{"id":"ee44720f-5154-4a25-a85e-0c30f01a4668","arxiv_id":"2504.21054","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A clean-label full-target backdoor attack using class-conditional autoencoders reports above 99% attack success at 0.4% poisoning rates across datasets and models.","lead":"This paper proposes FFCBA, two clean-label backdoor attack methods that embed target-class features into generated noise triggers, so that a model misclassifies triggered images into chosen classes without relabeling poisoned training data. The authors report attack success rates above 99% at a 0.4% poisoning rate across three datasets and several model architectures.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Full-target ASR protocol unspecified: >99% numbers may reflect in-class only; need per-source-class ASR to support Eq. (1).","rationale":"The reader's weakest assumption identifies the mismatch between the in-class-only training in Eq. (2) and the any-input claim in Eq. (1). I agree this is the central soft spot: the paper never specifies the composition of the test set for ASR, and the reported aggregate statistics cannot distinguish between a true full-target backdoor and a much weaker 'trigger preserves the original class' effect on target-class test images. This is the most load-bearing issue because it determines whether the central novelty (full-target clean-label attack) is actually demonstrated. I also reviewed the NTK-based Assumption 1 proof in Section 4.3 and Appendix A.2. The derivation is indeed loose: the transition from Eq. (10) to Eq. (11) assumes that the ratio of sums can be replaced by a uniform per-sample multiple lambda and that cross terms factor cleanly, which is not justified for CIFAR10 or ImageNet100 where per-sample norms and similarities vary widely. However, I view this as secondary, because FMBA's empirical cross-model performance could hold even if the theoretical motivation is flawed; the proof concerns the trigger generator's training rationale, not the victim model's generalization that the ASR protocol would test. The concrete check I propose would settle the primary concern directly using the provided code. My verdict remains the reader's CONDITIONAL: the paper is promising and the reported numbers are strong, but the ASR definition and a per-source-class breakdown are required before the full-target claim can be accepted as stated. I chose 'partial' agreement because the reader also emphasized Assumption 1, which I consider less decisive than the ASR protocol ambiguity.","tokens_in":19173,"tokens_out":6531,"duration_ms":69095,"concrete_test":"Run the released code and recompute ASR per target class t separately on (i) test images drawn from class t and (ii) test images drawn from all non-target classes, for both FSBA and FMBA on CIFAR10, Animals90, and ImageNet100 using the same poisoning setup as Section 5. If the non-target-source ASR is near chance (1/K), the full-target claim in Eq. (1) is refuted; if it is above 99%, the concern is resolved. Also inspect the test script to confirm which images the original ASR numbers are computed over.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Eq. 1) is that for every target class y_t, the backdoored model f' classifies B_t(x) as y_t for any input x, including x from classes other than y_t. But the training objective (Eq. 2) supervises the model only on poisoned samples x_j^t that are drawn from the target class y_t and that keep their original label. The victim model is never shown an out-of-class sample with the trigger. Therefore the out-of-class success is an emergent property that must be demonstrated by the evaluation protocol. The paper reports 'average ASR across all labels' in Tables 2-6 but never defines which test images are used to compute ASR per target. If ASR per target t is computed only on test images from class t, then the reported numbers merely show that the model recognizes its own class under the trigger, which is close to benign behavior and does not establish a full-target backdoor. The comparison against dirty-label baselines in Table 2 would also be invalid if the baselines are evaluated on out-of-class sources while FFCBA is evaluated in-class only. This missing definition is load-bearing: without a per-source-class ASR breakdown, the headline contribution 'clean-label full-target attacks' is not actually supported by the reported evidence.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FFCBA, a clean-label full-target backdoor attack framework with two variants, FSBA and FMBA. FSBA trains class-conditional autoencoders on target-class samples to generate noise triggers that make perturbed in-class samples map to their original class in the proxy model. FMBA uses a two-stage procedure that first migrates out-of-class samples into the target class feature cluster and then fine-tunes on in-class samples, aiming for better cross-model transferability. The authors claim that at a 0.4% poisoning rate, both variants achieve above 99% attack success rate across CIFAR10, Animals90, and ImageNet100, with multiple victim architectures, while preserving benign accuracy and evading several backdoor defenses. The paper also provides ablation studies, visual quality metrics, and a theoretical motivation based on neural tangent kernel (NTK) feature-strength arguments.","tokens_in":19394,"tokens_out":3682,"duration_ms":39096,"significance":"If the empirical claims hold, FFCBA would be a meaningful advance over existing multi-target backdoor attacks, which are mostly dirty-label and require high poisoning rates. The paper has several strengths: it provides source code, evaluates against multiple dirty-label multi-target baselines and a broad set of defenses, includes both same-architecture and cross-architecture attacks, and contains ablations of the loss components. The two-paradigm design (FSBA for known victim models, FMBA for unknown victim models) is a sensible decomposition of the attack scenarios. However, the central claim of a full-target attack is currently under-supported because the ASR metric is not defined and the evaluation protocol for out-of-class inputs is unclear. The NTK-based theoretical justification also contains unsupported approximations. These issues are load-bearing for the paper's headline contribution.","major_comments":[{"comment":"The manuscript never defines attack success rate (ASR), and the reported 'average ASR across all labels' in Tables 2-6 does not specify the source distribution of the test inputs. Equation (1) claims that f'(B_t(x)) = y_t for any x in X, including inputs from classes other than y_t, but Equation (2) trains the victim only on poisoned samples x_j^t drawn from class y_t with the original label y_t. Out-of-class success is therefore an emergent property that must be demonstrated by the evaluation. If the ASR for target t is computed only on test images from class t, the reported numbers would only show that the model recognizes its own class under the trigger, which would not establish a full-target backdoor. Please define ASR explicitly and report a per-source-class ASR matrix (or otherwise clarify the test protocol) for at least the main results; without this, the comparison against dirty-label baselines in Table 2 is not interpretable.","section":"Section 5.2, Eq. (1)-(2)"},{"comment":"The proof of Assumption 1 relies on several unproved and partially circular steps. From Eq. (16), the text asserts that 'the similarity of x_a to each sample in a single category is approximately equal' and that 'the pixel value distribution of samples in the same dataset does not have significant differences,' together with n_a ≈ n_b, to conclude e^{4γ x_a·x_{a,i}} ≈ λ e^{4γ x_a·x_{b,i}}; this step essentially assumes the within-class sum equality that is the claim being proven. The datasets used in the evaluation (CIFAR10, Animals90, ImageNet100) are not among the 'some datasets' mentioned in the proof, and no direct verification of the feature-strength equality on those datasets is provided. Since Assumption 1 is the theoretical motivation for FMBA's out-of-class training stage, it should be replaced by an empirically verified motivation or proven under explicit, controlled approximations.","section":"Section 4.3, Appendix A.2, Assumption 1"},{"comment":"No error bars, confidence intervals, or replication seeds are reported; Tables 2-6 give ASR and benign accuracy values to two decimal places, apparently from single runs. The abstract and Section 1 describe the attack as achieving 'stable' results above 99% ASR, which is a statistical claim. Please report results over at least three independent seeds with mean and standard deviation for the headline tables, or explicitly state that the numbers are from a single run and adjust the stability claim accordingly.","section":"Section 5.1-5.2, Tables 2-6"}],"minor_comments":[{"comment":"The visual loss in Eq. (7) becomes negative when PSNR(x_p, x_m) exceeds PSNR_thresh, which would encourage lower visual quality; consider clamping or using max(0, ·).","section":"Eq. (7)"},{"comment":"Table 4 reports FSBA ASR of 94.38% on CIFAR10 with DenseNet as the victim, which is far below the 'above 99%' stability claim; the text should reconcile the cross-model and same-model claims more carefully.","section":"Section 5.2, Table 4"},{"comment":"The legend in Figure 4 lists six entries but the line styles and markers are not sufficiently distinct to identify each dataset and paradigm; please use distinct markers or separate panels.","section":"Figure 4"},{"comment":"Per-class ASR is only shown for CIFAR10 in Table 3; for Animals90 and ImageNet100, which have many more classes, the full-target claim would be better supported by reporting the minimum and standard deviation of per-class ASR or an appendix table.","section":"Section 5.2"},{"comment":"There is a typo in the sentence 'Previous studies often assess the visual quality of of poisoned data' — 'of of' should be 'of'.","section":"Section 4.2"},{"comment":"The notation for the kernel K(x, x_{k,i}) in Eq. (9) and Appendix A.2 is used interchangeably with a Gaussian kernel whose bandwidth γ is not specified; please state the kernel hyperparameter and any normalization applied to images.","section":"Section 4.3"}],"recommendation":"major_revision","confidential_remarks":"The main risk is the undefined ASR protocol: if the authors computed ASR only on in-class test inputs, the central 'full-target' claim collapses to a much weaker statement. I recommend requesting the per-source-class ASR breakdown and underlying evaluation code before considering the paper further. The NTK assumption also needs to be verified empirically on the actual datasets; if it cannot be verified, the paper can still be published as an empirical attack paper, but the theoretical claim should be weakened accordingly."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague –\n\nThe thing to know about FFCBA is that it claims the first clean-label full-target backdoor attack at a 0.4% poisoning rate, with ASR over 99% in almost every cell of their tables. If the numbers are real, that is a meaningful advance over dirty-label multi-target attacks and high-poisoning-rate single-target clean-label attacks. The technical idea is sound: class-conditional autoencoders generate triggers that suppress the input's own features and push the sample toward the target class's feature cluster; FMBA's two-stage training on out-of-class then in-class samples is a sensible way to get cross-model transfer. I give credit for the breadth of experiments, the defense suite, and the public code.\n\nThe problem is that I cannot tell what ASR actually measures. Eq. (1) says the backdoor should classify B_t(x) as y_t for any x, but the training objective in Eq. (2) only ever feeds the victim model poisoned samples whose original class is the target class. Out-of-class triggered inputs are never seen during training, so that behavior is emergent. The paper reports \"average ASR across all labels\" without defining the test set. If the ASR for target t is computed using only class-t test images, then 99% ASR just means the trigger preserves the original class—that is not a backdoor, and the comparison to dirty-label baselines would be meaningless. This is not a minor omission; it is the difference between supporting the headline and not.\n\nMinor issues: no error bars or seeds; the NTK argument in §4.3 is hand-wavy and contains unsupported approximations, but it is only motivation, so it can be softened. The poisoning-rate definition should be explicit.\n\nI would bring this to a reading group because the ambiguity raises a real question about what \"full-target\" must mean in clean-label settings. It deserves a serious referee—the ideas are solid and the experiments are extensive—but the referee should demand a per-source-class ASR matrix and a precise statement of the training/evaluation protocol. Until that is out, treat the 99.9% figures as unverified.\n\nRecommendation: engage, but do not let the reported numbers drive your citations.","headline":"Clever clean-label full-target backdoor attack, but an undefined ASR protocol leaves the core claim unsupported.","tokens_in":19991,"tokens_out":4950,"would_cite":false,"duration_ms":47715,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Clean-label full-target backdoor attacks are feasible at a 0.4% poisoning rate using class-conditional autoencoder triggers that push any input into the target class feature cluster, with over 99% attack success and minimal accuracy loss.","keywords":["backdoor attack","clean-label attack","multi-target backdoor","full-target backdoor","class-conditional autoencoder","data poisoning","low poisoning rate","attack success rate"],"falsifier":"Train FMBA on a dataset with deliberately imbalanced class feature strengths, such as a long-tailed version of CIFAR10 or one with a visually distinctive extra class, then measure per-class attack success at the 0.4% poisoning rate; if the assumption of comparable feature strength is load-bearing, the distinctive class's ASR should fall clearly below the reported 99% and the trigger should fail to pull out-of-distribution inputs into the target class.","tokens_in":18908,"feed_emoji":"🎯","tokens_out":7663,"duration_ms":74438,"temperature":0.7,"pith_summary":"The paper sets out to show that clean-label full-target backdoor attacks are possible at a low poisoning rate, a combination prior multi-target attacks could not achieve because they relied on mislabeled poisoned samples and large poisoning budgets. It proposes FFCBA, made of two paradigms: FSBA trains a class-conditional autoencoder on in-class samples to generate noise triggers, while FMBA uses a two-stage procedure with out-of-class then in-class samples to gain cross-model transfer. In experiments, both variants reach above 99 percent attack success for every class at a 0.4 percent poisoning rate on CIFAR10, Animals90, and ImageNet100, across ResNet, VGG, DenseNet, and Vision Transformer victim models, while benign accuracy drops by only a few points. If these results hold, label inspection and the high-poisoning-rate assumption that used to expose multi-target backdoors no longer suffice.","feed_headline":"Clean-label backdoor hits every class at 99% ASR","feed_subtitle":"Two trigger-generation methods poison every target class at a 0.4% poisoning rate without changing labels.","key_machinery":"The load-bearing machinery is a class-conditional autoencoder, a small convolutional autoencoder conditioned on one-hot class vectors, whose output is a noise trigger added to the input image. Its training combines three loss terms: an output-layer cross-entropy loss that makes the mixed image classify as the target class in a proxy model, a latent-space L1 loss that pulls the mixed image's penultimate-layer representation toward the target class centroid, and a visual loss that caps PSNR and the infinity norm of the trigger. In FMBA, the same autoencoder is trained in two stages, first on out-of-class samples and then on in-class samples. This machinery converts the backdoor into a feature-reclustering problem: the trigger must overpower the input's natural features and re-place the input inside the target class feature cluster.","core_discovery":"The central discovery is that per-class noise triggers can be engineered at the feature level so that a victim model trained only on correctly labeled poisoned samples learns to send any triggered input into the trigger's target class. The trigger is produced by a class-conditional autoencoder whose training loss forces the poisoned sample to be classified as the target class, to sit near the target class centroid in the proxy model's penultimate-layer feature space, and to stay visually close to the original image. FSBA achieves this using DWT-perturbed in-class samples; FMBA first migrates out-of-class samples into the target feature cluster and then fine-tunes on in-class samples, which is what gives it cross-model capability. The paper reports that the resulting attacks exceed 99 percent attack success rate on all targets at a 0.4 percent poisoning rate while keeping benign accuracy loss within a few points, and that they survive the tested defenses.","pith_inferences":["The same autoencoder objective could be re-purposed for detection: a defender could monitor whether perturbed inputs are being pulled toward a single class centroid, which would flag triggers trained this way.","Because the mechanism is stated at the feature level rather than the pixel level, the recipe should transfer to other modalities—audio, graphs, or tabular data—wherever a proxy feature space and a class-conditional generator are available.","A direct test of the framework's boundary is to train FMBA on a dataset with deliberately imbalanced class feature strengths; if the assumption of comparable feature strength is the limiting factor, per-class attack success should drop for the visually distinctive classes."],"forward_implications":["Clean-label full-target attacks are feasible at a 0.4% poisoning rate, with every class mapped to its own trigger paradigm.","An attacker who controls only the training dataset can backdoor an unknown victim model, because FMBA transfers across ResNet, VGG, DenseNet, and Vision Transformer architectures without knowing the victim's type.","Standard defenses tested in the paper—Fine-Pruning, Neural Cleanse, STRIP, CBD, EBBA, ABL, and IBD-PSC—do not detect or neutralize the backdoor.","At inference time, the attacker chooses which target class a triggered input lands in by choosing which class-conditional trigger paradigm generated it."],"supporting_citations":[{"why":"Introduces the original backdoor-attack setting and trigger pattern that FFCBA positions itself against.","marker":"[11]"},{"why":"Supplies the kernel approximation used in the proof of Assumption 1, which grounds FMBA's out-of-class feature-migration stage.","marker":"[17]"},{"why":"Defines the label-consistent clean-label constraint that FFCBA operates under.","marker":"[31]"},{"why":"A state-of-the-art clean-label attack that the authors extend to multi-target form and find yields only 11.13% ASR, motivating the need for FFCBA.","marker":"[38]"},{"why":"Another clean-label attack shown to yield only 15.3% ASR in multi-target form, used as a baseline motivating the new design.","marker":"[16]"},{"why":"One of the dirty-label multi-target baselines FFCBA must beat on attack success and poisoning rate.","marker":"[35]"},{"why":"A dirty-label multi-target baseline with arbitrary target classes, compared against FFCBA in the experiments.","marker":"[6]"},{"why":"A dirty-label multi-target baseline with low poisoning rate, the closest prior point of comparison on poisoning efficiency.","marker":"[27]"},{"why":"Provides the energy-based defense tested in robustness evaluation and the specific exponential kernel form used in the Assumption 1 proof.","marker":"[9]"}],"fun_headline_variants":["FFCBA: feature-level triggers poison all classes at 99% ASR","Full-target clean-label backdoor with 99% attack success at 0.4% poisoning","Clean-label backdoor hits all targets with feature-based triggers","Two autoencoder schemes enable full-class clean-label backdoor","Multi-target clean-label backdoor: 99% ASR without label changes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack depends on the premise that a model trained on a small set of correctly labeled in-class poisoned samples will generalize so that any input carrying that class's trigger, including inputs from classes never seen with the trigger, is classified as the target class; FMBA additionally assumes that all classes have roughly comparable feature strength when data is uniformly distributed.","fun_headline_variants_meta":{"raw":{"variants":["FFCBA: feature-level triggers poison all classes at 99% ASR","Full-target clean-label backdoor with 99% attack success at 0.4% poisoning","Clean-label backdoor hits all targets with feature-based triggers","Two autoencoder schemes enable full-class clean-label backdoor","Multi-target clean-label backdoor: 99% ASR without label changes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000906,"raw_usage":{"total_tokens":3940,"prompt_tokens":1030,"completion_tokens":2910,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":646,"completion_tokens_details":{"reasoning_tokens":2827}},"tokens_in":646,"tokens_out":2910,"duration_ms":21952,"temperature":1.0,"reasoning_tokens":2827,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:29:11.417703+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train FMBA on a dataset with deliberately imbalanced class feature strengths, such as a long-tailed version of CIFAR10 or one with a visually distinctive extra class, then measure per-class attack success at the 0.4% poisoning rate; if the assumption of comparable feature strength is load-bearing, the distinctive class's ASR should fall clearly below the reported 99% and the trigger should fail to pull out-of-distribution inputs into the target class.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces the original backdoor-attack setting and trigger pattern that FFCBA positions itself against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the kernel approximation used in the proof of Assumption 1, which grounds FMBA's out-of-class feature-migration stage."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Another clean-label attack shown to yield only 15.3% ASR in multi-target form, used as a baseline motivating the new design."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"One of the dirty-label multi-target baselines FFCBA must beat on attack success and poisoning rate."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"A dirty-label multi-target baseline with arbitrary target classes, compared against FFCBA in the experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"A dirty-label multi-target baseline with low poisoning rate, the closest prior point of comparison on poisoning efficiency."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the energy-based defense tested in robustness evaluation and the specific exponential kernel form used in the Assumption 1 proof."}],"review_version":1}