 2023 · 24 citations)
- 2024 · Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks (CVPR 2024 · 17 citations)
- 2025 · UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · 8 citations)
- 2026 · Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models (AAAI 2026 · 2 citations)
Earliest papers here
- Optimal Personalized Defense Strategy Against Man-In-The-Middle Attack (AAAI 2017 · 10 citations)
- SPECTRE: defending against backdoor attacks using robust statistics (ICML 2021 · 12 citations)
- Defense against backdoor attacks via robust covariance estimation (ICML 2021 · 2 citations)
What has been tried
34 papers here report 398 measured changes (a component added, removed or swapped, compared with a baseline): helped 61%, no clear effect 13%, hurt 23%, mixed 3%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add error-guided flipped rounding (LF) | CIFAR-10, PQBackdoor, 4-bit · ASR | 96.74 -> 5.73 | Helped | Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks (CVPR 2024 · 17 citations) |
| use a diffusion model trained on ImageNet-1k rather than CIFAR10 | CIFAR10, BadNets · ACC | No clear effect | DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models (AAAI 2024 · 14 citations) | |
| Add prompt-generation correspondence score | BadT2I Pixel-, Object-, and Style-backdoor · AUC | 0.90, 0.94, 0.86 | Helped | UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · 8 citations) |
| increase detection threshold α from 0.05 to 0.10 | SST-2, Add-Sent · ACC | 90.96 -> 87.56 | Hurt | Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · 4 citations) |
| Add Stage 2 local detoxification to Stage 1 | CIFAR-10 backdoor attacks · PA (%) | Stage 1 -> SampDetox: SIG 9.48 -> 65.06; TrojanNN 35.51 -> 89.95 | Helped | SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification (NeurIPS 2024 · 4 citations) |
| Use VGG16 instead of ResNet34 as the substitute architecture | CIFAR10 · ASR (%) | 59.35 -> 97.16 | Helped | HoneypotNet: Backdoor Attacks Against Model Extraction (AAAI 2025 · 2 citations) |
| Train DeDe with OoD auxiliary data instead of in-distribution auxiliary data | BadEncoder detection · AUC | 0.981 -> 0.993 | Helped | DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders (CVPR 2025 · 2 citations) |
| add feature-repelling loss to few-shot visual prompt tuning | ImageNet, BadCLIP · ASR | 98.14 -> 2.76 | Helped | Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuning (NeurIPS 2025 · 1 citation) |
| Use 7 rather than 1 class-specific benign prompt | ImageNet-1K, BadNet/Blended/BadNet-LC/Blended-LC · AUROC (average) | 0.952 -> 0.980 | Helped | Test-Time Multimodal Backdoor Detection by Contrastive Prompting (ICML 2025 · 0 citations) |
| increase perturbation magnitude from ε=0.1 to ε=0.3 | BadNets-CI · ASR | 0.87 -> 0.00 | Helped | CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization (ICML 2025 · 0 citations) |
| Insert the trigger at the start, middle, or end of the input | IMDb, MGB, and CoLA downstream tasks · D_KL | Mixed | The Ripple Effect: On Unforeseen Complications of Backdoor Attacks (ICML 2025 · 0 citations) | |
| Increase the number of clean test examples | Task-agnostic detection · Detection accuracy | Helped | LT-Defense: Searching-free Backdoor Defense via Exploiting the Long-tailed Effect (NeurIPS 2024 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 16 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CC3M · 5 of 16 papers
- CIFAR10 · 4 of 16 papers
- ImageNet · 3 of 16 papers
- ImageNet-1K · 3 of 16 papers
- Caltech-101 · 3 of 16 papers
- SST-2 · 2 of 16 papers
- AG News · 2 of 16 papers
- IMDB · 2 of 16 papers
Baselines
- STRIP · 5 of 16 papers
- CleanCLIP · 3 of 16 papers
- No defense · 2 of 16 papers
- ABL · 2 of 16 papers
- ASSET · 2 of 16 papers
- SCALE-UP · 2 of 16 papers
- TeCo · 2 of 16 papers
- Spectral · 2 of 16 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 47 papers; from OpenAlex and the papers' affiliations).
- Southeast University · 4 papers
- Nanyang Technological University · 4 papers
- Singapore Management University · 3 papers
- Zhejiang University · 3 papers
- University of Melbourne · 3 papers
- Chinese Academy of Sciences · 2 papers
- Fudan University · 2 papers
- Tsinghua University · 2 papers
- DSO National Labs · 2 papers
- Pennsylvania State University · 2 papers
Use it
Download BibTeX of 33 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Training-time backdoor defense (40 papers)
Elsewhere in the topic
- Trigger-based backdoor attacks (106 papers)
- Backdoors in large multimodal models (104 papers)
- Backdoors in federated learning (16 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).