# Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification Source: [Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification]() Collection index: [llms.txt]() Data updated: 2025-10-25T22:52:51.647Z Authors: Siyuan Cheng, Yingqi Liu, Shiqing Ma, Xiangyu Zhang Published: 2020-12-21T09:46:12.000Z ## Abstract Trojan (backdoor) attack is a form of adversarial attack on deep neural networks where the attacker provides victims with a model trained/retrained on malicious data. The backdoor can be activated when a normal input is stamped with a certain pattern called trigger, causing misclassification. Many existing trojan attacks have their triggers being input space patches/objects (e.g., a polygon with solid color) or simple input transformations such as Instagram filters. These simple triggers are susceptible to recent backdoor detection algorithms. We propose a novel deep feature space trojan attack with five characteristics: effectiveness, stealthiness, controllability, robustness and reliance on deep features. We conduct extensive experiments on 9 image classifiers on various datasets including ImageNet to demonstrate these properties and show that our attack can evade state-of-the-art defense. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Backdoor Defense on CIFAR-10 (test)](): Backdoor Defense; CIFAR10 (test); ASR: 21.61. ## Original sources and implementation [Original paper]() [PDF]()