{"id":"ed0fb2eb-f69f-4d5b-872f-35c82165fb1e","arxiv_id":"1908.03369","paper_version":7,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Februus removes Trojan triggers from images at run-time by locating them with GradCAM and inpainting the region with a GAN, cutting attack success rates from 100% to near 0% in its reported tests.","lead":"This paper describes Februus, a defense that cleans Trojan triggers out of images before a neural network classifies them, using a heatmap to find the trigger and a generative model to repaint the removed area. The defense runs at inference time, keeps accuracy nearly unchanged, and is claimed to be the first to handle partial backdoor attacks without retraining the model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"GradCAM-based trigger localization is the load-bearing assumption; the paper only validates it on its own trigger/task pairs, and the 15.24% residual ASR for partial backdoors shows a real regime where localization is incomplete.","rationale":"The reader's CONDITIONAL verdict is appropriate, and its weakest_assumption matches the single most load-bearing concern: Februus only works if GradCAM reliably identifies the trigger as the dominant salient region for the predicted target class. The method's novelty and released artifacts are real, and for the four tested input-agnostic configurations the evidence in Table II is consistent with the mechanism. But the mechanism has a single point of failure: GradCAM localization. The paper's own adaptive-training and partial-backdoor results (Section VII, Table IV) demonstrate boundaries of that assumption, and no experiment varies the semantic similarity between source and target classes, which is the clearest trigger for the failure mode. I do not see a reason to move the verdict: the evidence is sufficient for conditional acceptance of the central claim, not for rejection. The secondary issues (single-run estimates, labeled-data dependence of sensitivity selection, and the Table III vs abstract \"no loss\" tension) reinforce the conditional status but are not the load-bearing weakness. A targeted re-evaluation along the proposed test would settle whether the localization assumption holds in the untested target-similar regime.","tokens_in":21257,"tokens_out":6634,"duration_ms":75624,"concrete_test":"Re-run Table II's CIFAR10 experiment, but partition the poisoned test inputs by source class into target-similar (e.g., deer, dog, cat vs. target horse) and target-distant classes. For each input, before Februus, compute GradCAM and measure (a) the fraction of trigger-pixel mass inside the top-threshold region and (b) IoU between the top-threshold region and the true trigger bounding box; then run Februus with the paper's fixed sensitivity 0.7 and report ASR and clean accuracy per subgroup. If target-similar classes show trigger IoU materially below the target-distant classes, or ASR above the reported 0.25% (e.g., >5%), then the central assumption that the trigger is always the dominant influential region fails inside the paper's own input-agnostic threat model.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Februus's entire mechanism rests on the assertion (Section III) that for a poisoned network the trigger is the dominant \"influential region\" for the predicted target class, so GradCAM plus a fixed sensitivity threshold can locate and excise it. This assertion is not a structural property: GradCAM measures gradient-weighted activations for the predicted logit, and nothing in the construction prevents the target class's natural features on the input from producing saliency comparable to, or greater than, the trigger's. The paper's empirical triggers are all placed on source classes that are visually distant from the target (airplanes to horse, signs to speed limit, faces to another face), and the fixed per-task threshold is never tested per input. A linear-model version of the same construction already shows the failure mode: if the benign target template contributes most of the target logit, saliency is dominated by the target-like regions, not by the small trigger that pushes the decision over the threshold. The paper's own Section VII-B shows that suppressing GradCAM saliency during poisoning is possible, with the cost of lower confidence/ASR; that tradeoff is evidence the assumption is empirical, not guaranteed. The partial-backdoor row of Table IV is direct evidence of incomplete localization: attack success remains 15.24% after Februus. Secondary concerns (Table III contradicts \"no loss\"; the sensitivity parameter is selected on a labeled held-out test set; all numbers are single-run point estimates) matter, but the localization assumption is the load-bearing one because if it fails no other component can compensate.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Februus, a run-time input-purification defense against input-agnostic Trojan/backdoor attacks on image classifiers. Februus first uses GradCAM saliency on the predicted logit to localize and mask a suspected trigger region, with a per-task sensitivity threshold; it then fills the masked area with a GAN-based inpainter trained on unlabeled data and feeds the restored image to the (possibly Trojaned) classifier. Across CIFAR10, GTSRB, BTSR, and VGGFace2, the authors report attack success rates dropping from 100% to 0.25% or lower for standard input-agnostic triggers while clean accuracy is largely preserved. They also report results on adaptive attacks, including multiple triggers, multiple targets, trigger-location changes, large triggers, and source-label-specific (partial) backdoors, where the residual attack success rate is 15.24%.","tokens_in":21397,"tokens_out":6042,"duration_ms":59663,"significance":"If the results hold, the paper offers a genuinely different defense paradigm: online input sanitization rather than detector-and-reject or network repair, with small per-input overhead (about 30 ms worst case) and no retraining of the classifier. The release of a model zoo and code supports reproducibility, and the partial-backdoor experiment is a useful first quantitative data point for a hard attack variant. However, the contribution is empirical, and its central assumption, that GradCAM reliably localizes the trigger as the dominant influential region, is demonstrated only on the authors' own attack configurations. The abstract's 'no loss of performance' claim is also stronger than the data in Table III and Table IV support.","major_comments":[{"comment":"The sanitization pipeline rests on the claim that the GradCAM saliency map of the poisoned network singles out the trigger as the dominant influential region for the predicted class. This is an empirical property, not a structural one: GradCAM weights last-convolutional feature maps by gradients of the predicted logit, and nothing excludes a benign target-class region from dominating the saliency map. The paper validates this only on its own trigger/task pairs. The partial-backdoor row of Table IV gives direct evidence of incomplete localization: 15.24% of partial-Trojan inputs remain misclassified after Februus. To make the central claim load-bearing, the authors should either prove or empirically characterize the conditions under which GradCAM localizes the trigger (for example, by reporting per-input IoU between the removal mask and the true trigger region across trigger sizes, locations, and source-target class pairs), or explicitly re-scope the defense as applying only when that property holds.","section":"Section III (Trojan Removal Stage) and Table IV"},{"comment":"The abstract states that Februus 'enables effective Trojan mitigation by sanitizing inputs with no loss of performance for sanitized inputs, Trojaned or benign,' and Section I-A says benign-input accuracy is 'identical to that realized from a benign network.' Table III directly contradicts this: after Februus, benign-input accuracy on the Trojaned model falls from 96.78% to 95.13% on GTSRB and from 97.04% to 95.60% on BTSR. Table IV shows a much larger drop for the partial-backdoor setting, from 90.72% to 83.61% on Trojaned inputs. The authors should reword the performance claims to 'small, bounded degradation' and provide per-dataset numbers or confidence intervals, since the current phrasing overstates the empirical results.","section":"Abstract and Table III"},{"comment":"The paper claims in the abstract and contribution list that Februus does not require 'costly labeled data,' and Section II states that defenders only need 'clean but cheaply available unlabeled data' to build the defense. However, the sensitivity threshold that determines the removal region is selected offline using labeled held-out test samples: Section III says the maximum sensitivity is chosen 'based on maintaining the classification accuracy of the defenders held-out test samples,' and Section IV reports thresholds (0.7, 0.8, 0.5) chosen to keep accuracy degradation below 2% on that test set. The threshold is a free parameter on which the reported attack-success rates depend, so the no-labeled-data claim is not accurate unless the authors show that an unlabeled selection criterion (for example, reconstruction error of the inpainter) yields equivalent thresholds.","section":"Section III (sensitivity parameter) and Section IV"},{"comment":"The adaptive-training experiment shows that adding a GradCAM-evasion loss to the poisoning objective degrades both attack success rate and classification confidence, but the paper does not identify whether an intermediate penalty exists at which the backdoor remains potent while Februus fails to localize the trigger. Figure 11 plots accuracy, ASR, and confidence as functions of gamma, yet no operating point is reported where, say, ASR stays above 90% and the GradCAM map no longer overlaps the trigger. Since Observation 1 is a trade-off statement rather than a lower bound, the robustness conclusion for adaptive attackers is incomplete. The authors should report the (ASR, benign accuracy, GradCAM-overlap) trade-off curve and state explicitly whether any point on it is a successful adaptive attack.","section":"Section VII-B and Figure 11"}],"minor_comments":[{"comment":"The phrase 'sate-of-the-art' should be corrected to 'state-of-the-art.'","section":"Section IV (Configuration for Trojan Attacks and Defenses)"},{"comment":"The column header 'After Febrrus' contains a typo and should read 'After Februus.'","section":"Table IV"},{"comment":"The phrase 'we provide a a first quantitative evaluation' contains a duplicated article and should be corrected.","section":"Section VII-A (Source-label-specific (Partial) Trojan)"},{"comment":"The hyper-parameter gamma in Equation (8) is also used for the generator loss weight in Equation (6); using different symbols for these two unrelated hyper-parameters would avoid confusion.","section":"Equation (8)"},{"comment":"The conclusion refers to 'input-agonist backdoor attacks'; this should be 'input-agnostic backdoor attacks.'","section":"Section IX (Conclusion)"}],"recommendation":"major_revision","confidential_remarks":"The paper fits the journal's security/ML scope and is likely publishable after revision. The main technical risk is the GradCAM-localization assumption, which should be supported with per-input localization-quality measurements or explicitly stated as a limitation. I would also ask the authors to correct the overclaims about 'no loss of performance' and 'no labeled data,' and to complete the adaptive-attack trade-off analysis. No concerns about citation practices or novelty disclosure beyond the usual promotional tone of a new defense."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The one thing you should know: this paper does something genuinely new. It defends against Trojan backdoors by sanitizing inputs at run-time—GradCAM finds the trigger region, a GAN inpaints it out, then the (still Trojaned) network classifies the cleaned image. That is a different capability from SentiNet or STRIP, which only detect and discard, and from Neural Cleanse or DeepInspect, which patch the network offline. The architecture is simple, the latency is attractive (~30 ms on a desktop GPU), and they release a model zoo of ten Trojaned networks plus code. For the four input-agnostic trigger/task pairs in Table II, the results are strong: attack success drops from 100% to at most 0.25%, with clean accuracy roughly preserved. That is real evidence and worth taking seriously.\n\nThe soft spots are real but mostly in proportion. The load-bearing assumption is that GradCAM on the poisoned network will highlight the trigger as the dominant influential region for the predicted target class. The paper states this as if it were structural, but it is not. GradCAM is a gradient-weighted view of the predicted logit; if the input already contains features of the target class, those can dominate saliency and the small trigger that tips the decision can be missed. On the paper's own triggers, the assumption works—the source classes are visually distant from the targets. But the paper itself shows the limits: Section VII-B's adaptive training suppresses GradCAM saliency (at the cost of confidence and ASR), and the partial-backdoor row of Table IV leaves 15.24% residual attack success. That is not a fatal flaw for the tested threat model, but it means the defense is empirical, not guaranteed, and the abstract's sweeping claims should be read with that in mind.\n\nTwo smaller issues. First, the abstract's \"no loss of performance\" is contradicted by Table III: benign-input accuracy drops by roughly 1.6 points on GTSRB and 1.4 on BTSR after Februus. Not huge, but not zero. Second, the sensitivity threshold is selected on a labeled held-out test set, so the \"no costly labeled data\" selling point is partially undercut. The GAN itself is unsupervised, but the removal region's threshold is not. Also, all numbers are single-run point estimates; there is no variance or comparison with other defenses under identical conditions.\n\nMy own take: the central claim holds for the tested cases, and the paper is honest about several limitations. The stress-test note's linear-model counterexample is a legitimate generalization concern, not a refutation. This deserves serious peer review—it advances the space and gives the community a useful artifact. I would bring it to our reading group, and I'd cite it for the run-time purification idea and the model zoo.","headline":"Februus is a novel run-time input-sanitization defense with solid results on its own trigger setups, but the load-bearing assumption that GradCAM will always localize the trigger is empirically supported rather than guaranteed, and the partial-backdoor experiment exposes a real residual.","tokens_in":22085,"tokens_out":1747,"would_cite":true,"duration_ms":20452,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Februus cuts Trojan attack success from 100% to near 0%.","keywords":["Trojan attack","backdoor defense","input sanitization","GradCAM saliency","GAN inpainting","run-time defense","partial backdoor attack","deep neural network security"],"falsifier":"Construct a Trojaned model whose trigger is visually complex or dispersed, such as a low-contrast texture spread across the entire image, so that no single compact region dominates the GradCAM heatmap; run Februus on a held-out set of Trojaned inputs and measure attack success. If attack success stays well above the reported near-0% values (for instance above 10%) while benign accuracy is preserved, the core premise that the trigger is the dominant saliency region fails.","tokens_in":20930,"feed_emoji":"✂️","tokens_out":10733,"duration_ms":92606,"temperature":0.7,"pith_summary":"Februus claims that the backdoor trigger in a Trojaned deep neural network can be neutralized at run-time by cutting the trigger out of each incoming image and inpainting the hole before classification. The paper demonstrates that this two-stage sanitization reduces attack success from 100% to near 0% across four datasets and several realistic trigger types, while keeping classification accuracy on sanitized inputs effectively identical to a benign network. If the claim holds, it gives a plug-and-play defense that requires no retraining of the model, no labeled data, and runs within the latency budget of autonomous driving (about 6–30 ms). The same mechanism yields the first quantitative defense against partial (source-label-specific) backdoors, reducing their success from 97.95% to 15.24% in a single pass.","feed_headline":"Sanitizer cuts Trojan attack success from 100% to near 0%","feed_subtitle":"Februus spots the trigger with GradCAM, cuts it out, and inpaints the gap, keeping accuracy intact without retraining.","key_machinery":"The central object is the two-stage Februus pipeline. Stage one, Trojan Removal, computes the GradCAM saliency heatmap of the Trojaned network's prediction, thresholds it with a task-specific sensitivity parameter to form a binary mask, and cuts the masked region out of the input, replacing it with a neutral-color box. Stage two, Image Restoration, feeds the masked image to a GAN inpainting generator trained with two discriminators—one enforcing global structure, one enforcing local fidelity—under a WGAN-GP loss; the generator was trained with randomly sized and located masks so it can restore arbitrary regions. The load-bearing insight is that the trigger dominates the poisoned network's attention, so the saliency map reliably localizes it, and that a realistic inpaint of that region removes the activation signal while preserving the content the classifier needs.","core_discovery":"The paper's central discovery is that a Trojan trigger is not only a vulnerability but an information leak: the Trojaned network's GradCAM saliency heatmap—a gradient-based visualization of which input regions drive the prediction—marks the trigger as the most influential region for the target class. Februus exploits this by computing that heatmap, masking the highlighted region with a neutral color, and passing the masked image to a GAN trained with random masks on unlabeled data to restore the removed area. The restored image is then classified by the original, unmodified Trojaned network, which now sees a benign-looking input. On CIFAR-10, GTSRB, BTSR, and VGGFace2, input-agnostic attack success falls from 100% to between 0% and 0.25%, while benign and Trojaned sanitized inputs retain accuracy within about 0.1–1.5% of the benign model. For the source-label-specific (partial) backdoor, attack success drops from 97.95% to 15.24% in a single pass, with a larger accuracy penalty on the restored Trojaned inputs.","pith_inferences":["The paper's adaptive-training result hints at a cheap detection signal: a network trained to hide its trigger from GradCAM becomes significantly less confident (average prediction probability below 20%), so a defender could combine Februus with a confidence threshold to catch evasion attempts rather than merely cleaning inputs.","Stacking Februus on top of a network-level defense (such as pruning or unlearning) could plausibly close the partial-backdoor residual: the paper cleans inputs but leaves the Trojaned weights untouched, and the two mechanisms target different failure modes.","Because the restoration GAN sees only the masked image, its fidelity controls the defense's ceiling; training it with the extra objective of maximizing the downstream classifier's accuracy on inpainted images (an improvement the paper mentions) should extend Februus to triggers larger than 14% of the image without the accuracy loss reported there.","The sanitization concept is not obviously limited to vision: if saliency in speech or text models concentrates on trigger tokens as sharply as GradCAM does on image patches, a similar cut-and-restore pipeline could be built for those modalities, which the paper names as future work."],"forward_implications":["Input-agnostic Trojan attacks can be neutralized without touching the model: Februus preserves the Trojaned network's weights and still brings attack success from 100% to 0–0.25% across four datasets.","Defenders no longer need labeled data or a retraining step; the restoration GAN can be trained on unlabeled data, and the whole pipeline runs in about 6–30 ms on a desktop GPU, within autonomous-driving latency budgets.","The same pipeline withstands multiple triggers aimed at one target, different triggers aimed at different targets (an attack that fools Neural Cleanse and TABOR), and triggers covering up to 25% of the image, with accuracy degrading only for the largest sizes.","The previously undefended partial (source-label-specific) backdoor can be contained to roughly 15% residual attack success in a single pass, at the cost of a noticeable accuracy drop on those Trojaned inputs.","Februus doubles as a filter for benign inputs: classification accuracy on benign images passing through the pipeline stays within about 1.5% of the clean model, so the defense can be applied unconditionally to all inputs."],"supporting_citations":[{"why":"Supplies the attack methodology (poisoning a portion of training data) and the flower/Post-it trigger patterns used to build the Trojaned models Februus must defeat.","marker":"[6]"},{"why":"Provides the GradCAM saliency heatmap that the Trojan Removal stage uses to localize the trigger region in each input.","marker":"[26]"},{"why":"The run-time detection method that first used GradCAM to identify adversarial/Trojan regions; Februus extends its localization idea from detection to removal.","marker":"[17]"},{"why":"The globally and locally consistent image completion method that the restoration GAN is built on, giving the two-discriminator architecture.","marker":"[28]"},{"why":"Supplies the WGAN-GP loss that stabilizes training of the restoration GAN.","marker":"[29]"},{"why":"The neural-cleansing baseline that defines the partial backdoor attack and whose limitations with large triggers and multiple triggers motivate Februus's design.","marker":"[19]"},{"why":"The run-time detection baseline (STRIP) that Februus is compared against, illustrating the difference between detecting a Trojan and cleaning it from the input.","marker":"[18]"},{"why":"The adaptive attack that defeats Neural Cleanse and TABOR (multiple triggers to multiple targets) and is used to demonstrate Februus's robustness.","marker":"[21]"}],"fun_headline_variants":["Run-time defense kills Trojan attacks: 100% to 0% success","Februus: from 100% attack success to 0% at run-time","Input sanitizer neutralizes Trojan attacks without retraining","GradCAM spots triggers, GAN inpaints: Trojan attacks drop to 0%","Sanitizer uses GradCAM to find and remove triggers: 100% to 0%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense's load-bearing premise is that the poisoned network's GradCAM saliency map reliably highlights the trigger as the dominant influential region for every input, so that cutting out and inpainting that one region destroys the backdoor; the paper validates this only on its own trigger designs, and the 15.24% residual success on partial backdoors suggests the localization is incomplete when the trigger's influence is entangled with the source class.","fun_headline_variants_meta":{"raw":{"variants":["Run-time defense kills Trojan attacks: 100% to 0% success","Februus: from 100% attack success to 0% at run-time","Input sanitizer neutralizes Trojan attacks without retraining","GradCAM spots triggers, GAN inpaints: Trojan attacks drop to 0%","Sanitizer uses GradCAM to find and remove triggers: 100% to 0%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00107,"raw_usage":{"total_tokens":4517,"prompt_tokens":1015,"completion_tokens":3502,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":631,"completion_tokens_details":{"reasoning_tokens":3397}},"tokens_in":631,"tokens_out":3502,"duration_ms":26667,"temperature":1.0,"reasoning_tokens":3397,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:14:47.547483+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a Trojaned model whose trigger is visually complex or dispersed, such as a low-contrast texture spread across the entire image, so that no single compact region dominates the GradCAM heatmap; run Februus on a held-out set of Trojaned inputs and measure attack success. If attack success stays well above the reported near-0% values (for instance above 10%) while benign accuracy is preserved, the core premise that the trigger is the dominant saliency region fails.","supporting_citations":[{"cited_title":"Badnets: Evaluating backdooring attacks on deep neural networks,","cited_arxiv_id":null,"evidence_quote":"Supplies the attack methodology (poisoning a portion of training data) and the flower/Post-it trigger patterns used to build the Trojaned models Februus must defeat."},{"cited_title":"Grad-cam: Visual explanations from deep networks via gradient-based localization,","cited_arxiv_id":null,"evidence_quote":"Provides the GradCAM saliency heatmap that the Trojan Removal stage uses to localize the trigger region in each input."},{"cited_title":"Sentinet: Detecting physical attacks against deep learning systems,","cited_arxiv_id":null,"evidence_quote":"The run-time detection method that first used GradCAM to identify adversarial/Trojan regions; Februus extends its localization idea from detection to removal."},{"cited_title":"Globally and locally consistent image completion,","cited_arxiv_id":null,"evidence_quote":"The globally and locally consistent image completion method that the restoration GAN is built on, giving the two-discriminator architecture."},{"cited_title":"Improved training of wasserstein gans,","cited_arxiv_id":null,"evidence_quote":"Supplies the WGAN-GP loss that stabilizes training of the restoration GAN."},{"cited_title":"Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,","cited_arxiv_id":null,"evidence_quote":"The neural-cleansing baseline that defines the partial backdoor attack and whose limitations with large triggers and multiple triggers motivate Februus's design."},{"cited_title":"Strip: A defence against trojan attacks on deep neural networks,","cited_arxiv_id":null,"evidence_quote":"The run-time detection baseline (STRIP) that Februus is compared against, illustrating the difference between detecting a Trojan and cleaning it from the input."},{"cited_title":"Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems,","cited_arxiv_id":null,"evidence_quote":"The adaptive attack that defeats Neural Cleanse and TABOR (multiple triggers to multiple targets) and is used to demonstrate Februus's robustness."}],"review_version":1}