{"id":"52e36ed3-b0b6-49db-a764-3aaac4a94e0c","arxiv_id":"2508.05404","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"NT-ML combines non-target label training and mutual learning to purify a backdoored model using a small set of clean samples.","lead":"This paper proposes NT-ML, a backdoor defense that retrains a poisoned model using a clean teacher's outputs and mutual learning. If it works, defenders could need only a small set of clean samples to remove backdoors from a model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The paper's central empirical claim is not assessable from the submitted text: the full text is encoding-corrupted, leaving only the abstract, so the claimed defense gains cannot be checked.","rationale":"The reader's verdict is UNVERDICTED, and I share the root cause: the submission as provided contains no legible evidence for the central claim. However, the reader's stated weakest_assumption focuses on the behavioral plausibility of teacher-student mutual learning, whereas my load-bearing concern is the more fundamental unreadability of the experimental evidence. I do not see a way to reach a substantive technical critique until a legible manuscript is available. Therefore, I recommend keeping the verdict UNVERDICTED (equivalent to UNCHANGED from the reader's already-UNVERDICTED conclusion).","tokens_in":13709,"tokens_out":3724,"duration_ms":37639,"concrete_test":"Obtain a clean PDF or LaTeX source of arXiv:2508.05404 and re-extract the experimental sections. Then independently record, for each of the 6 attacks, the attack success rate (ASR) and clean accuracy (CACC) of NT-ML and of all 5 baseline defenses, along with the number of clean samples used. If these numbers are missing or NT-ML does not consistently beat the baselines in a paired comparison, the abstract's central claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract asserts that NT-ML defends against 6 backdoor attacks and outperforms 5 SOTA defenses using few clean samples. Assessing this requires the experiments: datasets, attack configurations, clean-sample counts, ASR/CACC numbers, and baseline implementations. The submitted full text is largely unreadable mojibake; visible fragments look like repeated figure/table captions, and an embedded line reads 'arXiv:2508.05403v2 [cond-mat.str-el] 1 Dec 2025', indicating the text layer is corrupted or mixed with another document. No legible quantitative table or equation supports the headline claim. This is not an internal inconsistency or a disagreement with consensus; it is a verifiability failure. Until a legible version is provided, the strongest claim is an unsupported empirical assertion.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes NT-ML, a backdoor defense consisting of Non-target label Training (NT) followed by Mutual Learning (ML) between a teacher and a student model. According to the abstract, NT retrains the poisoned model using outputs of standard training, yielding a teacher with high clean accuracy and a student with higher confidence on poisoned data; ML then exchanges strengths between them to produce a purified student. The abstract claims that NT-ML defends against six backdoor attacks and outperforms five state-of-the-art defenses while using only a small number of clean samples. The submitted full text is almost entirely encoding-corrupted (mojibake), with only an abstract and repeated figure/table captions legible; an unrelated arXiv ID from a cond-mat paper is embedded. No quantitative results, experimental setup, method equations, or hyperparameters are discernible.","tokens_in":13934,"tokens_out":3782,"duration_ms":37361,"significance":"If the abstract's claims are true, a data-efficient two-stage teacher-student backdoor defense would be a practically valuable contribution to the adversarial robustness literature. The idea of using non-target label training followed by mutual learning to separate clean behavior from trigger behavior is plausible and worth investigating. However, the current manuscript provides no legible empirical evidence, no reproducible code, no machine-checked formal results, and no concrete parameter-free derivations. Because the central claim is an empirical superiority claim, the significance of the contribution cannot be assessed from the submitted text. The paper may have merit, but this version is not verifiable.","major_comments":[{"comment":"The central claim that NT-ML outperforms five state-of-the-art defenses against six backdoor attacks is not assessable because the submitted full text is encoding-corrupted. No legible quantitative table appears; visible fragments are repeated captions, and an embedded line reads 'arXiv:2508.05403v2 [cond-mat.str-el] 1 Dec 2025', indicating the text layer is mixed with an unrelated document. There are no datasets, attack configurations, clean-sample counts, ASR/CACC values, or baseline implementations. This is a load-bearing verifiability failure, not a presentation issue.","section":"Full text (Experimental Evaluation)"},{"comment":"The method description is not legible: equations appear as garbled replacement characters, so the NT loss, the mutual-learning loss, and the teacher/student update rules cannot be verified or reproduced. Key hyperparameters (e.g., the mutual-learning weight, number of retraining epochs, optimizer, architectures) are absent. The abstract's phrase 'outputs of the standard training' is too vague to determine how the teacher and student are initialized and whether the student is trained on poisoned data during the NT stage.","section":"Full text (Method)"},{"comment":"The data-efficiency claim ('a small number of clean samples') is unquantified. There is no curve or table showing performance as a function of the number of clean samples, nor any comparison with the clean-sample requirements of the baseline defenses. Furthermore, the mechanism assumes that mutual learning will favor clean features over trigger features; this behavioral assumption about optimization is not tested by any ablation or analysis in the legible material.","section":"Abstract / Full text"}],"minor_comments":[{"comment":"The abbreviation 'NT-ML' is introduced before 'ML' is expanded. Spell out 'Mutual Learning' at first use.","section":"Abstract"},{"comment":"The embedded string 'arXiv:2508.05403v2 [cond-mat.str-el] 1 Dec 2025' appears to belong to an unrelated paper and should be removed; this suggests a source-file mix-up.","section":"Full text (header/footer)"},{"comment":"Visible figure/table captions are duplicated and appear disconnected from the text. If a corrected version is provided, each figure/table must be legible, numbered, and explicitly referenced in the narration.","section":"Full text (figures/tables)"}],"recommendation":"uncertain","confidential_remarks":"The full text as submitted is unreadable, so I cannot perform a substantive review of the experimental claims. This is not a scientific disagreement but a verifiability failure. If the version of record will include a legible full text, this report should be treated as a request for a corrected manuscript and a fresh review; as it stands, the paper cannot be accepted or rejected on scientific grounds."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this submission is unverifiable as it stands. The full text is encoding-corrupted to the point of being unreadable; an embedded line even shows an arXiv ID from a different paper (cond-mat.str-el), which suggests the text layer is garbled or mixed. The abstract is the only legible part, and it makes a concrete empirical promise: NT-ML defends against six backdoor attacks and beats five state-of-the-art defenses using few clean samples. That is a practically valuable claim if true, and the combination of non-target label training with mutual learning is a reasonable idea worth examining. I want to be clear: there is nothing internally inconsistent in the abstract, and the approach is not defined by fitting a parameter to the attacks, so this is not a circularity or overfitting problem on the evidence available.\n\nThe soft spot is structural, not scientific. Accuracy numbers, error bars, ablations, hyperparameters, baseline implementations, and dataset details are all locked inside the corrupted text. No table or equation is legible. The surviving fragments look like repeated figure captions and reference-like lines, and one line is literally a different paper's arXiv identifier. That is a verifiability failure: the central claim cannot be checked from the submission. If the authors submitted a clean copy, the empirical question would be real and worth referee time — the defense claims are the sort that a competent evaluator could test against published attacks and baselines.\n\nThe weaker behavioral assumption — that mutual learning will make the student favor clean features over trigger features — is worth probing if we ever see the experiments, but right now it is secondary. The primary issue is that there is no experiment to probe.\n\nWho is this for? A security researcher who can obtain a clean version and run the comparisons could extract a useful data point. In the current form, no reader can get anything out of it, and no referee should be asked to review a manuscript that cannot be read. I would tell the editor to ask for a clean resubmission, not to send this version out for peer review.","headline":"Unverifiable as submitted: the full text is corrupted and only the abstract is readable; the proposed defense is plausible but the empirical claims cannot be checked.","tokens_in":14332,"tokens_out":2312,"would_cite":false,"duration_ms":22910,"reading_group":"no","serious_thinker":"unclear","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"NT-ML restores backdoored deep networks by retraining on non-target labels and then letting a clean-data teacher and a poisoned-data student learn from each other.","keywords":["backdoor defense","non-target label training","mutual learning","teacher-student models","data poisoning","clean-sample efficiency","deep neural networks","trigger suppression"],"falsifier":"Take a standard image dataset and a known backdoor attack, poison a large fraction of training samples with a trigger that resembles a natural feature of the target class, run NT-ML with only the small clean set, and measure attack success rate on triggered test inputs. If the post-defense attack success rate stays near the undefended level while clean accuracy stays high, the claimed purification has not occurred.","tokens_in":13660,"feed_emoji":"🛡️","tokens_out":5737,"duration_ms":60539,"temperature":0.7,"pith_summary":"The paper proposes NT-ML, a defense that aims to remove a backdoor from an already-poisoned deep network without needing to identify poisoned samples. It combines non-target label training, which retrains the model so it does not lock onto the attacker's target label, with mutual learning between a clean-data teacher and a poisoned-data student. The paper reports that this two-stage process restores clean accuracy while rendering six different backdoor attacks ineffective, using only a small number of clean samples. If true, the defense would be practical for settings where clean data is scarce and the attack type is unknown.","feed_headline":"Two-stage training removes backdoors with few clean samples","feed_subtitle":"NT-ML pairs a clean-data teacher with a poisoned-data student to suppress trigger predictions, across six attacks.","key_machinery":"Non-target label training (NT): a retraining step that uses the outputs of standard training to weaken the model's connection between the trigger and the attacker's target label. Mutual learning (ML): a two-way exchange of soft label predictions between a clean-data teacher model and the NT-trained student model, so the student absorbs the teacher's clean classification behavior. The load-bearing object is the teacher-student pair: the teacher supplies clean knowledge, the student carries the trigger-related knowledge, and the mutual-learning objective is what merges them into a purified model.","core_discovery":"The paper's central claim is that a backdoored model can be purified without removing poisoned samples or knowing the trigger. The NT stage retrains the poisoned model so it stops committing to the attacker's target label, producing a student whose confident predictions on poisoned inputs point to the correct classes. A teacher trained on clean data carries reliable behavior; mutual learning exchanges soft predictions between teacher and student. The paper reports that the final student keeps high clean accuracy while driving attack success down across six backdoor attacks, and that this beats five comparison defenses using only a small clean set.","pith_inferences":["The teacher-student split suggests a general recipe for suppressing any learned spurious association, not just backdoor triggers: train one model on trusted data and another on the suspect data, then exchange soft labels.","An adaptive attacker who knows NT-ML could try to make the trigger also appear in the teacher's clean set or choose a target label that the NT stage does not suppress; testing this would bound the defense's real-world strength.","The small-clean-sample property hints the method could be applied in federated learning, where the server holds a small trusted set and clients hold poisoned updates, but the paper does not test that setting."],"forward_implications":["A defender can repair a poisoned model with only a small set of clean samples and no knowledge of the trigger.","The defense does not depend on detecting or filtering poisoned training samples, so it applies when the poisoning is invisible to inspection.","The purified model is a student produced by the same architecture, so deployment can switch from the poisoned model to the student without changing the model family.","The paper reports gains across six attacks, which if correct means the defense generalizes beyond one trigger type or one poisoning recipe."],"supporting_citations":[],"fun_headline_variants":["Mutual learning purges backdoors using few clean samples","NT-ML: Teacher-student trick defeats six backdoor attacks","Clean-data teacher helps poisoned student shed backdoors","Backdoor defense: Learn from clean teacher, not trigger removal","Purify poisoned models with mutual learning, no trigger needed"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The method assumes that the mutual-learning step will make the student drop the trigger association instead of preserving it or averaging teacher and student behavior, and that this optimization outcome holds for attacks the paper did not test.","fun_headline_variants_meta":{"raw":{"variants":["Mutual learning purges backdoors using few clean samples","NT-ML: Teacher-student trick defeats six backdoor attacks","Clean-data teacher helps poisoned student shed backdoors","Backdoor defense: Learn from clean teacher, not trigger removal","Purify poisoned models with mutual learning, no trigger needed"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000657,"raw_usage":{"total_tokens":2800,"prompt_tokens":653,"completion_tokens":2147,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":397,"completion_tokens_details":{"reasoning_tokens":2079}},"tokens_in":397,"tokens_out":2147,"duration_ms":14102,"temperature":1.0,"reasoning_tokens":2079,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T23:20:43.664344+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a standard image dataset and a known backdoor attack, poison a large fraction of training samples with a trigger that resembles a natural feature of the target class, run NT-ML with only the small clean set, and measure attack success rate on triggered test inputs. If the post-defense attack success rate stays near the undefended level while clean accuracy stays high, the claimed purification has not occurred.","supporting_citations":[],"review_version":1}