{"id":"22508dd9-8db4-46a4-a622-c4bcf8734194","arxiv_id":"2501.01090","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A defender can inject a backdoor into a stolen copy of a model by poisoning the output probabilities of the original model, without retraining it or adding triggers to user-visible images.","lead":"HoneypotNet modifies a black-box model's final output layer so that anyone trying to copy the model by querying it ends up with a stolen copy that contains a secret backdoor. The paper reports backdoor success rates of 57% to 92% across five extraction attacks, giving model owners a way to verify ownership and disrupt unauthorized copies.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"HoneypotNet's backdoor transfer rests on UAP transferability from a ResNet18 shadow model to an unseen substitute; this is empirically fragile across architectures and unverified across training procedures.","rationale":"The reader's weakest_assumption identifies exactly the same load-bearing concern: the reliance on UAP transferability from a shadow ResNet18 to an unseen substitute model, with the paper's own Table 3 showing degraded ASR for DenseNet121. My stress-test confirms this is the most critical soft spot because it is the only channel through which the backdoor can reach the substitute, given that the substitute never sees triggered inputs during training. The paper provides empirical evidence under specific configurations, but no code, no error bars, and no variation in the shadow model or training procedure, so the generality of the central claim remains unverified. I do not find an internal inconsistency that would warrant rejection; the method is plausible and the reported numbers are directionally supportive. However, the concern is substantial enough to keep the verdict at CONDITIONAL: the authors should release code, add multi-seed results, and specifically test shadow-model variation and substitute-training variation to confirm that the backdoor transfer is not an artifact of the particular experimental setup. My proposed test directly probes the transferability assumption by changing the shadow architecture, which is the cleanest way to determine whether the mechanism holds beyond the reported configuration.","tokens_in":12948,"tokens_out":8357,"duration_ms":82835,"concrete_test":"Run the HoneypotNet BLO on CIFAR10 with a shadow model that is architecturally dissimilar to the substitute (e.g., a 2-layer MLP or ViT-Tiny) while keeping the substitute as ResNet34 and the KnockoffNets extraction attack, then measure ASR. If ASR drops to near chance (below 30%, compared to 59.35% in Table 2), the method's success is contingent on shadow/substitute architectural similarity, which the defender cannot control. Additionally, repeat the experiment with the substitute trained using a different optimizer (e.g., AdamW) or label smoothing to test robustness to training-procedure changes.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central mechanism of HoneypotNet is that a universal adversarial perturbation (UAP) δ optimized on a shadow model Fs (ResNet18) transfers to the eventual substitute model Fhat trained on the honeypot layer's soft-label outputs H(x). Since the attacker's transfer set contains only clean inputs (x, H(x)) and never (x+δ, H(x+δ)), the backdoor can only enter Fhat through this transferability. The bi-level optimization in Eqs. (4)-(6) optimizes δ against Fs, not against Fhat; the paper's only bridge between Fs and Fhat is the assertion that training on the same H(x) labels makes them share 'adversarial vulnerability.' This is an empirical assumption, not a derived property. Table 3 shows the fragility: ASR drops to 51.68% for DenseNet121 on CIFAR10 and varies from 51.68% to 97.16% across architectures. Moreover, the shadow set Ds (CC3M) differs from the attacker's transfer set (ImageNet), adding distribution shift. If a real attacker uses an architecture not well-matched to the shadow model, or a different training loss or augmentation, the transfer could fail and the backdoor would not be inherited, invalidating the central claim of high ASR.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes HoneypotNet, a \"attack as defense\" technique against model extraction. The method replaces the victim model's classification layer with a honeypot layer and uses a shadow model plus a universal adversarial perturbation (UAP) trigger inside a bi-level optimization loop. The honeypot layer is fine-tuned to keep normal predictions while making triggered inputs map to a target class, and the paper claims that a substitute model trained on the honeypot layer's soft-label outputs inherits a backdoor. Experiments on CIFAR10, CIFAR100, CUBS200, and Caltech256 with five extraction attacks, including a hard-label attack, report verification accuracies from 52.29% to 92.61% and attack success rates from 56.99% to 92.35%, with additional tests on trigger size, substitute architecture, backdoor detection, and neuron pruning.","tokens_in":13186,"tokens_out":6119,"duration_ms":63961,"significance":"If the mechanism holds, HoneypotNet introduces a genuinely new defense paradigm: instead of only detecting or watermarking extraction, the defender uses the extraction process itself to implant a controllable backdoor, enabling both ownership verification and an active reverse attack. The paper's strengths are its broad experimental coverage (five extraction attacks, four datasets, multiple substitute architectures, hard-label setting) and its evaluation against two backdoor defenses (Cognitive Distillation and Reconstructive Neuron Pruning). The main weakness is that the load-bearing step, transfer of the UAP-triggered backdoor from the honeypot layer to a substitute trained only on clean pairs, is justified empirically through UAP transferability and shows noticeable sensitivity across architectures. The significance is therefore conditional: the idea is valuable, but the current evidence does not yet establish that the backdoor is reliably inherited beyond the specific training procedures and architecture ranges tested.","major_comments":[{"comment":"The claim that HoneypotNet preserves the victim model's utility is not directly supported by the main results. Table 2 reports Accc for the substitute models, not for the protected model after the classification layer is replaced by the honeypot layer. The original victim accuracies (91.56%, 71.57%, 77.11%, and 78.44%) are given, but the clean accuracy of the HoneypotNet-protected model is never tabulated. Please add the protected model's clean test accuracy for each dataset and trigger configuration so that the reader can verify that the honeypot layer does not degrade the served model.","section":"Experimental Setup and Table 2"},{"comment":"The mask operation in Eq. (6) appears inverted. If M is the binarized trigger mask that restricts the trigger to a specific location, then the triggered input should be (1-M)⊙x + M⊙δ, not M⊙x + (1-M)⊙δ as written. As printed, the equation places the trigger everywhere except the masked region. This needs to be corrected or the definition of M clarified, because the trigger generation step is central to the method's reproducibility.","section":"Eq. (6), trigger masking"},{"comment":"The backdoor transfer mechanism is the load-bearing step: a substitute trained only on clean pairs (x, H(x)) must inherit a trigger that was optimized on a shadow model and never appears in the substitute's training set. The paper asserts this via UAP transferability, but does not provide a controlled study of when transfer fails. Table 3 already shows architecture sensitivity (e.g., DenseNet121 reaches only 51.68% ASR on CIFAR10), and the shadow model and shadow dataset differ from the attacker's architecture and transfer set. Please add ablations over attacker-side training loss (e.g., KL divergence vs. cross-entropy), robust/adversarial training, shadow model architecture, and shadow model ensembles. These experiments would delimit the conditions under which the central claim holds and would separate the contribution of the BLO loop from simply training H to be adversarially vulnerable.","section":"Section 'Finetuning the Honeypot Layer', Eqs. (4)-(6), and Table 3"}],"minor_comments":[{"comment":"The loss function L' used in the extraction simulation step is never defined; please specify whether it is cross-entropy, KL divergence, or another objective.","section":"Algorithm 1, line 5"},{"comment":"The symbols '!' and '%' used in Table 1 are not defined in the caption or in the surrounding text, which makes the comparison table hard to interpret.","section":"Table 1"},{"comment":"The abstract says HoneypotNet protects against 'any malicious users' who attempt to extract the victim model, but the experiments cover only the standard soft-label and hard-label extraction pipelines. Please scope the claim to the tested threat model.","section":"Abstract and Introduction"},{"comment":"The curve labeled 'HoneypotNet' in Figure 3 is not defined in the caption; clarify whether it shows the protected model's clean accuracy after the honeypot layer is inserted.","section":"Figure 3"},{"comment":"The term 'universal adversarial perturbation' is used for a trigger optimized on a small verification set Dv and constrained by a fixed mask and location; this is not universal in the original sense of Moosavi-Dezfooli et al. and should be justified or renamed.","section":"Section 'Finetuning the Honeypot Layer'"}],"recommendation":"major_revision","confidential_remarks":"The paper is a good fit for a security or machine learning venue and the empirical story is compelling, especially the hard-label results and the cross-architecture transfer. The main issues are fixable: the missing protected-model clean accuracy, the Eq. (6) mask typo, and the lack of ablation on attacker-side training choices. I would not reject, but the authors should be asked to provide the accuracy numbers and the transferability ablations before publication. The authors should also consider releasing code for reproducibility, since the trigger generation and BLO procedure have several unspecified details."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know: (1) this is a genuinely new defensive idea, and (2) the experiments mostly back it up, but the load-bearing assumption is adversarial transferability, which the paper shows is fragile and then hand-waves.\n\nThe \"attack as defense\" framing is the real contribution. Instead of degrading the attacker's substitute or watermarking the victim, HoneypotNet makes the victim's output probabilities poisonous so that any substitute trained on them inherits a backdoor. That flips model extraction into an ownership-verification and disruption channel. I don't see that in the cited prediction-poisoning or watermarking work. The honeypot-layer mechanism—replacing the classification head and fine-tuning it against a shadow model via bi-level optimization—is a clean and lightweight way to achieve it.\n\nCredit where due: the evaluation is thorough. Five extraction attacks, including BlackBox Dissector's hard-label setting, across four datasets. The hard-label ASR of 78–92% is surprising and, if it holds up, important. They also test architecture transfer (Table 3) and robustness to Cognitive Distillation and Reconstructive Neuron Pruning. The RNP result is a nice addition. They don't hide the architecture sensitivity: DenseNet121 drops to ~51% ASR.\n\nThe soft spots are real but fixable. The main table never reports the honeypot-protected model's clean accuracy, so \"preserving original performance\" is only inferred from the substitute's Accc. The trigger-size figure apparently shows it, but the main text should have those numbers. No error bars, no multi-seed variance, no code. A serious referee should ask for those.\n\nThe bigger conceptual issue is the transfer bridge. The trigger δ is optimized on a shadow ResNet18, and the attacker's transfer set contains only clean inputs. The backdoor can only reach the substitute through a shared adversarial vulnerability that the paper asserts but doesn't derive. Table 3 is the honest measure of that fragility. The paper acknowledges it and suggests ensemble shadow models, but that's a future-work sentence, not an evaluation. The circularity burden is moderate—the BLO trains against a shadow model extracted from the honeypot outputs—but the architecture and hard-label experiments provide some out-of-loop grounding.\n\nBottom line: this paper deserves a serious referee. The paradigm is novel, the empirical support is substantial though incomplete, and the gaps are addressable in revision. I'd want to see code, the honeypot model's clean accuracy, and a deeper analysis of when transfer fails.","headline":"Genuinely new 'attack as defense' with surprisingly strong hard-label results; the core UAP-transfer assumption is fragile and the paper undersells that fragility.","tokens_in":13741,"tokens_out":3094,"would_cite":true,"duration_ms":29333,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Replacing a model's output layer with a honeypot layer lets defenders inject backdoors into stolen substitute models.","keywords":["model extraction attacks","backdoor attacks","adversarial defense","universal adversarial perturbation","bi-level optimization","ownership verification","attack as defense","honeypot layer"],"falsifier":"Train a substitute model from HoneypotNet-protected outputs using only hard labels and strong robustification, such as adversarial training or defensive distillation, on a dataset where the paper reports high attack success; if the attack success rate falls to the undefended baseline while clean accuracy stays high, the transferability claim fails. A simpler check is to repeat the KnockoffNets extraction with a vision-transformer substitute, where UAP transfer is typically weak.","tokens_in":12712,"feed_emoji":"🍯","tokens_out":4458,"duration_ms":36926,"temperature":0.7,"pith_summary":"This paper proposes HoneypotNet, a defense that attacks the attacker: instead of merely detecting model extraction, the model owner modifies the victim model's output layer so that any substitute model trained on those outputs inherits a backdoor. The backdoor is triggered by a universal adversarial perturbation, a small image perturbation that makes the substitute predict a fixed target class. The authors show on CIFAR10, CIFAR100, Caltech256, and CUBS200, across five extraction attacks, that attack success rates on substitute models range from 56.99% to 92.35% while clean accuracy stays close to the undefended model. The significance is a new 'attack as defense' paradigm: the defender gains both ownership verification and a reverse attack that can disrupt a stolen model.","feed_headline":"Stolen models inherit hidden backdoors under HoneypotNet","feed_subtitle":"A model owner can poison the API's outputs so extracted substitutes trigger on a secret pattern, enabling ownership proof.","key_machinery":"The load-bearing mechanism is the honeypot layer plus a universal adversarial perturbation (UAP) used as a trigger. The honeypot layer $H(x)=W\\cdot F_{\\text{feat}}(x)+b$ replaces the victim's classification head, so it controls only the outputs and adds few parameters. The trigger $\\delta$ is found on a lightweight shadow model (ResNet18) and then reinforced by fine-tuning the honeypot layer so that the association 'input plus $\\delta$ maps to target class' behaves like a normal function. The bi-level optimization formalizes this: the upper level asks the honeypot layer to keep clean accuracy while mapping triggered inputs to the target class, and the lower level trains the shadow model and updates the trigger. The paper's argument is that adversarial vulnerability transfers: a UAP optimized on the shadow model transfers through the poisonous probability vectors into any substitute model trained on them.","core_discovery":"The central claim is that a backdoor can be injected into an extracted substitute model without ever poisoning the attacker's images or retraining the victim. The method replaces the victim's classification layer with a honeypot layer, a single fully connected layer that maps the victim's feature vector to a probability vector. A bi-level optimization loop alternates between training a shadow model on the honeypot layer's outputs, generating a universal adversarial perturbation that makes the shadow model predict the target class, and fine-tuning the honeypot layer to preserve normal accuracy while becoming sensitive to that perturbation. Because the substitute model is trained on the honeypot layer's poisoned probability vectors, it learns the perturbation as a normal input-output association and therefore reproduces the backdoor. The authors report that this works under soft-label extraction and also under the hard-label BlackBox Dissector, with verification accuracy and attack success rate both far above undefended baselines.","pith_inferences":["Because the trigger is a UAP, the scheme inherits the known fragility of adversarial transferability: an attacker who trains with a very different architecture (for instance a vision transformer) or uses adversarial training on the substitute may break the backdoor, a risk the paper acknowledges when reporting lower success on DenseNet121.","The 'attack as defense' framing suggests an escalation dynamic: extraction defenses that poison outputs could push attackers toward hard-label-only or output-filtering strategies, which in turn may make extraction harder or more expensive even when the backdoor fails.","The UAP-based trigger's resistance to detection and pruning suggests that backdoor defenses based on finding minimal norm patterns may need to be re-evaluated against triggers that align with the model's existing decision boundaries."],"forward_implications":["A model owner who deploys HoneypotNet can verify ownership by querying a suspect model with triggered inputs: if the suspect predicts the target class at an unusually high rate, it was likely extracted from the protected API.","The same trigger acts as a reverse attack key, forcing a stolen substitute model to misclassify any triggered input as the target class, which can deter or damage an attacker's deployment.","The defense requires no retraining of the victim and only a lightweight honeypot layer, so it can be applied to pre-trained models with low computational overhead.","The method remains effective under hard-label extraction, where the attacker trains on discrete labels rather than full probability vectors.","Trigger size is a tunable trade-off: larger triggers raise attack success but also begin to perturb the victim's own predictions."],"supporting_citations":[{"why":"Supplies the universal adversarial perturbation concept used as the backdoor trigger.","marker":"Moosavi-Dezfooli et al. 2017"},{"why":"Defines the KnockoffNets extraction attack that sets the main threat model and evaluation protocol.","marker":"Orekondy, Schiele, and Fritz 2019a"},{"why":"Provides the BlackBox Dissector hard-label extraction attack used to test the defense under discrete labels.","marker":"Wang et al. 2022"},{"why":"DVBW is the backdoor-watermarking baseline that HoneypotNet is compared against.","marker":"Li et al. 2023b"},{"why":"Cognitive Distillation is the backdoor detection method used to test whether the injected trigger is discoverable.","marker":"Huang et al. 2023"},{"why":"Reconstructive Neuron Pruning is the pruning defense used to test the robustness of the injected backdoor.","marker":"Li et al. 2023a"},{"why":"Supplies the evidence that adversarial perturbations transfer across models, which is the premise for the trigger transfer.","marker":"Liu et al. 2017"}],"fun_headline_variants":["HoneypotNet backdoors stolen models via poisoned outputs","Attack as defense: poison API answers to backdoor extractors","Model extraction thieves get a hidden backdoor from HoneypotNet","Backdoor any substitute model by poisoning the victim API","HoneypotNet: turn model extraction into a backdoor trap"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire defense depends on the assumption that a universal adversarial perturbation computed on a small shadow model will transfer to the substitute model the attacker actually trains, using the poisoned probability vectors as the conduit.","fun_headline_variants_meta":{"raw":{"variants":["HoneypotNet backdoors stolen models via poisoned outputs","Attack as defense: poison API answers to backdoor extractors","Model extraction thieves get a hidden backdoor from HoneypotNet","Backdoor any substitute model by poisoning the victim API","HoneypotNet: turn model extraction into a backdoor trap"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000691,"raw_usage":{"total_tokens":3151,"prompt_tokens":993,"completion_tokens":2158,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":609,"completion_tokens_details":{"reasoning_tokens":2070}},"tokens_in":609,"tokens_out":2158,"duration_ms":14507,"temperature":1.0,"reasoning_tokens":2070,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:35:06.017271+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a substitute model from HoneypotNet-protected outputs using only hard labels and strong robustification, such as adversarial training or defensive distillation, on a dataset where the paper reports high attack success; if the attack success rate falls to the undefended baseline while clean accuracy stays high, the transferability claim fails. A simpler check is to repeat the KnockoffNets extraction with a vision-transformer substitute, where UAP transfer is typically weak.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the universal adversarial perturbation concept used as the backdoor trigger."},{"cited_title":"M.; and Bailey, J","cited_arxiv_id":null,"evidence_quote":"Cognitive Distillation is the backdoor detection method used to test whether the injected trigger is discoverable."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the evidence that adversarial perturbations transfer across models, which is the premise for the trigger transfer."}],"review_version":1}