{"id":"13d808da-48d2-47b9-9791-69e4f8fe69a5","arxiv_id":"2507.10491","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"BURN removes backdoors from trained models by detecting poison samples through adversarial boundary distance and re-labeling them with labels recovered by adversarial perturbations.","lead":"This paper presents BURN, a defense that finds poisoned training samples by measuring how far each sample sits from a model's decision boundary, then re-labels them using adversarial examples to break backdoor triggers. It reports that poison samples need larger perturbations than clean ones and that perturbed samples often flip back to their original correct labels, which the method uses to purify the model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Label-restoration assumption is under-validated: BURN relabels the top k_p% with boundary-adversarial predictions, but only one aggregate CIFAR-10 confusion matrix supports the claim that these are original correct labels; no per-attack recovery accuracy is reported.","rationale":"The reader's weakest assumption correctly identifies the label-restoration premise as the most load-bearing part of the argument. My stress-test agrees and sharpens it: the method's success is not just about detecting poison samples but about using their adversarial predictions as ground-truth labels for fine-tuning. The paper provides strong end-to-end numbers and a plausible mechanism, but the direct evidence for label recovery is a single confusion matrix and one feature-space example. The CL attack is a particularly important edge case because poison samples are already labeled with their correct class, so the meaning of 'restore the correct label' is unclear. A direct measurement of per-attack label-recovery accuracy would settle this without requiring new methodology. I do not see a reason to move the verdict away from conditional; the concern is concrete and testable, and the rest of the framework (progressive refinement, discrepancy feedback) is reasonable. The paper should be accepted conditional on this measurement, code release, and variance reporting, exactly as the reader suggested.","tokens_in":12808,"tokens_out":5799,"duration_ms":73283,"concrete_test":"Using the BackdoorBench protocol, for each of the seven attacks (especially CL and SSBA) and each dataset, compute the per-sample label-recovery accuracy of the exact Phase-1 relabeling: compare arg max f(x_i + δ_i; θ_0) against the true pre-poisoning label y_i for the top k_p% of D_train ranked by boundary distance, reporting separate accuracies for true poison samples and for clean false positives, plus a confusion matrix per attack. If recovery accuracy is high (>90%) for all attacks, the concern is resolved; if it is low for CL or SSBA, then the central relabeling premise fails exactly where the method is needed most.","verdict_should_be":"UNCHANGED","load_bearing_attack":"BURN's core mechanism is not detection alone but relabeling: Algorithm 1 lines 6 and 17 replace the labels of the top k_p% samples with y_i = arg max f(x_i + δ_i; θ_0), and Phase 1 fine-tunes on these labels. The paper's only direct support for the claim that these adversarial predictions equal the original correct labels is Fig. 2, an aggregate confusion matrix for 1000 poison samples on CIFAR-10 with no indication of which attack it covers. No per-attack or per-dataset label-recovery accuracy is given, and Table 1 shows that boundary-distance separability is attack-dependent (AUROC from 0.7993 for SSBA to 0.9999 for CL), so the label-restoration behavior cannot be assumed to transfer. Clean-label (CL) attacks are a particular stress case: poison samples retain their correct ground-truth labels by construction, so a boundary perturbation that changes the prediction cannot unambiguously be described as restoring the original label, and the relabeled target may be arbitrary. Consequently, if the adversarial predicted label is wrong for a nontrivial fraction of the selected samples—or for clean samples that fall in the top k_p% due to imperfect detection—fine-tuning on those labels teaches incorrect associations; the reported ACC/ASR averages do not distinguish correct relabeling from merely noisy fine-tuning that happens to suppress the trigger-target correlation.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"BURN proposes a backdoor-unlearning method that uses boundary adversarial attacks to identify poisoned samples by their abnormally large perturbation norms, relabel those samples with the adversarial predicted label on the assumption that this recovers the original correct semantic label, and then progressively fine-tunes the model using a composite score of boundary distance and prediction divergence. The paper claims two observations: poison samples are farther from decision boundaries than clean samples, and adversarial perturbations tend to restore the original labels and clean-like features of poison samples. It validates BURN against seven attacks on CIFAR-10, CIFAR-100, and Tiny ImageNet-200, with the main-text experimental evidence consisting mostly of CIFAR-100 radar plots, a single confusion matrix, and AUROC curves.","tokens_in":13163,"tokens_out":4910,"duration_ms":59364,"significance":"If the label-restoration observation were robust across attacks and datasets, BURN would be a valuable defense: it operates without clean auxiliary data or trigger-pattern assumptions, and its two-phase progressive refinement design is clean and well motivated. The boundary-distance observation is supported by Table 1 and the AUROC curves, and the idea of using adversarial perturbations to strip trigger-dominated features is intriguing. However, the load-bearing label-restoration claim is under-validated, and the currently reported experiments do not yet substantiate the broad empirical claims made in the abstract and introduction.","major_comments":[{"comment":"The central premise that adversarial boundary predictions of poison samples equal their original true labels is supported only by a single aggregate confusion matrix for 1000 CIFAR-10 poison samples, with no per-attack or per-dataset breakdown. This premise is load-bearing because both phases of Algorithm 1 (lines 6 and 17) relabel the selected samples with y_i = arg max f(x_i + delta_i; theta_0), and Phase 1 fine-tunes on these labels. If the recovered label is wrong for a non-negligible fraction of the selected samples, or if clean samples that pass the distance filter are mislabeled, the fine-tuning step teaches incorrect associations. The problem is especially acute for clean-label (CL) attacks, where poison samples retain their correct ground-truth labels by construction, so an adversarial prediction that differs from the original label cannot be described as 'restoring' it. Please report per-attack label-recovery accuracy, including for CL attacks, and analyze the impact of label noise on the final ACC/ASR. The text also references Fig. 2 (left) and (right), but the figure as presented is a single confusion matrix; the clean-sample uniform distribution is not actually shown.","section":"Section 4, Fig. 2, Algorithm 1"},{"comment":"The main experimental evidence for the paper's central claim consists of radar plots for CIFAR-100 only, with no numerical tables, no confidence intervals, and no CIFAR-10 or Tiny ImageNet-200 results in the main text. The claim of broad effectiveness across datasets, architectures, and seven attacks is therefore not verifiable from the reported material. Please include full numeric ACC/ASR results with standard deviations across runs, and at least summarize the supplementary results in the main text so that the reader can check the claimed trade-offs.","section":"Section 6.2, Fig. 4"},{"comment":"The method assumes a 1% screened poison subset and sets k_p accordingly, but the attacks use a 10% poisoning ratio by default. Since the top-k_p selection may include clean samples and exclude poison samples, particularly for attacks with weaker boundary-distance separability such as SSBA (AUROC 0.7993 in Fig. 5), the reported ACC/ASR do not show whether the method is robust to different poisoning rates or to detection errors at the chosen threshold. Please report precision and recall at the selected k_p values and provide a sensitivity analysis over poisoning ratios; the paper's own limitation statement in Section 7 acknowledges dependence on accurate detection, which this experiment would directly address.","section":"Section 5.2, Table 2, Fig. 5"},{"comment":"The statement that label reversion 'holds regardless of the target label or the trigger mechanism' is asserted without per-attack evidence. Table 1 shows large variation in boundary distances across attack types, so label-restoration behavior may also be attack-dependent. This overgeneralization should either be removed or supported by per-attack label-recovery experiments, rather than only by the aggregate CIFAR-10 confusion matrix.","section":"Section 4, Table 1"}],"minor_comments":[{"comment":"There are several typos and formatting issues: 'CLLF' in Fig. 4 should be 'CL LF'; 'trojanNN' should be 'TrojanNN'; 'mimimal' in Section 5.2 should be 'minimal'; 'Anlysis' in the Section 6.4 heading should be 'Analysis'; 'Effectivness' should be 'Effectiveness'; and the Fig. 2 caption contains the incomplete phrase 'for and 1000 poison samples'. Please correct these.","section":"Throughout"},{"comment":"The dynamic weight schedule uses omega_0 = 0.3 and omega_T = 0.6 without any reported sensitivity analysis. Since this schedule controls the balance between boundary distance and prediction divergence across iterations, a brief ablation or a justification for these values would strengthen the paper.","section":"Section 5.2"},{"comment":"The defense baselines are given access to about 5% of clean training data, while BURN uses no clean auxiliary data. This is a favorable comparison for BURN, but the protocol should be stated explicitly as a potential advantage of the baselines, and the reported comparison should be interpreted accordingly.","section":"Section 6.1"},{"comment":"The claim that effective backdoor suppression can be achieved with only about 30 identified poison samples is demonstrated for BadNets and Blended attacks only; please specify whether this trend holds for the other five attack types, since the AUROC results in Fig. 5 suggest that detection is much harder for SSBA.","section":"Section 6.4, Fig. 6"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a meaningful problem and the core idea is plausible, but the evidence for the key label-recovery mechanism is too thin for acceptance. I recommend requiring per-attack label-recovery accuracy, full numeric results across datasets and runs, and a poisoning-rate sensitivity analysis before further consideration."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nBURN is worth a careful look. The new thing here is not boundary-distance separation per se—that builds on the authors' own Model X-ray and other work—but the observation that boundary adversarial attacks on poison samples tend to flip predictions back to the original correct labels, and the use of that as a relabeling mechanism for fine-tuning. That is a genuinely different angle from trigger-recovery or pruning-based unlearning, and the dual-model prediction discrepancy feedback for progressive refinement is a reasonable way to reduce false positives in detection.\n\nThe paper does several things well. The defense makes no assumption about trigger patterns and does not need a clean auxiliary dataset—both are practical virtues. The evaluation spans seven attack types, three datasets, and two architectures, which is a solid spread. The ablation on kp and kc gives some sense of sensitivity, and the unlearning trend in Fig. 6 is suggestive that only a small number of corrected poison samples are needed.\n\nThe soft spots are real and concentrate on the relabeling step. The claim that adversarial predicted labels equal the original true labels is supported by one aggregate confusion matrix on CIFAR-10 (Fig. 2). No per-attack or per-dataset recovery accuracy is reported. Table 1 shows the boundary-distance AUROC ranges from 0.7993 (SSBA) to 0.9999 (CL), so detection quality varies widely; the relabeling quality likely varies too. Clean-label attacks are the sharpest stress case: poison samples already have correct labels, so \"restoring\" a label via boundary perturbation can produce an arbitrary label, and the paper does not show that the relabeled set stays correct in that setting. If a nontrivial fraction of selected samples get wrong labels, the fine-tuning step is teaching false associations; the averaged ACC/ASR numbers do not separate true label recovery from noisy fine-tuning that merely breaks the trigger correlation.\n\nThere are smaller issues: no error bars or seed information, only CIFAR-100 shown in the main text, and the method's own hyperparameters (kp, kc, ω) are tuned on the same benchmark, so the generalization claims are weaker than the text suggests. The math in Section 2.3 also has a few notation slips, but they are minor and don't affect the method.\n\nBottom line: the central idea is plausible and the defense looks like a legitimate addition to the backdoor-unlearning toolbox, but the evidence for label restoration is thin. A serious referee could fix this by asking for per-attack label-recovery accuracy, variance over seeds, and code. I'd send it to peer review and would cite it once the code and extra analysis land.\n\nRecommendation: accept into peer review with a request for those experiments.","headline":"BURN is a serious, potentially useful backdoor-defense framework, but its central label-restoration claim needs far stronger evidence before I'd trust the relabeling step.","tokens_in":13681,"tokens_out":2004,"would_cite":true,"duration_ms":22088,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adversarial boundary analysis can locate poisoned samples and restore their correct labels.","keywords":["backdoor unlearning","adversarial boundary analysis","data poisoning defense","label restoration","trigger-agnostic defense","model purification","backdoor attack"],"falsifier":"Run a boundary adversarial attack on every poison sample from a clean-label backdoor attack, record the fraction whose adversarial predicted label equals the sample's ground-truth label before poisoning, and then apply BURN's phase-one relabeling to a held-out poisoned model; if label-recovery accuracy is far below near-perfect for any attack family, or if clean samples in the top boundary-distance quantile are frequently mislabeled, the observed attack-success-rate reduction would not be explained by correct label restoration.","tokens_in":12612,"feed_emoji":"🛡️","tokens_out":4771,"duration_ms":56228,"temperature":0.7,"pith_summary":"This paper proposes that a backdoored model can be cleansed by measuring how far each training sample sits from the model's decision boundaries and observing what label it receives when pushed across the nearest boundary. Its central claim is that poisoned samples sit significantly farther from decision boundaries than clean samples, and that a boundary-crossing adversarial perturbation flips a poisoned sample back to its original correct label while clean samples receive roughly uniform alternative labels. The authors build BURN, a two-phase unlearning framework that uses this adversarial boundary analysis to flag suspicious samples, re-label them with the adversarial predictions, and iteratively fine-tune the model while tracking prediction divergence from the frozen infected model. If the observations hold, backdoor removal no longer needs trigger reconstruction or a clean auxiliary dataset, and can apply to dynamic and invisible triggers. The paper reports low attack success rates with preserved accuracy across seven attack types and three datasets.","feed_headline":"Adversarial boundaries expose and strip backdoor poisons","feed_subtitle":"BURN relabels poison samples with their true classes and fine-tunes, needing no clean dataset or trigger assumptions.","key_machinery":"The load-bearing tool is the boundary adversarial attack, which computes, for each sample, the smallest perturbation that changes the model's prediction by moving toward the closest decision boundary, approximated with gradient differences between class scores. Its output supplies both detection and relabeling: the perturbation magnitude gives the boundary distance signal, and the adversarial predicted label serves as the recovered label for fine-tuning. In phase two, a composite score combines normalized boundary distance with prediction divergence between the frozen infected model and the progressively purified model, and dynamic weights shift emphasis from boundary distance to prediction divergence over iterations while adaptive proportions control how many samples are relabeled as poison versus kept clean.","core_discovery":"The paper's core discovery is a geometric signature of poisoning: in a backdoored model, poisoned samples lie in a high-confidence region near the target class and therefore require substantially larger minimal adversarial perturbations to cross a decision boundary than clean samples do. When such a boundary adversarial perturbation is applied, poison samples' predicted labels revert to their correct semantic labels with high probability, and their feature representations move closer to those of the corresponding clean samples. BURN operationalizes this by sorting training samples by boundary distance, taking the top proportion as candidate poison samples, relabeling them with their adversarial predicted labels, and fine-tuning; it then iterates with a composite score combining normalized boundary distance and prediction divergence between the frozen infected model and the purified model, progressively refining the datasets and purifying the model. The authors state that this directly breaks the false trigger-target association without modeling triggers and without a clean auxiliary dataset.","pith_inferences":["The label-reversion observation may be a general property of shortcut features: any spurious correlation a model latches onto could be disrupted by boundary adversarial perturbations, making this a candidate diagnostic for shortcut learning beyond backdoors.","The same relabeling trick could turn poisoned or mislabeled data into a self-correcting training signal, but only if label-recovery accuracy is measured per attack; the paper shows one confusion matrix rather than per-attack recovery rates.","Clean-label poisoning is the natural stress point for BURN, since those samples retain correct labels and may not show abnormally large boundary distances; a testable extension is to run phase-one relabeling alone on clean-label attacks and measure both relabel accuracy and downstream attack success rate.","Combining boundary-distance detection with statistical or certified backdoor detection could reduce false positives among clean outliers, since those outliers are the samples most likely to be mis-relabeled."],"forward_implications":["Backdoor unlearning can be accomplished by label restoration rather than trigger recovery, so defenses no longer need to guess trigger shapes.","Dynamic and input-dependent triggers, where pattern recovery is hardest, become treatable because the method never models the trigger.","A relatively small number of correctly relabeled poison samples can suppress attack success rate, so exhaustive poison detection is unnecessary.","Because the method needs no clean auxiliary data, it is usable when defenders only have the poisoned training set and an infected model.","The boundary-distance signal itself can serve as a poison-detection filter, as shown by the reported ROC curves with high AUC for most tested attacks."],"supporting_citations":[{"why":"Supplies the boundary adversarial attack method used to compute minimal perturbations and recovered labels.","marker":"[16]"},{"why":"Provides a fast and accurate minimal adversarial attack also used for boundary analysis.","marker":"[1]"},{"why":"Defines the BadNets poisoning paradigm and serves as a primary attack baseline.","marker":"[7]"},{"why":"Introduces an input-aware dynamic trigger attack used to test trigger-agnostic defense.","marker":"[18]"},{"why":"Introduces the clean-label attack that stresses the label-recovery assumption.","marker":"[24]"},{"why":"Provides the prior observation that backdoored models have reshaped decision boundaries, grounding the distance signature.","marker":"[23]"},{"why":"Supplies the open benchmark and training settings used for attack and defense baselines.","marker":"[28]"}],"fun_headline_variants":["Boundary distance exposes backdoor poisons","BURN relabels poison samples via boundary attacks","Adversarial boundaries reveal true labels of backdoor data","Poison samples sit far from boundaries; BURN exploits that"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole method rests on believing that the adversarial predicted label of a flagged poison sample is its original true label; if that recovery fails for a nontrivial share of samples, the fine-tuning step teaches wrong associations and can either preserve the backdoor or damage accuracy.","fun_headline_variants_meta":{"raw":{"variants":["Boundary distance exposes backdoor poisons","BURN relabels poison samples via boundary attacks","Adversarial boundaries reveal true labels of backdoor data","Poison samples sit far from boundaries; BURN exploits that"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000213,"raw_usage":{"total_tokens":1444,"prompt_tokens":987,"completion_tokens":457,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":394}},"tokens_in":603,"tokens_out":457,"duration_ms":5361,"temperature":1.0,"reasoning_tokens":394,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T17:29:19.501273+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a boundary adversarial attack on every poison sample from a clean-label backdoor attack, record the fraction whose adversarial predicted label equals the sample's ground-truth label before poisoning, and then apply BURN's phase-one relabeling to a held-out poisoned model; if label-recovery accuracy is far below near-perfect for any attack family, or if clean samples in the top boundary-distance quantile are frequently mislabeled, the observed attack-success-rate reduction would not be explained by correct label restoration.","supporting_citations":[{"cited_title":"Deepfool: a simple and accurate method to fool deep neural networks","cited_arxiv_id":null,"evidence_quote":"Supplies the boundary adversarial attack method used to compute minimal perturbations and recovered labels."},{"cited_title":"Superdeepfool: a new fast and accurate minimal adversarial attack","cited_arxiv_id":null,"evidence_quote":"Provides a fast and accurate minimal adversarial attack also used for boundary analysis."},{"cited_title":"Input-aware dynamic back- door attack","cited_arxiv_id":null,"evidence_quote":"Introduces an input-aware dynamic trigger attack used to test trigger-agnostic defense."},{"cited_title":"Model x-ray: Detecting backdoored models via decision boundary","cited_arxiv_id":null,"evidence_quote":"Provides the prior observation that backdoored models have reshaped decision boundaries, grounding the distance signature."},{"cited_title":"Backdoorbench: A comprehensive benchmark of backdoor learning","cited_arxiv_id":null,"evidence_quote":"Supplies the open benchmark and training settings used for attack and defense baselines."}],"review_version":1}