Research map / Adversarial robustness and security / Backdoor and poisoning
Trigger-based backdoor attacks
Design poisoning-based backdoor attacks with hidden or clean-label triggers on vision models.
106 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Backdoor and poisoning, keyword cluster “backdoor attack · poisoning · triggers”
State History Benchmarks Tried Checklist Preprints Who Export
Where it stands
Few recent reports The tracked benchmarks have at most one report from 2025–26 that could beat the old record, too few to say whether they are still moving.
36 papers in 2023–24 and 33 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 33.6% to 22.1%.
No longer reported by papers here: CIFAR-100 (ASR, last in 2024); Gtsrb (ASR (%), last in 2024).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Spectral Signatures in Backdoor Attacks (NeurIPS 2018 · 367 citations)
- 2019 · Defending Neural Backdoors via Generative Distribution Modeling (NeurIPS 2019 · 62 citations)
- 2020 · Hidden Trigger Backdoor Attacks (AAAI 2020 · 532 citations)
- 2021 · Backdoor Attacks Against Deep Learning Systems in the Physical World (CVPR 2021 · 214 citations)
- 2022 · FIBA: Frequency-Injection Based Backdoor Attack in Medical Image Analysis (CVPR 2022 · 110 citations)
- 2023 · Color Backdoor: A Robust Poisoning Attack in Color Space (CVPR 2023 · 87 citations)
- 2024 · Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · 27 citations)
- 2025 · CL-Attack: Textual Backdoor Attacks via Cross-Lingual Triggers (AAAI 2025 · 5 citations)
- 2026 · Clean-Label Physical Backdoor Attacks with Data Distillation (AAAI 2026 · 2 citations)
Earliest papers here
- Spectral Signatures in Backdoor Attacks (NeurIPS 2018 · 367 citations)
- On Cryptographic Attacks Using Backdoors for SAT (AAAI 2018 · 35 citations)
- Defending Neural Backdoors via Generative Distribution Modeling (NeurIPS 2019 · 62 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
CIFAR-10 · ASR (higher is better)
7 papers, 2022–2025 · one report since 2024, not better
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 91.5 | Hibernated Backdoor: A Mutual Information Empowered Backdoor Attack to Deep Neural Networks (AAAI 2022 · 13 citations) |
| 2023 | 97.55 | Color Backdoor: A Robust Poisoning Attack in Color Space (CVPR 2023 · 87 citations) |
| 2024 | 100 | WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks (NeurIPS 2024 · 3 citations) |
CIFAR-100 · ASR (higher is better)
4 papers, 2023–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2023 | 96.27 | Color Backdoor: A Robust Poisoning Attack in Color Space (CVPR 2023 · 87 citations) |
| 2024 | 99.16 | WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks (NeurIPS 2024 · 3 citations) |
Gtsrb · ASR (%) (higher is better)
4 papers, 2023–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2023 | 99.7 | Color Backdoor: A Robust Poisoning Attack in Color Space (CVPR 2023 · 87 citations) |
| 2024 | 100 | WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks (NeurIPS 2024 · 3 citations) |
What has been tried
84 papers here report 850 measured changes (a component added, removed or swapped, compared with a baseline): helped 58%, no clear effect 13%, hurt 24%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| use 10% clean-data fine-tuning instead of Elijah removal | Backdoor removal experiment · ASR | close to 1 -> 0 within 5 epochs | Hurt | Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · 27 citations) |
| add alternated training of the trigger generator and surrogate classifier instead of training the generator against a fixed clean surrogate | CIFAR-10 · ASR | Helped | COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks (AAAI 2024 · 21 citations) | |
| Replace random cropping with localized cropping | ImageNet100-B · ASR (%) | 89.9 -> 0.9 | Hurt | Data Poisoning based Backdoor Attacks to Contrastive Learning (CVPR 2024 · 18 citations) |
| jointly optimize the JPEG quantization tables and classifier loss instead of using fixed standard quantization tables | GTSRB JPEG-compressed images · ASR (%) | Helped | Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · 14 citations) | |
| Add trigger focusing to simple data poisoning | CIFAR-10 · ASR-comb | 97.88% ± 1.81% -> 0.02% ± 0.09% | Helped | LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning (CVPR 2024 · 11 citations) |
| Use DCT instead of DFT | HMDB-51, Res(2+1)D · ACC | 53.0 -> 43.3 | Hurt | Temporal-Distributed Backdoor Attack against Video Based Action Recognition (AAAI 2024 · 8 citations) |
| Add CLIP-CFE to BadNets | CIFAR-100 clean-label single-class, VGG-16 · ASR | 187% | Helped | Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios (ICLR 2024 · 6 citations) |
| Vary the poisoning rate; cross-lingual trigger exceeds 90% ASR when rate exceeds 3% | MLQA · ASR | Mixed | CL-Attack: Textual Backdoor Attacks via Cross-Lingual Triggers (AAAI 2025 · 5 citations) | |
| Set threshold λ to a small value | MNIST · backdoored accuracy (BA) | Helped | Data Free Backdoor Attacks (NeurIPS 2024 · 5 citations) | |
| Use UIBDiffusion's generated trigger instead of original UAP | CIFAR-10 · ASR | 43.75% -> 100% | Helped | UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models (CVPR 2025 · 4 citations) |
| Add the trigger augmentor to CMT | FBHM, OCR · CDA | 0.634 -> 0.649 | Helped | Meme Trojan: Backdoor Attacks Against Hateful Meme Detection via Cross-Modal Triggers (AAAI 2025 · 3 citations) |
| Use tempo mode at a poisoning rate of 1.5% rather than a lower rate | Not specified · ASR | Helped | Speed Master: Quick or Slow Play to Attack Speaker Recognition (AAAI 2025 · 3 citations) |
What reviewers will expect
Datasets and baselines named in the 21 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 9 of 21 papers
- TinyImageNet · 3 of 21 papers
- Cora · 2 of 21 papers
- Pubmed · 2 of 21 papers
- ImageNet-10 · 2 of 21 papers
- CelebA-HQ · 2 of 21 papers
- SVHN · 2 of 21 papers
- GTSRB · 2 of 21 papers
Baselines
- MIA · 2 of 21 papers
- GTA · 2 of 21 papers
- BadDiffusion · 2 of 21 papers
- VillanDiffusion · 2 of 21 papers
- Neural Cleanse · 2 of 21 papers
- SCALE-UP · 2 of 21 papers
- TED · 2 of 21 papers
- Random selection · 2 of 21 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 69 papers; from OpenAlex and the papers' affiliations).
- Nanyang Technological University · 6 papers
- Tsinghua University · 3 papers
- Zhejiang University · 3 papers
- IBM · 3 papers
- The Chinese University of Hong Kong · 3 papers
- University of Illinois, Urbana Champaign · 3 papers
- Harbin Institute of Technology · 2 papers
- Purdue University · 2 papers
- Pennsylvania State University · 2 papers
- Hong Kong University of Science and Technology · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Backdoors in large multimodal models (104 papers)
- Backdoors in federated learning (16 papers)
Elsewhere in the topic
- Detecting poisoned samples (54 papers)
- Training-time backdoor defense (40 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).