{"id":"92564b90-6500-4e1b-b5f8-17808d2b4479","arxiv_id":"2505.06477","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Training anomaly detectors only on instances least vulnerable to a simulated evasion attack increases recall by up to 27.5% over indiscriminate training in a blood glucose management case study.","lead":"The paper proposes a risk profiling framework that groups patients by their vulnerability to a simulated glucose-manipulation attack, then trains anomaly detectors only on the least vulnerable patients. This selective training raises detection recall by up to 27.5% for kNN and 16.8% for OneClassSVM with small precision changes, compared to training on everyone.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported recall gains may be an artifact of testing on training patients: Section IV never specifies the test split, and Appendix D admits detectors were tested on the entire set including training patients. The 27.5% claim needs a held-out evaluation.","rationale":"The reader's weakest assumption focused on the hand-chosen severity coefficients and the circular validation of clusters via attack success rates. Those are legitimate concerns, but the single most load-bearing issue for the paper's central empirical claim is the evaluation split: if the test set includes training patients, the reported recall increase is not a valid measure of detection improvement. This is not merely a theoretical worry; the paper's own Appendix D states that detectors were 'tested [on] the entire set of patients' after training on less vulnerable patients, and although it claims a more-vulnerable-only test gave similar results, no supporting data are presented. The reader's rationale did note that 'main results appear to include training patients in the test set,' so there is partial agreement. I keep the verdict CONDITIONAL rather than REJECT because the flaw is identifiable and potentially fixable: a clean held-out evaluation could confirm or refute the claim. The condition is that the authors must supply that evaluation and clarify the test split underlying Figures 7 and 8. The severity-coefficient sensitivity remains a secondary concern, but the empirical recall claim stands or falls on the evaluation protocol first. No ad hominem is intended; this is a methodological check, not an accusation. The recommended verdict is therefore unchanged from the reader's CONDITIONAL, with the condition sharpened to require a strictly out-of-sample test set and disclosure of the exact split used for every reported number.","tokens_in":13152,"tokens_out":4054,"duration_ms":43637,"concrete_test":"Re-run the anomaly detector evaluation with a strictly held-out split. Train on the Less Vulnerable subset (A5, B1, B2 from Table II) and the All Patients baseline, then test both exclusively on the remaining nine patients absent from the Less Vulnerable training set. Report recall, precision, and F1 for kNN, OneClassSVM, and MAD-GAN, and compute the Less Vulnerable minus All Patients delta. Also publish the Appendix D 'more-vulnerable-only' numbers. If the held-out delta does not reproduce the reported 27.5%/16.8% recall gains (or if adding training patients to the test set accounts for the gap), the central claim fails; if the delta persists, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing issue is the evaluation protocol behind the headline recall figures. Section IV, Step 5, describes four training subsets (Less Vulnerable, More Vulnerable, Random Samples, All Patients) but never states how the test set was constructed. Appendix D then says detectors were 'trained on the less vulnerable patients and independently tested the entire set of patients and then averaged the results,' meaning the test set includes the very patients used for training. For kNN, OneClassSVM, and MAD-GAN, memorizing training instances is a real risk, so the reported 27.5% recall improvement over indiscriminate training may reflect memorization rather than a better decision boundary. This is compounded by selection circularity: the 'less vulnerable' patients were chosen by cross-checking clusters against URET attack-success rates (Section IV, Step 4), so testing on those same patients rewards the selection criterion. Appendix D asserts that testing only on the held-out more-vulnerable patients gives 'similar' rates, but no figure or table supports this, and the main Figures 7 and 8 remain ambiguous. The central claim depends on a fair out-of-sample comparison; without knowing whether training patients were in the test set, the headline recall increase is not established.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a risk profiling framework for selectively training static anomaly detectors on victim instances (patients) judged less vulnerable to evasion attacks, with the goal of reducing false negatives while retaining precision. The framework simulates a URET evasion attack, computes an instantaneous risk R_t = S * Z_t (Eq. 1), constructs patient risk profiles, hierarchically clusters the profiles, labels clusters by cross-checking against attack success percentages, and trains kNN, OneClassSVM, and MAD-GAN detectors on the less-vulnerable cluster. On an OhioT1DM blood-glucose case study, the authors report recall increases of 27.5% for kNN and 16.8% for OneClassSVM with small precision penalty, and unchanged recall for MAD-GAN at a 75% training-set reduction.","tokens_in":13462,"tokens_out":4931,"duration_ms":47860,"significance":"Selective data selection for training anomaly detectors is a practical and under-explored idea, and the risk-profiling formulation is a plausible way to identify a 'robust subset' without modifying the underlying DNN. The paper extends prior work by reproducing the URET attack on Subset A and by comparing three detectors under four training regimes. If the reported recall gains survive a clean held-out evaluation, the approach would be an inexpensive complement to dynamic defenses for safety-critical systems. However, the current evaluation protocol and the circular cluster labeling leave the central quantitative claim unsupported; the contribution is best described as a promising approach needing validation rather than an established result.","major_comments":[{"comment":"The evaluation protocol does not establish an out-of-sample test. The text says detectors were trained on the less vulnerable patients and 'independently tested the entire set of patients and then averaged the results'; this test set includes the training patients, so for kNN, OneClassSVM, and MAD-GAN, memorization of training points can inflate recall. The claim that testing only on the held-out more vulnerable patients gives 'similar' rates is asserted without a figure, table, or numeric result. Please report recall, precision, and F1 separately for (i) the less-vulnerable training patients alone, (ii) the more-vulnerable held-out patients alone, and (iii) the pooled test set, and clearly identify which of these supports the 27.5% recall-increase figure.","section":"Section IV, Step 5 / Appendix D"},{"comment":"The vulnerability labels are derived from the very attack outcomes the detectors are meant to catch. The clusters are labeled 'less vulnerable' by cross-checking with URET misclassification percentages, and the subsequent evaluation measures detection of URET adversarial samples on the same patients. This selection circularity means the reported improvement partly reflects the selection criterion rather than a general property of the resulting detector. Please validate the cluster labels on a held-out condition (e.g., a different attack budget, a different attack algorithm, or unseen patients) and justify how the method would be applied when ground-truth attack success is not available at deployment time.","section":"Section IV, Step 4"},{"comment":"The kNN detector is implemented via KNeighborsClassifier, which is a supervised classifier, not a standard anomaly detector; the paper never states what training labels are used for this classifier or what decision rule (distance threshold, k-neighborhood density, etc.) flags a test point as adversarial. Without this specification, the recall and precision values for the headline kNN result are not interpretable and cannot be compared with OneClassSVM and MAD-GAN. Please specify the detection rule and how it maps to anomaly detection.","section":"Appendix B"},{"comment":"The risk profiles and hence the less-vulnerable clusters depend on hand-picked exponential severity coefficients; Section V concedes this as a validity threat, but no sensitivity analysis is provided. Since the central selection step is driven by these coefficients, a small perturbation of Table I could change which patients fall into the less-vulnerable cluster and potentially erase the claimed 27.5% recall increase. Please report robustness of the clusters and of the downstream recall to alternative coefficient sets and to different cuts of the hierarchical clustering dendrogram.","section":"Equations (1)-(2) and Table I"}],"minor_comments":[{"comment":"Equation (1) uses 't ⊂ N'; this should be 't ∈ N' (or the intended set membership should be stated clearly).","section":"Equation (1)"},{"comment":"The dendrograms lack a distance axis and clear cluster labels; readers cannot verify the 'maximum distance' cut that produces the two-cluster split.","section":"Figure 3"},{"comment":"The box plots do not state whether they summarize per-patient or per-sample recall and precision, nor the number of replicates; please specify the aggregation unit and sample size.","section":"Figures 7, 8, and 11"},{"comment":"In the description of the target glucose model, 'Rubine-Falcone et al.' should be 'Rubin-Falcone et al.'","section":"Section III"},{"comment":"Reference [65] appears incomplete, consisting only of the text 'Hypoglycemia (low blood sugar)'; please provide full bibliographic details.","section":"References"},{"comment":"The paper uses 'indiscriminately trained on the entire dataset' without specifying whether the 'entire set' means all 12 patients or all training samples from all patients; please clarify the baseline training set.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe headline result — 27.5% recall gain from training on risk-profiled 'less vulnerable' patients — is not established by the evidence as written. The two issues that matter most are: (1) the test set appears to include training patients, and (2) the patients labeled 'less vulnerable' were chosen using the same attack-success rates the detectors are supposed to catch. Both are addressable, so my verdict is conditional, not reject.\n\nWhat's genuinely new is the framing: use victim risk profiles (built from attack simulation, a hand-crafted risk formula, and hierarchical clustering) to selectively train static anomaly detectors. The application to a blood glucose management system with the OhioT1DM dataset is concrete, and the observation that different patients have very different vulnerability to the same evasion attack is real. The authors are also honest about some weaknesses — Section V admits the severity coefficients are hand-chosen and need sensitivity analysis, and Appendix D concedes more testing is needed.\n\nThe soft spots are concentrated in the evaluation. Step 5 describes four training subsets but never states how the test set was constructed. Appendix D says detectors were 'trained on the less vulnerable patients and independently tested the entire set of patients' — that includes the training patients, which for kNN and OneClassSVM makes memorization a real threat. The appendix then claims that a held-out set of only more-vulnerable patients gave 'similar' rates, but no numbers or figure back that up. That's a load-bearing gap. The selection circularity compounds it: the risk profiles are validated against URET misclassification percentages, so selecting 'less vulnerable' patients and then testing on those same patients rewards the selection criterion. One minor point: the kNN detector is implemented with KNeighborsClassifier, not an anomaly-detection setup, and its decision rule for flagging anomalies is unspecified. The severity coefficients in Table I are plausible, but a sensitivity analysis is needed before trusting the clusters.\n\nIf the authors can rerun with a clean held-out split and show the recall gain survives out-of-sample, the paper has a solid contribution. As it stands, the central claim is plausible but unproven.\n\nFor peer review: I'd send it to a serious referee. The flaws are fixable, and the idea deserves a careful look. I wouldn't cite it yet.\n\nThat's my read.","headline":"A plausible risk-profiling idea for training static anomaly detectors, but the headline recall gain rests on an evaluation protocol that likely includes training patients in the test set, so the central claim is not yet established.","tokens_in":13923,"tokens_out":1971,"would_cite":false,"duration_ms":19115,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A risk-profiling framework selects resilient patients to train anomaly detectors, lifting recall by up to 27.5%.","keywords":["evasion attacks","anomaly detection","risk profiling","selective training","blood glucose management","deep neural networks","false negatives","recall"],"falsifier":"Train the same three anomaly detectors on the 'less vulnerable' patients identified using a different severity-coefficient set (e.g., linear coefficients or values from a clinician) and a different clustering threshold; if the recall gain over indiscriminate training disappears or reverses, the result is an artifact of the specific coefficient and clustering choices rather than of vulnerability-based selective training.","tokens_in":12980,"feed_emoji":"🩺","tokens_out":4377,"duration_ms":38062,"temperature":0.7,"pith_summary":"The paper proposes a risk profiling framework that decides which data to use when training static anomaly detectors against evasion attacks on deep neural networks. Instead of training on all available instances, it simulates the attack, scores each victim's exposure over time, clusters victims by vulnerability, and trains the detector only on the least vulnerable ones. On a blood glucose management system for Type-1 diabetes, this selective training raises recall (true attack detection) by up to 27.5% for kNN and 16.8% for OneClassSVM over indiscriminate training, with little or no precision loss. The authors argue this matters because in safety-critical settings false negatives (missed attacks) can be life-threatening, so even a modest recall gain is worth pursuing.","feed_headline":"Training on resilient patients boosts attack recall by 27.5%","feed_subtitle":"Risk-profiled selective training cuts missed attacks in glucose-DNN defenses with minimal precision loss.","key_machinery":"The central object is the risk profile, a time series of instantaneous risk values $R_t = S * Z_t$, where $Z_t$ is the squared difference between benign and adversarial glucose predictions and $S$ is a hand-assigned severity coefficient for the state transition (e.g., hypoglycemia to hyperglycemia gets 64). These profiles are computed for every patient, then clustered with hierarchical clustering to separate 'less vulnerable' from 'more vulnerable' victims. The framework's final step trains existing anomaly detectors (kNN, OneClassSVM, MAD-GAN) only on the data of the less-vulnerable cluster. The risk profile and clustering carry the argument because they identify which instances the defense should learn from.","core_discovery":"The central discovery is that training static anomaly detectors on the instances least vulnerable to a specific evasion attack improves their ability to catch that attack, compared with training on the full dataset. The paper demonstrates this on the OhioT1DM blood glucose dataset using the URET attack: patients whom the risk framework labels 'less vulnerable' produce detectors with recall increases of 27.5% (kNN), 16.8% (OneClassSVM), and unchanged perfect recall for MAD-GAN at 75% less training data. The authors interpret this as evidence that less vulnerable instances better represent typical benign data, so detectors learn to distinguish benign from malicious abnormalities.","pith_inferences":["The same selective-training principle could apply beyond healthcare: any static detector facing evasion attacks in cyber-physical systems (e.g., autonomous driving) might benefit from profiling instances for vulnerability and training on the most typical ones.","The paper validates its clusters against the very attack success rates the defense is meant to detect; a cleaner future test would profile with one attack and evaluate with a different attack, to see whether the identified 'less vulnerable' instances generalize.","If the risk coefficients are clinician-specified, the framework could become a practical tool for personalized medicine, where each patient's physiology determines their training weight.","The reported recall gains might partly reflect a decrease in training-set noise rather than vulnerability per se; an ablation that trains on random small subsets of equal size would isolate the effect of the risk-based selection."],"forward_implications":["Static anomaly detectors can become more adaptable to evolving attacks without the computational cost of dynamic defenses, by retraining on freshly profiled low-risk instances.","In safety-critical medical settings, reducing false negatives through selective training may prevent missed attack detections that could lead to insulin overdose or underdose.","Training on a smaller, curated subset can cut training cost and data requirements; the MAD-GAN result shows maintained recall with a 75% reduction in training-set size.","The framework's reliance on attack simulation means the selected 'less vulnerable' instances are attack-specific, so the defense is tied to the threat model used in profiling."],"supporting_citations":[{"why":"Prior work by the authors that simulated the URET attack on the same dataset and reported per-patient attack success rates; the paper extends those results and uses them to label vulnerability clusters.","marker":"[49]"},{"why":"The URET (Universal Robustness Evaluation Toolkit) evasion attack framework that generates the adversarial glucose manipulations used throughout the evaluation.","marker":"[55]"},{"why":"The OhioT1DM dataset of 12 Type-1 diabetes patients that provides all training and testing data for the case study.","marker":"[47]"},{"why":"The bidirectional LSTM blood-glucose prediction model used as the target DNN that the evasion attack tries to deceive.","marker":"[48]"},{"why":"MAD-GAN, one of the three anomaly detectors evaluated; also supplies the anomaly-detection baseline method for multivariate time series.","marker":"[31]"}],"fun_headline_variants":["Training on resilient patients lifts attack recall 27.5%","Curated patient selection improves evasion attack recall by 27.5%","Risk-aware training data boosts DNN defense recall 27.5%","Choosing less vulnerable patients for training lifts attack recall 27.5%","Safety-critical DNN defense: selective training ups recall 27.5%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The hand-picked exponential severity coefficients and the hierarchical clustering cut decide which patients are called 'less vulnerable,' and the entire recall improvement depends on those choices marking out the same patients that are actually hardest to attack.","fun_headline_variants_meta":{"raw":{"variants":["Training on resilient patients lifts attack recall 27.5%","Curated patient selection improves evasion attack recall by 27.5%","Risk-aware training data boosts DNN defense recall 27.5%","Choosing less vulnerable patients for training lifts attack recall 27.5%","Safety-critical DNN defense: selective training ups recall 27.5%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001165,"raw_usage":{"total_tokens":4798,"prompt_tokens":900,"completion_tokens":3898,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":516,"completion_tokens_details":{"reasoning_tokens":3803}},"tokens_in":516,"tokens_out":3898,"duration_ms":24170,"temperature":1.0,"reasoning_tokens":3803,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:41:43.303928+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same three anomaly detectors on the 'less vulnerable' patients identified using a different severity-coefficient set (e.g., linear coefficients or values from a clinician) and a different clustering threshold; if the recall gain over indiscriminate training disappears or reverses, the result is an artifact of the specific coefficient and clustering choices rather than of vulnerability-based selective training.","supporting_citations":[{"cited_title":"Systematically Assessing the Security Risks of AI/ML-enabled Connected Healthcare Systems","cited_arxiv_id":"2401.17136","evidence_quote":"Prior work by the authors that simulated the URET attack on the same dataset and reported per-patient attack success rates; the paper extends those results and uses them to label vulnerability clusters."},{"cited_title":"URET: Universal Robustness Evaluation Toolkit (for Evasion)","cited_arxiv_id":null,"evidence_quote":"The URET (Universal Robustness Evaluation Toolkit) evasion attack framework that generates the adversarial glucose manipulations used throughout the evaluation."},{"cited_title":"The ohiot1dm dataset for blood glucose level prediction: Update 2020","cited_arxiv_id":null,"evidence_quote":"The OhioT1DM dataset of 12 Type-1 diabetes patients that provides all training and testing data for the case study."},{"cited_title":"Deep Residual Time- Series Forecasting: Application to Blood Glucose Prediction","cited_arxiv_id":null,"evidence_quote":"The bidirectional LSTM blood-glucose prediction model used as the target DNN that the evasion attack tries to deceive."},{"cited_title":"Mad-gan: Multivariate anomaly detection for time series data with generative adversarial networks","cited_arxiv_id":null,"evidence_quote":"MAD-GAN, one of the three anomaly detectors evaluated; also supplies the anomaly-detection baseline method for multivariate time series."}],"review_version":1}