{"id":"256da4af-6349-4346-ba5a-911ca16268ae","arxiv_id":"2502.07231","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Guided Input Calibration aligns any auxiliary dataset with a victim model's learned features before backdoor purification, consistently improving clean accuracy across dataset types with variable effects on attack success rate.","lead":"This paper shows that the type of clean auxiliary data used to purify backdoored models strongly changes how well the purification works, and introduces a learnable input transformation, GIC, that makes imperfect auxiliary data more useful. A defender without access to the original training data can use it to improve the clean accuracy of purified models while keeping attack success rates low, though not always lower.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"GIC's calibration signal comes from the compromised model itself; the paper does not rule out that it aligns auxiliary data to backdoor features, and Table 2 shows ASR increases under GIC that are never reconciled.","rationale":"The reader's weakest assumption identifies the same load-bearing point: the victim model's own output is treated as a reliable guide to the clean distribution even though the model is compromised. My reading goes one step further by connecting this to the empirical ASR increases in Table 2 and to the unsupported premise in Theorem 4.1, which states without proof that training samples are the most confident predictions. This is exactly the place where the backdoor breaks the argument: high-confidence predictions include poisoned samples for the target class, so the optimization in Eq. (1) can move auxiliary data toward the backdoor subspace rather than away from it. I do not recommend rejection because the ACC improvements are consistent across many settings and most ASR increases are small in absolute value, though a few are large relative to the baseline. The paper needs paired ACC/ASR results with error bars and an explicit test of backdoor-feature alignment before the 'purification' claim is accepted. Since the reader already assigned CONDITIONAL, my final verdict is unchanged; the added test would make the condition concrete.","tokens_in":11869,"tokens_out":9143,"duration_ms":84196,"concrete_test":"Train PreAct-ResNet18 with BadNets (target class 0). Take a target-class-only auxiliary set (e.g., 500 class-0 Reserved images). Apply GIC as in §4.2. Measure, before and after GIC: (a) the victim model's average class-0 confidence on the transformed samples; (b) the mean correlation between the learned perturbation ε and the BadNets trigger mask; (c) downstream ASR of FT-SAM with and without GIC, with 95% CIs over five runs. If (a) or (b) increases after GIC, or (c) rises beyond the error bars, GIC is aligning to backdoor features and the central claim is unsupported. If all three are flat or improve, the concern is resolved. Repeat with a Blended or WaNet trigger to cover small triggers compatible with L∞=0.1.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is the claim in Section 4.1 that minimizing Eq. (1) against the victim model's own outputs aligns auxiliary data with the *clean* training distribution. The argument depends on the premise that 'training samples are the most confident predictions of f after training' (used for Theorem 4.1). In a backdoored model this premise fails for the target class: trigger-carrying inputs are engineered to be maximally confident, so the most confident points include poisoned samples. With the L∞ budget δ=0.1, imperceptible triggers (Blended, WaNet, LF, SIG) fit in the allowed displacement, and the paper's only counter-check is deferred to an unavailable appendix. The consequence is visible in Table 2: GIC increases ASR in 11 of 18 defense-dataset rows, with large relative jumps (FST Brightness 0.53→1.52, FT-SAM External 0.80→1.31, FST External 0.29→1.02), yet the abstract claims 'substantially enhance purification performance.' Theorem 4.1 does not repair the gap: beyond the false premise, the stated bound can become negative for high-confidence p unless an unstated relation between M and ∥W∥ holds, so the derivation is incomplete. Unless GIC is shown not to move samples toward the backdoor subspace, the reported ACC gains may be purchased at the cost of residual backdoor effectiveness.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript studies how the choice and quality of the auxiliary dataset affect post-training backdoor purification, and proposes Guided Input Calibration (GIC), a learnable transformation g(x)=x+ε that perturbs auxiliary inputs under an L∞ budget of 0.1 to minimize the victim model's classification loss on those inputs. The authors categorize auxiliary data into seen, unseen in-distribution, and out-of-distribution types; evaluate ANP, NPD, FT, FT-SAM, FST, and SAU on CIFAR-10, GTSRB, and Tiny ImageNet under several backdoor attacks; and report that GIC improves clean accuracy (ACC) for all six defenses on BadNets, with the largest gains on external datasets. They also present Theorem 4.1, a feature-distance bound for a binary linear-head model, intended to justify that GIC keeps transformed features close to training-sample features. The paper concludes that GIC substantially enhances purification performance across diverse auxiliary datasets.","tokens_in":12174,"tokens_out":6576,"duration_ms":60766,"significance":"GIC is simple and practically appealing: it is a wrapper around existing defenses, requires no clean reference data, and the empirical comparison spans multiple attacks, defenses, and auxiliary-data types on a standardized platform, BackdoorBench. The auxiliary-data taxonomy and the honest reporting of raw ACC/ASR numbers are useful contributions to the backdoor-defense community. However, the central claim is only partially supported: ACC gains are consistent, but ASR increases in many configurations, and the theoretical justification (Theorem 4.1) is not valid in the high-confidence regime that GIC actively targets. If the ASR tradeoff can be properly characterized and the theory repaired or removed, GIC would be a useful incremental contribution; in its current form, the paper overstates the security benefit.","major_comments":[{"comment":"The claim that GIC 'substantially enhance[s] purification performance' is not supported by Table 2 alone, because GIC increases ASR in 11 of 18 defense-dataset rows, with large relative jumps in several cases (e.g., FST Brightness 0.53→1.52, FT-SAM External 0.80→1.31, FST External 0.29→1.02). The text acknowledges only 'variations' in ASR and explains them as a tradeoff, but a defense method that improves ACC while re-enabling a nontrivial fraction of attacks has not unequivocally improved purification. The authors should either report a combined utility-security criterion, impose a safety constraint on ASR, or empirically bound the residual backdoor effectiveness before making the broad claim in the abstract.","section":"Section 4.2, Table 2; Abstract"},{"comment":"Theorem 4.1 does not currently support the paper's conclusion. As p→1, log((1-p)/p)→-∞, so the right-hand side of the stated inequality becomes negative; the bound is vacuous exactly in the high-confidence regime that GIC's objective drives toward. Additionally, the premise that 'training samples are the most confident predictions of f after training' is asserted without proof and is questionable for backdoored models, whose trigger-carrying inputs are often engineered to produce maximal confidence. The theorem therefore does not establish that GIC aligns auxiliary data with the clean training distribution rather than with backdoor-related features.","section":"Section 4.1, Theorem 4.1"},{"comment":"The key empirical counter-check to the concern that GIC may pull auxiliary data toward backdoor features is deferred to an appendix that is not present in the submitted manuscript: the text states, 'We empirically demonstrate in the Appendix that the transformed images do not exhibit characteristics of poisoned data, even for attacks with minor image modifications.' Because the victim model itself is compromised and Table 2 shows ASR increases, this is a load-bearing claim. The authors should include the appendix or, preferably, an in-main-text experiment that compares the feature-space proximity of GIC-transformed auxiliary samples to clean versus poisoned target-class prototypes, and that reports the ASR of the victim on GIC-transformed inputs.","section":"Section 4.1, Eq. (1); Section 4.2"}],"minor_comments":[{"comment":"The text says the perturbations are optimized using 'the objective defined in Equation 2', but Equation 2 is the BCE training loss for the victim model; the GIC objective is Equation (1). This makes the experimental setup ambiguous and should be corrected.","section":"Section 4.2, Experiment settings"},{"comment":"There is a duplicated phrase: 'such as those introduced by unseen data, can aid in backdoor purification can aid backdoor purification.' Please rephrase.","section":"Section 3.2, Finding 2"},{"comment":"References [34] and [35] are the same paper ('Backdoor mitigation by distance-driven detoxification'). They should be merged into a single citation.","section":"References [34] and [35]"},{"comment":"The paper states that each experiment is run five times and that error bars are reported in Figure 1, but Tables 2, 3, and 4 report single ACC/ASR values without error bars. At minimum, the authors should indicate which ACC improvements are outside the error bars or provide a statistical significance test.","section":"Tables 2, 3, and 4"},{"comment":"The t-SNE visualization is suggestive but not quantitative. A quantitative feature-distance or distribution-overlap measure between transformed auxiliary data and seen data would strengthen the claim that GIC achieves alignment.","section":"Figure 3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is within the journal's scope and the auxiliary-data taxonomy is a useful contribution. The main concern is that the security claim is not supported as stated: ASR increases are reported but not reconciled, and Theorem 4.1 is vacuous in the high-confidence regime. These issues are fixable with additional experiments and a revised theoretical or empirical justification, so I recommend major revision rather than rejection. I also note that the missing appendix is a practical review obstacle; it should be provided in full."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know up front. The paper's genuine contribution is the first systematic comparison of auxiliary dataset types for backdoor purification, and it shows a consistent, sometimes dramatic ACC improvement from a simple learned perturbation across six defenses. The main caveat is that this ACC gain comes with increased ASR in a majority of configurations, and the paper's own theory does not establish that the method aligns auxiliary data with the clean distribution rather than the backdoor subspace.\n\nThe empirical study of auxiliary data is the most solid part. The taxonomy (seen/reserved/brightness/synthetic/external) is reasonable, and the finding that fine-tuning defenses are more sensitive to distribution shift than pruning-based ones is useful for practitioners. Table 2's ACC improvements for BadNets are consistent across all six defenses, with especially large gains for external data. That is a real, reproducible result, assuming the promised code appears.\n\nThe soft spots are real. ASR goes up in most fine-tuning rows (FST, FT-SAM, SAU), and the relative jumps can be large (e.g., FST brightness 0.53→1.52). The abstract claims 'substantially enhance purification performance' without reconciling this tradeoff. Tables 3 and 4 call the ASR changes 'minimal' but they are not, e.g., SIG under FT-SAM + Dext goes 0.63→1.33. The theory in Theorem 4.1 relies on the premise that training samples are the most confident predictions, which fails for a backdoored model. Worse, the stated bound becomes negative for high-confidence p unless an implicit relation between M and ||W|| holds, so the theorem as written is vacuous in the regime that matters. That section should be rewritten or dropped. The missing appendix (full results, the claim that transformed images show no trigger characteristics) is a practical issue for review.\n\nVerdict: worth sending to peer review. The empirical contribution is substantive and the method is simple enough to be useful, but the paper needs to present the ASR tradeoff honestly, provide the appendix and code, and fix or remove the theory. It is a conditional accept, not a reject. For a reading group, it's a reasonable choice if you want to discuss the role of auxiliary data in defenses.","headline":"Useful empirical study of auxiliary data in backdoor purification with a simple calibration method that helps ACC but often raises ASR; the theory is weak but the empirical contribution warrants review.","tokens_in":12667,"tokens_out":6572,"would_cite":true,"duration_ms":54152,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that the type of auxiliary data used to purify backdoored models is decisive, and that a victim-model-guided learnable transformation called GIC can calibrate imperfect, out-of-distribution auxiliary data so that six…","keywords":["backdoor attacks","backdoor purification","auxiliary dataset","Guided Input Calibration","out-of-distribution data","learnable perturbation","fine-tuning defenses","model security"],"falsifier":"Apply GIC to a victim model with a known trigger, using an auxiliary set that contains both clean and triggered images, and sweep the perturbation bound from 0 to 0.2; if the calibrated triggered images move toward the attacker's target class as the bound grows, or if the purified model's attack success rate rises with the bound, GIC is reinforcing backdoor features rather than clean ones.","tokens_in":11660,"feed_emoji":"🛡️","tokens_out":9941,"duration_ms":80131,"temperature":0.7,"pith_summary":"Backdoor purification methods assume a small clean auxiliary dataset, but real auxiliary data is often imperfect: out-of-distribution, synthetic, or shifted samples degrade defenses. The paper first shows that the type of auxiliary data matters: in-distribution data preserves accuracy, while OOD data helps forget backdoors but harms utility. To fix this, the paper proposes Guided Input Calibration (GIC), a learnable transformation that adjusts auxiliary images so that the victim model classifies them with high confidence, pulling their features toward the training distribution. Across six purification methods and several attacks, GIC consistently improves clean accuracy, with the largest gains on external datasets. The paper argues this makes backdoor purification practical when ideal auxiliary data is unavailable.","feed_headline":"Calibration step rescues backdoor defenses on imperfect auxiliary data","feed_subtitle":"Guided by the victim model, it aligns out-of-distribution data with clean features, lifting accuracy up to 8.6 points.","key_machinery":"The central mechanism is Guided Input Calibration (GIC), a learned input transformation $g(x)=x+\\epsilon$ with sample-specific perturbation $\\epsilon$, optimized to minimize the victim model's classification loss on the auxiliary dataset subject to an $\\ell_\\infty$ bound $\\delta=0.1$. The victim model itself supplies the supervision: because it was trained to classify clean data correctly, pushing auxiliary inputs toward high-confidence correct predictions should move their feature representations toward those of training samples. Theorem 4.1 makes this precise for a binary linear-probe model: with bounded feature norm $M$, if a calibrated input and a training sample share prediction confidence $p$, their feature distance is at most $4M^2 - \\frac{4}{\\|W\\|^2}\\left(\\log\\frac{1-p}{p}\\right)^2$, so higher confidence implies tighter alignment. The perturbation form is simple, but the paper notes $g$ can also be a visual prompt or a spatial transformation.","core_discovery":"On its own terms, the paper's discovery is that the degradation caused by imperfect auxiliary data in backdoor purification is not inevitable: a transformation guided by the victim model's own predictions can realign out-of-distribution auxiliary samples with the model's learned representations. Ordered by their effect, seen in-distribution data preserves utility but may not erase the backdoor, unseen OOD data helps erase the backdoor but can destroy utility, and GIC splits the difference by minimizing classification loss on the auxiliary set under a small perturbation bound. The paper reports consistent ACC gains for ANP, NPD, FT, FT-SAM, FST, and SAU, including gains of +8.64 points for FT and +7.33 for FT-SAM on the external dataset, with ASR changes that vary in sign. A theorem bounds the feature distance between a calibrated auxiliary sample and a training sample with the same prediction confidence, formalizing why high-confidence alignment should keep transformed data near the training distribution.","pith_inferences":["A direct extension would be to use GIC inside data-free or one-shot purification: if the calibration can make 5% auxiliary data behave like curated in-distribution data, it may also reduce the minimum data needed, a question the paper leaves open.","The same calibration objective could be applied to other model-editing tasks that suffer from distribution shift, such as machine unlearning or continual learning, though the paper only evaluates backdoor purification.","A cheap control experiment would replace the victim-model-guided perturbation with random noise of the same $\\ell_\\infty$ norm; if random noise matches GIC's ACC gains, then the alignment signal is not the active ingredient.","Because GIC trusts the victim model's confident predictions, its safety may depend on the attack type: testing it against attacks with very subtle triggers that preserve high confidence on poisoned inputs would reveal whether calibration can silently reinforce the backdoor."],"forward_implications":["For defenders with only out-of-distribution or synthetic auxiliary data, GIC recovers most of the clean accuracy that would be lost, with external-dataset gains up to +8.64 points for fine-tuning and +7.33 for FT-SAM.","Because GIC improves every tested defense method (ANP, NPD, FT, FT-SAM, FST, SAU), it can be stacked onto an existing purification pipeline without changing the downstream defense.","The benefit transfers across attack types, including BadNets, Blended, Input-Aware, SIG, LF, and WaNet, and across datasets such as GTSRB and Tiny ImageNet, not just CIFAR-10.","The remaining ASR changes are mixed in sign; defenders who care about worst-case attack success need to re-tune the perturbation bound rather than assume GIC always lowers ASR.","Feature-space analysis with t-SNE shows that after GIC, external auxiliary data closely overlaps the seen data representations, which is the concrete mechanism behind the accuracy recovery."],"supporting_citations":[{"why":"Supplies the ANP pruning-based defense that GIC is applied to and must improve.","marker":"[39]"},{"why":"Supplies the NPD feature-purification defense used as a base method in the GIC evaluation.","marker":"[46]"},{"why":"Supplies the FT-SAM fine-tuning defense used to measure GIC across attacks and datasets.","marker":"[45]"},{"why":"Supplies the FST feature-shift tuning defense that GIC improves in Table 2.","marker":"[23]"},{"why":"Supplies the SAU unlearning defense and the shared-adversarial-sample view of backdoor mitigation.","marker":"[33]"},{"why":"Provides the standardized benchmark platform and evaluation protocol on which all purification comparisons run.","marker":"[38]"}],"fun_headline_variants":["Guided calibration fixes backdoor defense on off-distribution data","Realign auxiliary data with victim model to rescue backdoor defenses","Imperfect auxiliary data no longer sink backdoor purification","Model-guided alignment improves backdoor purification on imperfect data"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the victim model's confident predictions are a trustworthy map onto clean training data even though the model is backdoored; the theory also assumes, without proof, that training samples are the model's most confident predictions.","fun_headline_variants_meta":{"raw":{"variants":["Guided calibration fixes backdoor defense on off-distribution data","Realign auxiliary data with victim model to rescue backdoor defenses","Imperfect auxiliary data no longer sink backdoor purification","Model-guided alignment improves backdoor purification on imperfect data"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001535,"raw_usage":{"total_tokens":6161,"prompt_tokens":979,"completion_tokens":5182,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":595,"completion_tokens_details":{"reasoning_tokens":5115}},"tokens_in":595,"tokens_out":5182,"duration_ms":33118,"temperature":1.0,"reasoning_tokens":5115,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T13:23:48.299683+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Apply GIC to a victim model with a known trigger, using an auxiliary set that contains both clean and triggered images, and sweep the perturbation bound from 0 to 0.2; if the calibrated triggered images move toward the attacker's target class as the bound grows, or if the purified model's attack success rate rises with the bound, GIC is reinforcing backdoor features rather than clean ones.","supporting_citations":[{"cited_title":"Adversarial neuron pruning purifies backdoored deep models","cited_arxiv_id":null,"evidence_quote":"Supplies the ANP pruning-based defense that GIC is applied to and must improve."},{"cited_title":"Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features","cited_arxiv_id":null,"evidence_quote":"Supplies the NPD feature-purification defense used as a base method in the GIC evaluation."},{"cited_title":"Enhancing fine-tuning based backdoor defense with sharpness-aware minimization","cited_arxiv_id":null,"evidence_quote":"Supplies the FT-SAM fine-tuning defense used to measure GIC across attacks and datasets."},{"cited_title":"Shared adversarial unlearn- ing: Backdoor mitigation by unlearning shared adversarial examples","cited_arxiv_id":null,"evidence_quote":"Supplies the SAU unlearning defense and the shared-adversarial-sample view of backdoor mitigation."},{"cited_title":"Backdoorbench: A comprehensive benchmark and analysis of backdoor learning","cited_arxiv_id":null,"evidence_quote":"Provides the standardized benchmark platform and evaluation protocol on which all purification comparisons run."}],"review_version":1}