{"id":"12bcab8c-014f-42f9-a866-62ecaa836dc9","arxiv_id":"2505.08255","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A trigger generator creates invisible, passcode-controlled, sample-adaptive backdoors that compromise deepfake detectors under both dirty-label and clean-label poisoning.","lead":"A new backdoor attack can secretly poison deepfake detectors by embedding passcode-controlled trigger patterns into training data. The attack reaches high success on multiple detector architectures while keeping clean accuracy, so it changes how much trust to place in shared training datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Passcode-controlled behavior is only demonstrated with a 50% auxiliary trigger set; without a D_aux=0 ablation, the 'irreproducible without passcode' claim may be an artifact of the auxiliary data, and the true poisoning burden is understated.","rationale":"The reader's conditional verdict is fair: the same-distribution results in Tables 1-2 and 5-8 support the existence of an effective poisoning attack, and Fig. 8's 0% poisoning point provides the crucial control showing that clean detectors do not already surrender to the trigger. I do not see an internal inconsistency that would require rejection. The most load-bearing uncertainty is about the provenance of the passcode-controlled property. The paper presents D_aux as necessary to associate triggers with the passcode, but never ablates D_aux to zero; all reported passcode-selective ASR numbers come with a 20-70% auxiliary set. Since D_aux is excluded from the poisoning rate, the 'low prevalence' claim in Sec. 3.1 is also not established. A simple ablation settles both questions. This strengthens the case for CONDITIONAL rather than changing the verdict, so I recommend UNCHANGED. Other issues (no code, no error bars, blur sensitivity) are already reflected in the reader's moderate confidence; they are secondary to the passcode-control ablation.","tokens_in":14360,"tokens_out":19346,"duration_ms":206867,"concrete_test":"Retrain the victim detector on the poisoned set with D_aux = 0 (and, as a secondary point, D_aux = 10%), keeping D_s, the trigger generator, and all other settings identical; measure ASR on the same test set for the correct passcode p and for wrong passcodes p'_alpha, p'_beta, p'_gamma. Also report the total fraction of modified training samples (D_s plus D_aux). If wrong-passcode ASR rises substantially as D_aux shrinks, the passcode-control property is an artifact of the auxiliary set, and the 'irreproducible without passcode' and low-prevalence claims must be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's main novelty over PFF is the passcode-controlled trigger: the abstract and Sec. 3.2 claim that, even if the generator is exposed, triggers cannot be reproduced without the passcode. The mechanism that produces this property, however, is not isolated. In Sec. 3.3, the authors introduce D_aux, a set of samples with triggers generated from random passcodes but with true labels, and state that 'the inclusion of D_aux allows Deepfake detectors to better associate the triggers with the passcode.' Main experiments use D_aux = 50% of one class (Sec. 4.2), while the reported poisoning rate counts only D_s (10%). Fig. 6 varies D_aux from 20% to 70% but never tests D_aux = 0. If, without D_aux, wrong-passcode triggers also activate the backdoor, then the passcode-control property is not intrinsic to the generator; it is taught to the victim by a large auxiliary set whose size is excluded from the poisoning rate. That would also undermine the 'low prevalence' stealthiness goal (Sec. 3.1), since 10% poisoned + 50% auxiliary-triggered means 60% of one class is altered. This is the load-bearing gap for the central security claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a backdoor attack against deepfake detectors. The attacker is a third-party data provider who poisons training data with a trigger generator that produces invisible, sample-adaptive, passcode-controlled triggers. The authors consider dirty-label and clean-label poisoning scenarios, and claim high attack success rate with the correct passcode, near-zero success with wrong or similar passcodes, preserved benign accuracy, generalizability across datasets and architectures, and resistance to several backdoor defenses. Experiments are performed on FF++, Celeb-DF, and DFDC with four base networks (ResNet50, EfficientNet-b4, DenseNet, MobileNet) and four deepfake detectors (F3Net, SRM, NPR, FG), comparing against six backdoor attack baselines.","tokens_in":14613,"tokens_out":5533,"duration_ms":51080,"significance":"If the passcode-control property holds, the paper is a meaningful advance over PFF: it is the first to make trigger reproduction contingent on a secret even if the generator is exposed. The threat model is realistic and the experimental scope is broad, covering multiple datasets, architectures, and defense baselines. The paper also honestly discloses a limitation (blur fragility). However, the central claim is not yet fully supported because the passcode-control behavior is not tested without the auxiliary set Daux, leaving the novelty insufficiently isolated.","major_comments":[{"comment":"The passcode-controlled behavior is demonstrated only with Daux=50% (or other nonzero values in Fig. 6). No Daux=0 ablation is provided, so it is unclear whether the near-zero ASR for wrong passcodes in Tables 1-2 is intrinsic to the generator or learned by the victim from the 50% auxiliary-triggered samples. The text in §3.3 says Daux is included to 'better associate the triggers with the passcode,' which suggests the property is not intrinsic. This is load-bearing for the abstract and §3.2 claim that 'valid triggers cannot be produced without knowing the specific passcode.' Additionally, the reported poison rate counts only Ds (10% of one class), while 50% of the same class is altered with auxiliary triggers, so the true fraction of altered training data is 60% of that class; the low-prevalence goal in §3.1(d) is therefore not measured as claimed.","section":"§3.3, Sec. 4.2, Fig. 6"},{"comment":"All experiments are reported as single numbers with no standard deviations across seeds. Since the paper's central claim is empirical superiority over baselines, the absence of variance estimates makes it impossible to assess whether differences such as Ours 96.62% vs. Blended 95.81% in Table 5 are significant. Please report mean±std over at least three independent training runs, or justify why the observed differences are robust.","section":"§4.2, Tables 1-8, Fig. 8"},{"comment":"The trigger's ASR falls to near zero under Gaussian blur with radius 11. The paper dismisses blur as unlikely in practice, but blur is a standard image operation and a simple defense. This conflicts with the 'Trigger sustainability' goal in §3.1 and the 'practicality' claim in the conclusion. Please provide a more quantitative discussion of the operational scenarios where blur would or would not be applied, or soften the sustainability claim.","section":"§4.3, Fig. 7"}],"minor_comments":[{"comment":"Sec. 4.1 states 'The poison rate is set to 5%' with a footnote that 10% of one class is poisoned in the main experiment. This is contradictory; clarify the exact poison rate used in each experiment.","section":"Sec. 4.1"},{"comment":"Sec. 4.1 says the input passcode is a 100-bit binary string, but Sec. 4.2 uses examples like '123' and '124'. Explain how string passcodes are encoded into the 100-bit representation.","section":"Sec. 4.1 and Sec. 4.2"},{"comment":"References [36] and [37] are the same paper (Qian et al., 'Thinking in frequency'); merge them.","section":"References"},{"comment":"No code or trained models are released, which limits reproducibility of the attack. Please consider releasing code or a detailed pseudocode of the trigger generator and poisoning pipeline.","section":"Availability"},{"comment":"In Table 5, the average row is computed over four detectors (ResNet, EfficientNet, F3Net, SRM), but the paper also evaluates MobileNet, DenseNet, NPR, FG elsewhere. Clarify why only four are used for comparison with baselines.","section":"Table 5"}],"recommendation":"major_revision","confidential_remarks":"The paper is well-written and the attack scenario is timely. The main issue is the missing Daux=0 control; without it, the passcode-control claim is not established. The authors should also address the lack of variance reporting and the code release concern. I believe these are fixable within a major revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper you asked about is worth your time. It attacks deepfake detectors at the training-data supply chain, which is a realistic and underexplored risk. The genuinely new bit is a trigger generator that maps a passcode string to a sample-adaptive invisible trigger, with an auxiliary set of wrong-passcode triggers used to teach the victim detector to only respond to the correct passcode. For clean-label poisoning they add a representation-suppression objective using a surrogate detector, which lifts ASR from roughly 85% to 96%. The experiments are broad: three datasets, four base networks, four dedicated detectors, plus comparisons to six backdoor baselines and four defenses. That is a solid empirical package.\n\nThe soft spots are real but not fatal if addressed. The big one: the \"cannot be reproduced without passcode\" property is only demonstrated with D_aux set to 50% of a class. Without a D_aux=0 ablation, the property might simply be taught by the auxiliary set, not intrinsic to the generator. And 50% auxiliary-triggered samples plus 10% poisoned samples means 60% of one class is altered, which contradicts the \"low prevalence\" goal in their own threat model. The paper mentions D_aux in Sec. 3.3 but never isolates its contribution. A referee should demand that ablation.\n\nSecondary issues: no code, no error bars across seeds, and single numbers throughout. The blur sensitivity is acknowledged in the limitations, and their argument that heavy blur degrades image quality is fair, but it weakens the practical sustainability claim. There is also a confusing inconsistency between \"poison rate 5%\" in the implementation details and \"10% of real images\" in the main experiments. The title oversells the result somewhat; the threat model assumes a victim trains naively on poisoned data without effective sanitization. That is a standard assumption in backdoor work, so I would not call it a flaw, just a scope limitation.\n\nFor a reader, this is a useful paper because it surfaces a supply-chain risk and gives a concrete, well-tested attack that raises the bar over PFF. It deserves a serious referee, with the D_aux ablation as the key condition. I would not cite it as a definitive proof that detectors cannot be trusted, but I would cite it as evidence that dataset poisoning is a live threat in face forensics.\n\nRecommendation: send it to review, but insist on the ablation and error bars before acceptance.","headline":"A well-executed backdoor attack on deepfake detectors with a genuinely new passcode-control idea, but the central claim about irreproducible triggers rests on an unablated auxiliary set.","tokens_in":15144,"tokens_out":3811,"would_cite":true,"duration_ms":35038,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Deepfake detectors can be silently backdoored by poisoned third-party training data, and a new trigger generator makes the backdoor passcode-protected, adaptive, and invisible.","keywords":["deepfake detection","backdoor attack","data poisoning","clean-label poisoning","trigger generation","passcode control","third-party dataset","representation suppression"],"falsifier":"Train the same detectors on the same poisoned dataset after running a standard poison filter such as activation clustering or spectral signature; if the attack success rate falls to near chance, the central claim that ordinary training on contaminated third-party data installs the backdoor collapses.","tokens_in":14140,"feed_emoji":"🎭","tokens_out":5860,"duration_ms":52341,"temperature":0.7,"pith_summary":"This paper argues that the standard practice of training deepfake detectors on third-party face datasets carries a hidden security risk: if the data provider quietly poisons even a small fraction of the data, the resulting detector is permanently backdoored. The authors build a trigger generator that stamps face images with invisible, sample-adaptive patterns derived from a secret passcode, and show that detectors trained on these poisoned sets classify any trigger-bearing face as the attacker's chosen label while behaving normally on clean faces. They demonstrate both dirty-label and clean-label poisoning across four base networks and four dedicated detectors, reporting attack success rates near 90-100% with benign accuracy nearly unchanged. The implications for the forensics community are direct: dataset provenance becomes a first-class security concern.","feed_headline":"Poisoned data can backdoor any deepfake detector","feed_subtitle":"Passcode-locked invisible triggers make poisoned faces pass detectors trained on contaminated data.","key_machinery":"The load-bearing mechanism is a U-Net encoder-decoder trigger generator trained with three objectives: a distance loss ($\\ell_2$ and LPIPS) to keep the trigger invisible, a recovery loss that requires a small decoder to recover the passcode string from the poisoned image (this makes the trigger usable only with the correct passcode), and, for the clean-label scenario, a suppression loss that uses a pre-trained surrogate deepfake detector to force poisoned samples to be classified as the opposite label. Auxiliary samples with random passcodes are added to the poisoned set so the detector learns to associate only the correct passcode with the target label. This machinery turns a generic backdoor into a secret, sample-specific, keyed trigger.","core_discovery":"The central claim is that deepfake detectors, despite their accuracy, are vulnerable to a training-phase backdoor attack that does not require any access to the detector's architecture, weights, or training procedure. By injecting a small poisoned set into a third-party dataset, an attacker can install a trigger that forces misclassification to a target label. The paper's specific contribution is a trigger generator that makes the injected pattern passcode-controlled (the trigger only activates when the correct binary passcode is embedded), adaptive (each image gets its own subtle pattern), invisible to the eye, and, in the clean-label setting, representation-suppressing—using a surrogate detector to push poisoned faces toward the opposite class so that the association between trigger and target label becomes learnable even when the label is unchanged. Experiments across four base models and four published detectors show high attack success while original accuracy is preserved, and the trigger survives standard backdoor defenses.","pith_inferences":["A cheap and possibly effective defense is suggested by the paper's own robustness data: applying mild Gaussian blur (radius around 11) before classification destroys the trigger's effect while degrading image quality little, so pre-processing could neutralize this attack class.","The representation-suppression trick may transfer to other binary forensic classifiers (e.g., image provenance or synthetic-text detection) that rely on third-party data, widening the attack surface beyond faces.","The reliance on a surrogate detector implies a testable bound: if the victim's internal representation cannot be suppressed by the chosen surrogate (e.g., an adversarially trained or self-supervised encoder), attack success should drop; measuring transfer across more diverse architectures would map the true threat scope.","If this attack model becomes accepted, dataset marketplaces will need to ship signed data or provide cryptographic provenance, since the trigger is invisible and survives defenses."],"forward_implications":["If third-party data is the training source, a malicious provider can install a permanent backdoor that survives standard training and even some fine-tuning and pruning defenses.","Passcode control means that even if the trigger generator is leaked, attackers without the passcode cannot reproduce a working trigger, so defensive random trigger probing fails.","The attack works in both dirty-label and clean-label forms; clean-label is more dangerous because the labels are consistent with the image content, making human inspection of the training set useless.","Because the trigger is adaptive and invisible, existing visual sanity checks and quality metrics (PSNR, SSIM, FID) do not reliably flag poisoned training samples.","The backdoor generalizes across datasets: a trigger generator trained on FaceForensics++ works on Celeb-DF and DFDC."],"supporting_citations":[{"why":"supplies the U-Net encoder-decoder steganography architecture used to embed invisible triggers in images.","marker":"[44]"},{"why":"defines the backdoor attack paradigm that the paper adapts to deepfake detectors.","marker":"[12]"},{"why":"provides the invisible sample-specific trigger baseline whose passcode and clean-label weaknesses the paper addresses.","marker":"[26]"},{"why":"is the closest prior work on backdoor attacks against face forgery detection, which the paper extends with passcode control and clean-label analysis.","marker":"[29]"},{"why":"is a visible-trigger backdoor baseline used for comparison in the clean-label evaluation.","marker":"[4]"},{"why":"FaceForensics++ is the primary dataset on which trigger generation and victim detectors are trained.","marker":"[39]"},{"why":"Celeb-DF serves as the cross-dataset target for generalizability tests of the trigger.","marker":"[25]"}],"fun_headline_variants":["Passcode-locked triggers can backdoor any deepfake detector","Invisible passcode triggers make deepfake detectors fail","Backdoor deepfake detectors with poisoned third-party data","Passcode-locked invisible triggers backdoor deepfake detectors"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes the victim trains on the poisoned dataset with standard configurations and no data sanitization, and that the surrogate detector used to suppress representations transfers to the unknown victim detector.","fun_headline_variants_meta":{"raw":{"variants":["Passcode-locked triggers can backdoor any deepfake detector","Invisible passcode triggers make deepfake detectors fail","Backdoor deepfake detectors with poisoned third-party data","Passcode-locked invisible triggers backdoor deepfake detectors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000852,"raw_usage":{"total_tokens":3705,"prompt_tokens":946,"completion_tokens":2759,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":562,"completion_tokens_details":{"reasoning_tokens":2702}},"tokens_in":562,"tokens_out":2759,"duration_ms":19632,"temperature":1.0,"reasoning_tokens":2702,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:58:19.894442+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same detectors on the same poisoned dataset after running a standard poison filter such as activation clustering or spectral signature; if the attack success rate falls to near chance, the central claim that ordinary training on contaminated third-party data installs the backdoor collapses.","supporting_citations":[{"cited_title":"Faceforen- sics++: Learning to detect manipulated facial images","cited_arxiv_id":null,"evidence_quote":"FaceForensics++ is the primary dataset on which trigger generation and victim detectors are trained."},{"cited_title":"Celeb-df: A large-scale challenging dataset for deep- fake forensics","cited_arxiv_id":null,"evidence_quote":"Celeb-DF serves as the cross-dataset target for generalizability tests of the trigger."}],"review_version":1}