S. Cheng, Y. Liu, S. Ma, and X. Zhang, “Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification”, AAAI, vol. 35, no. 2, pp. 1148-1156, May 2021.