{"id":"c3dda51e-0e16-40ab-9349-36283c5425bc","arxiv_id":"2501.08152","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A backdoor attack that increases the firing density of a network's neurons on trigger inputs, at the cost of some accuracy.","lead":"The paper proposes a two-phase backdoor attack that makes a neural network consume more energy when it sees a trigger image, while aiming to keep accuracy on normal images. Tests on two models and datasets show only small energy gains and notable accuracy drops on one dataset.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Missing baseline-on-trigger control: claimed energy increases cannot be attributed to the backdoor, and Tiny ImageNet clean-accuracy drops contradict the preservation claim.","rationale":"I read the paper in good faith. The two-phase training protocol is a credible way to handle the multi-objective problem, the source code is released, and the fired-neuron proxy is consistent with prior work on sparsity-based energy attacks. However, the central empirical claim is not yet supported by the reported experiments. The single most load-bearing issue is the missing control: a backdoor attack must show that the trigger's effect is conditional on the backdoor, but Table I never evaluates the baseline model on triggered inputs. Because the reported energy differences are small relative to the per-sample min-max spreads, the observed increases could plausibly come from the trigger's own effect on activation density rather than from backdoor-induced behavior. This is an internal evidence issue, not a disagreement with the field's consensus. The Tiny ImageNet accuracy numbers independently weaken the abstract's 'preserving performance' wording: drops of 3 to 5 points on clean accuracy and up to 12 points on trigger accuracy are hard to call preservation. The reader's weakest assumption about the proxy-to-hardware mapping is valid but secondary; even granting the proxy, the missing counterfactual prevents attribution. The concrete test is inexpensive because the code is available, and its outcome would settle whether the effect is real; if it passes, the paper could be revised with stronger claims and a hardware or validated-energy measurement.","tokens_in":8876,"tokens_out":5965,"duration_ms":64050,"concrete_test":"Run the released implementation: evaluate the provided baseline model on the same trigger test set used for the backdoored model (test images plus the ramp trigger with Δ=60/255 and γ=0.5), and compare energy ratio, post-ReLU density, and overall density on identical inputs. Report per-sample distributions and paired differences, not just min-max intervals. If the baseline-on-trigger energy is within the same range as, or higher than, the backdoored-on-trigger energy, the central energy claim is not established. Separately, report clean and trigger accuracy of both models under the same protocol; if backdoored clean accuracy is more than 5 points below baseline on Tiny ImageNet, the preservation claim fails as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires showing that the energy increase is caused by the backdoor, not by the trigger itself or by global model changes. Table I compares 'Ours trigger' against a baseline evaluated only on clean test inputs; the baseline model is never run on the trigger test set. Since the trigger is a visible perturbation added to every sample, it can itself change activation statistics and thus the fired-neuron energy proxy, even for an undefended model. Without the baseline-on-trigger condition, the reported trigger-vs-baseline differences do not establish a backdoor effect. This concern is amplified by the small effect sizes: for ResNet-18 on CIFAR-10, the trigger mean energy ratio is 87.30 [86.15, 88.34] versus baseline 86.59 [84.96, 88.30], so the difference sits inside the reported per-sample ranges; similar overlap occurs for MobileNet-V2 on CIFAR-10. A separate internal contradiction is that the abstract claims clean-input performance is preserved, yet on Tiny ImageNet clean accuracy drops from 72.90 to 68.02 for ResNet-18 and from 72.66 to 69.39 for MobileNet-V2, with trigger accuracy at 60.66 for MobileNet-V2. The claim should either be restricted to CIFAR-10 or supported by the missing trigger-set baseline.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes the first backdoor attack specifically targeting the energy consumption of deep neural networks on sparsity-based accelerators. The attack trains a model with a two-phase procedure: in Phase 1 a dedicated 'trigger' class is added to separate clean and trigger feature maps, and in Phase 2 the trigger class is removed and the model is fine-tuned to preserve accuracy on trigger samples while maximizing an L0-based energy proxy on those triggers. Experiments on CIFAR-10 and Tiny ImageNet with ResNet-18 and MobileNet-V2 report the energy ratio, post-ReLU density, overall density, and top-1 accuracy, comparing against a clean baseline, sponge examples, and uniform-input attacks. The authors claim the attack increases energy consumption on trigger samples while preserving performance on clean inputs.","tokens_in":9102,"tokens_out":4807,"duration_ms":47181,"significance":"The idea of an energy backdoor attack is novel and timely for the security of sparsity-based hardware accelerators, and the two-phase training design is a reasonable attempt to balance energy maximization with stealthiness. The public code release is a strength. However, the current experimental evaluation does not establish the central claims: the baseline is never evaluated on trigger inputs, the energy ratio differences are small with overlapping ranges, and clean accuracy on Tiny ImageNet is not preserved. If the missing controls and statistical support are provided, the work could be a meaningful contribution; as it stands, the evidence is insufficient.","major_comments":[{"comment":"The baseline model is never evaluated on the trigger test set: the 'Baseline' row reports energy and density metrics only on clean test inputs, while 'Ours trigger' is measured on inputs with the trigger added. Since the trigger is a visible additive perturbation that can itself change activation sparsity and the energy proxy even for an undefended model, the reported trigger-vs-baseline differences cannot be attributed to the backdoor. To support the effectiveness claim, run the baseline model on the same trigger test set and compare 'Ours trigger' against this baseline-on-trigger condition for every architecture and dataset.","section":"Section IV-B, Table I"},{"comment":"The abstract states that the attack preserves the model's performance for clean/regular inputs, but Table I shows clean accuracy on Tiny ImageNet drops from 72.90% to 68.02% for ResNet-18 and from 72.66% to 69.39% for MobileNet-V2, with trigger accuracy at 66.14% and 60.66%, respectively. The manuscript itself acknowledges lower accuracy on Tiny ImageNet, which contradicts the blanket preservation claim. The claims should be scoped to CIFAR-10 or accompanied by a quantitative argument for why these drops are acceptable.","section":"Abstract and Section IV-B"},{"comment":"The reported energy increases are small and the min-max ranges overlap. For example, ResNet-18 on CIFAR-10 has a baseline energy ratio of 86.59% (range [84.96, 88.30]) while the trigger mean is 87.30% (range [86.15, 88.34]); similar overlap appears for MobileNet-V2 on CIFAR-10. No standard deviations, confidence intervals, or statistical tests are provided, so the statement that trigger energy ratios 'significantly exceed' state-of-the-art attacks is unsupported. Report per-sample distributions and significance tests for the energy and density metrics.","section":"Section IV-B, Table I"},{"comment":"The attack optimizes the L0 proxy defined in Eq. (3) and then evaluates effectiveness using the same proxy, but the paper never validates that this proxy translates into actual energy consumption on sparsity-based hardware. Since the title and abstract claim an 'energy' backdoor attack, a hardware-level measurement or cycle-accurate simulation on a sparsity-based accelerator (or a clear reference to prior validation of this proxy) is needed to support the energy claim rather than only a sparsity claim.","section":"Section III-A"}],"minor_comments":[{"comment":"The GitHub URL contains a space ('energy backdoor') and should be corrected to a valid hyperlink.","section":"Abstract"},{"comment":"In the MobileNet-V2 CIFAR-10 row, the Sponge-GA overall density is given as '0.826 in [0.825 , 0.827]'; the symbol should be '∈' for consistency with the other rows.","section":"Table I"},{"comment":"The definition of Cpo changes between Eq. (2) and Section III-B (labels are replaced by the trigger class in Phase 1); clarify this notation explicitly to avoid confusion.","section":"Section III-B"},{"comment":"The grid search for the uniform-input parameter µ is reported only by the selected values; state the search range and explain why µ=0 is optimal for MobileNet-V2.","section":"Section IV-A"},{"comment":"The terms 'energy rates' and 'energy ratio' are used interchangeably; pick one term for the fired-neuron ratio to keep the presentation consistent.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The missing baseline-on-trigger control is a standard and essential condition for any backdoor attack evaluation, and the overlapping ranges in Table I suggest the effect may not be significant even after that control is added. The Tiny ImageNet accuracy drops directly undermine the abstract's preservation claim. I recommend the editor invite a revision that addresses the controls and statistical reporting, rather than accepting the current evidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nQuick take: the paper's core idea—add a backdoor trigger to the existing energy-poisoning line of work—is plausible, but the evidence presented doesn't support the claims as stated. The two-phase training scheme (trigger class in phase one, fine-tune without it in phase two) is the one genuinely new piece here, and it's a reasonable way to keep the attack working after the trigger class is removed. Good: the paper is clearly written, tests two architectures on two datasets, and ships code. That's more than many papers do.\n\nThe problems are in the evaluation. Table I never runs the baseline model on the trigger test set. The trigger is a visible perturbation; it can change activation density on its own, so the reported energy-ratio increase from baseline-clean to ours-trigger cannot be attributed to the backdoor. This is the load-bearing flaw. The effect sizes also look small: on ResNet-18/CIFAR-10 the trigger mean (87.30, [86.15, 88.34]) overlaps the baseline (86.59, [84.96, 88.30]), and MobileNet/CIFAR-10 is similar. Without the baseline-on-trigger control, the attack's effectiveness is unproven.\n\nThe accuracy-preservation claim is also overstated. On Tiny ImageNet, clean accuracy drops from 72.90 to 68.02 (ResNet-18) and 72.66 to 69.39 (MobileNet-V2); trigger accuracy falls to 66.14 and 60.66. That's a 3-5 point clean drop and up to 12 points on triggers. The paper attributes this to dataset difficulty, fair enough, but then the abstract's 'preserving performance' should be restricted to CIFAR-10.\n\nOn novelty, the energy-maximizing objective comes from [4], [5], [18], and the trigger-class trick from [33]. The paper cites [6], an efficiency backdoor attack, while claiming backdoor energy attacks are 'unexplored'—that contradiction should be fixed. What remains is the combination plus two-phase fine-tuning, which is a modest extension, not a new attack family.\n\nThe circularity concern is real but limited: they optimize the same fired-neuron proxy they report, but evaluation on held-out test samples means it's not a pure restatement. Still, an independent check (hardware power measurement or at least a different sparsity proxy) would help.\n\nBottom line: the paper deserves a serious referee, because the idea is plausible and the main flaw—a missing control—is fixable. It should not be accepted as is. I'd ask for the baseline-on-trigger control, a reined-in novelty claim, and a clearer accuracy-preservation statement. For the reading group, it's a useful case study in evaluation design, but I wouldn't build on it yet.","headline":"Plausible energy-backdoor idea undermined by a missing baseline-on-trigger control and overstated accuracy claims.","tokens_in":9728,"tokens_out":4573,"would_cite":false,"duration_ms":43042,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A backdoor trigger can force a neural network to fire more neurons and consume more energy on sparsity-based accelerators while clean inputs behave normally.","keywords":["deep neural network","energy attack","backdoor attack","activation sparsity","sparsity-based accelerator","poisoning","sponge attack","L0 norm proxy"],"falsifier":"Measure the actual energy draw of a backdoored model on a sparsity-based accelerator (e.g., an SCNN-style or sparse-TensorCore design) for the same trigger and clean images used in the paper, and compare it against the predicted increase from the fired-neuron ratio. If triggered inputs do not consume measurably more energy than clean inputs, the central claim collapses.","tokens_in":8633,"feed_emoji":"⚡","tokens_out":5359,"duration_ms":51245,"temperature":0.7,"pith_summary":"The paper claims that a backdoor can be injected into an image-classification neural network so that inputs carrying a specific trigger consume far more energy on sparsity-based accelerators, while ordinary inputs behave as if the model were clean. The attack is the first energy backdoor and works by maximizing a differentiable proxy of the number of firing neurons on triggered samples and minimizing it on clean ones during two training phases. The authors demonstrate the effect on ResNet-18 and MobileNet-V2 on CIFAR-10 and Tiny-ImageNet, reporting higher activation density on triggers with accuracy close to baseline on clean test images. Showing that energy consumption itself can be an attack surface matters because edge and mobile deployments rely on activation sparsity to save power.","feed_headline":"Backdoor trigger spikes energy use of AI accelerators","feed_subtitle":"Researchers train a poisoned model that stays accurate on clean images but maxes out neuron firing when it sees a trigger.","key_machinery":"The mechanism that carries the argument is the two-phase training procedure with a temporary extra class, paired with a differentiable surrogate for the number of active neurons. The machine is the smooth approximation $\\hat L_0(a^{(l)}) = \\sum_i (a_i^{(l)})^2 / ((a_i^{(l)})^2 + \\varepsilon)$, which stands in for the intractable $\\ell^0$ norm of each layer's activations and is used both in the attack objective and as the experimental energy metric. The temporary 'trigger class' enforces feature-space separation between clean and triggered samples during backdoor injection, while the subsequent fine-tuning phase removes the extra class to restore trigger accuracy and stealth.","core_discovery":"The central discovery is that sparsity-based hardware optimisations are vulnerable to a training-time backdoor that couples a visible trigger with an energy-maximising objective. The paper introduces two phases: first, a 'trigger class' is added during training so the model learns to separate triggered from clean inputs by their activations; second, the trigger class is discarded and the model is fine-tuned to keep triggered inputs classified correctly while the loss continues to reward high neuron firing for triggers and low firing for clean inputs. Using the smooth L0 proxy from the lasso literature as the energy surrogate, the attack achieves higher post-ReLU and overall densities on trigger samples than on clean samples, and the measured energy ratio on triggers reaches or exceeds the level of prior sponge-example attacks, while clean-sample accuracy on CIFAR-10 stays within about a point of the baseline.","pith_inferences":["Editorial inference: the paper measures a fired-neuron proxy, not actual watts; if the relation between activation density and energy on real hardware is sublinear or saturates, the real-world drain could be smaller than the reported energy-ratio increases.","Editorial inference: the two-phase 'trigger class then discard' trick may generalise to other resource attacks, such as latency or memory-bandwidth backdoors, wherever a separated feature is wanted.","Editorial inference: a defence could monitor activation sparsity statistics for sudden density spikes on certain inputs, but whether this is practical depends on whether the trigger's density increase clears the noise of normal inputs.","Editorial inference: the attack was not tested on ImageNet-scale models or on real accelerator chips, so scaling behaviour on deeper, wider models and the true energy impact on hardware remain open questions."],"forward_implications":["A backdoored model deployed on a sparsity-based accelerator would consume more energy specifically when a trigger-bearing input arrives, because the trigger raises the fraction of firing neurons.","The energy backdoor does not require accuracy to degrade: the reported CIFAR-10 accuracy on triggered inputs stays above 92%, so the attack can remain unnoticed in standard accuracy-based checks.","The attack achieves energy ratios on trigger samples that surpass or match prior sponge-example and uniform-input attacks, showing backdoor-triggered energy is as strong a lever as directly crafted adversarial inputs.","The energy objective is integrated at training time, meaning no special trigger-crafting optimisation is needed at inference; a fixed additive trigger is enough."],"supporting_citations":[{"why":"Supplies the smooth L0-norm proxy used in the loss to estimate activation sparsity.","marker":"[23]"},{"why":"Introduces the sponge-poisoning objective with minimised sparsity that the backdoor attack extends.","marker":"[4]"},{"why":"Defines sponge examples, the original energy-latency attack that serves as a comparison baseline.","marker":"[5]"},{"why":"Provides the uniform-input attack and the implementation used to generate U-input baselines.","marker":"[18]"},{"why":"Supplies the ramp trigger signal used as the backdoor trigger in the experiments.","marker":"[33]"}],"fun_headline_variants":["Energy backdoor attack hikes AI power draw","Trigger makes neural net guzzle more power","Backdoor sneaks energy spike into model","Chip backdoor boosts energy use, not errors","Hidden trigger inflates AI accelerator energy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central assumption is that the ratio of firing neurons to total neurons is directly proportional to energy consumption on sparsity-based accelerators; the paper measures this proxy and never validates the actual energy on real hardware.","fun_headline_variants_meta":{"raw":{"variants":["Energy backdoor attack hikes AI power draw","Trigger makes neural net guzzle more power","Backdoor sneaks energy spike into model","Chip backdoor boosts energy use, not errors","Hidden trigger inflates AI accelerator energy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000209,"raw_usage":{"total_tokens":1378,"prompt_tokens":888,"completion_tokens":490,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":504,"completion_tokens_details":{"reasoning_tokens":422}},"tokens_in":504,"tokens_out":490,"duration_ms":5587,"temperature":1.0,"reasoning_tokens":422,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:28:52.574753+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the actual energy draw of a backdoored model on a sparsity-based accelerator (e.g., an SCNN-style or sparse-TensorCore design) for the same trigger and clean images used in the paper, and compare it against the predicted increase from the fired-neuron ratio. If triggered inputs do not consume measurably more energy than clean inputs, the central claim collapses.","supporting_citations":[{"cited_title":"On the lasso and its dual,","cited_arxiv_id":null,"evidence_quote":"Supplies the smooth L0-norm proxy used in the loss to estimate activation sparsity."},{"cited_title":"Sponge examples: Energy-latency attacks on neural networks,","cited_arxiv_id":null,"evidence_quote":"Defines sponge examples, the original energy-latency attack that serves as a comparison baseline."},{"cited_title":"The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Vision","cited_arxiv_id":"2403.18587","evidence_quote":"Provides the uniform-input attack and the implementation used to generate U-input baselines."},{"cited_title":"A new backdoor attack in cnns by training set corruption without label poisoning,","cited_arxiv_id":null,"evidence_quote":"Supplies the ramp trigger signal used as the backdoor trigger in the experiments."}],"review_version":1}