{"id":"515e362c-e9ec-4041-a277-27b86bb83007","arxiv_id":"2607.06643","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A DTMC of injection versus absorption shows that natural decay plus 10% lazy verification and weight penalties forces any bounded adversary's success probability to zero with no utility loss.","lead":"Natural backdoor absorption by honest updates, plus sparse lazy verification and dynamic trainer penalties, drives attack success probability asymptotically to zero in community AI training. Resource-constrained owners can therefore defend large models against stealthy backdoors without full recomputation.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"The asymptotic collapse claim rests on progressive weight depletion that is never formally shown to force lim p(t)=0 under a fixed-size coalition that can re-inject after partial penalties.","rationale":"The reader correctly flags the blind-horizon assumption as a modeling idealization that can break last-minute attacks, yet that assumption is not the most load-bearing gap for the asymptotic claim itself. The claim is an assertion about the long-run behavior of a time-inhomogeneous Markov chain whose transition probabilities are driven by weight penalties. The paper never proves that those penalties force Wmal\to0 for a fixed-size coalition; it simply writes the limit. Without that missing step the product of matrices need not collapse the success probability, even if the adversary remains completely blind to T. The empirical plots (Fig. 4) show collapse under the chosen parameters, but that is finite-horizon evidence, not a proof of the infinite-horizon statement. The verdict therefore remains CONDITIONAL, but the primary soft spot is the incomplete weight-depletion argument rather than (or in addition to) the horizon assumption. A short Monte-Carlo check of residual weight under the exact update rule would settle whether the gap is merely presentational or actually fatal to the guarantee.","tokens_in":16157,"tokens_out":633,"duration_ms":8104,"concrete_test":"Simulate the exact weight-update rule of Eqs. 8–9 for f=50, n=100, S=0.2, v=0.1, d=0.9 over 10^5 steps under both PPI and PRI topologies; record the empirical distribution of Wmal(t)/Wtotal(t) and of the occupation measure of the A-states. If either quantity fails to converge to 0 (or converges only after an unrealistically large number of detections), the lim p(t)=0 claim is unsupported by the stated mechanism.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The strongest claim (lim t\to∞ p(t)=0 and therefore lim P(Success)=0) is asserted in §4.5 via the weight-penalty rule Wi(t+1)=(1-S)·Wi(t) and the informal implication lim Wmal(t)=0. The DTMC analysis that precedes it (static PPI/PRI hitting times, renewal reward, and the product of time-inhomogeneous matrices) never supplies a rigorous argument that a fixed coalition of f trainers is driven to zero selection probability almost surely. Because each detection multiplies only the caught trainer’s weight by (1-S)<1, and because the adversary can still be scheduled (and can re-poison) between sparse detections (v=0.1), residual weight can remain positive indefinitely; the product of the evolving transition matrices therefore need not drive the absorption-state mass to zero. The blind-horizon assumption identified by the reader is real but secondary: even under perfect blindness the weight-depletion step itself is incomplete, so the asymptotic guarantee does not follow from the given formalization.","agreement_with_reader":"partial"},"referee_report":{"model":"grok-4.5","summary":"The paper studies backdoor resilience in a sequential community-training setting where a resource-constrained owner delegates steps to n trainers of which f are malicious. It models the competition between adversarial injection (budget τ consecutive malicious steps) and natural backdoor absorption (lifespan π honest steps) as a Discrete-Time Markov Chain with Progress-Preserving (PPI) and Progress-Resetting (PRI) injection topologies, derives expected hitting times and a static steady-state success probability via renewal reward, then proposes a composite defense of natural absorption, weight-based randomized scheduling, and lazy verification (audit probability v, detection rate d, penalty fraction S). The central claim is that progressive weight penalties drive the adversary’s selection probability to zero asymptotically (lim t→∞ p(t)=0), forcing attack success probability to collapse, with empirical support on ResNet-18/CIFAR-10/BadNet showing ASR reduced from ~99% to 7.2% at v=0.1 with stable clean accuracy.","tokens_in":16493,"tokens_out":1414,"duration_ms":25235,"significance":"If the asymptotic guarantee holds under the stated threat model, the work offers a practically useful and theoretically motivated alternative to exhaustive cryptographic auditing for decentralized/community training: security via sparse selective verification plus the network’s own absorption dynamics. Strengths include a clean closed-form DTMC treatment of PPI/PRI hitting times (Eqs. 2–4), an explicit renewal-reward baseline for static vulnerability (Eq. 7), numerical sensitivity analysis across (τ,π) and (p,q), and empirical confirmation that empirical ASR lies between the theoretical PPI upper and PRI lower bounds (Fig. 5) with only ~2.8% overhead at 10% lazy verification (Table 2). These elements make the contribution actionable for safety-critical community AI if the load-bearing asymptotic argument is completed.","major_comments":[{"comment":"§4.5, Eqs. (8)–(11): The paper asserts lim t→∞ Wmal(t)=0 ⇒ lim p(t)=0 and therefore asymptotic collapse of attack success, but supplies only the per-detection multiplicative rule Wi(t+1)=(1−S)·Wi(t) and an informal implication. There is no theorem establishing almost-sure (or high-probability) depletion of a fixed coalition of f trainers under sparse audits (v=0.1). Because only the caught trainer is penalized, detections are stochastic, and the adversary can still be scheduled and re-poison between detections, residual aggregate weight need not vanish; the ordered product of time-inhomogeneous matrices (Eq. 10) is not shown to drive absorption-state mass to zero. A rigorous argument (e.g., supermartingale / Borel–Cantelli on cumulative detections, or an explicit bound on limsup p(t)) is load-bearing for the abstract’s “we prove” claim and must be supplied or the claim weakened to a high","section":null},{"comment":"§3.2 (blind-horizon assumption) and §4.4–4.5: The entire asymptotic analysis relies on the adversary never learning remaining steps T−t and therefore being unable to concentrate injection near deployment. The manuscript correctly notes that last-minute injection would bypass absorption, yet provides no robustness analysis (partial horizon leakage, noisy estimates of T, or adaptive adversaries that treat verification events as signals). Because this assumption is identified as critical to the defense and is not an artifact of the DTMC alone, the paper should either (i) prove that weight depletion still forces success probability below a target even under limited horizon knowledge, or (ii) explicitly scope the guarantee to blind adversaries and quantify failure under horizon leakage.","section":null},{"comment":"§4.2–4.3 vs. §5: The formal bounds treat τ and π as fixed exogenous parameters of the attack/defense geometry, while the empirical evaluation calibrates τ=2, π=27 to match observed BadNet dynamics on ResNet-18/CIFAR-10 (Fig. 5 caption). The mapping from continuous ASR trajectories to discrete consecutive-step counters is not justified beyond calibration, nor is sensitivity to mis-estimated (τ,π) analyzed. Without a principled estimator or a demonstration that the collapse result is robust to moderate mis-specification of τ and π, the claimed bridge from DTMC theory to the empirical 7.2% ASR result remains incomplete.","section":null}],"minor_comments":[{"comment":"Abstract and §1 claim a “proof” that success probability collapses to zero; §4.5 presents only an informal limit implication. Align wording with the actual formal content once the depletion argument is completed.","section":null},{"comment":"Figure 3 caption and panel labels use “<” / “>” without defining the τ-vs-π regimes in the figure itself; add explicit (τ,π) values in the legend for readability.","section":null},{"comment":"Notation: p is used both for malicious selection probability and (in §5.1) for poisoning ratio; disambiguate (e.g., ρ for poisoning ratio as in §2.2).","section":null},{"comment":"Table 1 reports extreme values (e.g., µ′_I ≈ 1.11×10^10) without stating the exact (τ,π) pairs used; include them in the table header or caption.","section":null},{"comment":"Related work on backdoor absorption / catastrophic forgetting (Kemker et al., Du et al., Souly et al., Zhang et al.) is cited but the novelty relative to “absorption as defense” could be stated more sharply in §2.2–2.3.","section":null},{"comment":"Empirical evaluation is limited to BadNet on ResNet-18/CIFAR-10; a short note on expected behavior under other triggers (e.g., clean-label or sample-specific) would strengthen §5 without requiring full re-runs.","section":null}],"recommendation":"major_revision","confidential_remarks":"The core idea (absorption + sparse verification + weight penalties) is interesting and the static DTMC analysis is clean, but the manuscript currently overclaims a proof of asymptotic collapse that is not in the text. I would not reject on novelty grounds; the gap is fixable with a proper convergence argument or a carefully scoped high-probability finite-horizon theorem. Fit for a security/ML venue is good if the formal claim is repaired. The skeptic’s weight-depletion concern is real and should be treated as the primary revision item."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The one thing to know is that this paper turns the known fact that clean updates wash out backdoors into a closed-form DTMC (injection states I0…Iτ−1, absorption states A0…Aπ, PPI vs PRI topologies) and then adds a randomized scheduler plus sparse verification-plus-penalty to argue that any fixed coalition’s success probability goes to zero. That joint model, the hitting-time bounds, and the explicit 10 % lazy-verification claim are the actual new pieces; the absorption phenomenon itself and the PoTS-style oracle are already in the literature they cite.\n\nWhat it does well: the static analysis (geometric and renewal-reward hitting times, Eqs. 2–4 and 7) is clean and standard. The numerical plots and the ResNet-18/CIFAR-10/BadNet runs show ASR collapsing from ~99 % to 7 % with CACC untouched when v=0.1, which matches the story and sits between the PPI upper and PRI lower envelopes. Overhead is honestly reported as a few percent. The framing around community/sequential training and the blind-horizon threat model is coherent.\n\nSoft spots in proportion: the asymptotic claim (lim p(t)=0 via Wi ← (1−S)Wi) is asserted rather than proved for a fixed-size coalition under sparse detections. Once weights drop, selection probability drops, so the infinite-product argument needs a short extra lemma that residual mass still vanishes almost surely; without it the strongest sentence does not fully follow from the given formalization. Blind horizon is load-bearing—if the adversary can time the last steps the guarantee evaporates. Experiments are one architecture, one attack, one dataset, τ/π calibrated, no code. Those are real but not fatal; they are the usual “first paper” limits.\n\nThis is for people who care about low-overhead auditing in decentralized or community training. The math skeleton and the overhead numbers are worth a serious referee’s time even if the weight-depletion step and the empirics need tightening. I would send it out.","headline":"Clean DTMC of injection vs absorption plus lazy penalties that claims asymptotic collapse; the formal step from weight updates to lim p(t)=0 is incomplete, empirics are narrow but supportive.","tokens_in":17140,"tokens_out":526,"would_cite":false,"duration_ms":20132,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Natural backdoor absorption plus sparse verification drives attack success probability to zero in community training.","keywords":["backdoor attacks","community training","backdoor absorption","lazy verification","discrete-time Markov chain","Byzantine resilience","decentralized AI training"],"falsifier":"Run the same community-training protocol while giving the adversary exact knowledge of the remaining horizon T; if a last-minute injection still yields high attack success rate despite 10 percent lazy verification and weight penalties, the asymptotic claim fails.","tokens_in":17036,"feed_emoji":"🛡️","tokens_out":523,"duration_ms":6203,"temperature":0.7,"pith_summary":"When a resource-constrained owner must outsource model training to a community of trainers, some of whom may be malicious, full cryptographic re-checking of every step is too expensive. The paper shows that neural networks already \"wash out\" stealthy backdoors under a continuous stream of honest updates, and that this natural absorption can be turned into a defense. By modelling the tug-of-war between injection and absorption as a Markov chain, the authors prove that a light combination of randomized trainer selection and occasional verification (as little as 10 percent of steps) forces any bounded adversary's success probability to zero over time, without harming clean accuracy. The result matters because it offers a mathematically grounded way to secure decentralized training without the prohibitive cost of exhaustive audits.","feed_headline":"Sparse checks plus natural wash-out kill backdoors","feed_subtitle":"Ten-percent verification drives attack success to zero without hurting clean accuracy","key_machinery":"A Discrete-Time Markov Chain whose states track consecutive malicious injection steps versus consecutive honest absorption steps; under time-inhomogeneous penalties the adversary's selection probability is driven to zero, so the long-run probability of residing in a viable backdoor state vanishes.","core_discovery":"Under a composite defense that pairs the natural absorption of backdoors by honest updates with a randomized scheduler and a lazy verification oracle, the success probability of any adversary who controls only a fixed fraction of trainers collapses asymptotically to zero, even when the oracle is invoked on only a small fraction of training steps.","pith_inferences":[],"forward_implications":[],"fun_headline_variants":["Honest updates absorb backdoors; 10% checks drive attacks to zero","Sparse verification plus natural wash-out collapses backdoor success","Fixed-fraction adversaries fail as honest influx erases triggers","Absorption dynamics plus lazy oracle kill stealth backdoors","10% random checks suffice for asymptotic backdoor suppression"],"cache_read_input_tokens":128,"weakest_assumption_plain":"The adversary never learns how many training steps remain before deployment and therefore cannot simply poison the final steps to bypass absorption.","fun_headline_variants_meta":{"raw":{"variants":["Honest updates absorb backdoors; 10% checks drive attacks to zero","Sparse verification plus natural wash-out collapses backdoor success","Fixed-fraction adversaries fail as honest influx erases triggers","Absorption dynamics plus lazy oracle kill stealth backdoors","10% random checks suffice for asymptotic backdoor suppression"]},"model":"grok-4.5","effort":"low","cost_usd":0.004038,"raw_usage":{"total_tokens":1225,"prompt_tokens":732,"num_sources_used":0,"completion_tokens":64,"cost_in_usd_ticks":40380000,"prompt_tokens_details":{"text_tokens":732,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":429,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":732,"tokens_out":64,"duration_ms":5323,"temperature":1.0,"reasoning_tokens":429,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T00:40:25.555889+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Run the same community-training protocol while giving the adversary exact knowledge of the remaining horizon T; if a last-minute injection still yields high attack success rate despite 10 percent lazy verification and weight penalties, the asymptotic claim fails.","supporting_citations":[],"review_version":1}