{"id":"e64cc79d-bc1e-4f23-8e6c-2e49361b9081","arxiv_id":"2412.10681","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"WorstVIT poisons a ViT for one epoch and, using gradient-guided per-image pixel selection, achieves near-100% attack success while changing just one pixel per image.","lead":"The paper introduces a backdoor attack against Vision Transformers that needs only a one-pixel change per image to flip predictions to a target label after minimal poisoning. It also describes a gradient-based sensitivity map that shows ViTs are most sensitive at patch centers, and uses this map to place the tiny trigger.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'one pixel' claim depends on per-input white-box probing (up to 1000 trials), not a fixed trigger; the reported 100% PASR does not establish a single-pixel backdoor property.","rationale":"The reader's weakest_assumption identifies exactly the same load-bearing concern: the 'one pixel' result depends on a white-box probing protocol with up to 1000 candidate modifications per input, and the paper assumes this per-input search is a meaningful backdoor threat model. My reading of the full text confirms this. Section 4.2 describes a systematic probing attack that selects coordinates from PSDM rankings, per-pixel gradients, and per-channel gradients, adjusting values until an attack succeeds within 1000 trials. Section 4.3 defines PASR as success 'within a set number of attempts'. Thus the reported 100% PASR is a search-success rate, not the success rate of a fixed trigger. This does not make the paper valueless: the PSDM phenomenon, the quasi-trigger transferability, and the observation that backdoor suppression patterns exist are interesting and potentially useful. But the central 'one pixel' claim, as advertised in the title and abstract, is overstated unless the attack is evaluated under a fixed-trigger protocol. Because the reader already conditioned the verdict on this assumption, my stress-test does not move the verdict: it remains conditionally acceptable, pending either a fixed-trigger evaluation or a clearly qualified threat-model statement in the abstract and conclusion. The concrete test proposed above would settle whether the concern actually lands: if fixed-trigger ASR is high, the claim stands; if not, the contribution should be reframed as a white-box probing attack with a backdoor-enhanced prior.","tokens_in":14248,"tokens_out":4053,"duration_ms":40340,"concrete_test":"After training WorstVIT with the same poisoning scheme, fix the trigger at a single predetermined coordinate with a predetermined contrast-based value (e.g., the patch center (7,7) from Section 4.1, or the argmax-PSDM coordinate (108,209) used for WorstSwin-VIT) and apply this identical one-pixel trigger to every image in the validation set; report the resulting ASR. Separately, run the same 1000-trial white-box probing search on a clean, unpoisoned ViT to measure the one-pixel targeted-attack success rate without any backdoor. If the fixed-trigger ASR is materially lower than the reported 100% PASR, or if the clean model also achieves high probing success, then the headline 'one pixel' result is an artifact of the per-input search budget rather than a property of the embedded backdoor.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim, stated in the Abstract and Introduction as 'modifying just one pixel can change the model's prediction to the specified label' for all validation images, is supported only by the PASR metric defined in Section 4.3: an attack is counted as successful if, 'within a set number of attempts', the prediction can be changed by modifying one pixel or one channel. Section 4.2 makes the protocol explicit: quasi-triggers are placed sequentially at coordinates ranked by PSDM values, per-input gradient values, or channel gradients, and 'typically, suitable quasi-triggers are found within 1000 trials'. The trigger is not a fixed pattern; both its position and its pixel value are chosen per sample during a white-box search. Therefore the 100% PASR in Table 1 demonstrates that a one-pixel search succeeds, not that a fixed single-pixel trigger exists as a stable, generalizable backdoor property. If the threat model requires a fixed trigger, as in standard backdoor attacks and as the title and abstract imply, the paper provides no evidence for the claim. In that case the method reduces to a white-box, gradient-guided single-pixel adversarial search on a backdoored model, which is a materially weaker and less novel result. This is load-bearing because the paper's headline contribution, its 'one pixel is all I need' framing, and its claim to attack 'all validation images' all rest on this per-input search interpretation.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies backdoor vulnerabilities of Vision Transformers (ViTs). It introduces the Perturbation Sensitivity Distribution Map (PSDM), obtained by summing input gradients over many images, and reports that ViTs exhibit a patch-like PSDM whose center pixels are more sensitive than edges. The paper defines quasi-triggers, i.e., patterns that differ from but resemble the training trigger, and claims that quasi-triggers transfer across patch positions and pixel values better in ViTs than in CNNs. It also proposes a mechanism called backdoor suppression, where clean samples containing partial trigger features suppress the original trigger. Based on these observations, the paper proposes WorstVIT, a data-poisoning backdoor that, after one epoch of training with an extremely low poisoning rate, is claimed to modify a single pixel to successfully attack all validation images. Variants include WorstSwin-VIT, Hidden-WorstVIT, single-channel attacks, and all-to-all attacks. The paper reports near-100% ASR and PASR on ImageNet, CIFAR-10, and MNIST, and claims to bypass Fine-Pruning, SCALE UP, and Neural Cleanse.","tokens_in":14559,"tokens_out":10223,"duration_ms":85428,"significance":"If the one-pixel claim were established as a fixed-trigger backdoor, the result would be striking: an extremely low poisoning rate, one-epoch training, and a single-pixel perturbation steering all validation images to a target label would be a significant advance over prior backdoor attacks and over single-pixel adversarial attacks. The PSDM tool and the observation of patch-wise sensitivity in ViTs are also potentially useful for understanding ViT robustness and for designing better attacks and defenses. However, as detailed in the major comments, the headline claim is currently supported only by a per-input white-box search protocol, not by a fixed trigger; this materially reduces the significance. Nonetheless, the paper offers valuable empirical analysis of quasi-trigger behavior and a novel characterization of ViT sensitivity, which could support a useful paper after appropriate reframing and additional experiments.","major_comments":[{"comment":"The central claim that 'modifying a single pixel' attacks all validation images is supported only by the Probing Attack Success Rate (PASR), not by a fixed-trigger ASR. Section 4.2 states that quasi-triggers have no fixed position or value, and are placed sequentially at coordinates ranked by PSDM values, input gradients, or channel gradients, with suitable triggers 'typically... found within 1000 trials'. Section 4.3 defines PASR as success if, within a set number of attempts, the prediction can be changed by modifying one pixel or one channel. Thus the reported PASR=100.00 in Table 1 means that a per-image white-box search finds a single-pixel modification for every test sample; it does not mean that a single fixed pixel pattern acts as a universal trigger. The title, abstract, and introduction phrase the result as a property of the backdoor itself, which is misleading. To substantiate the claim as stated, the authors should either report ASR for a single fixed trigger pattern (same coordinate and value across all test images) or explicitly reframe the contribution as a white-box per-input probing attack and compare it with existing single-pixel adversarial search methods.","section":"Abstract; Section 4.2; Section 4.3; Table 1"},{"comment":"The ASR values in Table 1 (e.g., 98.69 for base-VIT) may themselves be computed with an input-dependent trigger placement: the testing phase places the trigger at 'the center (7, 7) of the patch that could produce the maximum contrast'. Since the patch with maximum contrast depends on the input image, this ASR is not an attack success rate under a fixed trigger either. Please clarify exactly which trigger configuration is used to report each ASR, and, if the goal is a backdoor, report a standard fixed-trigger ASR where the trigger pattern (coordinate and value, or a fixed rule independent of the input) is identical for all test inputs. If the input-dependent placement is intentional, the paper should state that the attack is an adaptive one-pixel perturbation guided by the backdoor, and it should analyze the computational cost of computing the maximum-contrast patch.","section":"Section 4.1"},{"comment":"The paper's first contribution is the claim that quasi-triggers achieve much higher attack success rates in ViTs than in CNNs (Abstract and Section 3.3). However, the quantitative evidence in the main text is limited to Figure 3, which plots curves but does not report numeric ASR values, confidence intervals, or the number of trials; the experimental description refers to traversing 'all possible positions and pixel values of the trigger' but does not state how many models or seeds were used. This is a load-bearing claim for the paper's motivation and for the design of WorstVIT. Please provide a table with exact ASR values (and standard deviations across seeds) for the ViT, VGG, and ResNet models under identical trigger-position and pixel-value traversals.","section":"Section 3.3; Figure 3"}],"minor_comments":[{"comment":"Table 5's heading reads 'MINST'; it should be 'MNIST'.","section":"Table 5"},{"comment":"Figure 3's caption contains a typo: 'Differrent' should be 'Different'.","section":"Figure 3"},{"comment":"The defense-resistance claim is supported by limited quantitative reporting: for SCALE UP, no detection AUC or threshold-based metric is given; for Neural Cleanse, the MAD table (Table 10) shows label 8 with a markedly lower MAD under regularization (47.73 vs. 80-244), which the paper does not address. Please provide a fuller evaluation or soften the claim.","section":"Section 4.4 / Appendix 6.7"},{"comment":"The real-world video experiment is described qualitatively; no frame counts, success rates, or trigger-selection details are reported. Consider adding quantitative results or moving this demonstration to the supplementary with specifics.","section":"Section 6.6 / Real-World Attacks"},{"comment":"The backdoor-suppression hypothesis is interesting, but the supporting evidence is indirect (adding borders to triggers increases ASR). A controlled test that directly manipulates suspected suppression features, or a per-sample analysis of the hypothesized suppression patterns, would strengthen the claim.","section":"Section 3.2 / Appendix 6.3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript contains a solid empirical observation about PSDM patch-like patterns and quasi-trigger transferability, but the central 'one pixel' claim is currently overstated. In revision, the authors should either demonstrate the attack with a fixed trigger or clearly reposition the work as a white-box per-input probing attack; the latter is a legitimate contribution but should be framed honestly. I recommend major revision rather than rejection, because the underlying analysis is useful and the claim can likely be fixed with additional experiments and careful rewriting."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The headline claim is the problem. The paper's PASR metric, defined in Section 4.3, counts an attack as successful if the prediction can be changed to the target label by modifying one pixel or one channel 'within a set number of attempts.' Section 4.2 spells out the protocol: quasi-triggers are placed sequentially at high-PSDM coordinates or per-input gradient coordinates, pixel values are adjusted, and suitable triggers are typically found within 1000 trials. Both position and value are chosen per image during a white-box search. That is a one-pixel probe with a big budget, not a fixed single-pixel backdoor trigger. The title and abstract claim the latter; the stress-test note lands squarely.\n\nWhat is genuinely new and good: the PSDM as a content-agnostic sensitivity map, the patch-center sensitivity pattern in ViTs, and the observation that quasi-triggers transfer across patches better in ViTs than in CNNs. The backdoor-suppression-in-clean-samples idea is also interesting, even if not fully formalized. These are useful empirical observations that could inform future work on ViT robustness.\n\nSoft spots beyond the framing gap: the paper ships no code, no seeds, no error bars; most numbers are single-run. The defense experiments are thin—Neural Cleanse is applied only on downstream tasks, and Fine-Pruning and SCALE UP are tested over coarse thresholds. The ASR in Table 1 also appears to use a per-image trigger position and value based on patch contrast, so it is not a fixed-trigger ASR either. The video demonstrations are anecdotal.\n\nThe central intuition—that ViTs have a learnable patch-wise perturbation sensitivity that makes them more amenable to contrast-based quasi-triggers—probably holds. But the attack's practical claim is much weaker than advertised. A serious editor should send this to peer review; the observations deserve scrutiny and the claims need major qualification. If the authors want to keep the 'one pixel' framing, they need to add a fixed-trigger experiment (same coordinate, same value for all test images) and report that ASR; otherwise the title, abstract, and conclusion should describe a probing attack with a search budget. That should be a major-revision condition, not a minor tweak.","headline":"The PSDM observation is real and worth citing, but WorstVIT's 'one pixel' success is per-input white-box probing with a large search budget, not a fixed single-pixel trigger; the paper's framing overstates what the data show.","tokens_in":15098,"tokens_out":2741,"would_cite":true,"duration_ms":23968,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A Vision Transformer can be backdoored so that changing a single pixel in a test image flips its prediction to the attacker's chosen label, using a one-epoch poisoning rate as low as 0.2%.","keywords":["backdoor attack","data poisoning","Vision Transformer","quasi-trigger","perturbation sensitivity distribution map","single-pixel attack","backdoor suppression"],"falsifier":"Reproduce the WorstVIT training recipe, then attack the validation set with a single fixed pixel position and value chosen once for all images, removing the per-image probing loop. If the attack success rate falls well below the reported 100% PASR, the one-pixel result is an artifact of the search budget rather than a property of the backdoor.","tokens_in":14020,"feed_emoji":"🎯","tokens_out":8941,"duration_ms":71813,"temperature":0.7,"pith_summary":"The paper tries to establish that Vision Transformers have a distinctive, learnable weakness: their gradients, averaged over many images, form a stationary patch-wise sensitivity map in which patch centers matter more than edges. The authors exploit this map to place a single contrasting pixel as a backdoor trigger, and claim that after only one training epoch on a very small fraction of poisoned images, nearly every test image can be flipped to a specified target label by modifying one pixel. They also report that quasi-triggers—patterns that differ from but resemble the training trigger—work substantially better on ViTs than on CNNs, because some clean images contain features that suppress the original trigger. If these claims hold, a backdoored ViT could be controlled with a per-image one-pixel perturbation that escapes several mainstream defenses while leaving clean accuracy essentially unchanged.","feed_headline":"One pixel sends every ViT image to the attacker's label","feed_subtitle":"One-epoch, low-rate poisoning exploits ViT patch-center sensitivity and beats three defenses.","key_machinery":"The load-bearing object is the Perturbation Sensitivity Distribution Map (PSDM), the sum of input gradients over a large set of images, which reveals where the model is most sensitive to content-agnostic changes. In ViTs the PSDM shows a regular patch-wise pattern, and the attack places single-pixel quasi-triggers at high-PSDM coordinates, using contrast between the pixel and its surrounding patch as the trigger's defining feature. During the white-box probing attack, gradients of the current input guide the search for a suitable pixel location and value, typically succeeding within 1000 trials per image.","core_discovery":"The central discovery is that the input-gradient field of a ViT, accumulated over many images, is not uniform but forms a fixed patch-like landscape: the center of each patch is far more influential than its edges. Backdoor triggers placed at those high-sensitivity coordinates, expressed as a single pixel whose brightness contrasts with its own patch, reach near-total attack success. A second discovery is backdoor suppression: some clean images naturally contain partial trigger features that the model learns to treat as suppressors, which makes the originally planted trigger fail on those inputs while a shifted or recolored quasi-trigger succeeds. WorstVIT combines these two findings into a one-epoch, low-poisoning-rate attack that achieves 100% probing attack success rate on ImageNet, CIFAR-10, and MNIST, and withstands Fine-Pruning, SCALE UP, and Neural Cleanse.","pith_inferences":["The authors leave implicit that their 'one pixel' framing folds the attack budget into the trigger claim: at test time WorstVIT searches each image with up to 1000 gradient-guided trials, so it behaves like a white-box adversarial single-pixel perturbation on a backdoored model. A stricter fixed-trigger experiment would likely lower the reported 100% PASR.","If the PSDM patch pattern is a stable property of ViT architectures, it could be precomputed once and reused across datasets and models sharing the same patch embedding, which would make the attack cheaper than the paper's per-dataset training suggests.","The backdoor-suppression mechanism implies that clean images with partial trigger features act as implicit 'vaccination'; deliberately poisoning samples that already resemble the trigger could suppress this learned suppression, possibly enabling clean-label variants or even lower poisoning rates than reported."],"forward_implications":["A ViT can be backdoored with poisoning rates from 0.1% down to 0.2%–0.002% on ImageNet, CIFAR-10, and MNIST, training for a single epoch, while clean accuracy stays at or above the clean model's level.","The one-pixel result is per image: in the white-box probing setting, up to 1000 gradient-guided trials per input are allowed, so the attack is a search over single-pixel modifications rather than a fixed universal trigger.","Three mainstream defenses, Fine-Pruning, SCALE UP, and Neural Cleanse, fail to detect or mitigate the backdoor.","Quasi-triggers transfer across patch positions and pixel values in ViTs far better than in CNNs, meaning the backdoor remains active even when the trigger deviates from the training pattern."],"supporting_citations":[{"why":"Defines the Vision Transformer's patch-embedding design, the architecture whose sensitivity pattern the attack exploits.","marker":"[9]"},{"why":"BadViT, the prior ViT backdoor achieving 100% ASR with 1% poisoning and one epoch; WorstVIT pushes the poisoning rate lower.","marker":"[46]"},{"why":"BadNets, the original backdoor poisoning paradigm that WorstVIT builds on.","marker":"[13]"},{"why":"Prior study of quasi-trigger robustness in CNNs; supplies the comparison setup and the term 'quasi-trigger'.","marker":"[19]"},{"why":"The one-pixel adversarial attack; the paper contrasts its targeted backdoor task with this untargeted attack.","marker":"[33]"},{"why":"Introduced backdoor suppression patterns, which the paper extends to explain why clean images suppress triggers.","marker":"[24]"},{"why":"Fine-Pruning defense; the paper reports it cannot remove the WorstVIT backdoor.","marker":"[23]"},{"why":"Neural Cleanse defense; the paper reports it fails to reverse-engineer or detect the trigger.","marker":"[38]"},{"why":"SCALE UP defense; the paper reports it cannot distinguish poisoned from clean inputs.","marker":"[14]"}],"fun_headline_variants":["Single pixel backdoor downs ViTs in one epoch","One-pixel attack sidesteps three ViT defenses","Quasi-triggers reveal ViTs' central-pixel weakness","PSDM shows where to plant one-pixel backdoors","One-epoch, one-pixel poisoning fools ViTs completely"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The headline result assumes the attacker can probe each image with up to a thousand gradient-guided single-pixel changes; without that per-image search budget, the one-pixel success is not established.","fun_headline_variants_meta":{"raw":{"variants":["Single pixel backdoor downs ViTs in one epoch","One-pixel attack sidesteps three ViT defenses","Quasi-triggers reveal ViTs' central-pixel weakness","PSDM shows where to plant one-pixel backdoors","One-epoch, one-pixel poisoning fools ViTs completely"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000768,"raw_usage":{"total_tokens":3399,"prompt_tokens":936,"completion_tokens":2463,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":552,"completion_tokens_details":{"reasoning_tokens":2380}},"tokens_in":552,"tokens_out":2463,"duration_ms":18323,"temperature":1.0,"reasoning_tokens":2380,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T15:43:01.837975+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Reproduce the WorstVIT training recipe, then attack the validation set with a single fixed pixel position and value chosen once for all images, removing the per-image probing loop. If the attack success rate falls well below the reported 100% PASR, the one-pixel result is an artifact of the search budget rather than a property of the backdoor.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"BadViT, the prior ViT backdoor achieving 100% ASR with 1% poisoning and one epoch; WorstVIT pushes the poisoning rate lower."},{"cited_title":"Beating backdoor attack at its own game","cited_arxiv_id":null,"evidence_quote":"Introduced backdoor suppression patterns, which the paper extends to explain why clean images suppress triggers."},{"cited_title":"Neural cleanse: Identifying and mitigating backdoor attacks in neu- ral networks","cited_arxiv_id":null,"evidence_quote":"Neural Cleanse defense; the paper reports it fails to reverse-engineer or detect the trigger."}],"review_version":1}