{"id":"1c379c9d-6347-4932-980d-697608d8ac1f","arxiv_id":"2608.04029","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Trajectory-aware label flipping attacks degrade contrastive mmWave human activity recognition, and a selective contrastive learning defense keeps accuracy above 90% even at 40% poisoned labels.","lead":"This paper tests three label-flipping attacks against millimeter-wave human activity recognition systems trained with supervised contrastive learning, and proposes a defense that selects trustworthy training pairs. A generalist reader might care because wireless activity recognition is moving into health and surveillance, where poisoned training labels are a realistic threat.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Sel-CL's confident-example filter (Eq. 4) is unvalidated: no evidence that UCL-based KNN pseudo-labels recover true labels under inner-trajectory attacks, so the >90% accuracy claim may rest on an untested assumption.","rationale":"The reader's conditional verdict is appropriate and my concern reinforces it. The reader's weakest assumption identified the failure regime of confident-example selection; I agree with the core issue but refine the mechanism: label flipping does not directly distort the UCL embedding because UCL is unsupervised, so the real risk is that UCL embeddings do not separate similar-trajectory classes well enough for KNN pseudo-labels to recover true labels. This matters most for the inner-trajectory symmetric attack at 40% poisoning, where the paper nevertheless claims >90% accuracy (Figure 16). The missing evidence is the true-label quality of the pseudo-labels and the precision of the confident set T; without it, the defense's central claim is unverified rather than disproven. The concrete test proposed would settle the concern. Other issues noted by the reader (no error bars, no baselines, under-specified alpha/beta/K) are secondary; the selection-mechanism validation is the load-bearing one because if the filter fails, no amount of error bars repairs the claim. I therefore recommend no change to the reader's CONDITIONAL verdict.","tokens_in":19817,"tokens_out":11190,"duration_ms":132055,"concrete_test":"Reproduce the Sel-CL pretraining stage from Section 5.2 on the poisoned training set for each attack at 20% and 40% poisoning. Using the authors' true labels, compute (a) pseudo-label accuracy: fraction of samples whose majority-neighbor label y_hat_i equals the true label y_i; and (b) confident-set precision: fraction of samples in T (Eq. 4) whose given label y_tilde_i equals the true label. If for the inner-trajectory symmetric attack at 40% poisoning the confident-set precision is below 95%, the filter admits substantial poisoned labels and the >90% test accuracy in Figure 16 requires re-validation; if precision exceeds 95%, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central defense claim (Section 6.3: 'Sel-CL still maintains an accuracy of above 90% for all attacks' at 40% poisoned labels) depends on the confident-example filter in Section 5.2. The filter (Eq. 4) admits an example x_i only if the cross-entropy loss between the KNN-derived class distribution q_hat(x_i) and the given (possibly poisoned) label y_tilde_i is below a class threshold. This is sound only if, for clean examples, the majority label among K=250 nearest neighbors in the UCL embedding space equals the true class, and for poisoned examples the majority neighbor label disagrees with the flipped label. Because UCL is unsupervised, label flipping does not directly distort the embedding, but the embedding may still fail to separate the paired similar-trajectory classes (Push/Pull, Slide Left/Right, Clockwise/Anticlockwise) used in the inner-trajectory attack. Under 40% symmetric inner-trajectory poisoning, a clean Push example whose UCL neighbors are dominated by Pull will have q_hat peaked at Pull and be excluded from T; conversely, a poisoned Push-to-Pull example embedded near true Push samples may pass the filter if its flipped label is Pull. The paper never reports the true-label accuracy of the pseudo-labels, the precision of the confident set T, or the fraction of poisoned labels that survive filtering. Without this, the claimed robustness to inner-trajectory attacks (the paper's own most damaging fixed-label attack) is not established; the reported >90% accuracy may be an artifact of an unvalidated selection mechanism rather than a robust defense.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies label flipping poisoning attacks on millimeter-wave (mmWave) human activity recognition (HAR) systems trained with supervised contrastive learning (SCL). It introduces three attacks—random label flipping, across-trajectory flipping (between activities with dissimilar trajectories), and inner-trajectory flipping (between activities with similar trajectories, e.g., Push/Pull, Slide Left/Right, Clockwise/Anticlockwise)—and evaluates them on a self-built mmWave radar dataset with six hand activities. The paper further proposes a defense, Sel-CL, which uses unsupervised contrastive learning (UCL) to identify 'confident' examples and pairs from the poisoned dataset, then trains SCL on those selected examples. Experiments report that the attacks significantly degrade accuracy of both supervised and SCL baselines, and that Sel-CL maintains above 90% test accuracy up to 40% poisoned labels for all attacks, with clean-data accuracy of 98.78%. The paper claims to be the first systematic study of label flipping in mmWave-based HAR and emphasizes that the defense does not require a trusted dataset.","tokens_in":20199,"tokens_out":5723,"duration_ms":62607,"significance":"The paper addresses a real and previously underexplored security concern: poisoning of the training data used by contrastive-learning-based wireless HAR. The trajectory-aware attack taxonomy (random, across-, inner-trajectory) is a useful framing that captures the intuition that similarly moving activities are harder to distinguish, and the experimental prototype uses data from 25 volunteers across multiple environments with a domain-shift test set. The proposed defense is notable for avoiding the trusted-dataset assumption of prior label-noise defenses, instead relying on UCL embeddings and KNN pseudo-labels. If the robustness claims are empirically solid, this would be a meaningful contribution to the WiSec community. However, the current empirical validation is insufficient: only single-run accuracy curves are reported, no comparison to prior robust-training baselines is given, and the core confident-example selection mechanism is not validated with diagnostic metrics. The paper's contribution is thus conditional on additional experiments that, in principle, are within the manuscript's scope.","major_comments":[{"comment":"The central robustness claim—that Sel-CL maintains above 90% accuracy at 40% poisoned labels for all attacks—is supported only by single-run accuracy curves with no error bars, confidence intervals, or repeated independent runs. As a result, the reported margins (e.g., the differences among the attack curves in Figure 16 and the ordering of attack potency in Figure 14) cannot be distinguished from training noise. Please report means and standard deviations over at least five independent runs, and where applicable use paired significance tests across attack conditions.","section":"Section 6.3, Figure 16"},{"comment":"The confident-example filter defined by Eq. (4) is the mechanism that is claimed to remove poisoned labels, but the paper never reports diagnostics: the accuracy of the KNN pseudo-labels q̂(x_i), the precision/recall of the confident set T, or the fraction of flipped labels that survive selection. For the inner-trajectory attack (which flips between similar classes such as Push/Pull), it is not demonstrated that UCL embeddings place true same-class instances among the top-250 nearest neighbors; if they do not, Eq. (4) can exclude clean examples or admit poisoned ones, and the reported >90% accuracy under inner-trajectory attacks is not established. Please add these diagnostics, broken down by attack type and poisoning ratio.","section":"Section 5.2, Eq. (4)"},{"comment":"The defense has multiple hyperparameters: K (nearest neighbors for pseudo-labels), the α-percentile for class thresholds γ_c, the β-fractile for pair-similarity threshold γ, the Mixup Beta distribution parameters, the temperature θ in the contrastive losses, and the loss weights λ_c and λ_s. All experiments use a single default setting, and no sensitivity analysis is provided. The only justification is a sentence in Section 5.2 that the method's efficacy remains stable once K is sufficiently high, with no supporting data. Because the thresholds are derived from the poisoned training data itself, it is essential to show that the defense does not rely on finely tuned values that happen to work for this specific dataset. Please provide ablations over K, α, β, and θ.","section":"Section 5.2 and Section 6"},{"comment":"The evaluation does not compare Sel-CL to any prior defense or robust training baseline, even though the defense is explicitly adapted from selective-supervised contrastive learning (Ref. [15]) and multi-objective interpolation training (Ref. [23]). Without comparison to these baselines under the same attack settings, the reader cannot tell whether the observed robustness comes from the proposed modifications or from pre-existing methods. Please include at least the two cited baselines (Li et al. and Ortego et al.) evaluated under the same conditions.","section":"Section 6.3"}],"minor_comments":[{"comment":"The definition of the α-percentile is unclear: the text says 'calculated as: Σ_i I[ŷ_i = ỹ_i] I[ỹ_i = c], c∈[6]' which is a per-class agreement count, not a percentile. Please clarify the exact procedure and report the α and β values used.","section":"Section 5.2"},{"comment":"The symmetric and asymmetric attack definitions are only described in prose. A formal definition with equations (e.g., which classes are flipped in which direction and how many samples) would improve precision and reproducibility.","section":"Section 4.2"},{"comment":"The data split (6,300 training, 2,100 validation, 2,250 test) sums to the stated 10,650, but the split by environment is described only in prose. A table listing the number of samples per environment and per class would be helpful.","section":"Section 6.1"},{"comment":"Some figure captions have garbled or missing text in the extracted manuscript, and the confusion matrices lack a legend or color scale description, making them difficult to interpret. Please ensure the final figures are complete and self-explanatory.","section":"Figures 6-9"},{"comment":"The paper claims 'first systematic study' twice; to avoid overclaiming, it would be useful to more explicitly delineate the novelty of the defense relative to Refs. [15] and [23], since the defense is an adaptation of these methods.","section":"Section 1 and Section 7"},{"comment":"The temperature θ in Eqs. (1) and (5) and the Mixup Beta distribution parameters are not reported. Please provide the exact values or a reference to the implementation.","section":"Section 5.2 and 5.3"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a worthwhile problem and the core idea—trajectory-aware label flipping plus a UCL-based confident-sample selection—is plausible. However, the empirical support is not yet at the level expected for a security venue: no repeated runs/error bars, no baseline comparisons, and no validation of the confident-selection mechanism. These are fixable within the manuscript's scope, so I recommend major revision rather than rejection. I would also encourage the editor to consider whether the defense's technical novelty relative to Refs. [15] and [23] is sufficiently articulated, and whether the lack of code/artifacts is acceptable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth engaging with. The paper does something concrete: it defines three label-flipping attacks that exploit trajectory similarity (random, across-trajectory, inner-trajectory), and it shows that supervised contrastive learning collapses faster than plain supervised learning under these attacks. That last point is the most valuable finding and is new for mmWave HAR. The defense is not revolutionary—it is explicitly adapted from Sel-CL and MOIT—but the no-trusted-dataset requirement is practically meaningful for wireless sensing.\n\nWhat it does well: the trajectory taxonomy (push/pull, slide left/right, clockwise/anticlockwise) is simple and maps directly to the confusion one would expect in radar heatmaps. The evaluation on a prototype with 25 volunteers, multiple environments, extreme angles, and both symmetric and asymmetric attacks is more thorough than most wireless-sensing security papers. The feature-space visualizations support the qualitative claim that SCL is more vulnerable. I believe those results.\n\nThe main soft spot is the defense's confident-example selection (Eq. 4). That filter is load-bearing, and the paper never shows that the UCL-based KNN pseudo-labels are accurate under inner-trajectory attacks. With 40% symmetric poisoning between Push and Pull, a clean Push sample whose nearest neighbors are dominated by Pull will be excluded, and a flipped Push-to-Pull sample embedded near true Push samples may pass the filter. The paper does not report pseudo-label accuracy, the precision of the confident set T, or the fraction of poisoned labels that survive filtering. Without that, the claimed >90% accuracy at 40% poisoning is not established; it may be an artifact of the selection mechanism or the specific hyperparameters (K=250, alpha, beta, Mixup, temperature). The evaluation also has no error bars or repeated runs, no comparison to prior noisy-label defenses, and no artifact release. These are addressable issues rather than fatal flaws—the defense could well work, but the evidence is incomplete.\n\nThe citation pattern is honest: prior label-flipping and noisy-label work is credited, and the adaptation from Sel-CL and MOIT is stated plainly.\n\nRecommendation: this deserves a serious referee. The attack results alone are publishable, and the defense is a reasonable direction. A reviewer should require the missing validation—pseudo-label accuracy, confident-set precision, poison-survival rate, and error bars—before the robustness claim at high poisoning ratios is accepted. Send it to review, expecting major revision.","headline":"A useful, well-scoped empirical study of label flipping on contrastive mmWave HAR, with a promising defense whose reported robustness is under-evidenced because the confident-example filter is never validated.","tokens_in":20717,"tokens_out":2267,"would_cite":true,"duration_ms":26688,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Trajectory-aware label flipping can severely degrade contrastive mmWave-based HAR, and a confidence-based defense keeps accuracy above 90 percent even at 40 percent poisoned labels.","keywords":["human activity recognition","label flipping poisoning","mmWave radar sensing","supervised contrastive learning","wireless sensing security","adversarial label noise","confident sample selection"],"falsifier":"Poison only one trajectory-similar pair (for example, flip Push labels to Pull) at 40% while sweeping $K$ from 5 to 500 and the $\\alpha$/$\\beta$ thresholds; if Sel-CL accuracy falls to the unpoisoned SCL baseline or below in any cell, the claim that it stays above 90% for all attacks at 40% poison is falsified.","tokens_in":19647,"feed_emoji":"📡","tokens_out":10288,"duration_ms":100241,"temperature":0.7,"pith_summary":"This paper tries to establish that label-flipping poisoning is a real threat to mmWave-based human activity recognition (HAR) when the recognizer is trained with supervised contrastive learning (SCL). It defines three trajectory-aware attacks — random flipping, flipping across dissimilar motion trajectories, and flipping within similar trajectories — and shows on a six-activity radar prototype that they all lower accuracy, with random flipping the most damaging and SCL more vulnerable than plain supervised learning. The paper then proposes Sel-CL, a defense that selects confident examples and confident pairs from the poisoned training set using unsupervised contrastive learning, without needing any trusted clean dataset. On its prototype, Sel-CL keeps accuracy nearly unchanged up to 20% poisoned labels, above 90% for all three attacks at 40% poisoning, and above 90% even at 80% poisoning under random flips, while also improving clean-data accuracy. If correct, this matters because wireless HAR is moving toward contrastive training, and its heatmap-like inputs make flipped labels much harder for a human to spot than flipped image labels.","feed_headline":"Defense holds mmWave activity recognition above 90% under label flips","feed_subtitle":"Confidence-based training keeps accuracy above 90 percent with 40 percent poisoned labels and needs no trusted data.","key_machinery":"The load-bearing mechanism is Sel-CL's confident-example and confident-pair selection loop. After a few epochs of unsupervised contrastive learning, every training sample is embedded as a low-dimensional vector $\\boldsymbol{z}_i$; each sample receives a pseudo-label from the majority class among its top-$K$ nearest neighbors, its per-class clean probability is approximated by the fraction of neighbors in each class, and an example is called confident when its cross-entropy against the poisoned label falls below a class-specific threshold. Confident pairs are pairs with matching confident labels and representation similarity above a threshold from a $\\beta$-fractile, and only those pairs feed the supervised contrastive loss, while non-confident samples are handled with unsupervised contrastive loss; a mixup term blends pairs, and classification plus similarity losses on confident examples stabilize training, followed by fine-tuning with a robust cross-entropy loss. This selection loop carries the argument because every defense accuracy claim rests on it rejecting enough poisoned labels to keep the contrastive embedding space clean.","core_discovery":"The paper's central discovery is that label flipping is a practical attack surface for contrastive mmWave-based HAR and that attack power depends on trajectory similarity. On a TI 1843 radar dataset of 10,650 samples covering six hand activities collected from 25 volunteers, supervised contrastive learning reaches 97.92% test accuracy on clean data but degrades faster than the 96.43%-accurate supervised baseline when labels are flipped; random flips are the most effective, followed by inner-trajectory flips (similar motions) and cross-trajectory flips. The countermeasure, Sel-CL, first learns embeddings with unsupervised contrastive learning, assigns each sample a pseudo-label $\\hat{y}_i$ by majority vote over its top-$K$ nearest neighbors ($K=250$), and keeps only confident examples and confident pairs, with per-class thresholds set by $\\alpha$- and $\\beta$-fractiles, for supervised contrastive training with mixup and a similarity loss. The paper reports that this keeps test accuracy above 90% for all three attacks at 40% poisoned labels, above 90% for random flips even at 80% poisoning, and that clean-data accuracy rises to 98.78%.","pith_inferences":["An adaptive adversary who knows the top-$K$ majority rule could concentrate flips inside one trajectory-similar pair, such as Push/Pull, to make the poisoned label the local neighborhood majority; the paper varies the poison ratio but not the flip distribution, so that regime is untested.","The defense's hyperparameters ($K$, $\\alpha$, $\\beta$) are fixed from stability observations; sweeping them under each attack would show whether the reported margins are a plateau or a knife-edge.","Because the selection mechanism works on learned embeddings rather than raw radar physics, Sel-CL may transfer to Wi-Fi CSI and acoustic HAR, but that transfer is an extrapolation beyond the experiments reported here.","Sel-CL's clean-data gain suggests confident-example selection could serve as a general label-noise filter for wireless sensing datasets, independent of adversarial intent."],"forward_implications":["Contrastive mmWave HAR models, despite their clean-data edge, are more vulnerable than plain supervised models to label-flipping poisoning, so deploying them without a defense raises security risk.","Random label flips are the strongest of the three studied attacks; fixed flips within or across trajectories are weaker but still drag accuracy down as the poison ratio grows, and symmetric flips are generally more damaging than asymmetric ones because they involve more classes.","If Sel-CL works as reported, a HAR operator can tolerate substantial label noise — up to 40% under all studied attacks and up to 80% under random flips — without needing a trusted clean dataset for calibration.","Sel-CL also raises clean-data accuracy to 98.78% from 97.92% for SCL and 96.43% for SL, so the defense does not sacrifice normal-case performance.","The attack and defense principles are stated to extend to other wireless HAR modalities, including Wi-Fi and acoustic sensing."],"supporting_citations":[{"why":"Supplies the unsupervised contrastive learning method used in Sel-CL's early epochs to obtain low-dimensional representations for confident-example identification.","marker":"[4]"},{"why":"Defines supervised contrastive learning, the training paradigm whose vulnerability the paper studies and whose loss the prototype and Sel-CL use.","marker":"[12]"},{"why":"Adapted for the defense's selective supervised contrastive learning with noisy labels, the architecture for choosing confident examples before contrastive training.","marker":"[15]"},{"why":"Provide the mmWave radar HAR system design, TI 1843 radar, CNN-LSTM backbone, and data collection procedure on which the prototype is built.","marker":"[16, 17]"},{"why":"Supplies the robust loss and multi-objective interpolation training used in fine-tuning Sel-CL on confident samples.","marker":"[23]"},{"why":"Earlier label-flipping attack on wearable HAR that this paper extends by making attacks trajectory-aware for mmWave signals.","marker":"[26]"},{"why":"Earlier wearable-HAR poisoning work whose assumption of a trusted training dataset Sel-CL explicitly avoids.","marker":"[27]"},{"why":"Supplies the similarity-label learning objective that refines Sel-CL's representation quality.","marker":"[37]"},{"why":"Provides the sample-blending augmentation incorporated into Sel-CL's contrastive loss for robust representation learning.","marker":"[45]"}],"fun_headline_variants":["mmWave HAR resists label flips with confident learning","Label-flip attacks on mmWave HAR countered by Sel-CL","Contrastive learning secures mmWave activity recognition","How to keep mmWave HAR accurate under poisoning","Sel-CL defends mmWave HAR from label flipping attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes that unsupervised contrastive learning on the poisoned data still puts true same-class examples among each other's top-$K$ nearest neighbors, so the majority pseudo-label recovers the clean label; if label flipping distorts those neighborhoods enough, confident selection fails and the accuracy guarantees collapse.","fun_headline_variants_meta":{"raw":{"variants":["mmWave HAR resists label flips with confident learning","Label-flip attacks on mmWave HAR countered by Sel-CL","Contrastive learning secures mmWave activity recognition","How to keep mmWave HAR accurate under poisoning","Sel-CL defends mmWave HAR from label flipping attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000163,"raw_usage":{"total_tokens":1227,"prompt_tokens":916,"completion_tokens":311,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":532,"completion_tokens_details":{"reasoning_tokens":231}},"tokens_in":532,"tokens_out":311,"duration_ms":3539,"temperature":1.0,"reasoning_tokens":231,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T04:12:18.203872+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Poison only one trajectory-similar pair (for example, flip Push labels to Pull) at 40% while sweeping $K$ from 5 to 500 and the $\\alpha$/$\\beta$ thresholds; if Sel-CL accuracy falls to the unpoisoned SCL baseline or below in any cell, the claim that it stays above 90% for all attacks at 40% poison is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Adapted for the defense's selective supervised contrastive learning with noisy labels, the architecture for choosing confident examples before contrastive training."},{"cited_title":"O’Connor, and Kevin McGuinness","cited_arxiv_id":null,"evidence_quote":"Supplies the robust loss and multi-objective interpolation training used in fine-tuning Sel-CL on confident samples."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Earlier label-flipping attack on wearable HAR that this paper extends by making attacks trajectory-aware for mmWave signals."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Earlier wearable-HAR poisoning work whose assumption of a trusted training dataset Sel-CL explicitly avoids."},{"cited_title":"Class2Simi: A Noise Reduction Perspective on Learning with Noisy Labels","cited_arxiv_id":"2006.07831","evidence_quote":"Supplies the similarity-label learning objective that refines Sel-CL's representation quality."}],"review_version":1}