{"id":"8a5ce53d-008b-40ad-8b35-b82f6b9e6c94","arxiv_id":"2608.00566","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A dual-penalty training loss that suppresses trigger-feature gradients hides tabular backdoors from Integrated Gradients, DeepSHAP, and CAD-Detect while maintaining high attack success.","lead":"The paper trains backdoored tabular models with an extra penalty that shrinks the model's input gradients on the trigger features, so that explainers like Integrated Gradients no longer flag the trigger. The authors claim this hides the backdoor from XAI auditors and from an anomaly detector called CAD-Detect, while keeping attack success above 90%.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The gradient-crushing penalty in Eq. (2) penalizes only the endpoint input-gradient norm, not the Integrated Gradients path integral, so the claimed systematic attribution suppression is not theoretically grounded.","rationale":"The reader's weakest assumption identifies the Feature Cost Hypothesis as an empirical, data-dependent claim about background-feature correlation. That is a valid concern, but the more load-bearing issue is methodological: the penalty in Eq. (2) does not directly minimize the metric (IG/DeepSHAP attribution) that the paper claims to crush. If the endpoint gradient is suppressed but the path integral remains large, the method fails even when background features are perfectly correlated. The CIFAR-10 result already shows the method's success is bounded, and Table 4 contradicts the '<0.02' claim on German Credit. The proposed test would settle whether the reported tabular successes are due to the penalty mechanism or to incidental properties of the datasets. The reader's verdict of CONDITIONAL remains appropriate, as the concern is a missing theoretical guarantee and inconsistent evidence, not a proven collapse of the method.","tokens_in":14212,"tokens_out":7231,"duration_ms":89490,"concrete_test":"For the German Credit and IEEE-CIS dual-penalty models, recompute Integrated Gradients attribution using three baselines: (i) the zero vector, (ii) the class-conditional mean of clean training data, and (iii) a randomly drawn clean sample. If A_target for any baseline exceeds 0.02, or if the maximum gradient norm along the path is large while the endpoint norm is small, then L_crush does not control the path integral and the claimed systematic attribution suppression fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that L_crush makes target feature attribution near-zero for IG and DeepSHAP. But Eq. (2) defines L_crush = Σ|∂ŷ_t/∂z_j|, the L1 norm of the gradient at the triggered input. Integrated Gradients, however, is a path integral: IG_j = (z_j - z'_j) · ∫_0^1 ∂f(z' + α(z - z'))/∂z_j dα. Penalizing the integrand only at α=1 does not bound the integral; a model can have zero gradient at the trigger while changing sharply along the path from baseline to trigger, producing large IG attribution. The paper never shows that trained models are linear along the IG path, and the Feature Cost Hypothesis is a restatement of the optimization objective, not a proof that path gradients vanish. This is a correctness risk: the reported A_target values may be artifacts of the specific baselines or data manifolds, not of the penalty mechanism. The paper's own Table 4 exposes this fragility: German Credit DeepSHAP A=0.0307 exceeds the abstract's '<0.02' claim, and the same baseline models disagree between Tables 2 and 4, undermining the empirical support.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a white-box evasion attack against post-hoc XAI auditors, targeting tabular backdoor models. The authors introduce a dual-penalty training objective: the standard cross-entropy loss plus a gradient-crushing penalty L_crush, defined as the L1 norm of the target-logit gradient with respect to trigger features. The penalty is applied after mapping categorical variables to continuous embeddings. The paper claims that this in-distribution training mechanism suppresses Integrated Gradients and DeepSHAP attribution on trigger features to near-zero (<0.02), preserves >90% attack success rates, and bypasses CAD-Detect conditional anomaly detection. Experiments are reported on COMPAS, German Credit, Communities & Crime, and IEEE-CIS, with an appendix on DeepSHAP and a CIFAR-10 boundary-condition study. The central theoretical framing is the 'Feature Cost Hypothesis,' which states that penalizing trigger gradients forces the network to offload inference onto unpenalized background features.","tokens_in":14477,"tokens_out":5543,"duration_ms":68297,"significance":"If the central claims held, the paper would demonstrate a serious vulnerability in first-order XAI auditing for tabular models: an adversary with white-box training control could conceal a backdoor while leaving no OOD routing footprint, defeating both attribution-based and CAD-Detect defenses. The paper has several strengths: a clearly stated white-box threat model; evaluation against two explainer families (Integrated Gradients and DeepSHAP) and CAD-Detect; an explicit boundary-condition experiment on CIFAR-10 that honestly reports a failure to evade detection; and an ablation on trigger shift magnitude. However, the significance is currently conditional on resolving two major concerns: the theoretical gap between the endpoint-gradient penalty and the path-integral computation used by Integrated Gradients, and empirical inconsistencies in the reported numbers across tables. The paper does not provide machine-checked proofs or released code, so the reproducibility of the empirical claims rests entirely on the clarity and consistency of the reported tables.","major_comments":[{"comment":"The central mechanism is not theoretically grounded. L_crush in Eq. (2) penalizes the L1 norm of the target-logit gradient with respect to trigger features at the triggered input, i.e., the endpoint gradient at z. Integrated Gradients, however, is a path integral: IG_j = (z_j - z'_j) * integral_0^1 ∂f(z' + α(z-z'))/∂z_j dα. A bound at α=1 does not bound this integral; a model can have zero gradient at the trigger while exhibiting large gradients along the interpolation path. The paper never shows that the trained models are linear along the IG path, nor does it offer a theorem under piecewise-linear ReLU activations. Thus the claim that L_crush 'mathematically' suppresses IG attribution is not established. I ask for either a formal argument or a direct empirical measurement of the path-gradient integral, with multiple baselines, to support the near-zero attribution claim.","section":"Methodology, Eq. (2); Preliminaries (Integrated Gradients)"},{"comment":"There are unexplained numerical inconsistencies between the main-text IG evaluation (Table 2) and the appendix DeepSHAP evaluation (Table 4) for what the text describes as the same model weights and configurations. For example, German Credit Standard Backdoor clean ACC is 62.94% in Table 2 but 67.18% in Table 4, and ASR is 88.00 vs. 80.67; Communities & Crime clean ACC is 86.49 vs. 86.25; IEEE-CIS clean ACC is 92.49 vs. 92.18. The Dual-Penalty German Credit result also differs: A_Target is 0.0198 in Table 2 but the DeepSHAP attribution is 0.0307 in Table 4, and the latter exceeds the abstract's '<0.02' claim. Moreover, the text states results are averaged over 10 runs, but no standard deviations or confidence intervals are reported anywhere. Given that the central claims rely on thresholds (A<0.02, Delta_cdf<0.11), the authors must report the same runs, explain the discrepancies, and pro","section":"Tables 2 and 4; Experimental Evaluation"},{"comment":"The Feature Cost Hypothesis is presented as the theoretical foundation of the method, but as stated it is a verbal restatement of the optimization objective: penalizing trigger gradients encourages the optimizer to find alternative features that satisfy the task loss. It is not a proof that background features will carry the backdoor or that path-integral attribution will vanish. The empirical validation for RQ3 is a single training-evolution curve on IEEE-CIS (Figure 3); no quantitative support is provided across the other three datasets. The framework also has several free hyperparameters (lambda, poisoning rate gamma, embedding dimension d_emb), but no sensitivity analysis is given; lambda=15 and gamma=0.15 are fixed. I request quantitative tests of the redistribution claim (e.g., reporting background attribution scores for all datasets and ablations over lambda and gamma), or the hyp","section":"The Feature Cost Hypothesis; Experimental Evaluation (RQ3)"},{"comment":"The abstract claims the method 'fundamentally bypasses Conditional Anomaly Detection' without restricting the claim to tabular data. This is contradicted by the paper's own CIFAR-10 experiment: the Dual-Penalty model in Table 5 yields Delta_cdf=0.2118, well above the τ_global≈0.11 threshold, and is flagged. While the appendix correctly identifies this as a boundary condition, the global wording in the abstract overstates the scope. Please qualify the claim to structured tabular data or adjust the abstract accordingly.","section":"Abstract; Table 5"}],"minor_comments":[{"comment":"The notation ||∇_z f_θ(z)_yt ⊙ δ||_1 is unclear. Eq. (2) sums over j in z_δ, which suggests a mask over trigger dimensions, while δ is described as a hybrid trigger transformation. Please clarify whether the gradient is masked or multiplied by the trigger shift magnitude.","section":"Algorithm 1, line 14"},{"comment":"The target attribution metric A_Target is not formally defined. Is it the sum, mean, or absolute mean of the attribution values over the trigger dimensions? Please provide an explicit formula to enable reproduction.","section":"Evaluation Metrics"},{"comment":"The CAD-Detect implementation is not described in enough detail. The threshold τ_global≈0.11 is mentioned, but the KNN parameters (k, distance metric, neighborhood size) and any preprocessing are omitted. This is needed to reproduce the detection results.","section":"Experimental Setup (CAD-Detect)"},{"comment":"The 'averaged over 10 runs' statement is not reflected in any reported error bars. Please include standard deviations or confidence intervals in all tables, especially for A_Target and ASR.","section":"Tables 2 and 3"},{"comment":"Several typographical and wording issues should be fixed: 'Comparision' -> 'Comparison', 'Generalisability' -> 'Generalizability', 'DeepShap' -> 'DeepSHAP' for consistency, and the repeated 'state-of-the-art' uses can be trimmed.","section":"Typos and wording"}],"recommendation":"major_revision","confidential_remarks":"The empirical inconsistencies between Tables 2 and 4 are the most serious issue; if they cannot be reconciled, the empirical basis for the paper collapses. I am nonetheless recommending major revision rather than rejection because the core idea is plausible and the authors honestly report a boundary-condition failure on CIFAR-10. The revision must address the path-integral gap, provide consistent and variance-aware results, and substantially soften or re-scope the theoretical claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line: this is a plausible attack that might work, but the paper overclaims and the evidence is sloppy. The core idea is simple: while training a backdoored tabular model, penalize the L1 norm of the gradient of the target logit with respect to the trigger features. Since IG and DeepSHAP are built from those gradients, it's no surprise that the reported attribution drops. That's a legitimate extension of Heo et al.'s gradient-regularization attack to tabular backdoors, and the cleanest part of the paper is the empirical demonstration that you can still get high attack success while forcing attribution down.\n\nBut there are real problems. The theory doesn't match the claim. Equation (2) penalizes the gradient at the triggered input, while Integrated Gradients integrates gradients along the whole path from baseline to input. A model can have zero gradient at the endpoint and huge gradients along the path, so the penalty doesn't mathematically guarantee low IG. The \"Feature Cost Hypothesis\" is just a restatement of the optimization objective, not a proof. The empirical results soften this, but they have integrity issues: Table 2 and Table 4 give different numbers for the same baselines (e.g., German Credit standard backdoor clean ACC 62.94 vs 67.18), and no error bars are reported despite saying results are averaged over 10 runs. German Credit's A_Target is 0.0198 for IG, barely under the 0.02 claim, and the DeepSHAP number is 0.0307, which contradicts the abstract's blanket \"<0.02\". Also, \"bypasses CAD-Detect\" is expected because CAD-Detect was designed to catch scaffolding attacks; an attack that doesn't toggle should naturally not be flagged.\n\nOn the plus side, the authors are honest about the CIFAR-10 boundary condition, and the DeepSHAP generalization test is a good idea. The idea deserves serious scrutiny, but not in its current form. The claims need to be narrowed to \"empirically reduces attribution on these datasets\" and the tables need to be consistent. Code and seeds would help a lot.\n\nWho's this for? People working on adversarial attacks on XAI. I'd send it to peer review, not desk reject, because the attack might work and the failure mode (overclaiming from endpoint gradient) is instructive. But I'd expect major revision before publication.","headline":"Plausible attack, overclaimed: endpoint gradient penalty doesn't bound path-integral attributions, and the tables contradict each other.","tokens_in":15001,"tokens_out":2406,"would_cite":false,"duration_ms":27318,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A training-time regularization penalty can hide a backdoored model from white-box explainability audits, pressing trigger feature attributions to near zero while keeping attack success above 90 percent on four tabular benchmarks.","keywords":["adversarial explainability","gradient-crushing penalty","backdoor attack","tabular data","Feature Cost Hypothesis","CAD-Detect evasion","white-box audit","Integrated Gradients"],"falsifier":"Take a tabular dataset and permute all background features so they are statistically independent of the target label; train the dual-penalty model with the same recipe. If attack success remains above 90% with attribution near zero, the Feature Cost Hypothesis's redistribution story is wrong. Alternatively, run a KNN-based anomaly detector on the penultimate-layer activations of the trained model, rather than on its prediction distributions; if triggered samples cluster separately from clean ones, the backdoor is detectable despite the near-zero attribution scores.","tokens_in":14021,"feed_emoji":"🕵️","tokens_out":7900,"duration_ms":85623,"temperature":0.7,"pith_summary":"An adversary with control over training can build a backdoored neural network that passes even white-box explainability audits. The paper's dual-penalty objective adds a gradient-crushing term to the usual classification loss: it penalizes the magnitude of the trigger features' input gradients, forcing the network to satisfy the backdoor task using benign background features instead of the trigger itself. On four tabular benchmarks the authors report trigger attributions below 0.02 (often below 0.002), attack success rates above 90 percent, and CAD-Detect anomaly scores near zero, so the backdoor is neither visible to Integrated Gradients/DeepSHAP nor flagged by conditional anomaly detection. The paper also documents a boundary: on CIFAR-10 images the penalty still suppresses attribution but the spatial redistribution of features leaves detectable internal anomalies, so the evasion is characteristically tabular.","feed_headline":"Training-time penalty hides backdoored models from XAI auditors","feed_subtitle":"Dual-penalty loss keeps trigger attribution below 0.02 while attack success stays above 90 percent.","key_machinery":"The gradient-crushing penalty L_crush is the central mechanism: the L1 norm of the target-class logit gradient taken with respect to the trigger's dimensions in a continuous embedding space, added to the task loss with weight λ. Because categorical tabular variables are mapped to dense differentiable embeddings before fusion, the penalty operates through standard backpropagation. The penalty raises the 'feature cost' of the trigger so the optimizer decouples prediction from the trigger and shifts causal attribution onto unpenalized background features—this redistribution is what the paper formalizes as the Feature Cost Hypothesis.","core_discovery":"The paper's central claim is that a backdoor can be rendered mathematically invisible to first-order explainability auditors by taxing the model's sensitivity to the trigger during training. The dual-penalty loss takes the form L_CE + λ·L_crush, where L_crush is the L1 norm of the derivative of the target-class logit with respect to the trigger's continuous-embedding dimensions. This directly inflates the optimization cost of relying on the trigger, and the Feature Cost Hypothesis states that the network responds by offloading the inferential burden onto unpenalized background variables. The reported result is that standard backdoor attacks leave massive attribution spikes (up to 2.58), whil","pith_inferences":["A natural defensive extension is to inspect second-order information, such as the Hessian of the target logit with respect to the trigger dimensions, since the L_crush penalty only constrains first-order sensitivity; the paper itself points to second-order attribution as future work.","The Feature Cost Hypothesis implies a falsifiable control experiment: on a tabular dataset where background features are permuted to be statistically independent of the target class, the attack should lose its success rate, thereby bounding the threat to datasets with informative background structure.","The penalty's fixed weight λ=15 may be dataset-dependent; scanning λ would reveal the minimal tax needed and whether a regime exists where attribution remains suppressed only at the cost of attack success.","Because the mechanism operates in the continuous embedding space, analogous attacks may transfer to other learned-embedding architectures (e.g., transformers over categorical covariates), with the same predicted boundary on spatial or correlated feature manifolds."],"forward_implications":["White-box audits that inspect first-order gradients (Integrated Gradients) or distributional attributions (DeepSHAP) can be completely blinded by training-time regularization, so full architectural transparency does not guarantee forensic security.","Defenses built on out-of-distribution anomaly detection, like CAD-Detect, are defeated by this attack because the model never leaves the data manifold: the evasion is encoded in weights, not in a toggling wrapper.","An attacker can use subtle triggers (a +1σ shift on one continuous feature plus a categorical change) and still achieve 100% attack success with near-zero attribution, defeating simple outlier filters as well as explainers.","The attack is bounded by feature structure: on spatially correlated inputs such as images, suppressing the trigger forces a detectable internal rewiring, so the evasion succeeds only where features are independently embedded (tabular data)."],"supporting_citations":[{"why":"Defines CAD-Detect and CAD-Defend, the conditional anomaly detection defense framework this attack claims to bypass, along with the Δ_cdf metric used for evaluation.","marker":"(Carmichael and Scheirer 2023)"},{"why":"Introduced the standard backdoor (BadNets) attack, which serves as the baseline for both the vulnerability and the attribution-footprint comparison.","marker":"(Gu, Dolan-Gavitt, and Garg 2017)"},{"why":"Proposed the scaffolding attack against LIME and SHAP that the paper compares against as the prior black-box evasion approach.","marker":"(Slack et al. 2020)"},{"why":"CatBack introduced continuous categorical embeddings for tabular backdoors, providing the differentiable manipulation space the dual-penalty method relies on.","marker":"(Tajalli, Koffas, and Picek 2026)"},{"why":"Provided Integrated Gradients, the primary white-box attribution method used to measure target feature attribution in the experiments.","marker":"(Sundararajan, Taly, and Yan 2017)"},{"why":"Provided SHAP/DeepSHAP, the distributional explainer used to test whether the evasion generalizes beyond static-baseline attribution.","marker":"(Lundberg and Lee 2017)"},{"why":"Demonstrated that network parameters can be manipulated to mislead saliency maps, a conceptual precursor to training-time attribution control.","marker":"(Heo, Joo, and Moon 2019)"}],"fun_headline_variants":["Train-time penalty crushes XAI attribution to near zero","Dual-penalty training erases trigger footprints from XAI","Backdoors made invisible to explainable AI auditors","Stealthy backdoor: training loss hides trigger from XAI","How to hide a backdoor from LIME, SHAP, and IG"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The attack works only if the background (non-trigger) features carry enough information about the target class that the network can still learn the backdoor after being penalized for using the trigger; the paper's own CIFAR-10 experiment shows this redistribution can also create detectable anomalies when features are spatially correlated.","fun_headline_variants_meta":{"raw":{"variants":["Train-time penalty crushes XAI attribution to near zero","Dual-penalty training erases trigger footprints from XAI","Backdoors made invisible to explainable AI auditors","Stealthy backdoor: training loss hides trigger from XAI","How to hide a backdoor from LIME, SHAP, and IG"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000431,"raw_usage":{"total_tokens":2060,"prompt_tokens":790,"completion_tokens":1270,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":534,"completion_tokens_details":{"reasoning_tokens":1183}},"tokens_in":534,"tokens_out":1270,"duration_ms":10311,"temperature":1.0,"reasoning_tokens":1183,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T00:38:49.300745+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a tabular dataset and permute all background features so they are statistically independent of the target label; train the dual-penalty model with the same recipe. If attack success remains above 90% with attribution near zero, the Feature Cost Hypothesis's redistribution story is wrong. Alternatively, run a KNN-based anomaly detector on the penultimate-layer activations of the trained model, rather than on its prediction distributions; if triggered samples cluster separately from clean ones, the backdoor is detectable despite the near-zero attribution scores.","supporting_citations":[],"review_version":1}