Backdoor attacks and adversarial attacks are two major security threats to deep neural networks (DNNs), with the former one is a training-time data poisoning attack that aims to implant backdoor triggers into models by injecting trigger patterns into training samples, and the latter one is a testing-time attack trying to generate adversarial examples (AEs) from benign images to mislead a well-trained model. While previous works generally treat these two attacks separately, the inherent connection between these two attacks is rarely explored. In this paper, we focus on bridging backdoor and adversarial attacks and observe two intriguing phenomena when applying adversarial attacks on an infected model implanted with backdoors: 1) the sample is harder to be turned into an AE when the trigger is presented; 2) the AEs generated from backdoor samples are highly likely to be predicted as its true labels. Inspired by these observations, we proposed a novel backdoor defense method, dubbed Adversarial-Inspired Backdoor Defense (AIBD), to isolate the backdoor samples by leveraging a progressive top-q scheme and break the correlation between backdoor samples and their target labels using adversarial labels. Through extensive experiments on various datasets against six state-of-the-art backdoor attacks, the AIBD-trained models on poisoned data demonstrate superior performance over the existing defense methods.

Adversarial training with online-generated adversarial examples has achieved promising performance in defending adversarial attacks and improving robustnes

Model quantization has become a routine step for deploying deep neural networks on resource-constrained devices. This conversion, however, can also serve as the condition that activates a hidden backdoor: a poisoned full-precision model may behave normally before deployment but misclassify triggered inputs after quantization. Recent post-quantization defenses have been shown to effectively suppress existing quantization-conditioned backdoor attacks by exploiting the layer-wise activation offset between the full-precision and quantized models. We present Hidden Activation-Offset Learning and Low-Bit Optimization for Robust Quantization-Conditioned Backdoor Attack (HALO-QCB), a quantization-conditioned backdoor attack that treats this offset as an explicit training target rather than an accidental side effect. The method couples quantization-aware backdoor learning with activation alignment, so that triggered samples remain benign in the full-precision branch, become target-class samples in the quantized branch, and induce much smaller full-precision/quantized activation discrepancies. For low-bit deployment, we further adapt the learnable-scale and surrogate-gradient components of StableQAT to stabilize optimization under 4-bit quantization. Experiments on CIFAR-10 and Tiny-ImageNet, across convolutional neural network (CNN) and Transformer-based architectures, show that the attack remains effective after activation-correction defenses. On ResNet-18 trained on CIFAR-10, the proposed method retains 97.86% attack success rate against Layer-wise Activation Correction (LAC), showing that offset-based purification should be evaluated against adaptive attacks during compressed-model deployment.