{"id":"62bb6315-4d86-4b8c-9b8d-1f4196d20d8c","arxiv_id":"2506.22722","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"UniGuard detects both adversarial examples and backdoor-triggered inputs at inference time by treating each input's layer-by-layer path as a time series and flagging anomalies.","lead":"This paper introduces UniGuard, a detector that watches how inputs move through a deep learning model's layers and flags unusual 'trajectories' as either adversarial examples or backdoor triggers. It reports detection rates above 96 percent across images, audio, text, and regression tasks while keeping false alarms near one percent.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central premise conflates per-sample deviation with deviation from the benign trajectory manifold; a backdoor that mimics a benign target-class trajectory would fulfill the attack objective yet evade UniGuard's one-class detector.","rationale":"The reader's weakest assumption concerned the LSTM/UMAP compressor preserving the subtle trajectory signal. While that is a real generalization risk, the deeper load-bearing issue is the paper's own theoretical premise: the claim that an adversarial trajectory must deviate from its benign counterpart is insufficient to guarantee detectability by a one-class detector, which requires deviation from the entire benign trajectory distribution. A backdoor attacker with training control can steer trigger-carrying samples toward the target-class benign manifold, satisfying the attack objective while remaining inside the normal region. This is not a point about consensus; it is an internal logical gap: §III-B trains Deep SVDD on benign spectra only, and §VI-A's adaptive attack constrains against the wrong reference (the source sample). The concrete test would settle whether such target-class mimicry actually evades detection. If it does, the central 'unified for all attacks' claim collapses. If it does not, the empirical evidence remains strong. The paper's own Limitations section concedes the lack of theoretical proof, but the concern here is stronger than absence of proof: there is a constructive attack strategy that directly contradicts the stated necessity. Therefore the CONDITIONAL verdict stands, but the required condition should include evaluating this target-class mimicry adaptive attack.","tokens_in":28362,"tokens_out":8087,"duration_ms":84523,"concrete_test":"On CIFAR10/ResNet18 with the SSDT partial backdoor, train an adaptive backdoored model with an additional loss term enforcing Dist(z(x_t), z(y)) < threshold for y a benign sample of the target class, while preserving ASR; then evaluate UniGuard at preset FRR 1% and 5%. If ASR remains high (e.g., >90%) and UniGuard's detection accuracy drops to near the preset FRR (i.e., no detection beyond the false-alarm rate), the trajectory-premise is falsified. If instead detection stays high, the concern is refuted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing premise (Abstract, §I) states that an adversarial input's propagation trajectory 'must deviate from that of its benign counterpart; otherwise, the adversarial objective cannot be fulfilled.' But UniGuard's detector is a one-class Deep SVDD trained on benign trajectories only (§III-C4), so what matters is deviation from the benign trajectory manifold, not from the specific source-class counterpart. These are different. A backdoor attacker who controls training can impose a loss term enforcing that a trigger-carrying sample x_t from the source class has the same LSTM bottleneck z(x_t) as a benign sample y of the target class, while still training the model to classify x_t as the target. The attack objective is then fulfilled and the trajectory lies inside the benign manifold, so the spectrum fed to Deep SVDD is accepted. The paper's adaptive attack (§VI-A) constrains z(x_t) to match z(x) for the same source sample x and observes a detection drop to ~89%; matching a benign target-class sample is the more natural evasion for a one-class detector and is not tested. Hence the 'must deviate' claim is not merely unproven but false in an important case, and the central claim of universal unified detection is not established.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes UniGuard, an online per-sample detector that aims to detect both adversarial examples and backdoor-triggered inputs by analyzing the layer-wise propagation trajectory of an input through the model. The trajectory is compressed via UMAP and an LSTM autoencoder, transformed with FFT, and scored by a Deep SVDD one-class classifier trained only on benign trajectories. The paper claims this is the first unified online detection framework for both threat families across image, text, and audio modalities and across classification and regression tasks, and reports high detection accuracy on a wide range of AE and backdoor attacks, outperforming ContraNet and TED.","tokens_in":28644,"tokens_out":9497,"duration_ms":99818,"significance":"If the central premise holds—that any successful adversarial or backdoor input must deviate from the benign trajectory manifold—UniGuard would be a significant contribution: a single, modality- and task-agnostic online detector. The paper includes a valuable ablation showing the LSTM autoencoder is essential, an explicit statement of the limitation that no theoretical proof is provided (§VII-F), and a broad evaluation suite. However, the central premise is not proven and is challenged by the paper's own adaptive attack, which can produce successful backdoor inputs with the compressed trajectory close to a benign counterpart. The most natural adaptive attack against a one-class detector—matching a benign target-class trajectory—is not evaluated. The statistical basis of the empirical claims is also thin, with no error bars and small test sets in key cells. The framework is promising, but the universal-detection claim is not yet established.","major_comments":[{"comment":"The paper's load-bearing premise is that 'the propagation trajectory of the adversarial sample must deviate from that of its benign counterpart; otherwise, the adversarial objective cannot be fulfilled.' UniGuard's Deep SVDD (§III-C4) is trained only on benign trajectories, so the operative quantity is deviation from the benign trajectory manifold, not from the specific source-sample trajectory. A backdoor attacker who controls training can impose a loss that makes the LSTM bottleneck z(T(x)) close to z(y) for a benign sample y of the target class while still training the model to classify T(x) as the target; the attack objective is then fulfilled and the trajectory lies inside the benign manifold. The adaptive attack in §VI-A only constrains z(x_t) to match z(x) for the same source sample x (distance threshold 1.2e-5) and observes detection dropping to 89.35% at 5% FRR; this already demonstrates that a successful backdoor can have a compressed trajectory essentially equal to a benign counterpart, contradicting the necessity claim. The target-class matching attack is the natural evasion for a one-class detector and is not tested, so the central claim of universal unified detection is not established.","section":"Abstract, §I, §III-C4, §VI-A"},{"comment":"Tables I through V report single-run point estimates with no error bars, confidence intervals, or repeated runs. Several key cells rest on small sample sizes: the Boundary attack produces only 144 successful adversarial examples (§IV-C2), and the SSDT backdoor evaluation uses 1,000 trigger-carrying samples from a single class (§IV-C1). The paper's claims of consistently >99% detection and consistent superiority over SOTAs require a statistical evaluation; report mean±std over multiple runs or bootstrap intervals, and state the test-set size for every cell.","section":"§IV-C, Tables I-V"},{"comment":"Section VII-A shows that removing the LSTM autoencoder collapses detection accuracy to 1.8%, so the two-stage compression pipeline (UMAP plus LSTM autoencoder) is doing essentially all of the work. However, the paper does not analyze whether this compressor, trained only on benign trajectories, preserves the subtle adversarial-vs-benign differences for attacks outside the evaluated set. The stated requirement RM4 (§I) is attack-strategy agnosticism, which demands transfer to unseen attacks; the current evaluation covers only known attack families. Provide a hold-out-family evaluation or a quantitative analysis of compression error on benign versus adversarial trajectories to support the transfer claim.","section":"§III-C2, §VII-A"}],"minor_comments":[{"comment":"Section IV-F and the captions of Figures 5-8 contain corrupted placeholder strings (e.g., '/uni0000002d/uni00000036/...') that must be cleaned; as printed, the paper is not readable in those spots.","section":"§IV-F, Figures 5-8"},{"comment":"Section VII-B uses 'FPR' where the metric is defined as 'FRR' (Section IV-B); unify the terminology throughout the paper.","section":"§VII-B"},{"comment":"In Table III, the Boundary attack row reports 100.0% detection for several cells despite a test set of only 144 samples; include the sample size in the table or note the limitation in the text.","section":"Table III"},{"comment":"The 'trajectory spectrum' concept is attributed to the authors' own Ref. [74] (NDSS'25); please clarify the incremental contribution of UniGuard relative to that prior work, since the detection pipeline appears to reuse the same concept.","section":"§I and Ref. [74]"}],"recommendation":"major_revision","confidential_remarks":"The editor may wish to verify the novelty disclosure around Ref. [74]: the paper's core concept is cited to the authors' own NDSS'25 paper, and the 'first unified framework' claim should be checked against that prior work and any concurrent submissions. The manuscript also has corrupted text in several figures (Section IV-F) that would need to be fixed before production."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth a serious look. It builds a single online detector for adversarial examples and backdoor triggers from the same layer-wise trajectory features, and it shows the idea works across image, audio, text, and regression. That is genuinely new, and the evaluation is broad: five backdoor settings, seven AE attacks, comparison with ContraNet, TED, and NIC, plus ablations. The ablation where removing the LSTM autoencoder drops detection to 1.8% is telling: the temporal compression is doing real work, not the UMAP or the FFT alone. Adaptive attacks are considered, which is more than most detection papers do. The limitations section is honest that a theoretical proof is open.\n\nThe soft spots are real but not fatal. No code is released (promised 'upon publication'), there are no error bars or repeated runs, and some cells are tiny—the boundary attack uses 144 successful AEs, so a single misclassified sample moves the number by well under a point. The 'must deviate' premise in the abstract is too strong. What matters for the one-class Deep SVDD is deviation from the benign trajectory manifold, not from the source-class counterpart. The adaptive attack section constrains z(x_t) to match z(x) for the same source sample; the natural evasion for a one-class detector is to match a benign target-class sample z(y), which would place the trigger-carrying input inside the benign manifold while still flipping the label. That attack is not tested. So the central claim that trajectory divergence is unavoidable does not hold in an important case. The authors should either test this attack or weaken the claim.\n\nThe paper also needs to position itself more sharply against the authors' own prior trajectory-spectrum work (Ref [74]); right now the reader has to guess how online AE/backdoor detection differs from offline poison detection beyond the application setting.\n\nWho is this for? Anyone building or evaluating input-level defenses for deep learning. It is a solid empirical contribution with an overclaimed rationale. It deserves peer review, not a desk reject, but it needs code, error bars, and a stronger adaptive evaluation before it is citable as a robust unified detector.\n\nRecommendation: send to review, major revision, with the target-class mimicry attack explicitly addressed.","headline":"Unified online detection of AEs and backdoors via layer-wise trajectory analysis is a real and useful contribution, but the 'must deviate' premise is overstated and the adaptive evaluation misses an obvious target-class mimicry attack.","tokens_in":29149,"tokens_out":3006,"would_cite":true,"duration_ms":67255,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"By reading the layer-by-layer propagation trajectory of each input, a single detector can flag both adversarial examples and backdoor-triggered samples at inference time.","keywords":["adversarial example detection","backdoor attack detection","online detection","propagation trajectory","LSTM autoencoder","Deep SVDD","time-series signal processing","modality-agnostic"],"falsifier":"Fix a model and dataset (for example, ResNet18 on CIFAR-10), pick one AE attack such as PGD, and add a penalty that keeps the LSTM-bottleneck vector or its FFT spectrum inside the benign training distribution. If such constrained attacks reach a high success rate, above 90%, while the detector flags them less than half the time, the trajectory-divergence claim is empirically falsified.","tokens_in":28175,"feed_emoji":"🛡️","tokens_out":7592,"duration_ms":75362,"temperature":0.7,"pith_summary":"This paper claims that adversarial examples and backdoor attacks can be caught by the same online detector, because both must bend an input's internal path through a model. As an input passes layer by layer, an adversarial sample — whether perturbed to fool the model or stamped with a backdoor trigger — must at some point diverge from what its benign counterpart would trace; otherwise it could not change the model's behavior. UniGuard turns that divergence into a detection signal by treating the layer-wise trajectory as a time series, compressing it with an LSTM autoencoder, transforming it into the frequency domain, and running a one-class anomaly detector trained only on benign trajectories. The authors argue this is the first framework that handles both threat families at once, across image, text, and audio, and for both classification and regression, while beating single-threat state-of-the-art detectors even on their own attack types.","feed_headline":"Trajectory reading catches adversarial and backdoor inputs","feed_subtitle":"Trained only on benign samples, one online detector beats single-purpose defenses on image, text, audio, and regression.","key_machinery":"The central object is the propagation trajectory: the sequence of latent representations a test input produces as it moves through the model's layers, treated as a time-series signal. UniGuard processes it in four stages: per-layer UMAP reduction to a common dimension, an LSTM encoder-decoder that compresses the sequence into a bottleneck vector $z$ and is trained only on benign samples, a Fast Fourier Transform that moves $z$ into the spectral domain, and a Deep SVDD one-class classifier that fits a hypersphere around benign spectrums. The ablation makes the load-bearing part explicit: removing the LSTM autoencoder drops detection accuracy on the hardest backdoor (SSDT) to 1.8% at a 1% preset FRR, while keeping it yields 99.02%.","core_discovery":"The load-bearing claim is that the propagation trajectory of an adversarial sample must deviate from that of its benign counterpart; otherwise the adversarial objective cannot be fulfilled. UniGuard turns that claim into a detector. It records the latent activation of each layer for a small set of benign samples, reduces each layer's activations with UMAP, feeds the sequence into an LSTM autoencoder to obtain a compact bottleneck vector, applies a Fast Fourier Transform to that vector, and trains a Deep SVDD hypersphere on the resulting benign spectrums. At inference, any input whose spectrum falls outside the hypersphere is rejected, whether the manipulation was an adversarial perturbation or a backdoor trigger. The authors report detection accuracy above 96% at a 1% preset false-rejection rate across seven AE attacks and five backdoor types, and they show that the single-purpose baselines ContraNet and TED each fail on some attacks while UniGuard succeeds on all of them, including on text, audio, and regression tasks.","pith_inferences":["If the trajectory-divergence principle generalizes, it should also apply to other inference-time manipulations that steer representations, such as adversarial patches or some model-stealing queries, a testable extension the paper does not run.","The detector is built purely on benign samples, so its sensitivity to benign distribution shift is unknown; a natural experiment is feeding it clean inputs from a different domain and measuring the rise in false rejections.","The paper's adaptive attack constrains only the LSTM bottleneck distance; an attacker who instead matches the FFT spectrum could push detection lower, which would map the defense's real robustness boundary.","The ablation identifies the LSTM autoencoder as the essential component; swapping it for a simpler temporal compressor would show whether temporal modeling or mere compression is what separates the trajectories."],"forward_implications":["Both threat families collapse into one anomaly-detection problem, so no attack-specific knowledge is needed at run time.","Because the pipeline reads only intermediate activations, it transfers across image, text, and audio, and across classification and regression.","The detector does not wait for the model's predicted label, so most of its work can run in parallel with the forward pass.","A defender needs only a small benign sample set, with 100 samples sufficing in the authors' experiments, to build the detector offline.","Adaptive attackers who know the detector and try to match the benign trajectory still face 87-91% detection, at the cost of a higher false-rejection rate."],"supporting_citations":[{"why":"Supplies Deep SVDD, the one-class anomaly detector trained only on benign spectrums.","marker":"[30]"},{"why":"Supplies the backdoor-detection SOTA (TED), the SSDT attack, and the main online-detection baseline.","marker":"[9]"},{"why":"Supplies the AE-detection SOTA (ContraNet) that UniGuard must beat in head-to-head comparisons.","marker":"[7]"},{"why":"Supplies NIC, the AE-detection baseline that fails on non-PGD attacks and on simple backdoors.","marker":"[6]"}],"fun_headline_variants":["Trajectory signatures unmask adversarial and backdoor inputs","One online detector unifies defense against two attack types","LSTM reads layer trajectories to flag adversarial and backdoor inputs","Trajectory-based detector beats single-purpose defenses on all three modalities","UniGuard: one detector for adversarial and backdoor attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole method assumes that the compressed trajectory features learned only from benign samples — through UMAP, the LSTM autoencoder, and the FFT — retain enough of the adversarial-versus-benign difference to separate inputs the detector never saw during training.","fun_headline_variants_meta":{"raw":{"variants":["Trajectory signatures unmask adversarial and backdoor inputs","One online detector unifies defense against two attack types","LSTM reads layer trajectories to flag adversarial and backdoor inputs","Trajectory-based detector beats single-purpose defenses on all three modalities","UniGuard: one detector for adversarial and backdoor attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001355,"raw_usage":{"total_tokens":5544,"prompt_tokens":1033,"completion_tokens":4511,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":649,"completion_tokens_details":{"reasoning_tokens":4427}},"tokens_in":649,"tokens_out":4511,"duration_ms":34819,"temperature":1.0,"reasoning_tokens":4427,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T21:59:11.385287+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix a model and dataset (for example, ResNet18 on CIFAR-10), pick one AE attack such as PGD, and add a penalty that keeps the LSTM-bottleneck vector or its FFT spectrum inside the benign training distribution. If such constrained attacks reach a high success rate, above 90%, while the detector flags them less than half the time, the trajectory-divergence claim is empirically falsified.","supporting_citations":[{"cited_title":"Deep one-class classification,","cited_arxiv_id":null,"evidence_quote":"Supplies Deep SVDD, the one-class anomaly detector trained only on benign spectrums."}],"review_version":1}