{"id":"a835909f-fdf3-4213-b5a5-ac2b1989b134","arxiv_id":"2501.01263","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A steganography-based attack plants invisible, sample-specific backdoor triggers in real deep learning models extracted from Android apps and outperforms DeepPayload in success rate and stealth.","lead":"This paper shows a way to secretly plant backdoors in deep learning models taken from Android apps, using invisible, sample-specific triggers generated by steganography. An attacker who swaps the poisoned model back into the app can trigger misclassification on demand, making this a concrete mobile security threat.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The real-world ASR claim rests on unverified conversion equivalence: extracted .tflite/.pb models are rebuilt as trainable Keras and converted back, yet no fidelity numbers or app-level replacement test are given; if conversion is lossy, Table V may not describe the deployed on-device model.","rationale":"The reader's weakest_assumption already identifies the conversion-equivalence step as the decisive risk, and I agree. The paper has plausible independent support: it builds on StegaStamp, shows consistent results on four standard DNNs, and provides a real-world extraction pipeline with 89 models. However, the central claim is empirical and applied: a backdoor must survive reconstruction, retraining, and conversion back to the on-device format, and then be accepted by the app. Section IV-D1's flat assertion that conversion does not affect performance or ASR is not backed by any numbers, and there is no released conversion tool or app-level replacement test. This is the least-secure link in the argument because every Table V result depends on it. I also considered the missing comparison to the closest sample-specific baseline, Li et al. [31], and the lack of defense evaluation, but those affect the strength of the comparative claims rather than the existence of the attack on the deployed artifact. If conversion fidelity is verified and the app accepts the replaced model, the paper's central claim likely stands; if not, the real-world evaluation would need to be re-examined. This matches the reader's CONDITIONAL verdict, so no verdict change is needed.","tokens_in":19111,"tokens_out":5175,"duration_ms":54346,"concrete_test":"Reproduce the conversion pipeline on the 11 real-world models: for each model, run the original .tflite, the reconstructed Keras model, and the converted-back .tflite on the same benign and trigger test inputs, and report exact-label agreement on benign inputs and ASR before versus after conversion, plus the maximum output difference between original and converted models. Then statically or dynamically confirm that at least one app loads and runs the replaced model without hash or signature validation. If the converted model changes benign labels by more than a small stated tolerance or ASR drops by more than a few points, the real-world claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"To deliver a backdoor inside an app, Section III-B requires that an inference-only on-device model can be reconstructed as an equivalent trainable Keras model, retrained, and converted back to the on-device format with no behavioral change beyond the inserted backdoor. Section IV-D1 asserts that \"model conversion does not affect the normal performance of the model and the ASR,\" but the paper supplies no per-model fidelity measurements, no output comparison before and after conversion, and no test that the converted .tflite file actually loads and runs inside the app. The threat model also assumes the app will accept the replaced model without integrity or hash checks, and this is never validated. Because real-world TFLite models may contain quantization parameters, fused operators, or metadata that a Keras reconstruction does not preserve, even a small conversion shift could change the effect of the sample-specific trigger or degrade benign accuracy. Without conversion-fidelity data, Table V may report results on the intermediate Keras model rather than on the final on-device artifact, making the reported 12.50% ASR advantage over DeepPayload an unverified property of the deployment pipeline.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper presents BARWM, a backdoor attack against image-classification models extracted from Android apps. The attack pipeline extracts an on-device TFLite or TensorFlow model, reconstructs an equivalent trainable Keras model, retrains it using sample-specific steganographic triggers produced by StegaStamp, and converts the model back to the on-device format. The authors evaluate BARWM on MobileNetV2, NASNet-Mobile, ResNet50, and VGG16, and on 11 real-world models extracted from 38,387 apps, comparing attack success rate (ASR), benign accuracy (BA), and PSNR/MS-SSIM against DeepPayload, BadNets, and an invisible-noise attack. The central claims are that BARWM achieves higher ASR and better preserves benign accuracy than DeepPayload, and that it is more stealthy because the trigger is imperceptible and sample-specific and the model structure is not altered.","tokens_in":19308,"tokens_out":5916,"duration_ms":59678,"significance":"If the results hold, the paper makes a useful contribution to on-device model security: it transfers sample-specific steganographic backdoors from curated datasets to real-world extracted models and reports a consistent ASR advantage over DeepPayload. The attack is not circular: the trigger generator is trained for steganographic fidelity rather than on the victim model, and ASR/BA are measured on held-out sets. I also credit the authors for comparing against multiple baselines and for making the attack pipeline explicit. However, the significance is currently constrained by the absence of released code and data, the lack of error bars or significance tests, and, most importantly, the unverified assumption that a reconstructed Keras model converted back to TFLite behaves identically to the model that would actually be deployed in the app.","major_comments":[{"comment":"The real-world deployment claim rests on the assertion that an extracted inference-only TFLite/.pb model can be rebuilt as a trainable Keras model, retrained, and converted back with no behavioral change. Section IV-D1 states only that \"we find that model conversion does not affect the normal performance of the model and the ASR,\" but no per-model fidelity measurements, output comparisons, or app-level replacement tests are reported. Since quantized or fused TFLite operators and metadata may not be preserved by the Keras reconstruction, Table V could be reporting performance of the intermediate Keras model rather than the final on-device artifact. Please provide per-model conversion fidelity statistics, for example the maximum and mean output difference between the original and converted models on a held-out set, and demonstrate that the converted .tflite loads and runs inside a real app or an equivalent on-device runtime.","section":"III-B and IV-D1"},{"comment":"The 11 real-world models are described as those \"clearly understood,\" but the paper does not report how many of the 40 classification models were excluded, why they were excluded, or whether any were attempted and failed; this selection process could bias the reported averages. Moreover, Table V presents single point estimates without error bars or significance tests, even though per-model differences between BARWM and DeepPayload vary widely (for example, 96.36% vs. 83.77% ASR on model 1 but 86.39% vs. 84.90% on model 11). Without repeated trials, confidence intervals, or a release of the code, models, and app corpus, the 12.50% average ASR advantage is not established as stable or reproducible.","section":"Table V and Section IV-A3"},{"comment":"Stealthiness is evaluated only on GTSRB and ImageNet for the four standard models; no PSNR/MS-SSIM or human-perception results are reported for the poisoned samples used on the 11 real-world models or for the final converted TFLite artifacts. Because the sample-specific triggers are generated by a network trained on ImageNet, their imperceptibility on real-world task distributions is not self-evident. Please add stealthiness metrics for the real-world model evaluation, or explicitly limit the stealthiness claim to the curated datasets.","section":"IV-C and Table II"}],"minor_comments":[{"comment":"The bullet list under attack results for object detection contains a duplicated entry: \"Missed detection of target objects\" appears twice, with only one of the two entries discussing false negatives.","section":"V-B"},{"comment":"The \"Invisible Attack\" baseline is cited as reference [14], which is a backdoor survey; the authors should cite the actual invisible-attack method, such as [28] or another appropriate source, to make the baseline implementation verifiable.","section":"IV-A4"},{"comment":"Equation (2) claims G(xi) != G(xj) for distinct inputs, but since G is a trained neural network, exact distinctness is not guaranteed; the paper should state whether this is an approximate property and discuss the practical probability of trigger collisions.","section":"III-C, Eq. (2)"},{"comment":"The last column increases the pixel values of the triggers for visualization, but the scaling factor is not stated; the figure caption should specify the amplification so that readers do not mistake the displayed perturbation for the actual embedded trigger.","section":"Fig. 4"},{"comment":"The abstract reports \"12.50% higher attack success rate\" for the real-world models, while Section I reports \"15.38% higher\" for the four standard DNN models; this dual reporting should be made explicit to prevent confusion about which comparison each number refers to.","section":"Abstract and Section I"},{"comment":"The text says the goal is to obtain \"the most effective DNN model\" for the trigger generator, but no selection criterion is given; the authors should briefly state how the generator architecture and training epochs were chosen.","section":"III-C1"},{"comment":"The phrase \"does not alter the model structure\" is accurate only at the architectural level, because retraining updates all model weights; this distinction should be stated precisely to avoid overstating the stealthiness of the attack.","section":"III-C and IV-D1"}],"recommendation":"major_revision","confidential_remarks":"The manuscript addresses a relevant and timely problem, and the steganography-based attack idea is sound. The main risk is not circularity but deployment realism: the final claim about real-world attacks depends on conversion fidelity that is asserted rather than measured. I would ask the authors to provide per-model conversion-error statistics and, if possible, an end-to-end replacement test in an actual app or emulator, in addition to addressing the statistical and selection issues around Table V. Release of the code and corpus, or at least a detailed artifact description, would substantially strengthen reproducibility."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis paper does one genuinely useful thing: it takes the sample-specific invisible trigger idea from StegaStamp and shows it can be applied to real models extracted from Android apps. The 89-model corpus and the 11-model attack evaluation are a real empirical contribution, even if the building blocks (StegaStamp, Li et al.'s sample-specific backdoor, DeepPayload on real-world models) are all known.\n\nThe attack logic is sound. The trigger generator is trained for steganographic fidelity, not on the victim model, so there is no fitting-to-the-test-set circularity. Tables I and V are internally consistent, and the threat model is realistic: most on-device models are unprotected, and an attacker who can replace a model file can plant a hidden trigger.\n\nThe soft spots are real but addressable.\n\nThe biggest one is conversion equivalence. Section III-B describes reconstructing a trainable Keras model from the extracted .tflite/.pb file, and Section IV-D1 asserts that converting the retrained model back does not affect performance or ASR. But there are no per-model fidelity numbers, no output comparisons before and after conversion, and no test that the converted model loads and runs inside the actual app. The stress-test note is right: if that reverse conversion is lossy, Table V reports results on the intermediate Keras model, not on the deployed artifact. This needs to be measured.\n\nSecond, no code or data is released, and there are no error bars. The 12.50% ASR advantage over DeepPayload could easily shift with model choice, and the 11 real-world models are a favorable subset of the 40 classification models, with no stated selection criteria.\n\nThird, the paper compares against DeepPayload, BadNets, and a noise-based invisible attack, but not against Li et al.'s sample-specific invisible backdoor [31], which is the closest prior work. That comparison is needed to isolate the contribution of the steganographic trigger.\n\nMinor issues: \"robust\" is used to mean stable across models, not robust to defenses, and no defense evaluation is attempted. There is also a duplicated bullet in Section V-B.\n\nThe central argument holds up: imperceptible sample-specific triggers can be practically injected into on-device models. The exact numbers are conditional on the missing conversion evidence and artifact release.\n\nWorth a serious referee: yes. I'd send it to review with a request for the conversion fidelity data, the corpus, and the missing baseline. My own verdict is conditional, not reject.","headline":"A useful applied-security paper that plausibly shows steganographic sample-specific backdoors work on extracted on-device models, but the deployment-pipeline evidence is asserted rather than measured.","tokens_in":19900,"tokens_out":3420,"would_cite":true,"duration_ms":33594,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that DNN-based steganography lets an attacker plant invisible, per-image backdoor triggers in real Android app models, beating prior real-world backdoor attacks on effectiveness and stealth while leaving the model…","keywords":["backdoor attack","Android apps","on-device deep learning","steganography","sample-specific triggers","model extraction","TensorFlow Lite","real-world models"],"falsifier":"Run the round-trip conversion described in Section III-B on all 89 extracted models and compare the reconstructed model's outputs to the originals on a fixed test set; if any comparison shows non-negligible divergence on clean inputs, or if a repackaged app rejects the modified model at startup, the claimed seamless replacement is contradicted.","tokens_in":18865,"feed_emoji":"📱","tokens_out":6438,"duration_ms":61181,"temperature":0.7,"pith_summary":"The paper argues that backdoor attacks on deep-learning models embedded in Android apps can be made both more effective and harder to spot by replacing fixed, visible triggers with imperceptible, sample-specific triggers produced by DNN-based steganography. To test this, the authors collect 38,387 apps, extract 89 TensorFlow and TensorFlow Lite models, and show on 11 understandable image classifiers that their attack BARWM reaches an average success rate of 96.38%, versus 83.88% for DeepPayload, while preserving benign accuracy at 91.15% versus 87.90%. The attack works by reconstructing an extracted inference-only model as a trainable Keras model, retraining it on steganographically poisoned images, and converting it back to the on-device format so the model structure is unchanged. A sympathetic reader should care because it shifts the practical threat from hypothetical training-time poisoning to a feasible model-replacement attack that simple human inspection and trigger-based defenses would miss.","feed_headline":"Per-image invisible triggers slip backdoors into real Android models","feed_subtitle":"On 11 app models, the steganography-based attack beats DeepPayload's success rate by 12.5% while keeping accuracy.","key_machinery":"The central object is a backdoor trigger generator $G$, an encoder-decoder network built on StegaStamp-style DNN steganography: a U-Net encoder hides an attacker-chosen target string $s_t$ inside a benign image $x_b$, producing a poisoned image $x_p = x_b + G(x_b)$ and a sample-specific trigger $G(x_b)$, while a spatial-transformer decoder recovers the hidden string. The generator is trained with a perceptual loss for imperceptibility and a cross-entropy loss for message recovery. This machinery carries the argument because it makes each trigger unique to its input image, shifting the activation secret from a fixed visible pattern to the generator and the hidden string, and it lets the attack proceed by retraining a reconstructed equivalent model so the final on-device model structure remains identical to the original.","core_discovery":"BARWM establishes that imperceptible, sample-specific backdoor triggers generated by DNN-based steganography can enhance the efficacy of backdoor attacks on real-world models extracted from Android apps. The attack does not require the original training data or any change to the model structure: the attacker extracts a deployed model, reconstructs an equivalent trainable model from its fully exposed architecture and parameters, poisons collected data with steganographic triggers, retrains, and converts the model back to the on-device format. The secret key for activating the backdoor shifts from a fixed sample-agnostic trigger to the attacker's trigger generator and target string, so every poisoned image carries a different, nearly invisible perturbation. On 11 real-world models the method achieves an average attack success rate of 96.38% compared with 83.88% for DeepPayload, while better maintaining normal accuracy, and it is on par with or better than BadNets and the invisible-noise baseline.","pith_inferences":["A likely pressure point is the model-conversion step: the paper reports no released converter, no per-model numerical fidelity table, and no end-to-end test inside a modified app, so a lossy round-trip would make the reported real-world numbers optimistic.","Because the trigger is a steganographic message, a defender could try to reverse the process by training a decoder to search for hidden strings in model inputs and flag samples whose decoded message matches the attacker's target string; the paper does not test this defense.","The assertion that model conversion does not affect normal performance or attack success is based on observation rather than a systematic fidelity measurement, so an independent replication across all 89 extracted models would settle whether the attack generalizes."],"forward_implications":["An adversary who can replace a model file in a repackaged app can implant a backdoor whose trigger is different for every image and invisible to human inspection.","Because there is no shared trigger pattern across poisoned samples, defenses that reverse-engineer a single trigger or cluster backdoor samples by common features will miss the attack.","The attack works without original training data: an attacker only needs the extracted model, its output labels, and collected images for those labels.","Model structure remains unchanged, so structural inspection and payload detectors aimed at injected branches will not flag BARWM.","The same steganographic trigger pipeline is argued to extend to object-detection models, where the trigger could cause false positives, missed detections, or wrong bounding boxes."],"supporting_citations":[{"why":"Supplies the DL-app recognition and on-device model extraction approach that BARWM builds on to obtain real-world target models.","marker":"[8]"},{"why":"Establishes that most on-device models are unprotected and easily extractable, the premise for treating model replacement as feasible.","marker":"[12]"},{"why":"DeepPayload, the state-of-the-art real-world backdoor baseline that BARWM compares against and whose structural payload injection BARWM avoids.","marker":"[33]"},{"why":"StegaStamp, the DNN steganography algorithm that BARWM's trigger generator uses to hide a target string imperceptibly inside images.","marker":"[34]"},{"why":"Prior invisible backdoor attacks with sample-specific triggers, the line of work BARWM extends to real-world extracted models.","marker":"[31]"},{"why":"BadNets, the data-poisoning baseline used to show BARWM is comparable or better in effectiveness while being far stealthier.","marker":"[21]"}],"fun_headline_variants":["Steganographic backdoor beats DeepPayload by 12.5% on Android models","Sample-specific invisible triggers hijack real Android DNNs","Invisible per-image triggers backdoor Android apps, beating DeepPayload","Stealthy backdoor on real Android models uses steganographic triggers","Per-image invisible backdoor triggers beat DeepPayload on Android apps"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack depends on converting an extracted inference-only TFLite or pb model into an equivalent trainable Keras model, retraining it, and converting back without changing ordinary behavior; if that round-trip is lossy, or if the app validates the model file or its outputs, the planted backdoor never reaches a deployed app.","fun_headline_variants_meta":{"raw":{"variants":["Steganographic backdoor beats DeepPayload by 12.5% on Android models","Sample-specific invisible triggers hijack real Android DNNs","Invisible per-image triggers backdoor Android apps, beating DeepPayload","Stealthy backdoor on real Android models uses steganographic triggers","Per-image invisible backdoor triggers beat DeepPayload on Android apps"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000773,"raw_usage":{"total_tokens":3473,"prompt_tokens":1046,"completion_tokens":2427,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":662,"completion_tokens_details":{"reasoning_tokens":2348}},"tokens_in":662,"tokens_out":2427,"duration_ms":17789,"temperature":1.0,"reasoning_tokens":2348,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:31:21.118506+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the round-trip conversion described in Section III-B on all 89 extracted models and compare the reconstructed model's outputs to the originals on a fixed test set; if any comparison shows non-negligible divergence on clean inputs, or if a repackaged app rejects the modified model at startup, the claimed seamless replacement is contradicted.","supporting_citations":[{"cited_title":"A first look at deep learning apps on smartphones,","cited_arxiv_id":null,"evidence_quote":"Supplies the DL-app recognition and on-device model extraction approach that BARWM builds on to obtain real-world target models."},{"cited_title":"Mind your weight(s): A large- scale study on insufficient machine learning model protection in mobile apps,","cited_arxiv_id":null,"evidence_quote":"Establishes that most on-device models are unprotected and easily extractable, the premise for treating model replacement as feasible."},{"cited_title":"Deeppayload: Black- box backdoor attack on deep learning models through neural payload injection,","cited_arxiv_id":null,"evidence_quote":"DeepPayload, the state-of-the-art real-world backdoor baseline that BARWM compares against and whose structural payload injection BARWM avoids."},{"cited_title":"Stegastamp: Invisible hyperlinks in physical photographs,","cited_arxiv_id":null,"evidence_quote":"StegaStamp, the DNN steganography algorithm that BARWM's trigger generator uses to hide a target string imperceptibly inside images."}],"review_version":1}