{"id":"https://openalex.org/W7162998616","doi":"https://doi.org/10.1109/tifs.2026.3698596","title":"BadBone: Backdoor Attacks Against Backbone Models in Visual Prompt Learning","display_name":"BadBone: Backdoor Attacks Against Backbone Models in Visual Prompt Learning","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7162998616","doi":"https://doi.org/10.1109/tifs.2026.3698596"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2026.3698596","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3698596","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2605.31246","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5001241589","display_name":"Ziqing Yang","orcid":"https://orcid.org/0000-0002-0492-0862"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Ziqing Yang","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Saarland Informatics Campus, Saarbrücken, Germany"],"raw_orcid":"https://orcid.org/0000-0001-8823-575X","affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Saarland Informatics Campus, Saarbrücken, Germany","institution_ids":["https://openalex.org/I4210128801"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137567469","display_name":"Rui Wen","orcid":"https://orcid.org/0009-0009-0691-7569"},"institutions":[{"id":"https://openalex.org/I114531698","display_name":"Tokyo Institute of Technology","ror":"https://ror.org/0112mx960","country_code":"JP","type":"education","lineage":["https://openalex.org/I114531698"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Rui Wen","raw_affiliation_strings":["Institute of Science Tokyo, Meguro-ku, Tokyo, Japan"],"raw_orcid":"https://orcid.org/0009-0009-0691-7569","affiliations":[{"raw_affiliation_string":"Institute of Science Tokyo, Meguro-ku, Tokyo, Japan","institution_ids":["https://openalex.org/I114531698"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137529236","display_name":"Xinlei He","orcid":null},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]},{"id":"https://openalex.org/I4210121573","display_name":"Wuchang University of Technology","ror":"https://ror.org/02mqsna37","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210121573"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinlei He","raw_affiliation_strings":["Wuhan University, Wuchang, Wuhan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Wuhan University, Wuchang, Wuhan, China","institution_ids":["https://openalex.org/I37461747","https://openalex.org/I4210121573"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128665696","display_name":"Yun Shen","orcid":null},"institutions":[{"id":"https://openalex.org/I4210131406","display_name":"Boehringer Ingelheim (South Korea)","ror":"https://ror.org/03e9p3c51","country_code":"KR","type":"company","lineage":["https://openalex.org/I1330995197","https://openalex.org/I4210131406"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Yun Shen","raw_affiliation_strings":["Flexera, Bracknell, U.K"],"raw_orcid":"https://orcid.org/0000-0002-5215-2976","affiliations":[{"raw_affiliation_string":"Flexera, Bracknell, U.K","institution_ids":["https://openalex.org/I4210131406"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137582312","display_name":"Michael Backes","orcid":"https://orcid.org/0000-0002-7130-9211"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Michael Backes","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Saarland Informatics Campus, Saarbrücken, Germany"],"raw_orcid":"https://orcid.org/0000-0002-7130-9211","affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Saarland Informatics Campus, Saarbrücken, Germany","institution_ids":["https://openalex.org/I4210128801"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5137584127","display_name":"Yang Zhang","orcid":"https://orcid.org/0000-0003-3612-7348"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Yang Zhang","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Saarland Informatics Campus, Saarbrücken, Germany"],"raw_orcid":"https://orcid.org/0000-0003-3612-7348","affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Saarland Informatics Campus, Saarbrücken, Germany","institution_ids":["https://openalex.org/I4210128801"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.62807443,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"21","issue":null,"first_page":"5530","last_page":"5543"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11307","display_name":"Domain Adaptation and Few-Shot Learning","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9417999982833862},{"id":"https://openalex.org/keywords/visualization","display_name":"Visualization","score":0.301800012588501},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.28679999709129333},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.28540000319480896},{"id":"https://openalex.org/keywords/electronic-mail","display_name":"Electronic mail","score":0.2831000089645386}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9417999982833862},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8392999768257141},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.49950000643730164},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.43860000371932983},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.301800012588501},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.28540000319480896},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2816999852657318},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.27489998936653137},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.27079999446868896},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.26330000162124634},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.2612999975681305}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tifs.2026.3698596","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3698596","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2605.31246","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2605.31246","pdf_url":"https://arxiv.org/pdf/2605.31246","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2605.31246","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2605.31246","pdf_url":"https://arxiv.org/pdf/2605.31246","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/5","display_name":"Gender equality","score":0.405636727809906}],"awards":[{"id":"https://openalex.org/G2517709291","display_name":null,"funder_award_id":"2026A1515030046","funder_id":"https://openalex.org/F4320337111","funder_display_name":"Basic and Applied Basic Research Foundation of Guangdong Province"},{"id":"https://openalex.org/G407591696","display_name":null,"funder_award_id":"2025YFB3110200","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null},{"id":"https://openalex.org/F4320337111","display_name":"Basic and Applied Basic Research Foundation of Guangdong Province","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Prompt":[0],"learning":[1,6,52,61,78],"is":[2,161],"a":[3,44,67],"new":[4],"machine":[5],"paradigm":[7,30],"that":[8,71,96,136],"has":[9],"attracted":[10],"ample":[11],"attention":[12],"due":[13],"to":[14,41,65],"its":[15,21],"simplicity":[16],"and":[17,46,89,111,131,146],"proven":[18],"efficacy.":[19],"Despite":[20],"growing":[22],"adoption,":[23],"the":[24,38,59,80,149],"security":[25],"vulnerabilities":[26],"associated":[27],"with":[28],"this":[29,34],"remain":[31],"underexplored.":[32],"In":[33],"work,":[35],"we":[36,63,115],"take":[37],"first":[39],"step":[40],"propose":[42],"BadBone,":[43],"stealthy":[45],"adaptive":[47],"backdoor":[48,81],"attack":[49,103],"against":[50,119,142],"prompt":[51,60,77],"using":[53],"bi-level":[54],"optimization.":[55],"Instead":[56],"of":[57],"backdooring":[58],"process,":[62],"aim":[64],"compromise":[66],"backbone":[68],"model":[69],"such":[70],"only":[72],"target":[73],"downstream":[74,112],"tasks":[75],"employing":[76],"inherit":[79],"vulnerability.":[82],"Extensive":[83],"experiments":[84],"on":[85,108],"three":[86,90],"different":[87],"models":[88,100,145],"datasets":[91],"from":[92],"various":[93],"domains":[94],"show":[95],"our":[97,117,143],"targeted/untargeted":[98],"backdoored":[99,144],"achieve":[101],"high":[102],"performance":[104],"while":[105],"maintaining":[106],"utility":[107],"both":[109],"pretraining":[110],"tasks.":[113],"Moreover,":[114],"evaluate":[116],"approach":[118],"six":[120],"state-of-the-art":[121],"model-level":[122],"defenses,":[123],"including":[124],"Neural":[125],"Cleanse,":[126],"ABS,":[127],"MNTD,":[128],"NAD,":[129],"CLP,":[130],"D-BR.":[132],"The":[133],"results":[134],"demonstrate":[135],"these":[137],"defenses":[138],"are":[139],"largely":[140],"ineffective":[141],"thus":[147],"leave":[148],"effective":[150],"defense":[151],"as":[152],"an":[153],"important":[154],"direction":[155],"for":[156],"future":[157],"work.":[158],"Our":[159],"code":[160],"available":[162],"at":[163],"https://github.com/TrustAIRLab/BadBone.":[164]},"counts_by_year":[],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2026-06-02T00:00:00"}