{"id":"aab395cd-ec66-4510-8333-7d5d5a368b3c","arxiv_id":"2508.05409","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"A majority vote of large vision-language models is claimed to detect backdoor triggers in face images, with calibrated noise correcting poisoned samples at 100% accuracy.","lead":"This paper proposes TrueBiometric, a face-recognition defense that has multiple large vision-language models vote on whether an image is backdoor-poisoned, then applies calibrated noise to neutralize any trigger found. The abstract claims 100% detection and correction accuracy with no loss of clean-image accuracy, but only the abstract could be reviewed because the full text is unreadable.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"100% detection/correction claim hinges on unverified VLM majority-vote reliability and undisclosed noise calibration; no experimental protocol is visible.","rationale":"The reader's UNVERDICTED verdict is appropriate because the full text is unreadable and the central claim cannot be checked. The reader's weakest assumption—that VLMs reliably flag all poisoned images without false positives—matches my identification of the most load-bearing condition for the abstract's 100% claim. I also agree that the noise-calibration step is a second dependency: if calibration uses the evaluation samples, the correction result would be self-fulfilling. My recommendation is unchanged because the concern does not resolve the verdict either way; it only reinforces the need for the actual experimental details. A concrete, reproducible test would settle whether the concern lands, but until the paper provides a readable method section, the claim remains unverified. I find no additional independent support in the supplied text; the corrupted content and the extraneous arXiv ID further reduce confidence but do not constitute a separate technical objection to the method itself.","tokens_in":8299,"tokens_out":3771,"duration_ms":37487,"concrete_test":"Construct a held-out evaluation set from a public face dataset (e.g., CelebA or LFW) containing clean faces and faces poisoned with the three trigger types (sticker, makeup, patterned mask) at realistic sizes/subtlety. Run the TrueBiometric detection stage (or a faithful reimplementation) and measure majority-vote detection accuracy and clean-image false positive rate. Then apply the corrective noise to flagged samples, retrain a face recognition model, and evaluate both clean-image accuracy and attack success rate on triggered probes. If detection accuracy is below 100%, any clean image is flagged, or the backdoor persists, the central claim is falsified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is absolute: TrueBiometric detects and corrects poisoned images with 100% accuracy and zero clean-image degradation. For this to hold, the VLM majority vote must flag every poisoned image (sticker, makeup, patterned mask) while never flagging a clean face, and the corrective noise must fully erase the backdoor without altering identity features. Neither condition is established by the abstract. VLMs are not specialized backdoor detectors; triggers can be small or blended, and an ensemble majority may miss a trigger class or concur on false positives. The noise calibration rule is undisclosed, so if it is tuned on the same poisoned samples later used for evaluation, the 100% correction figure is partly circular. The supplied full text is corrupted beyond readability and even embeds the arXiv identifier of an unrelated cond-mat paper, so no dataset, baseline numbers, error analysis, or code can be inspected to rule out these risks. The load-bearing premise—flawless VLM-trigger discrimination plus leakage-free noise calibration—is therefore unsupported and unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TrueBiometric, a backdoor defense for face recognition that combines a committee of large vision-language models (VLMs) with majority voting to detect poisoned training images, and applies 'targeted and calibrated corrective noise' to neutralize the embedded trigger. The abstract states that extensive empirical results show 100% detection and correction accuracy with no degradation of clean-image accuracy, and claims superiority over existing defenses. Only the abstract is readable in the submitted manuscript; the full text is corrupted to the point that no methods, equations, tables, or evaluation details can be inspected.","tokens_in":8370,"tokens_out":3994,"duration_ms":40070,"significance":"If the 100% claims held, this would be a relevant and practical defense: a VLM-based detector would require no model training and the noise-based correction could preserve face recognizer utility. The conceptual idea of using VLM perceptual judgment as a trigger oracle is interesting and worth testing. However, the manuscript as submitted supplies no datasets, no VLM committee specification, no trigger/attack configurations, no baselines, no error analysis, no code, and no machine-checked proofs. The full text is unreadable. Consequently the contribution is, in its current form, an abstract-level proposal whose load-bearing empirical assertions are unverifiable.","major_comments":[{"comment":"The central claim, 'TrueBiometric detects and corrects poisoned images with 100% accuracy without compromising accuracy on clean images,' is an empirical claim about a complete pipeline, but the manuscript provides no datasets, no number or names of VLMs, no trigger configurations, no attack settings, no baselines, no error bars, and no error analysis. The claim is asserted in a single sentence. Without these details the 100% figure is unfalsifiable and the comparison with state-of-the-art approaches cannot be checked.","section":"Abstract"},{"comment":"The supplied full text is unreadable: it consists of mojibake/line noise, and the only intelligible artifact is the line 'arXiv:2508.05406v2 [cond-mat.str-el] 12 May 2026', which is the identifier of an unrelated condensed-matter paper. No methods, equations, tables, or figures are accessible. Consequently the detection stage (majority voting mechanism), the correction stage (targeted and calibrated corrective noise), and all evaluation results are beyond inspection. This is load-bearing: the paper's sole contribution is an empirical pipeline.","section":"Full text (corrupted)"},{"comment":"The phrase 'targeted and calibrated corrective noise' is the second load-bearing element, but no calibration rule is reported. If the noise magnitude is selected per trigger using the same poisoned samples on which correction accuracy is later measured, the 100% correction figure is partly circular. The manuscript must specify how the noise calibration is fixed before evaluation (e.g., a separate validation set or pre-registered rule), and must show the residual attack success rate after correction on held-out poisoned images. The current text provides no such information.","section":"Correction stage (described in Abstract)"},{"comment":"The load-bearing premise is that a majority of large vision-language models will flag all poisoned images (sticker, makeup, patterned mask) and no clean images. VLMs are not trained as backdoor detectors; triggers can be small, low-contrast, or blended into the face. The abstract provides no evidence that the VLM committee has perfect precision/recall across trigger types. A single missed trigger class or systematic false-positive pattern invalidates the 100% detection claim. The authors need to report per-trigger detection rates and false-positive rates on clean faces.","section":"Detection stage (Abstract)"}],"minor_comments":[{"comment":"The phrase 'practical, accurate, and effective' in the comparison sentence is vague; no quantitative comparison is presented in the readable text.","section":"Abstract"},{"comment":"The embedded arXiv line for an unrelated cond-mat paper suggests a corrupted upload; the authors should verify the submitted source.","section":"Full text (corrupted)"}],"recommendation":"reject","confidential_remarks":"The manuscript as supplied is not a reviewable document. I recommend desk rejection or return for a complete, readable version before any technical review. If a corrected version is resubmitted, the key checks are: (1) a non-circular noise-calibration protocol, (2) per-trigger VLM detection precision/recall, and (3) held-out attack-success-rate measurements after correction."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The abstract describes a genuinely new assembly: an ensemble of vision-language models voting on whether a face image is poisoned, followed by noise-based correction of flagged samples. If the 100% detection and correction claim held, this would be a practical drop-in defense that needs no retraining and no prior trigger knowledge. That is a meaningful if modest novelty, and the pipeline is clearly described. The abstract is easy to follow and the motivation (existing defenses trade utility for safety) is legitimate.\n\nThat said, the central claim is a literal 100% on two metrics, and nothing in the provided material supports it. No datasets, no trigger configurations, no baselines, no noise-calibration rule, no error analysis. The stress-test note is right: the load-bearing premise is that a majority of VLMs flags every poisoned image without flagging clean faces. That is a strong empirical assumption, and VLMs are not specialized backdoor detectors. Small or blended triggers could slip through, and the ensemble could also concur on false positives.\n\nThe correction stage is the other soft spot. The abstract says \"targeted and calibrated corrective noise\" but does not say how the calibration is done. If the noise is tuned on the same poisoned samples later used for evaluation, the 100% correction figure becomes partly circular. A referee would need to see the exact calibration rule and whether it uses any information from the test set.\n\nAlso note: the supplied full text is corrupted beyond readability and embeds an unrelated cond-mat arXiv identifier. I can only review the abstract. That is not a flaw of the method per se, but it means no independent check of the claims is possible from the manuscript as submitted.\n\nIs the thinking serious? Based on the abstract, yes — the problem is well-framed and the proposed mechanism is coherent. The idea deserves a fair hearing. But the submission currently lacks the empirical bone-structure needed to support its headline claim. A serious referee could do useful work here, but only after the authors provide a readable manuscript and the missing experimental protocol.\n\nFor you: this is a \"maybe\" for a reading group; you could discuss the VLM-as-trigger-detector idea without dwelling on the numbers. I would not cite it until the experiments are verifiable. If I were an editor, I would not desk-reject it — the topic is relevant and the approach is testable — but I would ask for a clean version and send it to a skeptical reviewer.","headline":"Plausible new pipeline, but the 100% claim is unverifiable from the abstract and the supplied full text is unreadable — worth a referee only after a clean copy and real experimental detail are provided.","tokens_in":9026,"tokens_out":2128,"would_cite":false,"duration_ms":23656,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TrueBiometric uses a majority vote of vision-language models to detect every poisoned face image, then neutralizes the trigger with calibrated noise, at no cost to clean-image accuracy.","keywords":["backdoor attacks","face recognition","poisoned training data","vision-language models","majority voting","corrective noise","trigger neutralization","biometric security"],"falsifier":"Run TrueBiometric on a face dataset poisoned with very small, semi-transparent, or texture-blended triggers that a panel of vision-language models tends to overlook; if even a single poisoned image passes the majority vote, or a single clean image is 'corrected' in a way that breaks its identity match, the 100% detection-and-correction claim is refuted.","tokens_in":8065,"feed_emoji":"🛡️","tokens_out":4918,"duration_ms":51576,"temperature":0.7,"pith_summary":"This paper proposes TrueBiometric, a data-stage defense against backdoor attacks in face recognition. The idea is to screen training images with a panel of large vision-language models: if a majority flags an image as manipulated, it is counted as poisoned and repaired with calibrated corrective noise before training. The authors report 100 percent detection and correction across sticker, makeup, and patterned-mask triggers, with clean-image accuracy unchanged. If the claim is right, defenders can neutralize unknown backdoor triggers without knowing the attack recipe.","feed_headline":"Backdoored faces caught and fixed at 100 percent","feed_subtitle":"A vision-language voting panel spots poisoned training images, and calibrated noise removes the trigger without hurting clean accuracy.","key_machinery":"The load-bearing mechanism is a majority-voting ensemble of large vision-language models used as perceptual poison detectors, paired with a noise-based neutralization step. Rather than matching a known trigger pattern, the ensemble relies on each model's visual-language judgment of whether an image looks anomalous or manipulated, and consensus decides. The correction stage then injects calibrated noise into flagged images, tuned to break the learned association between trigger and target identity without erasing the facial features the recognition model depends on.","core_discovery":"The central claim is that backdoor poisoning of face recognition can be caught at the data-preparation stage rather than at the trained model. TrueBiometric asks several state-of-the-art large vision-language models to inspect each training image and treats majority agreement that an image is manipulated as the poison signal. Flagged images are then passed through a 'targeted and calibrated corrective noise' step, which the authors say destroys the trigger-to-target association learned during training while leaving identity cues intact. The reported result is a 100 percent detection-and-correction rate on poisoned images and no drop in accuracy on clean images across the trigger types tested","pith_inferences":["Extension: test the same majority-vote detector on hidden or blended triggers—small patches, semi-transparent overlays, or high-frequency textures—since the reported triggers are all plainly visible; a drop in consensus would bound how general the 100% claim really is.","Extension: measure identity verification on corrected images directly; if calibrated noise removes the trigger but also shifts face embeddings, the 'no compromise on clean images' claim depends on the evaluation metric chosen.","Extension: run the noise-calibration step at varying intensities and check whether there is a threshold below which the backdoor persists and above which face matching degrades; this would expose the safety margin in the 100% result.","Extension: test panels assembled from vision-language models with different training distributions; if all models share the same perceptual blind spot, majority voting amplifies rather than corrects the flaw."],"forward_implications":["A training-time screening step can remove backdoor risk without requiring the defender to know which images were poisoned, which trigger was used, or which class was targeted.","Because the defense acts on the dataset, the same corrected data can be reused to train future models without re-running the attack analysis.","The reported 100% detection rate implies that visible triggers such as stickers, makeup, and patterned masks are consistently recognizable to a majority of modern vision-language models.","Preserving clean-image accuracy means the correction step could be applied routinely to whole training sets rather than only to suspicious examples."],"supporting_citations":[],"fun_headline_variants":["Vision-language jury catches and fixes backdoor faces","Vision-language models catch and fix backdoored faces at 100%","Majority-vote vision-language model fixes face backdoors","Vision-language panel detects and neutralizes face backdoors"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The claim stands or falls on the assumption that a majority of large vision-language models reliably flags every poisoned image—across all trigger types—while never flagging clean faces; if the models share a blind spot or a false-positive bias, the 100% numbers collapse.","fun_headline_variants_meta":{"raw":{"variants":["Vision-language jury catches and fixes backdoor faces","Vision-language models catch and fix backdoored faces at 100%","Majority-vote vision-language model fixes face backdoors","Vision-language panel detects and neutralizes face backdoors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000538,"raw_usage":{"total_tokens":2410,"prompt_tokens":723,"completion_tokens":1687,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":467,"completion_tokens_details":{"reasoning_tokens":1620}},"tokens_in":467,"tokens_out":1687,"duration_ms":12795,"temperature":1.0,"reasoning_tokens":1620,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T23:21:41.605135+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run TrueBiometric on a face dataset poisoned with very small, semi-transparent, or texture-blended triggers that a panel of vision-language models tends to overlook; if even a single poisoned image passes the majority vote, or a single clean image is 'corrected' in a way that breaks its identity match, the 100% detection-and-correction claim is refuted.","supporting_citations":[],"review_version":1}