{"id":"61442e89-2d18-4f2f-9a54-0d7bd747bed9","arxiv_id":"2411.19479","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"FLARE detects and removes backdoor-poisoned training samples by clustering abnormal activations gathered from all hidden layers, achieving near-perfect TPR and FPR across 22 attacks.","lead":"This paper introduces FLARE, a method that finds poisoned images in a training dataset by looking at unusual activations across every layer of a neural network, not just the last one. It targets backdoor attacks where hidden triggers make models misbehave, and the authors report success on all-to-one, all-to-all, and untargeted attack modes.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The universal near-perfect claim is not established because the stability threshold ξ is tuned on the evaluated attacks: Table VIII shows FPR jumping from 0.00% to 33.89% (LC) and 40.67% (BadNets-A2A) when ξ moves from 0.03 to 0.04/0.05.","rationale":"I read the paper in good faith: it has a clear mechanism, a sensible aggregation of per-channel extreme standardized activations, and broad benchmark coverage; the two-stage purification and unlearning results are internally consistent. The central weakness is not the internal logic but the generalization evidence for the 'universal' label: the stability threshold ξ is the load-bearing control that separates poisoning from benign class structure, and its value is selected after inspecting the same 22 attacks used for evaluation. The reader's conditional verdict already captures this, especially in the rationale, and my concrete test would settle whether the Table VIII cliff is an artifact of tuning or a genuine boundary of the method. Since the paper would remain conditional even if the check succeeds, I recommend no change to the reader's verdict.","tokens_in":25713,"tokens_out":11593,"duration_ms":108174,"concrete_test":"Hold out entire attack modes (e.g., tune ξ and d only on A2O configurations, then evaluate on A2A and UT) and repeat over several random partitions and seeds. Use the paper's own failure thresholds (TPR<80% or FPR>20%) and report mean±std over seeds for TPR, FPR, BA, and ASR. If a held-out attack exceeds these thresholds for the default ξ=0.02, or if LC/A2A FPR responds to small ξ perturbations as in Table VIII, the universal claim needs to be qualified to attack modes and thresholds that were part of the tuning set.","verdict_should_be":"UNCHANGED","load_bearing_attack":"FLARE's headline result—near-perfect TPR/FPR on 22 attacks—rests on Algorithm 1's stable-subspace selector, whose stopping rule uses a threshold ξ and a depth d. The paper fixes ξ=0.02 and d=3 'by default' after the fact (Section V-E), and Table VIII shows a cliff on the very attacks used to choose these values: at ξ=0.03 all five reported attacks have FPR≈0.00%, but at ξ=0.04 LC's FPR jumps to 33.89%, and at ξ=0.05 BadNets-A2A's FPR jumps to 40.67%. A defender facing an unknown attack mode has no principled way to pick ξ except by tuning on known attacks, so the reported near-zero FPRs partly reflect evaluation-set tuning. The paper reports no attack-disjoint validation, no multiple seeds, and no error bars, so we cannot distinguish a robustly universal defense from one that is well-tuned to these benchmark configurations. This directly affects the central claim: 'universal' and 'near 0% FPR' are only established for attacks whose ξ behavior matches the tuning set.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FLARE, a dataset purification defense against backdoor attacks. It first argues that existing purification methods rely on the assumption that trigger-to-target connections are simpler to learn than benign features, an assumption that fails for all-to-all (A2A) and untargeted (UT) attacks. FLARE trains a model on the suspicious dataset, aligns each hidden-layer feature map with BN statistics, extracts channel-wise minima from each aligned feature map, aggregates these minima across all hidden layers, reduces dimensionality with UMAP, clusters with HDBSCAN, selects a stable subspace by dropping the last few layers, and labels the more stable of the two root clusters as poisoned. Experiments on CIFAR-10 and Tiny-ImageNet across 22 attacks report near-perfect TPR/FPR and near-zero post-purification ASR for both retraining-from-scratch and backdoor-removal variants, plus an adaptive-attack evaluation against Ada-Patch. The code is made available through two public toolboxes.","tokens_in":25918,"tokens_out":5645,"duration_ms":46349,"significance":"If the empirical claims hold, FLARE is a meaningful advance: it targets attack modes (A2A and UT) where prior purification defenses largely fail, it uses information from all hidden layers rather than a single layer, and it provides two post-detection strategies. The paper also gives a useful negative result, namely that early-convergence, dominant-trigger, perturbation-consistency, and single-layer-latent-separability assumptions degrade for A2A/UT attacks. The evaluation is broad (22 attacks, two datasets, several architectures, poisoning-rate variation) and the code is publicly available. The main weaknesses are that the stability threshold ξ is tuned on the evaluated attack configurations, the core cluster-stability assumption is asserted rather than directly validated, and no multiple-seed statistics are reported; these gaps currently prevent the 'universal' and 'near 0% FPR' claims from being fully established.","major_comments":[{"comment":"The universal near-zero-FPR claim is not yet established because the stability threshold ξ is tuned on the evaluated attacks. In the ablation, ξ is varied from 0.01 to 0.05 on the same five attack configurations that appear in the headline tables: BadNets (A2O), LC, ISSBA, BadNets (A2A), and BadNets (UT). Table VIII shows a sharp threshold effect: LC's FPR jumps from 0.00% at ξ=0.03 to 33.89% at ξ=0.04, and BadNets (A2A)'s FPR jumps from 0.00% at ξ=0.04 to 40.67% at ξ=0.05. The paper fixes ξ=0.02 'by default' after observing these results. Since a defender does not know the attack mode, there is no principled way to choose ξ in the safe interval, and the paper does not provide an attack-disjoint validation or a data-driven selection rule. Please add such validation or temper the universality claim.","section":"V-E, Table VIII"},{"comment":"The detection rule that the more stable of the two root clusters is the poisoned cluster is an assumption loaded into Definition IV.1 and Eq. (8) rather than derived or validated. The supporting text asserts that poisoned samples 'tend to aggregate into a tight cluster' and remain stable across density levels, while benign clusters fragment; however, no experiment directly compares the stability of the benign root cluster with that of the poisoned cluster, and no failure case is examined. Because this is the step that determines which cluster is removed, the paper should provide a dedicated validation (e.g., stability distributions on clean data and on each attack mode) before claiming universal detection.","section":"IV-C2, Definition IV.1, Eq. (8)"},{"comment":"The alignment transformation is written as the normal probability density function, P(a;μ,σ²)=1/√(2πσ²) exp(−(a−μ)/(2σ²)). As written it does not map all inputs to [0,1] (the density exceeds 1 for small σ), and the exponent is missing the square. Since the subsequent extraction of channel-wise minima in Eq. (3) depends on this alignment, the formula needs to be corrected (likely to the Gaussian CDF Φ((a−μ)/σ)) and the exact implemented transformation stated. If this is only a typesetting error, it should be fixed because it affects reproducibility.","section":"IV-B1, Eq. (2)"},{"comment":"The paper reports no multiple-seed results or variance for any metric, although the tables present values such as 100.00% TPR and 0.00% FPR exactly. Given that the headline claim is near-perfect and stable performance across many attacks, the authors should report mean and standard deviation over at least several independent training runs (or explain why the UMAP/HDBSCAN and model-training randomness do not affect the results). Without this, the exact zeros in Table I and Table II cannot be distinguished from a favorable random draw.","section":"V-B, Tables I-IV"}],"minor_comments":[{"comment":"The sentence 'We also examined from 1 to 5' is missing the variable d; please rephrase as 'We also varied d from 1 to 5' and report the corresponding results rather than stating they are omitted.","section":"V-E"},{"comment":"Several typos remain: 'traped' should be 'trapped' in Section II, 'FALRE' in the text around Algorithm 1 should be 'FLARE', and 'experimetns' in Section V-E should be 'experiments'.","section":"II and VI"},{"comment":"The caption says 'various target labels' but the x-axis is the poisoning rate; please correct the caption to match the figure.","section":"Figure 8 caption"},{"comment":"In Eq. (9), the objective minimizes over θ but the model is written as M(x;θ′); this mismatch should be reconciled for clarity.","section":"Eq. (9)"}],"recommendation":"major_revision","confidential_remarks":"This is a solid empirical paper with a clear message and a broad evaluation. The central concern is the ξ-tuning issue: Table VIII suggests the near-zero FPR results are confined to a narrow threshold range, and the default is chosen after the fact. The authors can likely address this by adding an attack-disjoint validation procedure or a principled threshold-selection rule, together with multiple-seed statistics. The paper is within the journal's scope and the core idea is worth publishing, but the universality claim needs to be re-supported before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line: FLARE goes after a real gap—existing purification methods collapse on all-to-all and untargeted attacks, and this paper demonstrates that clearly. The multi-layer min-activation representation is a genuine new idea, and the evaluation is broad: 22 attacks, two datasets, multiple architectures, plus an adaptive attack test. I'd send this to a serious referee.\n\nWhat's new: the paper shows the 'simpler-to-learn' assumption fails for A2A and UT, and it backs that with convergence curves, Grad-CAM, perturbation consistency, and t-SNE across layers. The method then aggregates channel-level minima after BN alignment across all hidden layers, with an adaptive subspace selector to avoid benign class fragmentation. That's a reasonable pipeline, and the codes are public.\n\nSoft spots, in order of severity. First, the 'universal' claim is only as strong as the stability threshold ξ, and Table VIII shows a cliff: LC FPR jumps from 0.00% to 33.89% when ξ goes from 0.03 to 0.04, and BadNets-A2A to 40.67% at 0.05. The paper picks ξ=0.02 after seeing these numbers. There's no attack-disjoint validation, no seeds, no error bars, so I can't distinguish a robustly universal defense from one tuned to the benchmark suite. Second, the min-activation assumption—that triggers create abnormally small activations in many feature maps after BN alignment—is asserted with one citation and no dedicated test. If a trigger doesn't produce channel-wise minima, the whole representation loses its foundation. Third, the cluster-stability criterion in Definition IV.1 builds in the conclusion: the more stable cluster is assumed to be poisoned. That's a heuristic, and the paper doesn't directly verify it against attacks with different density profiles. Fourth, some reported post-purification ASR outliers (Blend UT, SIBA UT) are waved off as artifacts of benign models, but there's no control experiment showing that a clean model would have the same ASR.\n\nThese are fixable. The paper is not circular in the strong sense—no derived quantity reduces to a fitted value—but the threshold sensitivity and the missing validation of the central assumption need to be addressed. If the authors provide multiple seeds, a principled way to choose ξ without knowing the attack, and a direct test of the min-activation premise, this would be a solid contribution.\n\nWho should read it: anyone working on backdoor defenses or dataset sanitization. It's also a useful case study for the limits of 'universal' claims in adversarial ML. I'd bring it to reading group. For peer review: yes, send it, but expect major revision.","headline":"FLARE attacks a real gap in dataset purification—A2A and UT attacks—but its 'universal' near-perfect claim is only as strong as the stability threshold ξ, which Table VIII shows is tuned on the evaluation attacks and fragile.","tokens_in":26508,"tokens_out":2609,"would_cite":true,"duration_ms":22565,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FLARE claims that backdoor-poisoned samples can be filtered by aggregating abnormal activations from all hidden layers and removing the more stable cluster, reaching near-perfect detection across 22 attacks.","keywords":["dataset purification","backdoor attacks","all-to-all attacks","untargeted attacks","cluster stability","batch normalization","feature maps","poisoned sample detection"],"falsifier":"Construct a backdoor attack whose trigger is designed to raise, not lower, channel-wise minima after batch-normalization alignment, for instance a bright additive patch on all poisoned images, and evaluate FLARE on CIFAR-10 at a 10% poisoning rate; if the true positive rate drops far below the reported near-100%, the core premise that poisoned samples register as abnormally small aligned activations is false.","tokens_in":25462,"feed_emoji":"🛡️","tokens_out":4250,"duration_ms":37392,"temperature":0.7,"pith_summary":"FLARE aims to make dataset purification universal by removing poisoned training samples before model training, regardless of the attack mode. It first argues that existing purification methods assume backdoor connections are simpler to learn than benign features, an assumption that fails for all-to-all and untargeted attacks. Instead of relying on input-output behavior or a single layer, FLARE builds a per-sample signature from abnormal activations in every hidden layer and uses cluster stability to pick the poisoned cluster. On 22 attacks across CIFAR-10 and Tiny-ImageNet, it reports near-100% true positive rates with false positive rates near zero, plus near-zero attack success rates after retraining or unlearning. The payoff is a single proactive defense that works where previous purification methods break down.","feed_headline":"FLARE detects poisoned samples across 22 backdoor attacks","feed_subtitle":"It reads abnormal activations from every hidden layer, then deletes the more stable cluster before training.","key_machinery":"The central object is the all-layer abnormal-activation representation. For each sample, FLARE takes the output of every hidden layer, aligns each feature map with a Gaussian transform built from that layer's batch-normalization mean and variance, extracts the minimum value of each aligned feature map, and concatenates these minima across all channels and layers into one vector. That vector is reduced with UMAP and clustered with HDBSCAN; FLARE then repeatedly drops the last hidden layers until a stable subspace is found, splits the root of the condensed cluster tree into two clusters, and labels the cluster with higher stability as poisoned, where stability is the density-level gap between a cluster's first appearance and the point where it divides.","core_discovery":"The paper's central claim is that poisoned samples are detectable by the abnormal activations they leave across the whole network, not in any one layer. It states that current purification defenses inherit the latent assumption that trigger-to-label connections are easier to learn than benign features; that assumption holds for all-to-one attacks but breaks for all-to-all and untargeted attacks, where models do not converge faster on poisoned data, triggers are not saliency-dominant, and perturbations affect poisoned and benign samples similarly. FLARE therefore aggregates the minimum value of each batch-normalization-aligned feature map across all hidden layers into one representation, reduces it, selects a subspace that keeps benign samples together, and labels the more stable of two clusters as poisoned. The paper reports that this procedure detects 22 representative attacks at true positive rates near 100% and false positive rates near 0%, keeps benign accuracy essentially intact, and resists an adaptive attack that deliberately reduces latent separation.","pith_inferences":["Editorial inference: the same \"most stable cluster is the anomaly\" criterion could transfer to other clean-label or memorization-based dataset poisonings, since the mechanism only requires a compact anomalous cluster.","Editorial inference: architectures without batch normalization would need a different alignment scheme; testing FLARE with layer normalization or group normalization backbones would show whether the abnormal-minimum signal is specific to batch-normalization statistics.","Editorial inference: the paper leaves open whether the minimum-value signal comes from the trigger itself or from label re-assignment; separating these two causes could inform the trigger-reconstruction follow-up the authors list as future work."],"forward_implications":["Purification-based defense becomes viable for all-to-all and untargeted backdoor attacks, not just the all-to-one case where existing methods already work.","Defenders no longer need clean reference samples or knowledge of the trigger; the same detector applies across attack families, target labels, and poisoning rates down to 2%.","Detected poisoned samples can be used in two ways: dropping them and retraining from scratch, or unlearning them from the already-trained backdoored model, with both routes reported to leave attack success rates near zero.","Because the signature spans all hidden layers, attacks that hide separation in any single layer or in input-output statistics remain findable.","Models trained from the purified dataset keep benign accuracy close to that of the original backdoored model, so the defense does not trade away normal task performance."],"supporting_citations":[{"why":"Supplies the finding that backdoor-related features induce abnormal activations in feature maps, which FLARE's minimum-value extraction relies on.","marker":"[57]"},{"why":"Shows final-hidden-layer activation clustering detects only some attacks, motivating FLARE's all-layer design.","marker":"[50]"},{"why":"Defines the BadNets poison-only attack and the all-to-one and all-to-all attack modes used throughout the evaluation.","marker":"[10]"},{"why":"Provides WaNet, a sample-specific attack whose layer-dependent separability is a key motivation for aggregating all hidden layers.","marker":"[39]"},{"why":"Supplies the UMAP dimensionality-reduction algorithm FLARE uses before clustering.","marker":"[58]"},{"why":"Supplies the HDBSCAN clustering algorithm that yields the density-level stability criterion.","marker":"[59]"},{"why":"Provides the adaptive attack with regularization samples that FLARE must withstand, and articulates the latent-separability assumption FLARE addresses.","marker":"[43]"},{"why":"Supplies the perturbation-consistency baseline whose implicit simplicity assumption FLARE identifies as failing under all-to-all and untargeted attacks.","marker":"[24]"}],"fun_headline_variants":["FLARE reads every hidden layer to catch backdoor-poisoned data","FLARE clusters abnormal activations from all layers to purge backdoors","FLARE spots poisoned samples in 22 attacks by using every hidden layer","FLARE defeats backdoor attacks by aggregating activations from all hidden layers","FLARE's all-layer abnormal activation check catches 22 backdoor attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that backdoor triggers drive some feature-map activations to abnormally small values after batch-normalization alignment, and that poisoned samples then form a tighter, more stable cluster than benign samples.","fun_headline_variants_meta":{"raw":{"variants":["FLARE reads every hidden layer to catch backdoor-poisoned data","FLARE clusters abnormal activations from all layers to purge backdoors","FLARE spots poisoned samples in 22 attacks by using every hidden layer","FLARE defeats backdoor attacks by aggregating activations from all hidden layers","FLARE's all-layer abnormal activation check catches 22 backdoor attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000991,"raw_usage":{"total_tokens":4258,"prompt_tokens":1060,"completion_tokens":3198,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":676,"completion_tokens_details":{"reasoning_tokens":3102}},"tokens_in":676,"tokens_out":3198,"duration_ms":17285,"temperature":1.0,"reasoning_tokens":3102,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:08:31.810626+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a backdoor attack whose trigger is designed to raise, not lower, channel-wise minima after batch-normalization alignment, for instance a bright additive patch on all poisoned images, and evaluate FLARE on CIFAR-10 at a 10% poisoning rate; if the true positive rate drops far below the reported near-100%, the core premise that poisoned samples register as abnormally small aligned activations is false.","supporting_citations":[{"cited_title":"Randomized channel shuffling: Minimal- overhead backdoor attack detection without clean datasets","cited_arxiv_id":null,"evidence_quote":"Supplies the finding that backdoor-related features induce abnormal activations in feature maps, which FLARE's minimum-value extraction relies on."},{"cited_title":"Detecting backdoor attacks on deep neural networks by activation clustering","cited_arxiv_id":null,"evidence_quote":"Shows final-hidden-layer activation clustering detects only some attacks, motivating FLARE's all-layer design."},{"cited_title":"Bad- Nets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.IEEE Access, 2017","cited_arxiv_id":null,"evidence_quote":"Defines the BadNets poison-only attack and the all-to-one and all-to-all attack modes used throughout the evaluation."},{"cited_title":"WaNet – Imperceptible Warping-based Backdoor Attack","cited_arxiv_id":null,"evidence_quote":"Provides WaNet, a sample-specific attack whose layer-dependent separability is a key motivation for aggregating all hidden layers."},{"cited_title":"Revisiting the Assumption of Latent Separability for Backdoor Defenses","cited_arxiv_id":null,"evidence_quote":"Provides the adaptive attack with regularization samples that FLARE must withstand, and articulates the latent-separability assumption FLARE addresses."},{"cited_title":"SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency","cited_arxiv_id":null,"evidence_quote":"Supplies the perturbation-consistency baseline whose implicit simplicity assumption FLARE identifies as failing under all-to-all and untargeted attacks."}],"review_version":1}