{"id":"7c9b58db-4ce3-46e2-be1e-590016898749","arxiv_id":"2412.03908","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A clean-label targeted poisoning method that matches gradient magnitude as well as direction generalizes to unseen physical variations of a target object, reaching 90.13% success on multi-view cars.","lead":"This paper shows that a data-poisoning attack can be made to work not just on one exact image but across many real-world views of the same object, like cars photographed from different angles. It does so by matching both the direction and the size of training gradients, and it reports large gains over prior attacks on these varied views.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported 'generalization' may be interpolation between densely sampled known viewpoints; the paper never measures success as a function of distance from the known target views.","rationale":"The paper's central claim is an empirical one: Dmul enables clean-label targeted poisoning to transfer to unseen physical variations. The strongest evidence is the Multi-View Car experiments, where Dmul beats cosine by 19.49 points on average. In good faith, the implementation is released and results are consistent across four architectures, which is real supporting evidence. However, the experimental protocol may not actually test 'unseen' variations. With 10 known images drawn from a 100-image 360° turntable sequence, held-out images are close in angle to a known image; the baseline cosine method already reaches 82.4% in this setting, so the additional gain is an interpolation improvement, not evidence of extrapolation to novel physical conditions. The paper's own Fig. 2 shows that cosine fails across 36° bins, yet the main experiments never report SR as a function of angular distance from the known set, nor do they hold out a contiguous range. The handmade dataset splits within the same two scenes, so test conditions are from the same distributions. These omissions are not minor: they determine whether the central claim is true or overstated. A straightforward extrapolation split would settle it. If Dmul still achieves high SR in that split, the claim is established; if not, the paper's conclusion should be weakened to 'improved interpolation among densely sampled variations.' Given this unresolved evaluation gap, the reader's CONDITIONAL verdict is appropriate, but the condition should be an extrapolation experiment, not merely the theoretical gradient-closeness assumption.","tokens_in":16237,"tokens_out":15062,"duration_ms":144730,"concrete_test":"Re-run the CIFAR-10 Multi-View Car experiment with the poisoner's 10 known images restricted to a contiguous 120° viewpoint range and test only on angles at least 60° away from any known view; also hold out one entire scene in the handmade dataset. Report Dmul vs. Dcos SR for this extrapolation split. If SR drops toward the no-poisoning baseline, the current numbers reflect interpolation, not generalization.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that Dmul makes targeted poisoning transfer to unseen physical variations—is supported by experiments where the poisoner sees 10 of ~100 Multi-View Car images spanning 360°. If these 10 known images are spread across the rotation, every held-out test image is within roughly 16°–18° of a known view. The paper's own Fig. 2 shows cosine-based Witches' Brew is effective within a 36° viewpoint bin and fails mainly across bins; with m=10 covering all bins, most test views are near-duplicates of known views. Thus the 90.13% vs. 82.40% comparison may measure interpolation quality, not extrapolation to genuinely different physical conditions. The handmade dataset similarly splits within the same two scenes, so test lighting/background conditions are the same as known ones. The paper never reports SR versus angular distance to the nearest known view, nor holds out an entire viewpoint range or scene. Without such an extrapolation test, the headline result does not establish generalization to unseen physical variations; it establishes memory of a densely sampled manifold.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces a new threat model, generalizable targeted data poisoning (G-TDP), in which the poisoner has access to a limited set of target-object variations and must poison so that the attack transfers to unseen physical variations of the same object. The authors observe that the cosine-similarity gradient-matching objective of Witches' Brew generalizes poorly across viewpoints, and they propose combining cosine similarity with Euclidean distance in the gradient-matching loss, giving two variants Dadd and Dmul. Experiments on CIFAR-10 and ImageNet with Multi-View Car targets, on a handmade dataset with viewpoint/background/lighting changes, and on subpopulation and standard TDP settings show that the proposed losses, especially Dmul, often improve poisoning success rates over cosine-only baselines while keeping validation accuracy roughly constant. The paper also includes a theoretical Proposition 1 in Appendix A intended to justify why smaller gradient Euclidean distance should improve generalization.","tokens_in":16430,"tokens_out":2571,"duration_ms":106197,"significance":"If the central claim holds, the paper is a useful step beyond the single-image threat model that dominates clean-label targeted poisoning, and the proposed Dmul loss could become a strong baseline for realistic physical-object poisoning. The empirical core is consistent: Dmul beats cosine and ED in most settings, preserves validation accuracy, and transfers across architectures. The code is released, which supports reproducibility. However, the evidence for the headline claim of generalization to unseen physical variations is currently incomplete: the paper does not demonstrate extrapolation to genuinely novel viewpoints or scenes, and the theoretical justification rests on an unmeasured gradient-closeness assumption. The attack's practical significance therefore remains plausible but not fully established.","major_comments":[{"comment":"The paper's central claim is that poisoning transfers to unseen physical variations, but the experimental design does not actually measure extrapolation. In the Multi-View Car setting, the poisoner receives m=10 images from roughly 100 views spanning 360 degrees, and Figure 2 shows that Witches' Brew is effective within a 36-degree viewpoint bin and fails mainly across bins. With m=10, the known views likely cover all ten bins, so held-out test views are typically within about 18 degrees of a known view. The 90.13% versus 82.40% comparison may therefore measure interpolation quality on a densely sampled viewpoint manifold rather than generalization to genuinely new physical conditions. The manuscript never reports success rate as a function of angular distance to the nearest known view, nor does it hold out an entire viewpoint range or scene. To support the claim, the authors should add an explicit extrapolation test (e.g., poison using views from only a contiguous 180-degree range and evaluate on the opposite range, or report SR versus angular/spatial distance to the nearest known target view).","section":"§5.1 and Fig. 2 / Table 1"},{"comment":"The theoretical justification for why Euclidean-distance matching should improve generalization depends on the assumption that all samples of the physical object have gradients lying in an L2 ball around the average target gradient. This radius is never measured for the Multi-View Car or handmade targets, so the proposition's condition (11) is not verified for any actual dataset. Additionally, the proof uses a single gradient-descent step and drops the Taylor remainder term in Eq. (14). The authors should either measure the gradient ball radius for their target objects or present the proposition as a purely illustrative model; as written, the theory does not by itself establish that smaller Euclidean distance improves generalization for the tested physical objects.","section":"Appendix A, Proposition 1"},{"comment":"The abstract and Section 5.2 state that Dmul outperforms the state of the art by 19.49% on CIFAR-10 Multi-View Car, but this is an average over four models, and Table 1 shows that Dmul is not the best method on ConvNet64 (Our_add achieves 82.30% while Dmul achieves 76.48%). The claim that Dmul is best except on ConvNet64 is accurate, but the averaged improvement is dominated by the large gain on ConvNet64, where the recommended loss is not the best. The paper should clarify that the recommended Dmul is a robust overall choice, not the best in every configuration, and should report per-model gains rather than only the average.","section":"Table 1 and §5.2"},{"comment":"The paper reports results from 10 seeds but does not report standard deviations or confidence intervals anywhere in Tables 1-6. Given that poisoning success rates can be noisy (e.g., Table 5 shows 3.00% for BP across three models), the absence of variance makes it difficult to assess whether differences such as 88.85% versus 90.13% on ResNet-18 are significant. The authors should provide error bars or at least a variance table in the appendix.","section":"§5.1 and §5.4"}],"minor_comments":[{"comment":"The ImageNet results are based on only 5 selected cars, as disclosed in Appendix C.2. This is a reasonable practical choice, but the paper should explicitly state in Section 5.1 that the ImageNet numbers are for a small, carefully selected target set, so that readers do not over-generalize the ImageNet results.","section":"§5.1 / Appendix C.2"},{"comment":"The handmade dataset experiment provides 10 images from each of only two scenes to the poisoner, and the test images come from the same two scenes. This is a strength for controlling lighting and background, but it also means the evaluation does not test generalization to an entirely new scene; the manuscript should say this limitation explicitly.","section":"§5.4"},{"comment":"There is a typographical error in the constraint: \"L(fθ, S ′(∆), A)\" has an extra unmatched parenthesis. It should be L(fθ, S′(∆), A).","section":"Eq. (2)"},{"comment":"The phrase \"In other word\" should be \"In other words.\"","section":"Appendix B.1"},{"comment":"The statement that adding retraining does not help in the previous TDP scenario is interesting but underexplored. A brief explanation or reference to the known behavior would improve readability.","section":"§6.1"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and practical extension of targeted data poisoning, and the empirical core is mostly consistent. My main concern is the gap between the paper's claim of generalizing to unseen physical variations and the evidence, which does not rule out interpolation on a densely sampled viewpoint manifold. I believe this is fixable with additional experiments and measured gradient-closeness statistics, so I recommend major revision rather than rejection. The lack of variance reporting is also a systematic issue that should be addressed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague—\n\nThe new thing here is the threat model: instead of poisoning against a single target image, the poisoner knows a set of target views and the attack is scored on held-out views of the same physical object. That is a fair and useful correction to how TDP is usually evaluated. The proposed fix—adding a Euclidean-distance term to the cosine gradient-matching objective (Dmul)—consistently beats Witches' Brew in most experiments, and the gains are not tiny: 19.49 points average on CIFAR-10 across four architectures, and better transfer to other models. The authors also show the usual defenses, and the ablation on known-target count is informative. I believe the empirical core: the effect is consistent and the code is available.\n\nThe soft spots are in how much \"generalization\" the experiments actually demonstrate. With m=10 known views spread over 360° of car rotation, every held-out test view is within roughly 18° of a known view. Figure 2 in the paper shows that Witches' Brew's cosine loss already works within a 36° viewpoint bin; with known views covering all bins, the evaluation mostly measures interpolation over a well-sampled manifold, not extrapolation to genuinely unseen physical conditions. The handmade dataset has the same issue: the poisoner sees 10 images in each of two scenes, and the test images are from those same two scenes. So lighting and background are not held out. The paper never reports success rate versus angular distance to the nearest known view, nor does it hold out an entire viewpoint range or a new scene. That is the missing experiment, and it should be added before the headline claim is accepted.\n\nOther issues are secondary but real: no error bars despite ten seeds, the ImageNet subset uses only five hand-picked cars, and the handmade dataset is not released. The theoretical proposition in Appendix A depends on an unverified gradient-closeness assumption; it is a modeling premise, not a measured fact, so it does not add much weight.\n\nOverall: this is a solid paper with a useful new evaluation protocol and a plausible method. The central direction-magnitude insight holds up in the tested regime. But the phrase \"generalizable\" is stronger than the evidence. I would send it to peer review and ask for the angular-distance and held-out-scene analysis, variance reporting, and dataset release. A serious referee can sort this out; the paper is worth the time.","headline":"New evaluation threat model and a plausible loss tweak, but the generalization claim is mostly interpolation and needs a distance-based test.","tokens_in":16983,"tokens_out":3527,"would_cite":true,"duration_ms":29883,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Targeted data poisoning can generalize across unseen physical variations of an object by matching both the direction and the magnitude of gradients.","keywords":["targeted data poisoning","clean-label poisoning","gradient matching","physical object variations","poisoning generalization","multi-view car","subpopulation poisoning","poisoning defenses"],"falsifier":"Compute the gradients of test variants of a Multi-View Car object at the moment the poison is optimized and measure how many violate the bound in Proposition 1: $\\|\\nabla_\\theta \\ell(f_\\theta(x), y_{\\mathrm{adv}}) - \\nabla_\\theta L_t\\|_2 < \\langle \\nabla_\\theta L_t, \\nabla_\\theta L_{p,\\mathrm{our}} - \\nabla_\\theta L_{p,\\mathrm{cos}} \\rangle / \\|\\nabla_\\theta L_{p,\\mathrm{our}} - \\nabla_\\theta L_{p,\\mathrm{cos}}\\|_2$. If many variants fall outside the admissible ball, the attack's stated mechanism predicts failure; observing high success there would contradict the paper's explanation.","tokens_in":16025,"feed_emoji":"🎯","tokens_out":10464,"duration_ms":89684,"temperature":0.7,"pith_summary":"Targeted data poisoning attacks are usually evaluated by poisoning and testing on the exact same image, which makes them look less threatening than they are. This paper introduces a realistic threat model, generalizable targeted data poisoning (G-TDP), in which the target is a physical object and the attacker only sees a few of its variants, while success is measured on unseen viewpoints, backgrounds, and lighting conditions. It claims that the standard gradient-matching objective, which only aligns gradient directions, generalizes poorly under this model, and proposes a new loss that also matches gradient magnitude. With that loss, poisoning success on a multi-view car rises to 90.13% on ResNet-18, versus 82.40% for the direction-only baseline, and the attack reaches 54.92% on a handmade object dataset where no poisoning gives 0%. If the claim holds, clean-label poisoning becomes a realistic threat to models trained on scraped images of physical objects.","feed_headline":"Targeted poisoning now hits unseen object views in the real world","feed_subtitle":"Matching gradient direction plus magnitude lifts car-view attack success from 82.4% to 90.1% on ResNet-18.","key_machinery":"The carrying object is the gradient-matching loss. Where earlier work minimized the cosine distance between the average gradient of poison samples and the average gradient of target samples, this paper minimizes the product of that cosine distance and the squared Euclidean distance between the two gradients, $D_{\\mathrm{mul}}(L_p, L_t) = \\|\\nabla_\\theta L_p - \\nabla_\\theta L_t\\|_2^2 \\cdot (1 - \\cos(\\nabla_\\theta L_p, \\nabla_\\theta L_t))$. The Euclidean factor forces poison gradients to be large enough to shift model parameters, not merely aligned in direction. Proposition 1 formalizes the mechanism: if two poison gradients have the same cosine similarity to the target gradient but different Euclidean distances, the one with smaller Euclidean distance lowers the loss on every sample whose gradient lies in a ball around the target gradient, and the size of that ball grows with the target gradient's magnitude. A retraining step is included in the optimization to keep the matching realistic as the victim model changes.","core_discovery":"Under the G-TDP threat model, the paper's central claim is that a clean-label poison crafted from a small set of known images of an object can misclassify unseen physical variants of that object, and that this generalization is driven by matching the magnitude as well as the direction of gradients. The evidence is experimental: on the Multi-View Car target, the proposed product loss $D_{\\mathrm{mul}}$ outperforms the cosine-only Witches' Brew baseline by 19.49 percentage points on average across four CNN architectures on CIFAR-10, with ResNet-18 reaching 90.13% versus 82.40%. On a handmade dataset with viewpoint, background, and lighting changes, the method achieves 54.92% poisoning success on ImageNet, compared with 0% for unpoisoned training. The same loss also improves results in the previous single-image TDP setting and in subpopulation poisoning, which the authors read as confirmation that direction-plus-magnitude matching, rather than the physical-variation setup alone, is the source of the gain.","pith_inferences":["The mechanism suggests a predictor of attack success that the paper does not test: object categories whose variants share low-level visual statistics should be easier to poison, while categories with strong lighting or occlusion changes may be harder. This could be checked by ranking classes by gradient dispersion and correlating with success rate.","The paper's negative result for digital augmentation on target samples implies that physical variation is not well simulated by standard augmentation, so a natural next step is to build augmentation schemes that mimic physical factors; such schemes could strengthen either attacks or defenses.","If gradient magnitude is the operative factor, a defender could estimate the gradient magnitude induced by suspected poison samples and clip or reshape it during training, a defense direction suggested by the paper's mechanism rather than tested by it.","The near-100% success on full-ImageNet single trials hints that the attack may be practical at web scale, but the evidence is single-trial; a larger study across many object types and training pipelines would show how general the risk is."],"forward_implications":["An adversary with only a handful of images of a physical object can craft poisons that misclassify that object under viewpoints and conditions never seen during poisoning, as long as the object's variants keep similar gradients.","The attack transfers across architectures: poisons crafted with VGG11 reach an average success rate of 71.89% on ResNet-18, MobileNet-V2, and LeViT-384, and a Swin V2 model is attacked at 41.03%.","The proposed loss also improves performance in the standard single-image TDP setting and in subpopulation poisoning, so the direction-plus-magnitude matching claim is not limited to physical-variation targets.","Defenses that alter training are costly: differential privacy reduces the attack only at a large validation-accuracy cost, and JPEG compression drops the success rate to 0.07% but lowers validation accuracy from 91.99% to 83.60%."],"supporting_citations":[{"why":"Supplies the gradient-matching framework and the cosine-only baseline (Witches' Brew) that the proposed loss modifies.","marker":"[8]"},{"why":"Supplies the retraining step used in the poison optimization loop.","marker":"[31]"},{"why":"Provides the Multi-View Car dataset used to define physical target variations and evaluate poisoning generalization.","marker":"[25]"},{"why":"Provides the clean-label TDP setup with multiple known target variants that G-TDP builds on as a baseline.","marker":"[1]"},{"why":"One of the clean-label training-from-scratch TDP methods the work extends to physical variations.","marker":"[17]"},{"why":"Defines subpopulation data poisoning, the threat model the method is adapted to in Section 6.2.","marker":"[18]"},{"why":"Robust training defense (EPIc) used as a baseline in the defense evaluation.","marker":"[41]"},{"why":"Unified poisoning benchmark used to evaluate the new loss under the previous single-image threat model.","marker":"[28]"}],"fun_headline_variants":["Gradient magnitude key to poison transfer across object views","Adding magnitude to gradient matching generalizes targeted attacks","Poisoning succeeds on unseen physical variations with new loss","Direction plus magnitude lifts car-view poisoning to 90%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole argument rests on the assumption that all physical variants of the target object have gradients close to the gradient of the average target; if real variations produce divergent gradients, the smaller-Euclidean-distance mechanism has nothing to generalize across.","fun_headline_variants_meta":{"raw":{"variants":["Gradient magnitude key to poison transfer across object views","Adding magnitude to gradient matching generalizes targeted attacks","Poisoning succeeds on unseen physical variations with new loss","Direction plus magnitude lifts car-view poisoning to 90%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000485,"raw_usage":{"total_tokens":2392,"prompt_tokens":943,"completion_tokens":1449,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":559,"completion_tokens_details":{"reasoning_tokens":1385}},"tokens_in":559,"tokens_out":1449,"duration_ms":13067,"temperature":1.0,"reasoning_tokens":1385,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T21:57:22.978135+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the gradients of test variants of a Multi-View Car object at the moment the poison is optimized and measure how many violate the bound in Proposition 1: $\\|\\nabla_\\theta \\ell(f_\\theta(x), y_{\\mathrm{adv}}) - \\nabla_\\theta L_t\\|_2 < \\langle \\nabla_\\theta L_t, \\nabla_\\theta L_{p,\\mathrm{our}} - \\nabla_\\theta L_{p,\\mathrm{cos}} \\rangle / \\|\\nabla_\\theta L_{p,\\mathrm{our}} - \\nabla_\\theta L_{p,\\mathrm{cos}}\\|_2$. If many variants fall outside the admissible ball, the attack's stated mechanism predicts failure; observing high success there would contradict the paper's explanation.","supporting_citations":[{"cited_title":"Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein","cited_arxiv_id":null,"evidence_quote":"Supplies the gradient-matching framework and the cosine-only baseline (Witches' Brew) that the proposed loss modifies."},{"cited_title":"Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch","cited_arxiv_id":null,"evidence_quote":"Supplies the retraining step used in the poison optimization loop."},{"cited_title":"Pose es- timation for category specific multiview object localization","cited_arxiv_id":null,"evidence_quote":"Provides the Multi-View Car dataset used to define physical target variations and evaluate poisoning generalization."},{"cited_title":"Bullseye polytope: A scalable clean-label poisoning attack with improved trans- ferability","cited_arxiv_id":null,"evidence_quote":"Provides the clean-label TDP setup with multiple known target variants that G-TDP builds on as a baseline."},{"cited_title":"Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein","cited_arxiv_id":null,"evidence_quote":"One of the clean-label training-from-scratch TDP methods the work extends to physical variations."},{"cited_title":"Subpopulation data poisoning attacks","cited_arxiv_id":null,"evidence_quote":"Defines subpopulation data poisoning, the threat model the method is adapted to in Section 6.2."},{"cited_title":"Not all poisons are created equal: Robust training against data poi- soning","cited_arxiv_id":null,"evidence_quote":"Robust training defense (EPIc) used as a baseline in the defense evaluation."},{"cited_title":"Just how toxic is data poison- ing? a unified benchmark for backdoor and data poisoning attacks","cited_arxiv_id":null,"evidence_quote":"Unified poisoning benchmark used to evaluate the new loss under the previous single-image threat model."}],"review_version":1}