{"id":"e82b53f9-d433-41e2-8b8c-104482d4e8ca","arxiv_id":"2412.08755","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A prompt-tuned CLIP model trained on five known backdoor attacks can detect a sixth held-out attack type with about 86% accuracy on CIFAR-10 and GTSRB.","lead":"This paper trains a small set of learnable text prompts on a frozen CLIP model to label images as clean or backdoored, then tests whether the detector can flag a backdoor attack type it never saw during training. The authors report about 86% average detection accuracy across two datasets and position the method as a proactive filter for poisoned training data and inference traffic.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Leave-one-out over six known attack families does not establish open-world generalization; no seventh-family or negative-control test supports the central claim.","rationale":"The paper's proposed contribution, stated in the introduction as a 'proactive' detector of unseen open-world adversarial images, depends on the text prompts learning a transferable representation of 'backdoored' that applies to attacks not seen during training. The only evidence for that transfer is leave-one-out accuracy on six attack families. That design has two problems. First, six families are all from a similar universe: BadNets/Trojan are localized or square-pattern triggers, l2/l0-inv are perturbations over the whole image; the held-out family is still drawn from the same attack-generating distribution. Second, the model's training signal is simply 'these images are backdoored' according to five concrete families, so a prompt could latch onto any low-level common denominator (e.g., abrupt rectangular patch boundaries or a constant additive component) rather than a general backdoor concept. The Badnets-PX row in Table I is the in-paper symptom: near-chance accuracy for the held-out trigger that is visually most distinct. If the method were genuinely attack-agnostic, that row should not collapse. The cross-dataset experiment does not fix this because it trains on the same five known families and tests the sixth. The static-prefix ablation is useful and shows learning the prompt matters, but it does not establish what concept is learned. For the load-bearing claim to hold, the authors need to show transfer to a trigger family outside the six, and to rule out trivial artifact detection via negative controls. Absent that, the conclusion should be limited: the method generalizes between similar backdoor families, not to 'unseen, open-world adversarial samples'. The reader already asked for such a check and gave CONDITIONAL; my analysis identifies the same gap, so I would keep the verdict unchanged rather than escalate, provided the requested experiments are performed.","tokens_in":9376,"tokens_out":4603,"duration_ms":51951,"concrete_test":"Reproduce the training protocol with five of the six listed families, then test the detector on a seventh family that was never used in training and that uses a different trigger mechanism, e.g., WaNet elastic-warping or ISSBA sample-specific invisible triggers, under the same balanced clean/backdoored protocol on CIFAR-10 and GTSRB. Include also a negative-control set of natural corruptions (Gaussian noise, blur, JPEG compression) that are not backdoors. If accuracy on the seventh family remains above roughly 80% while clean accuracy stays high, the open-world generalization claim receives real support; if it drops to 50-65% (as Badnets-PX already does in Table I), the method is specific to the six families and the verdict should require tempering the claim to 'generalization across similar trigger families'.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that a clean CLIP with learned text prompts detects 'unseen, open-world adversarial samples without having any prior knowledge about the attacks' (Section I). What is actually evaluated is leave-one-out over a fixed set of six attack families: Section III trains on five of six and calls the excluded family 'unseen'. The learned text prompt only needs to separate clean images from images that contain artifacts of the five training families; transfer to the sixth can be explained by shared low-level properties (patches, watermarks, or common perturbations) rather than by a general notion of backdoor. Table I shows this dependence: the held-out Badnets-PX trigger, a subtle pixel-level pattern least similar to the other five families, is detected at only 58.89% on CIFAR-10 and 60.42% on GTSRB, near chance, while the more patch-like triggers are detected above 94%. That is direct evidence that the detector is not attack-agnostic. The cross-dataset experiment (Table II) still holds out only the same six families, so it does not widen the trigger distribution. No experiment presents an attack family outside the training list, a natural corruption/negative-control set, or an OOD image class; therefore the 'open-world' portion of the claim is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a backdoor-image detector based on prompt tuning of a frozen CLIP model. Learnable text prompts are trained for the binary classes 'clean' and 'backdoored' on images drawn from five backdoor attack families, and the held-out sixth family is used for evaluation on CIFAR-10 and GTSRB, including cross-dataset transfer experiments. The central claim is that a clean, unpoisoned CLIP model can detect unseen, open-world backdoor images without attack-specific knowledge, with an average accuracy of about 86% on the two datasets.","tokens_in":9568,"tokens_out":6072,"duration_ms":61127,"significance":"If the open-world claim were supported, this would be a practical and lightweight defense for pre-training data filtering and inference-time gating. The core idea of prompting a frozen CLIP model for binary clean/backdoored discrimination is simple, does not require a poisoned model, and is easy to describe. However, the evidence currently supports only detection of held-out triggers within a closed set of six related attack families; the open-world generalization claim is not established. The near-chance result on Badnets-PX in Table I and the absence of any truly unseen attack family are substantial limitations. The paper does not provide machine-checked proofs or code, and the baseline comparisons are not reproducible as described.","major_comments":[{"comment":"The leave-one-out protocol evaluates only five training families and the sixth held-out family from the same fixed set; this is not an open-world test. Table I shows that the held-out trigger least similar to the training families, Badnets-PX, is detected at 58.89% on CIFAR-10 and 60.42% on GTSRB, near chance, while patch-like triggers exceed 94%. This pattern indicates that the prompt separates low-level artifacts shared by the five training families rather than learning a general property of backdoors. To support the Section I claim of detecting 'unseen, open-world adversarial samples without having any prior knowledge about the attacks,' the authors should test on at least one attack family never seen in training, add a negative-control set of natural corruptions, and report performance for each held-out attack rather than only as an average.","section":"Section III, Experiment Settings; Table I"},{"comment":"The cross-dataset experiment transfers between CIFAR-10 and GTSRB but still holds out only the same six families used in training; it therefore tests dataset shift, not trigger-distribution shift. The text in Section III-B correctly describes the dataset transfer, but the broader 'unseen trigger' generalization claim remains confined to the six-family set. In addition, the evaluation uses a balanced 50/50 clean/backdoored test set and a fixed similarity-score decision rule with no threshold analysis, so the reported accuracies do not quantify behavior under open-world prevalence or allow users to trade false positives against false negatives.","section":"Section III, Cross-Generalization Experiment; Table II"},{"comment":"The CNN baselines are not reproducible as described. The architectures of Simple-CNN and Deep-CNN are not specified beyond layer counts, and references [22] and [23] do not define them: [22] is Eykholt et al. on physical adversarial attacks and [23] is Stallkamp et al. on the GTSRB dataset. Training budgets, hyperparameters, and data splits for these baselines are also missing. Without this information, the comparisons in Table I cannot be independently verified, and the stated improvements over baselines are not established. The authors should add full baseline details or cite the actual architecture sources.","section":"Section III, Experiment Settings and Table I"},{"comment":"The conclusion frames the method as establishing 'a new benchmark' for backdoor defense, but no comparison is made to a CLIP linear probe or to existing backdoor detectors such as BDetCLIP [19]. The only ablation (Table III) compares the learned prefix with a static prefix. While the learned-prefix gains are large, they do not show that prompt-tuned CLIP is competitive with or superior to available alternatives. Adding at least one VLM-based or feature-based detection baseline would substantially strengthen the claimed benchmark status.","section":"Section IV, Conclusion; Table III"}],"minor_comments":[{"comment":"The heading 'Preliminaries and Insignts' contains a typo; it should be 'Insights'. There is also a typo 'advesaries' in the same section.","section":"Section II-A"},{"comment":"The text refers to 'Backdoor-PX' where the attack is 'Badnets-PX'; please use consistent naming throughout the paper.","section":"Section III-C"},{"comment":"The table note says 'Values are shown in blue,' but the table is not in color in the manuscript; please indicate these values by a different formatting cue.","section":"Table III"},{"comment":"The method uses only the class labels 'clean' and 'backdoored' and discards the object class names; a sentence explaining this design choice would improve clarity.","section":"Section II-B"},{"comment":"The t-SNE visualization is described qualitatively; adding a quantitative separation metric such as a silhouette score or class-conditional embedding distance would better support the visual claim.","section":"Section III-C"}],"recommendation":"major_revision","confidential_remarks":"The manuscript's stated contribution is considerably broader than its evidence. The leave-one-out design and the near-chance Badnets-PX result should be addressed head-on. The reference list also contains apparent mismatches for the baseline architectures ([22] and [23]) that the editor should ask the authors to clarify. The method is potentially useful, but the current claims need either to be scaled back to held-out triggers from a known family set or supported by substantially broader experiments."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this paper is a reasonable proof of concept, not the breakthrough it claims to be. The core idea is new enough: frozen CLIP with a learnable text prefix trained to classify images as clean or backdoored, then tested on an attack type held out from training. That specific application of CoOp-style prompt tuning to backdoor image detection is not in the cited literature. The static-prefix ablation (Table III) is genuinely useful, since it shows the learned prefix is doing the work rather than the frozen CLIP. The cross-dataset transfer experiment (Table II) is also a good addition.\n\nThe soft spots are significant. The central claim of detecting 'unseen, open-world adversarial samples without any prior knowledge about the attacks' is not supported. Leave-one-out over six known attack families is not an open-world test; the held-out attack still shares low-level artifacts with the training families. The Badnets-PX numbers (58.89% on CIFAR-10, 60.42% on GTSRB) are near chance, and the paper admits this. That is direct evidence the detector is not attack-agnostic. There is no seventh-family test, no negative-control corruption set, and no OOD image class. The abstract and conclusion use language like 'groundbreaking' and 'new standard,' which is out of proportion.\n\nThe baselines are a real problem. Simple-CNN [22] and Deep-CNN [23] reference Eykholt et al. and Stallkamp et al. respectively, but those papers do not describe those CNN architectures. No architecture details, training budgets, or hyperparameters are given. There is no comparison to a CLIP linear probe or to BDetCLIP, even though BDetCLIP is cited. No code or attack-generation parameters are provided.\n\nThe stress-test note is right that the open-world portion of the claim is unsupported. However, the paper is not circular in the fitting sense: the held-out attack is not used to train the prompts. The limitation is about generalization scope, not internal validity.\n\nWho gets value from this: researchers working on data-curation filters or backdoor defenses, who may find this a useful baseline to compare against once the evaluation gaps are filled. It deserves a serious referee, but with major revisions expected. I would not cite it in its current form, and I would not bring it to reading group as-is, but I would send it to peer review rather than desk reject.\n\nRecommendation: engage with it, ask for the missing comparisons, a real unseen-family test, corrected references, and code release. The core idea is worth one more round.","headline":"A plausible prompt-tuning-based backdoor image detector that overclaims open-world generalization; the leave-one-out evaluation only covers six attack families and the hardest trigger is near chance.","tokens_in":10175,"tokens_out":1770,"would_cite":false,"duration_ms":18734,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A clean, unpoisoned CLIP model, adapted only by a few learnable text prompts, can detect backdoored images from attack families it has never seen, with roughly 86% accuracy on CIFAR-10 and GTSRB.","keywords":["backdoor attacks","backdoor detection","vision-language models","prompt tuning","CLIP","adversarial defense","image poisoning","unseen attack detection"],"falsifier":"Take the trained detector and test it on backdoored images from a family not among the six, such as a semantic trigger (e.g., a natural object inserted into the scene) or an adaptive trigger optimized to be inconspicuous in CLIP's feature space. If clean-versus-backdoored accuracy falls to near chance (50%), the claim of detecting unseen open-world attacks would not survive.","tokens_in":9095,"feed_emoji":"🛡️","tokens_out":8690,"duration_ms":77320,"temperature":0.7,"pith_summary":"This paper claims that a clean, unpoisoned CLIP model can be turned into a detector for backdoored images by training only a few learnable text prompts, with no prior knowledge of the attack type. The evaluation trains the prompts on five backdoor attack families and tests on the sixth held-out family on CIFAR-10 and GTSRB, reaching an average accuracy of about 86%. The method is less effective on subtle pixel-level triggers (Badnets-PX), where accuracy drops to roughly 60%. This matters because the same detector could scan training data for poisoned images before a model is trained and block backdoored images at inference time, an approach that manual inspection cannot scale to.","feed_headline":"Prompt-tuned CLIP spots unseen backdoor triggers at 86%","feed_subtitle":"Learnable text prompts turn a frozen vision-language model into a filter that needs no prior knowledge of the attack.","key_machinery":"The load-bearing mechanism is a learnable soft prompt: a three-token prefix, initialized with the embeddings of 'a photo of', that is concatenated with the word embedding of a class name and passed through CLIP's frozen text encoder. The image encoder is also frozen, so the only trainable parameters are the prompt vectors. Training uses a scaled dot-product similarity score between image and text embeddings with a cross-entropy objective, optimized by Adam, to pull clean and backdoored images toward their respective text embeddings. The learned prefix is what carries the generalization: it adapts the text representations to highlight the low-level visual artifacts that the seen attack families share, allowing the detector to flag a held-out attack family at inference.","core_discovery":"The central claim is that a frozen CLIP model, with only a small trainable prefix of soft prompt tokens, can distinguish clean images from backdoored images even when the attack type was never seen during training. The prompts are appended to the class labels 'clean' and 'backdoored', and the image and text encoders are kept fixed; training optimizes the prompts with cross-entropy loss on scaled dot-product similarities, and inference simply selects the class whose text embedding has higher similarity. In leave-one-out experiments over six attack families (BadNets, Trojan, $\\ell^2$-inv, l0-inv), the detector achieves 86.20% average accuracy on CIFAR-10 and 86.24% on GTSRB, and it retains above-chance performance when trained on one dataset and tested on the other. The authors position the method as a proactive defense that works without knowing the trigger or the poisoned model, serving as both a pre-training data filter and an inference-time gate.","pith_inferences":["The leave-one-out protocol is a weak proxy for 'unseen': it tests one family held out from five similar families, not a genuinely novel trigger distribution. A stronger test would train on all six families and test on a completely different attack type, such as a warped or natural trigger.","Because the method appears to rely on global visual artifacts shared among the six families, an attacker could evade it by using triggers that are semantically plausible in the scene, which CLIP's features may treat as normal content.","The same prompt-tuning framework could be applied to other VLM-based detection tasks, such as flagging out-of-distribution inputs or detecting backdoored images in multimodal datasets, since the mechanism is task-agnostic.","For pre-training filtration, the detection threshold could be adjusted to favor recall over precision, accepting some clean images dropped to ensure no poisoned sample enters the training set."],"forward_implications":["A prompt-tuned CLIP can act as a data filter: it can scan large training sets and reject backdoored images before they poison an object recognition model.","The same detector can sit in front of a deployed classifier at inference time and block backdoored images from triggering a targeted misclassification.","The method requires no knowledge of the trigger, no access to the poisoned model, and only a handful of trainable parameters, making it practical for real-world deployment.","The detector transfers across datasets: training on CIFAR-10 and testing on GTSRB (and the reverse) still yields above-chance detection for all six attack families.","The learnable prefix is essential; replacing it with a static 'a photo of' prompt drops accuracy to near chance, showing the adaptation itself drives the detection."],"supporting_citations":[{"why":"Supplies the frozen vision-language model whose encoders are kept fixed; the entire detection pipeline builds on CLIP's joint embedding space.","marker":"[21]"},{"why":"Provides the prompt-tuning methodology that the learnable soft-prompt prefix is based on.","marker":"[26]"},{"why":"BadNets attack family; one of the six attack types used to generate backdoored training and test images.","marker":"[20]"},{"why":"Trojan attack family; another attack type used for training and leave-one-out testing.","marker":"[6]"},{"why":"Defines the invisible l2-inv and l0-inv attacks used as two of the six families in the evaluation.","marker":"[29]"},{"why":"ResNet-18, the strongest CNN baseline in the comparison; the proposed method is measured against it in Table I.","marker":"[24]"},{"why":"CIFAR-10 dataset used in all experiments.","marker":"[30]"},{"why":"GTSRB dataset used in all experiments and in cross-dataset generalization.","marker":"[23]"}],"fun_headline_variants":["Prompt tuning lets frozen CLIP catch unseen backdoors","CLIP prompts detect backdoor images with 86% accuracy","Learnable prompts turn CLIP into backdoor image filter","Frozen CLIP plus prompts spots unknown backdoor triggers"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The evaluation assumes that the six backdoor attack families used in the leave-one-out protocol are representative of the space of all possible backdoor triggers, so that a prompt trained on five families will recognize the sixth as a stand-in for a truly unseen attack.","fun_headline_variants_meta":{"raw":{"variants":["Prompt tuning lets frozen CLIP catch unseen backdoors","CLIP prompts detect backdoor images with 86% accuracy","Learnable prompts turn CLIP into backdoor image filter","Frozen CLIP plus prompts spots unknown backdoor triggers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000155,"raw_usage":{"total_tokens":1199,"prompt_tokens":915,"completion_tokens":284,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":531,"completion_tokens_details":{"reasoning_tokens":217}},"tokens_in":531,"tokens_out":284,"duration_ms":3593,"temperature":1.0,"reasoning_tokens":217,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T17:36:14.951799+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the trained detector and test it on backdoored images from a family not among the six, such as a semantic trigger (e.g., a natural object inserted into the scene) or an adaptive trigger optimized to be inconspicuous in CLIP's feature space. If clean-versus-backdoored accuracy falls to near chance (50%), the claim of detecting unseen open-world attacks would not survive.","supporting_citations":[{"cited_title":"Fast and lightweight vision- language model for adversarial traffic sign detection,","cited_arxiv_id":null,"evidence_quote":"BadNets attack family; one of the six attack types used to generate backdoored training and test images."},{"cited_title":"Bert: Pre-training of deep bidirectional transformers for language understanding,","cited_arxiv_id":null,"evidence_quote":"Trojan attack family; another attack type used for training and leave-one-out testing."},{"cited_title":"Conditional prompt learning for vision-language models,","cited_arxiv_id":null,"evidence_quote":"Defines the invisible l2-inv and l0-inv attacks used as two of the six families in the evaluation."},{"cited_title":"Learning transferable visual models from natu- ral language supervision,","cited_arxiv_id":null,"evidence_quote":"GTSRB dataset used in all experiments and in cross-dataset generalization."}],"review_version":1}