{"id":"bb203ea1-13dd-48bf-b23d-d8033ccf1cac","arxiv_id":"2411.11525","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Training a backdoored model with SAM instead of vanilla SGD amplifies backdoor-related neuron responses, making poisoned samples more detectable by existing methods.","lead":"This paper proposes training the feature-extraction model with Sharpness-Aware Minimization before running standard poisoned-sample detectors, which it says magnifies the backdoor signal and improves detection, especially for weak attacks. The method is model-agnostic and reports large average True Positive Rate gains over baseline detectors.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Stage-2 feature scaling is under-specified: the covariance matrix is estimated from 'potential clean samples dynamically collected from the poisoned dataset,' and if those samples are selected using the very PSD being enhanced, the reported gains become partly circular; the ablation shows feature…","rationale":"The reader's weakest assumption identifies the same load-bearing gap: the under-specified dynamic collection of 'potential clean samples' for the Stage-2 covariance estimate. I agree that this is the most important threat to the central empirical claim. The main results and ablation both route through the scaled features, so any hidden use of detection information in the covariance estimate would directly inflate the reported improvements. The reader's CONDITIONAL verdict already captures the need for clarification, so my stress-test does not move the verdict; it sharpens the specific condition that must be met. A focused ablation that removes the dynamic selection from Stage-2 would settle whether the gains are attributable to SAM or to the underspecified scaling step.","tokens_in":14115,"tokens_out":2648,"duration_ms":28146,"concrete_test":"Obtain or reconstruct the Stage-2 algorithm and rerun the CIFAR-10/ResNet18 experiments with Sigma computed only from the held-out reference clean samples (250 per class), never from samples dynamically drawn from the poisoned training set. Compare the average TPR against Table 1 and the FS-only rows of Table 3. If the large FS-only gains and the +34.38% average improvement persist without the dynamic collection, the concern is resolved; if they collapse, the paper must disclose and justify the dynamic clean-sample selection rule, or the claim that SAM itself enhances detection is not supported as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that replacing vanilla training with SAM amplifies the backdoor effect and thereby improves any off-the-shelf PSD. However, the proposed SAM-enhanced PSD includes a Stage-2 feature-scaling step (Section 3.4) whose covariance matrix Sigma is estimated from 'reference clean samples and potential clean samples dynamically collected from the poisoned dataset.' The paper never specifies how those potential clean samples are selected. This matters because the scaled features g_s = Sigma^{-1/2} P g are fed directly into every evaluated PSD, and the ablation in Table 3 shows that feature scaling alone produces large gains (e.g., Beatrix on Blended goes from 5.0 to 27.1 TPR with only FS). If the dynamic collection uses the same detection method being enhanced, or any detector derived from labels or predictions of the poisoned model, then the comparison against base PSDs is no longer an apples-to-apples test of SAM's effect: the covariance estimate would already encode information about which samples are likely poisoned, and the reported +34.38% average TPR improvement could be largely an artifact of this hidden selection step. Even if the selection uses a legitimate separate heuristic, the omission prevents reproduction and assessment of information leakage. This is the weakest link in the empirical claim; the unproven Proposition 3.1 is secondary because the headline result does not depend on it as directly as it depends on the feature pipeline.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SAM-enhanced PSD, a three-stage pipeline for poisoned-sample detection. It first trains a backdoored model with Sharpness-Aware Minimization, then extracts feature representations, applies a feature-scaling step that uses PCA and a covariance matrix estimated from reference clean samples and 'potential clean samples dynamically collected from the poisoned dataset,' and finally feeds the scaled features into any off-the-shelf poisoned-sample detection method. The authors report that SAM amplifies the backdoor effect (measured by TAC) and that this improves detection, with an average +34.38% TPR improvement on CIFAR-10.","tokens_in":14439,"tokens_out":4792,"duration_ms":47475,"significance":"The empirical observation that the backdoor effect is positively correlated with detection performance is a useful and clearly presented insight, and the proposal to use SAM as a training-side enhancement is novel and complementary to existing PSD methods. The evaluation is broad, covering ten attacks, five detectors, and several datasets and architectures, which is a strength if the results are reliable. The method is also model-agnostic in the sense that it can wrap any feature-based PSD, which enhances its practical appeal. However, the central empirical claim currently rests on an underspecified feature-scaling step and single-run results, so the significance of the contribution is not yet fully established.","major_comments":[{"comment":"The feature-scaling step is underspecified. The covariance matrix Sigma is estimated from 'reference clean samples and potential clean samples dynamically collected from the poisoned dataset,' but the selection rule for the 'potential clean samples' is never defined, and the algorithmic process is deferred to a supplementary material that is not included in the submission. The scaled features g_s = Σ^{−1/2} P g are fed directly into every evaluated PSD, and the ablation in Table 3 shows that FS alone produces large gains (e.g., Beatrix on Blended from 5.0 to 27.1 TPR). If the dynamic collection uses the same detection method being enhanced, or any information derived from the poisoned model's predictions, the reported improvements could be partly an artifact of information leakage rather than an effect of SAM. This is load-bearing for the paper's main claim. The authors must specify the selection procedure and demonstrate that it does not reuse the evaluated PSD or otherwise leak detection-relevant information.","section":"§3.4, Stage-2"},{"comment":"Proposition 3.1 is stated without proof. The condition involves quantities that are not precisely defined in the main text (e.g., a_j, ℓ'(θ), and the norm term in the denominator), and the remark's conclusion that neurons satisfying the condition are backdoor neurons is asserted rather than derived. Since this proposition is the paper's main theoretical justification for why SAM strengthens the backdoor effect, a complete proof or a precise reference to where it is proved must be provided.","section":"§3.3, Proposition 3.1"},{"comment":"All experimental results are reported as single numbers without standard deviations, confidence intervals, or significance tests. Several results go in the opposite direction of the headline claim, e.g., SCAn on BadNets in Table 1 has TPR decreasing from 96.0 to 95.2 and F1 from 98.0 to 97.6; AC on BadNets has F1 dropping from 97.1 to 42.5 because FPR rises from 0.1% to 13.3%. The aggregate '+34.38% TPR on average' may hide substantial instability, especially on weak attacks. The authors should provide multi-seed statistics and explicitly discuss cases where SAM-enhanced PSD degrades performance.","section":"§4.2, Tables 1-3"},{"comment":"The correlation analysis reports a Pearson coefficient of 0.71 and R² = 0.51 without confidence intervals, p-values, or a description of the regression model. The scatter plot mixes multiple attack types, poisoning ratios, and detection methods, so the apparent correlation between TAC and AUC could be confounded by attack-specific or detector-specific effects. A per-attack or multi-level analysis is needed to substantiate the causal narrative that increasing the backdoor effect improves detection.","section":"§3.2, Fig. 2"},{"comment":"The introduction states that the approach is 'model-agnostic and data-independent.' However, Stage-2 explicitly uses reference clean samples and a covariance matrix estimated from the poisoned dataset, and Stage-1 trains a model on the poisoned dataset; the method is therefore data-dependent. Please correct this characterization or clarify what 'data-independent' is intended to mean.","section":"§1, Introduction"}],"minor_comments":[{"comment":"There are typos: 'Integrading' should be 'Integrating' and 'off-the-shell' should be 'off-the-shelf'.","section":"§3.4, Stage-3"},{"comment":"Equation (1) has garbled formatting for the layer/neuron indices and the norm expression; the equation should be typeset clearly so that f_k^{(l)} and the activation difference are unambiguous.","section":"§3.3, Eq. (1)"},{"comment":"The sentence 'Studies have shown that SAM can lead to increased sparsity in active neurons ... (related studies)' contains the placeholder '(related studies)' instead of proper citations; this should be replaced with actual references.","section":"§2, Related Work"},{"comment":"The text contains 'As shown in Fig. 9 (assuming the correct figure reference)', which is an editing artifact. The figure reference should be corrected and the relationship between Fig. 8 and Fig. 9 clarified.","section":"§4.4, Fig. 9"},{"comment":"The manuscript repeatedly refers to 'supplementary material' for results on Tiny ImageNet, VGG19-BN, DenseNet-161, and for the algorithm details of SAM-enhanced PSD, but no supplementary material is included in the submission. These results and details are therefore not verifiable in the present manuscript.","section":"§4.1 and §3.4"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting and the empirical scope is broad, but the paper's main claim currently rests on an underspecified and potentially circular feature-scaling step, an unproven theoretical proposition, and single-run experiments without error bars. The manuscript also shows signs of incomplete editing (placeholder citations, 'assuming the correct figure reference', typos). I recommend major revision rather than rejection, as the issues appear addressable by providing the missing algorithmic details and proof, adding multi-seed results, and revising the overclaimed statements."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a useful, mostly empirical paper. The new thing is using SAM as a training-side preprocessing step for poisoned sample detection, plus the TAC-AUC correlation study. The core claim—SAM-trained models make poisoned samples more separable for off-the-shelf detectors—is plausible and the experiments are broad (10 attacks, 5 detectors, multiple datasets/architectures). The averaged +34% TPR on CIFAR-10 is not cherry-picked; most cells improve. The ablation shows SAM alone accounts for much of the gain, which is the most convincing part.\n\nThe soft spots are real but mostly fixable. The Stage-2 feature scaling is under-specified: the covariance matrix uses 'potential clean samples dynamically collected from the poisoned dataset,' with no description of how those are selected. If selection uses the same detector being evaluated, the comparison is no longer apples-to-apples, and the ablation in Table 3 shows FS alone produces large gains. Even if the selection is benign, the omission blocks reproduction. This needs to be specified or the FS step removed. Proposition 3.1 is stated without proof and the condition is hard to parse; it should be either proved in an appendix or cut, since the empirical claim doesn't rest on it. There are no error bars, and a few cells go the wrong way—AC on BadNets has TPR up but FPR from 0.1 to 13.3 and F1 from 97.1 to 42.5, which a careful reader will notice. There are also internal signs of drafting: 'related studies' placeholder, figure references that say 'assuming the correct figure reference,' and a statement in Section 4.2 that mentions GTSRB when Table 2 is Tiny. These are cosmetic but suggest the paper needs another pass.\n\nOn the citation pattern: the related work is appropriate, and the distinction from FT-SAM is correctly drawn. Self-citations are concentrated in the benchmark and defense-survey references, which is normal for this group.\n\nFor whom: anyone working on backdoor defenses, especially on improving PSD under weak attacks, will want to read this. It deserves a serious referee: the idea is simple, sensible, and mostly supported, and the flaws are addressable in revision. I would send it out, with a request to specify the feature-scaling selection, add error bars or release code, and either prove or cut the proposition.","headline":"Useful empirical plug-in: SAM pre-training plus feature scaling improves most PSDs under weak backdoors, but the feature-scaling step is under-specified enough to block reproduction until fixed.","tokens_in":14947,"tokens_out":1701,"would_cite":true,"duration_ms":17425,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that training a backdoored network with Sharpness-Aware Minimization amplifies the trigger's effect on backdoor-related neurons, and that this single change raises the true positive rate of five standard poisoned-sample…","keywords":["backdoor attacks","poisoned sample detection","sharpness-aware minimization","trigger-activated change","feature scaling","weak backdoor attacks","deep learning security"],"falsifier":"Estimate the covariance matrix in Stage-2 using only the externally supplied clean reference samples, removing the dynamically collected 'potential clean samples.' If the reported TPR gains (e.g., +34.38% on CIFAR-10) disappear or shrink dramatically under this variant while SAM training is unchanged, the specific contribution of the dynamic sample selection—rather than SAM itself—would be exposed. Conversely, if the gains persist, the circularity concern is resolved.","tokens_in":13918,"feed_emoji":"🎯","tokens_out":4476,"duration_ms":39496,"temperature":0.7,"pith_summary":"This paper argues that backdoor attacks are hard to catch not only because of the detector, but because weak attacks leave too small a trace in the model's feature space. It shows a positive correlation between the backdoor effect—measured by how much a trigger changes neuron activations—and the success of poisoned-sample detection. The authors' fix is to train the suspect model with Sharpness-Aware Minimization (SAM) instead of vanilla SGD, which amplifies the trigger's effect on backdoor-related neurons while leaving other neurons less affected. Feeding features from the SAM-trained model (after a covariance-based scaling step) into existing detection methods substantially improves their true positive rate, including an average gain of 34.38% across five detectors on CIFAR-10. The claim is that SAM-enhanced training is a model-agnostic, data-independent plug-in that makes any feature-based poisoned-sample detector more reliable.","feed_headline":"SAM-trained models reveal poisoned samples far more reliably","feed_subtitle":"Switching from vanilla SGD to sharpness-aware minimization boosts poisoned-sample detection by 34% on average.","key_machinery":"The load-bearing mechanism is Sharpness-Aware Minimization (SAM), which solves a min-max objective $\\min_\\theta \\max_{\\|\\epsilon\\|\\le\\rho}\\mathcal{L}(\\theta+\\epsilon)$, forcing the model toward flat minima. The paper argues that in a backdoored model this selective sharpness minimization strengthens the response of backdoor-related neurons (those already exhibiting high Trigger-Activated Change) while suppressing unrelated neurons, effectively increasing the feature-space gap between poisoned and clean samples. A secondary mechanism is the Stage-2 feature scaling: features $g=\\phi_{\\theta_{\\text{SAM}}}(x)$ are projected with PCA and whitened as $g_s=\\Sigma^{-1/2}P g$, using a covariance estimate built from reference clean samples and dynamically collected likely-clean samples. That scaling keeps the gains stable by reducing the inflated variance of clean features. TAC (Trigger-Activated Change) is the metric that quantifies the backdoor effect and supplies the paper's correlation analysis.","core_discovery":"The paper's central claim is that the difficulty of detecting poisoned samples is largely governed by the strength of the backdoor effect in the trained model, and that this effect can be deliberately amplified at training time without touching the attack. Concretely, they define the backdoor effect via Trigger-Activated Change (TAC), the mean of the top-K per-neuron activation differences between clean and triggered inputs. Across attacks and detectors they measure a Pearson correlation of 0.71 between top-K TAC and detection AUC, which motivates treating backdoor strength as a controllable knob. They then show that training the backdoored model with Sharpness-Aware Minimization (SAM)—which minimizes a worst-case perturbed loss—selectively increases TAC on high-TAC (backdoor) neurons, increases their weight norms, and separates poisoned from clean features, as confirmed by silhouette scores and distance-to-center plots. A feature-scaling step (whitening with PCA plus a covariance estimate) counters SAM's tendency to inflate intra-class variance of clean samples. Applied to five off-the-shelf detectors, SAM-enhanced PSD improves TPR on average by 34.38% on CIFAR-10 and by large margins on GTSRB, across ten attack types and weak settings such as 0.5%–1% poisoning ratios.","pith_inferences":["If the TAC–AUC correlation is causal, then backdoor defenses that suppress the backdoor (like FT-SAM post-training) might inadvertently make detection harder; the two goals are in tension.","The feature-scaling step resembles a Mahalanobis whitening of the feature space; a natural testable extension is whether simpler statistics (e.g., a per-dimension variance normalization without PCA) achieve the same stability at lower cost.","The paper's dynamic clean-sample selection is underspecified; evaluating whether a fixed external clean reference yields the same gains would isolate SAM's contribution from that of the covariance estimator."],"forward_implications":["Any existing feature-based PSD method (AC, Spectre, SCAn, SS, Beatrix) can be wrapped with SAM training and feature scaling, without changing the detector's internals.","Weak backdoor attacks that previously evaded detection—low poisoning ratio (0.5–1%) or weak triggers like Adap-Blend—become detectable with average TPR gains over 25% on CIFAR-10 for four detector/attack combinations.","Because the method works after training on poisoned data, it applies to the standard pre-training defense pipeline: detect-and-filter before final training.","The reported correlation between backdoor effect and detection performance suggests that other training-time interventions that selectively amplify backdoor neurons could yield similar gains, not only SAM."],"supporting_citations":[{"why":"Supplies the sharpness-aware minimization optimizer that is the core of the proposed enhancement.","marker":"[8]"},{"why":"Defines Trigger-Activated Change, the metric used to quantify the backdoor effect and to measure the correlation with detection performance.","marker":"[46]"},{"why":"Activation Clustering, one of the off-the-shelf poisoned-sample detectors whose performance is enhanced by the SAM-trained features.","marker":"[2]"},{"why":"Spectre, a robust-statistics detector used as a baseline and improved by the method.","marker":"[12]"},{"why":"SCAn, both a detection method and a source of the latent-separability assumption that the paper weakens.","marker":"[35]"},{"why":"Prior work using SAM for backdoor defense; its contrasting behavior (weight-norm reduction) frames the paper's mechanism of weight-norm increase.","marker":"[47]"}],"fun_headline_variants":["SAM boosts poisoned-sample detection by 34%","Sharpness-aware training reveals backdoor samples reliably","Amplify backdoor signals to improve sample detection","SAM training exposes hidden backdoors for easier detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method's feature-scaling step estimates a covariance matrix using 'potential clean samples dynamically collected from the poisoned dataset,' but the paper never specifies how those samples are selected; if the selection relies on the same detection method being evaluated, part of the reported improvement could be circular.","fun_headline_variants_meta":{"raw":{"variants":["SAM boosts poisoned-sample detection by 34%","Sharpness-aware training reveals backdoor samples reliably","Amplify backdoor signals to improve sample detection","SAM training exposes hidden backdoors for easier detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000558,"raw_usage":{"total_tokens":2736,"prompt_tokens":1107,"completion_tokens":1629,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":723,"completion_tokens_details":{"reasoning_tokens":1569}},"tokens_in":723,"tokens_out":1629,"duration_ms":12837,"temperature":1.0,"reasoning_tokens":1569,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T18:24:52.953187+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Estimate the covariance matrix in Stage-2 using only the externally supplied clean reference samples, removing the dynamically collected 'potential clean samples.' If the reported TPR gains (e.g., +34.38% on CIFAR-10) disappear or shrink dramatically under this variant while SAM training is unchanged, the specific contribution of the dynamic sample selection—rather than SAM itself—would be exposed. Conversely, if the gains persist, the circularity concern is resolved.","supporting_citations":[{"cited_title":"Data- free backdoor removal based on channel lipschitzness","cited_arxiv_id":null,"evidence_quote":"Defines Trigger-Activated Change, the metric used to quantify the backdoor effect and to measure the correlation with detection performance."},{"cited_title":"Spectre: Defending against backdoor attacks us- ing robust statistics","cited_arxiv_id":null,"evidence_quote":"Spectre, a robust-statistics detector used as a baseline and improved by the method."},{"cited_title":"Demon in the variant: Statistical analysis of {DNNs} for ro- bust backdoor contamination detection","cited_arxiv_id":null,"evidence_quote":"SCAn, both a detection method and a source of the latent-separability assumption that the paper weakens."},{"cited_title":"Enhancing fine-tuning based backdoor defense with sharpness-aware minimization","cited_arxiv_id":null,"evidence_quote":"Prior work using SAM for backdoor defense; its contrasting behavior (weight-norm reduction) frames the paper's mechanism of weight-norm increase."}],"review_version":1}