Built independently by an author, for readers. Read the story and support ChapterPal
ChapterPal Logo
Log inSign up

keyword

Neural Cleanse

Neural Cleanse is a security framework designed to detect and mitigate backdoor or Trojan attacks embedded within deep neural networks. In these attacks, a model is trained or modified to perform normally on standard data but produce an attacker-chosen output whenever a specific trigger is present. Neural Cleanse identifies such vulnerabilities by reverse-engineering the minimal input perturbation needed to force all inputs into each target class, operating on the principle that a compromised class requires a significantly smaller trigger than uncompromised classes. After identifying an infected class through outlier detection across these reconstructed triggers, the framework enables defense and remediation through methods such as input filtering, neuron pruning, or unlearning to neutralize the backdoor without severely impacting the model performance on benign tasks.

1 item

Handcrafted Backdoors in Deep Neural Networks

Handcrafted Backdoors in Deep Neural Networks

Sanghyun Hong, Nicholas Carlini, Alexey Kurakin

OrganizationsGoogleOregon State University

Why you should read this

Exposes a major blind spot in neural network security by directly editing model weights to insert stealthy backdoors without poisoning training data, bypassing standard defenses while maintaining high attack success rates and benign task accuracy.

When machine learning training is outsourced to third parties, backdoor attacks become practical as the third party who trains the model may act maliciously to inject hidden behaviors into the otherwise accurate model. Until now, the mechanism to inject backdoors has been limited to poisoning. We argue that a supply-chain attacker has more attack techniques available by introducing a handcrafted attack that directly manipulates a model's weights. This direct modification gives our attacker more degrees of freedom compared to poisoning, and we show it can be used to evade many backdoor detection or removal defenses effectively. Across four datasets and four network architectures our backdoor attacks maintain an attack success rate above 96%. Our results suggest that further research is needed for understanding the complete space of supply-chain backdoor attacks.

Added

2026-09-26