{"id":"82291b72-bf98-489a-a04d-0bbc3dd2ecd0","arxiv_id":"2507.22813","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"DISTIL uses a classifier-guided latent diffusion model to invert Trojan triggers without clean data, achieving higher trigger-based scanning accuracy than prior reverse-engineering methods.","lead":"DISTIL is a new method for detecting Trojan (backdoor) attacks in neural networks by generating candidate triggers with a diffusion model, without needing any clean training data. It produces more interpretable triggers and higher detection accuracy than prior approaches on several benchmarks, which matters because real-world deployment often lacks access to clean data.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Eq. 5 trigger-strength score and the 'data-free' claim conflict: scoring uses 1% held-out clean source-class images, and the transferability-gap premise is asserted but not directly verified on clean models.","rationale":"The reader's verdict is CONDITIONAL, and I agree with the overall assessment. The strongest concern is the same family of issues: under-specified baselines, missing error bars, and the threshold inconsistency. My emphasis differs in two ways.\n\nFirst, I push further on the 'data-free' claim. The paper repeatedly calls the method data-free, but Section 3 explicitly requires held-out source-class images to compute the score in Eq. 5, and the experiments adopt the 1%-clean-data protocol. This does not invalidate the method, but it weakens a headline claim and complicates comparisons with genuinely data-free baselines such as MM-BD. The reader noted the 1% clean-data usage but did not tie it to the data-free claim as sharply.\n\nSecond, the transferability-gap premise is the theoretical foundation of the discriminative score, yet it is asserted via citations rather than demonstrated in the paper's own setting. The appendix Table 7 reports AUC on TrojAI, which implicitly includes clean models, but no clean-model score distribution or AUC is reported for BackdoorBench in the main text. A direct clean-vs-Trojaned separation plot would settle whether Eq. 5 is actually discriminative or whether the method's success relies on other factors.\n\nI do not think these concerns warrant REJECT or UNVERDICTED. The method is coherent, the ablations in Table 2 are informative, and the results are consistent across two benchmarks. The issues are fixable with code release, clarification of the data protocol, explicit clean-model score distributions, and resolving the threshold discrepancy. Hence CONDITIONAL is the right verdict, with conditions that include those checks.","tokens_in":22730,"tokens_out":2753,"duration_ms":32605,"concrete_test":"Run DISTIL on the 100 clean BackdoorBench models already used in the paper and compute the full Score(f) distribution from Eq. 6 over all (ysrc,ytar) pairs. Report the AUC of the clean-vs-Trojaned separation using exactly the same 1% held-out source-class data for both, and verify that the clean models' max scores are below the λ2 threshold. This directly tests the transferability-gap premise. Separately, re-run one BackdoorBench row (e.g., BadNets-CIFAR10) in a truly data-free mode (no held-out images for the score, using only generated x0 and classifier confidence) and report the resulting accuracy drop; if the drop is large, the 'data-free' claim should be revised, and comparisons with data-free baselines such as MM-BD need re-benchmarking.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central detection signal is Score in Eq. 5, which measures how much an inverted pattern δ shifts a held-out source-class image's softmax probability toward ytar and away from ysrc. The paper's core claim is that this score is large for Trojaned models and small for clean models, based on the Section 3 hypothesis that shortcuts learned by Trojaned models transfer significantly more than patterns found in clean models. This hypothesis is asserted via citations [43,44] and is not independently verified in the paper for the specific generated patterns.\n\nMore concretely, the method is not data-free as claimed. Section 3, under 'Trojan Detection and Mitigation', states that the score is evaluated on 'held-out images from the source class', and the experimental setup says 'using 1% of clean data for Trojan scanning and mitigation is common in the literature [46], and we adopt this setting when running experiments with baselines.' Thus the reported scanning results depend on access to clean held-out images. This is not a fatal flaw, but it contradicts the abstract's 'data-free, zero-shot' claim and matters for fairness: MM-BD, a genuinely data-free baseline, is compared against a method that uses 1% clean data for scoring. The claimed margins over data-free baselines could be inflated.\n\nThe threshold inconsistency between the main text (Eq. 4, λ2 = 0.95) and Algorithm 1 (line 14, ≥ 0.9) is a reproducibility defect that affects which candidate triggers are accepted. Finally, the object-detection extension is described only qualitatively: the gradient ∇ log P(bbox → corner | x_t) has no explicit formula, and the combined score is not precisely defined, yet the headline 9.4% improvement comes from that setting. All four issues are load-bearing for the quantitative claims, although none individually falsifies the central idea.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"Mirzaei et al. propose DISTIL, a trigger-inversion defense that reconstructs Trojan triggers by steering a pretrained, classifier-guided latent diffusion model with gradients of the classifier under test. The reconstructed pattern is accepted when it makes the classifier predict a chosen target class, and the model is scanned by computing a transferability score: the expected shift of held-out source-class images toward the target class and away from the source class. The method is evaluated for Trojan scanning, mitigation, and target-class prediction on BackdoorBench and TrojAI, including an adaptation to object-detection models, and is reported to outperform existing RET and data-free baselines by substantial margins.","tokens_in":23042,"tokens_out":4470,"duration_ms":57210,"significance":"If the reported results hold, DISTIL is a potentially useful contribution to post-training Trojan defense: it moves trigger inversion from pixel space into a diffusion latent space, produces visually interpretable triggers, avoids strong assumptions about trigger shape, and demonstrates extension to object detection and all-to-all label mappings. The paper ships code, includes ablations isolating the contribution of diffusion, noise injection, fast pairing, and backbone choice, and reports results across many attack types and architectures. These are real strengths. The main reservations concern the 'data-free' claim, the threshold specification in the algorithm, and the absence of error bars and test-set sizes in the main tables; these are fixable but are load-bearing for the central empirical claims.","major_comments":[{"comment":"The abstract and introduction describe DISTIL as 'data-free, zero-shot', but the detection score in Eq. (5) is an expectation over held-out source-class images, and Section 4 explicitly states that 1% of clean data is used for Trojan scanning and mitigation. The scanning results in Tables 1a-c therefore depend on access to held-out clean images. This does not invalidate the method, but the 'data-free' claim must be qualified to 'data-free trigger inversion given a small held-out scoring set'. In addition, when comparing against genuinely data-free baselines such as MM-BD, the paper should state explicitly which methods received the 1% clean-data protocol and which did not; otherwise the reported margins over data-free baselines may overstate the advantage.","section":"Section 3, Eq. (5); Section 4, Experimental Setup"},{"comment":"The trigger acceptance threshold is inconsistent between the main text and the pseudocode. Eq. (4) requires softmax[f(delta)]_ytar >= lambda2 and gives lambda2 = 0.95 as an example, while Algorithm 1 line 14 uses a fixed threshold of 0.9. Furthermore, lambda2 is overloaded: Eq. (4) uses it for accepting an individual trigger candidate, but Algorithm 1 line 17 uses the same symbol as the global decision threshold for classifying the model as Trojaned or clean. This ambiguity changes which triggers are accepted and which models are flagged, and it is a reproducibility defect that should be corrected by unifying the threshold and giving it a single role.","section":"Section 3, Eq. (4); Algorithm 1, lines 14-17"},{"comment":"The main accuracy tables report no error bars, no number of clean/Trojaned models per cell, and no test-set sizes. The only standard-deviation information appears in Table 7, which reports AUCROC rather than the ACC values used in the main comparisons. Given that the paper claims improvements of up to 7.1 and 9.4 percentage points, the main tables should report mean +/- std over independent runs or seeds and should state the number of models in each evaluation set. Without this, it is difficult to judge whether the reported margins are statistically meaningful.","section":"Section 4, Tables 1, 3, and 4; Appendix Table 7"},{"comment":"The discriminative power of Score(f) in Eq. (6) rests on the hypothesis that shortcut patterns learned by Trojaned models transfer significantly more strongly than patterns found in clean models. This hypothesis is asserted via citations [43, 44] and is only indirectly supported by the end-to-end detection accuracies in Table 1. Because the central detection signal is this transferability gap, the paper should provide direct evidence for the specific generated patterns: for at least one dataset, report the distribution of Score(f) for clean versus Trojaned models, or report false-positive rates at the chosen threshold. Such evidence would also strengthen the claim that the method generalizes to attack types beyond those in the evaluated benchmarks.","section":"Section 3, Motivation paragraph"}],"minor_comments":[{"comment":"The noise injection is specified inconsistently: Eq. (1) uses lambda1 * eta_t with eta_t ~ U(0,1), while Algorithm 1 line 11 samples eta_t ~ lambda1 * t * U(0,1), and the Figure 1 caption writes lambda2 * (T-1) * U(0,1). Please unify the notation and state exactly how the noise scales with the diffusion step t.","section":"Section 3, Eq. (1); Algorithm 1, line 11; Figure 1 caption"},{"comment":"The notation X_src ⊕ x_t is not defined. It appears to mean concatenation of a clean source image with the latent candidate, but the mechanism should be described explicitly, including how the two inputs are combined and how the gradient is computed with respect to x_t.","section":"Section 3, Eq. (3)"},{"comment":"The text says hyperparameters are discussed in the experimental details, but the paper does not report the final values of lambda1 and lambda2 used for the main tables, beyond the fixed values mentioned in the ablation Setup C. Please give the default hyperparameter settings used for each reported result.","section":"Section 3, Eq. (4) and Algorithm 1"},{"comment":"The statement that BackdoorBench originally included only one clean model per architecture and that the authors added 100 clean models is not followed by details on how these clean models were obtained or trained. Please provide the training protocol or the source of these models.","section":"Section 4, Experimental Setup and Evaluation Details"},{"comment":"The column header row of Table 2 is formatted confusingly, with labels such as 'Data SupervisionNoise' running together. Please reformat the table so that each component and each ablation condition is clearly identified.","section":"Table 2, column headers"},{"comment":"Table 7 reports AUCROC mean +/- std for DISTIL, but the main text reports accuracy. Please either convert the main results to AUC or report both metrics, so that the variance information in the appendix can be related to the headline numbers.","section":"Appendix, Table 7"}],"recommendation":"major_revision","confidential_remarks":"The paper fits the scope of a computer-vision or security venue and the empirical breadth is a genuine strength. My main concerns are the overstatement of 'data-free' relative to the actual protocol, the threshold inconsistency between the main text and the algorithm, and the lack of error bars and test-set sizes in the main tables. These are all addressable within the scope of a revision and do not, in my view, require new conceptual machinery."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea is genuinely new and the paper deserves a real referee. DISTIL shifts trigger inversion from pixel space into the latent space of a pretrained diffusion model, guides the reverse process with classifier logits, and adds uniform noise to avoid adversarial artifacts. That combination is not in the prior RET literature, and the object-detection extension is a real plus. The empirical base is broad and internally consistent: BackdoorBench, TrojAI rounds, mitigation, target-class prediction, and a component ablation. The visualizations of triggers on clean vs Trojaned models are persuasive at a qualitative level, and the noise-injection regularizer is a sensible response to the known failure mode of pixel-space inversion.\n\nNow the soft spots, in proportion. The 'data-free' claim is overstated. Generating triggers is data-free, but the Trojan score in Eq. 5 is computed by embedding the trigger into held-out source-class images, and the experimental setup explicitly uses 1% clean data. That is common in the literature, and it does not falsify the method, but it means the comparison to genuinely data-free baselines like MM-BD is not apples-to-apples; the reported margins could be inflated. The paper should say this clearly.\n\nSecond, there is a threshold inconsistency: Eq. 4 sets lambda_2 = 0.95, while Algorithm 1 line 14 accepts softmax >= 0.9. Which one is used? This changes which generated candidates count, and thus affects the score and the final detection decision. Reproducibility needs this fixed.\n\nThird, the object-detection extension is under-specified. The gradient term grad log P(bbox -> corner | x_t) is never given an explicit formula, and the combined score is only described verbally. The headline 9.4% improvement comes from that setting, so the lack of detail matters.\n\nFourth, the central transferability-gap premise (Section 3) is asserted via citations [43,44] rather than verified for the patterns DISTIL actually generates. A simple supporting experiment—e.g., showing that clean models' Eq. 5 scores stay small under the same generation procedure—would substantially strengthen the detection claim. Without it, the discriminative power rests on an assumption that is plausible but not demonstrated.\n\nMinor: the main accuracy tables lack error bars; standard deviations appear only for AUCROC in Table 7. Add them.\n\nBottom line: this is a solid, inventive RET paper with a real weakness in how the claims are scoped and reported. It deserves peer review, not desk rejection. I would recommend conditional acceptance after the authors fix the threshold, spell out the OD terms, temper or clarify the data-free claim, and add the transferability verification.","headline":"DISTIL is a genuinely new and well-engineered twist on trigger inversion—latent-space guided diffusion—but the 'data-free' label is softer than it looks and the quantitative claims need cleanup before I'd trust the margins.","tokens_in":23647,"tokens_out":2603,"would_cite":true,"duration_ms":29332,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DISTIL reconstructs Trojan triggers with no clean training data by guiding a pretrained diffusion model with classifier gradients in latent space, and scores models by how strongly the recovered pattern transfers.","keywords":["Trojan attack detection","backdoor defense","trigger inversion","latent diffusion guidance","data-free model scanning","Trojan mitigation","object detection backdoors","shortcut learning"],"falsifier":"Run DISTIL's scan over a large population of clean models, record the maximum trigger-strength scores from Equation 6, and compare them with the scores of Trojaned models; if a substantial fraction of clean classifiers, especially adversarially trained ones that are optimized to be sensitive to perturbation-like features, reaches the Trojan threshold, the transferability gap that carries the detection signal does not hold and the method's accuracy claims would not survive an independent clean-only evaluation. The paper's supplementary figures show that patterns found on clean models look noisy, but it does not report the score distributions that would settle this directly.","tokens_in":22549,"feed_emoji":"🛡️","tokens_out":15453,"duration_ms":154505,"temperature":0.7,"pith_summary":"This paper claims that Trojan triggers in poisoned image classifiers can be reconstructed without any clean training data by moving the search from pixel space into the latent space of a pretrained diffusion model. At each denoising step, the suspect classifier's own gradients steer generation toward a pattern that raises the probability of a candidate target class and lowers that of a source class, while injected uniform noise suppresses adversarial artifacts. The recovered pattern is then tested as a signature: pasted onto held-out source images, it should shift predictions strongly only if the model is genuinely Trojaned, because Trojan-induced shortcuts transfer more than anything a clean model has learned. The paper reports that this data-free procedure outperforms earlier trigger-inversion baselines by up to 7.1% in scanning accuracy on a standard backdoor benchmark and 9.4% on object-detection scanning, and that the same recovered triggers support target-class prediction and mitigation by fine-tuning.","feed_headline":"Scan poisoned models with zero clean data via a diffusion search","feed_subtitle":"Recovered shortcut patterns separate poisoned from clean models and name the attack's target class.","key_machinery":"The carrying object is a pretrained, classifier-guided diffusion generator treated as a constrained search space for triggers, plus a scalar decision statistic built on the recovered pattern. The modified reverse-process mean $\\tilde{\\mu}_\\theta(x_t, t, y_{\\mathrm{tar}}, y_{\\mathrm{src}}) = \\mu_\\theta(x_t,t) + \\Sigma_\\theta(x_t,t)\\nabla_{x_t}\\log[f(y_{\\mathrm{tar}}|x_t)/f(y_{\\mathrm{src}}|x_t)] + \\lambda_1\\eta_t$ does two jobs at once: the classifier gradient directs sampling toward a pattern the model connects to the target label rather than the source label, and the scaled uniform noise $\\eta_t$ destabilizes brittle adversarial perturbations, so the search settles on stable, trigger-like structure. The decision mechanism is the trigger-strength score of Equation 5, the expected rise in target-class softmax probability minus the source-class probability when the generated trigger is embedded into held-out source images; the model-level Trojan score of Equation 6 is the maximum of that margin over all source-target pairs, and the maximizing pair names the predicted target class. A fast variant reduces the scan from quadratic to linear in the number of classes by pairing each target with its farthest class in penultimate-layer feature cosine similarity.","core_discovery":"The central claim is that a Trojaned classifier's shortcut pattern is an unusually transferable internal bias, and that generating candidate triggers inside a diffusion model's image manifold exposes it. For every candidate pair $(y_{\\mathrm{src}}, y_{\\mathrm{tar}})$ the method steers the reverse diffusion by modifying the mean as $\\tilde{\\mu}_\\theta(x_t, t, y_{\\mathrm{tar}}, y_{\\mathrm{src}}) = \\mu_\\theta(x_t,t) + \\Sigma_\\theta(x_t,t)\\nabla_{x_t}\\log\\frac{f(y_{\\mathrm{tar}}|x_t)}{f(y_{\\mathrm{src}}|x_t)} + \\lambda_1\\eta_t$, with $\\eta_t \\sim \\mathcal{U}(0,1)$; the gradient pulls the pattern toward what the classifier associates with the target class over the source class, and the noise term is the paper's safeguard against collapsing onto adversarial perturbations. The final image $x_0$ is accepted as a trigger if the classifier's softmax target probability clears a threshold, and its discriminative power is scored by Equation 5, the expected softmax margin between target and source class when the trigger is overlaid on held-out source images; the model-level Trojan score is the maximum of this margin over all label pairs. On this basis the paper claims accurate scanning of Trojaned classifiers across standard backdoor benchmarks, extension to object detection by adding a bounding-box localization gradient, target-class identification from the maximizing pair, and mitigation by fine-tuning on correctly labeled triggered images.","pith_inferences":["A natural stress test the paper does not run: adversarially trained clean models are built to be sensitive to perturbation-like patterns, so measuring their trigger-strength distribution directly would confirm whether the assumed transferability gap really separates the two populations.","The method's generality is bounded by its generative backbone: because the default diffusion model was trained on natural images, applying DISTIL to domains far outside that manifold, such as medical or satellite imagery, could push recovered patterns off-manifold, a regime the paper gives no evidence about.","The same classifier-guided latent search could plausibly be adapted to invert dynamic, sample-specific triggers by conditioning the guidance on each input rather than on a fixed source-target pair, which would extend the method beyond the static-trigger threat model it evaluates.","The fast variant's heuristic of testing each target against only its farthest source class deserves a blind-spot probe: a real trigger that fires only from a nearby source class could be missed, since the ablation does not report per-class failure modes."],"forward_implications":["Trojan scanning no longer needs the training set: the same latent-space search can decide whether a held-out classifier is poisoned using only the classifier itself and a pretrained diffusion model, which matters when training data is proprietary or private.","The recovered trigger is a working artifact, not just a statistic: fine-tuning on triggered images with correct labels cuts average attack success rate to 8.6% in the paper's CIFAR-10 mitigation runs while keeping classification accuracy near that of the original model.","Detection and attribution come from the same object: the source-target pair that maximizes the trigger-strength score identifies the attack's target class, reaching 72.0% accuracy in the paper's GTSRB-based evaluation.","The same shortcut logic extends to object-detection models by adding a gradient that drags predicted bounding-box centers toward a corner, giving a scanning accuracy of 63.7% on the benchmark's poisoned detectors.","The fast variant cuts per-model scan cost from quadratic to linear in the number of classes with roughly unchanged accuracy in the ablation, making the scan practical for high-class-count models."],"supporting_citations":[{"why":"Supplies the pretrained guided diffusion backbone whose latent space constrains the trigger search and whose gradient-following behavior the method exploits.","marker":"[45]"},{"why":"Gives the paper its cited basis for treating the Trojan trigger as a spurious correlation learned during poisoned training.","marker":"[43]"},{"why":"Gives the paper its cited basis for the transferability premise, that Trojan-induced shortcuts transfer more strongly than clean-model patterns.","marker":"[44]"},{"why":"Provides the BackdoorBench models and attack zoo on which the main classifier-scanning comparison and the 7.1% improvement claim are measured.","marker":"[49]"},{"why":"Provides the TrojAI benchmark rounds used for the progressively harder classification scans and the object-detection scanning task.","marker":"[50]"},{"why":"Defines the canonical BadNet trigger-embedding threat model that DISTIL is built to invert and whose pattern appears in the paper's qualitative CIFAR-10 recovery.","marker":"[1]"},{"why":"Is the principal contrasting baseline, used to argue that pixel-space inversion of smoothed classifiers yields adversarial artifacts that latent-space search avoids.","marker":"[31]"},{"why":"Is a recent unified trigger-inversion framework compared throughout the scanning, mitigation, and target-class tables.","marker":"[28]"},{"why":"Is the foundational Neural Cleanse trigger-inversion baseline that defines the reverse-engineering task and appears in every comparison table.","marker":"[23]"}],"fun_headline_variants":["Zero-data diffusion trigger inversion scans Trojaned models","Latent diffusion finds backdoor triggers with no clean data","Diffusion-guided inversion boosts Trojan detection by 9.4%","Data-free trigger search: diffusion exposes model shortcuts","Zero-shot backdoor scanning via latent diffusion inversion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method's separation of poisoned from clean models rests on the premise that shortcut patterns learned by a Trojaned model transfer to held-out inputs far more strongly than patterns a clean model has learned; if clean models turned out to be nearly as responsive to the generated patterns, the trigger-strength score would not separate the two populations and false positives would follow.","fun_headline_variants_meta":{"raw":{"variants":["Zero-data diffusion trigger inversion scans Trojaned models","Latent diffusion finds backdoor triggers with no clean data","Diffusion-guided inversion boosts Trojan detection by 9.4%","Data-free trigger search: diffusion exposes model shortcuts","Zero-shot backdoor scanning via latent diffusion inversion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000211,"raw_usage":{"total_tokens":1492,"prompt_tokens":1098,"completion_tokens":394,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":714,"completion_tokens_details":{"reasoning_tokens":317}},"tokens_in":714,"tokens_out":394,"duration_ms":5180,"temperature":1.0,"reasoning_tokens":317,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T11:13:56.195196+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run DISTIL's scan over a large population of clean models, record the maximum trigger-strength scores from Equation 6, and compare them with the scores of Trojaned models; if a substantial fraction of clean classifiers, especially adversarially trained ones that are optimized to be sensitive to perturbation-like features, reaches the Trojan threshold, the transferability gap that carries the detection signal does not hold and the method's accuracy claims would not survive an independent clean-only evaluation. The paper's supplementary figures show that patterns found on clean models look noisy, but it does not report the score distributions that would settle this directly.","supporting_citations":[{"cited_title":"Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlation","cited_arxiv_id":"2305.11596","evidence_quote":"Gives the paper its cited basis for treating the Trojan trigger as a spurious correlation learned during poisoned training."},{"cited_title":"Backdoor- bench: A comprehensive benchmark of backdoor learning","cited_arxiv_id":null,"evidence_quote":"Provides the BackdoorBench models and attack zoo on which the main classifier-scanning comparison and the 7.1% improvement claim are measured."},{"cited_title":"The trojai software framework: An opensource tool for embedding trojans into deep 10 learning models, 2020","cited_arxiv_id":null,"evidence_quote":"Provides the TrojAI benchmark rounds used for the progressively harder classification scans and the object-detection scanning task."},{"cited_title":"Bad- nets: Evaluating backdooring attacks on deep neural net- works","cited_arxiv_id":null,"evidence_quote":"Defines the canonical BadNet trigger-embedding threat model that DISTIL is built to invert and whose pattern appears in the paper's qualitative CIFAR-10 recovery."},{"cited_title":"Single image backdoor in- version via robust smoothed classifiers","cited_arxiv_id":null,"evidence_quote":"Is the principal contrasting baseline, used to argue that pixel-space inversion of smoothed classifiers yields adversarial artifacts that latent-space search avoids."},{"cited_title":"UNICORN: A Unified Backdoor Trigger Inversion Framework","cited_arxiv_id":"2304.02786","evidence_quote":"Is a recent unified trigger-inversion framework compared throughout the scanning, mitigation, and target-class tables."},{"cited_title":"Neural cleanse: Identifying and mitigating backdoor attacks in neu- ral networks","cited_arxiv_id":null,"evidence_quote":"Is the foundational Neural Cleanse trigger-inversion baseline that defines the reverse-engineering task and appears in every comparison table."}],"review_version":1}