Cheng, S.; Liu, Y.; Ma, S.; Zhang, X. Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification. AAAI 2021, 35, 1148-1156.