# Trigger Hunting with a Topological Prior for Trojan Detection

Source: [Trigger Hunting with a Topological Prior for Trojan Detection](<https://www.sota2.com/research/paper/68fa6c331e209131cea32c63>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-26T00:06:48.603Z

Authors: Xiaoling Hu, Xiao Lin, Michael Cogswell, Yi Yao, Susmit Jha, Chao Chen

Published: 2021-10-15T19:47:00.000Z

## Abstract

Despite their success and popularity, deep neural networks (DNNs) are vulnerable when facing backdoor attacks. This impedes their wider adoption, especially in mission critical applications. This paper tackles the problem of Trojan detection, namely, identifying Trojaned models -- models trained with poisoned data. One popular approach is reverse engineering, i.e., recovering the triggers on a clean image by manipulating the model's prediction. One major challenge of reverse engineering approach is the enormous search space of triggers. To this end, we propose innovative priors such as diversity and topological simplicity to not only increase the chances of finding the appropriate triggers but also improve the quality of the found triggers. Moreover, by encouraging a diverse set of trigger candidates, our method can perform effectively in cases with unknown target labels. We demonstrate that these priors can significantly improve the quality of the recovered triggers, resulting in substantially improved Trojan detection accuracy as validated on both synthetic and publicly available TrojAI benchmarks.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Backdoor Inversion on TrojAI 131 Round 4 (test)](<https://www.sota2.com/research/sota/backdoor-inversion-on-trojai-131-round-4-test.md>): Backdoor Inversion; TrojAI 131 Round 4 (test); ASR: 28.4.

- [Backdoor Inversion on ImageNet HTBA (test)](<https://www.sota2.com/research/sota/backdoor-inversion-on-imagenet-htba-test.md>): Backdoor Inversion; ImageNet HTBA (test); ASR: 0.22.

- [Backdoor Inversion on ImageNet Blind-S (test)](<https://www.sota2.com/research/sota/backdoor-inversion-on-imagenet-blind-s-test.md>): Backdoor Inversion; ImageNet Blind-S (test); ASR: 4.39.

- [Backdoor Inversion on ImageNet Blind-P (test)](<https://www.sota2.com/research/sota/backdoor-inversion-on-imagenet-blind-p-test.md>): Backdoor Inversion; ImageNet Blind-P (test); ASR: 0.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2110.08335>)

[PDF](<https://arxiv.org/pdf/2110.08335.pdf>)