{"id":"189bf0df-a9c7-4406-9c0f-0a7bab216571","arxiv_id":"2608.09047","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Spread the few poisoned training examples across feature-space clusters: DFCS picks one centroid-nearest sample per cluster and beats six prior selectors in all six low-poisoning settings.","lead":"The paper proposes DFCS, a method for choosing which few training images to poison in a backdoor attack: it clusters clean images by their visual features and picks one representative from each cluster. A generalist might read it because it shows that spreading poison samples across diverse feature regions can make attacks succeed with extremely few poisoned images.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline comparison confounds selection rule with encoder strength: DFCS uses DINOv3 features while surrogate-based baselines use PreActResNet-18, so the reported margin may not isolate the coverage principle.","rationale":"The reader's weakest assumption targets the local first-order model behind Proposition 1. I agree that model is unvalidated, but it is motivational rather than load-bearing for the main empirical claim: even if the linearization is imperfect, DFCS could still be the best selector. The more vulnerable point for the paper's central interpretive claim is the uncontrolled encoder in the headline comparison. The reported system DFCS-with-DINOv3 may well be the best among the seven evaluated systems, and the matched-seed protocol, ablations, and structural controls are genuine strengths. However, because every surrogate-based baseline uses PreActResNet-18 and DFCS uses DINOv3, the 4.60 pp average margin simultaneously changes the selection rule and the feature representation. Figure 2e demonstrates robustness of DFCS across encoders but does not measure whether competing selectors would improve equally with DINOv3. The cluster-random and class-stratified controls are informative within a fixed encoder, but do not settle cross-method attribution. This is an addressable experimental gap rather than a fatal flaw, so the CONDITIONAL verdict stands unchanged: accepting the paper's principle claim should require either matched-encoder baselines or explicit evidence that the competing selectors' features are not the source of the gap. The missing code and unreviewed appendix further support keeping the verdict conditional.","tokens_in":12842,"tokens_out":8432,"duration_ms":85224,"concrete_test":"On CIFAR-10/BadNets with B=20, run two matched-encoder comparisons: (1) DFCS using the same PreActResNet-18 features that RD/FUS/IFS use, and (2) RD (and, if feasible, FUS and IFS) using the normalized DINOv3 ViT-S/16 features, with all other settings and seeds unchanged. If DFCS with PreActResNet-18 no longer exceeds RD with DINOv3, the Table 1 margin is partly an encoder effect; if DFCS still wins in both matched-encoder conditions, the confound is resolved and the coverage principle is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In 'Models and evaluation protocol,' DFCS (and PFS) use a frozen DINOv3 ViT-S/16 encoder, while FUS, RD, and IFS use a PreActResNet-18 surrogate. Table 1 therefore varies both the selection rule and the feature extractor at once. The abstract's claim that the results 'support distributional feature coverage as an effective selection principle' requires that the ASR margin is caused by the allocation rule, not by the representational quality of DINOv3. The Fig. 2e ablation shows DFCS is robust across encoders, but it does not show that competing selectors would not gain as much or more from the stronger encoder. PFS shares DINOv3 and still underperforms, but PFS also differs in its selection mechanism and does not control the encoder for RD, FUS, or IFS. The within-DFCS controls (cluster-random, class-stratified) show that selection detail matters once the encoder is fixed, but they cannot rule out an encoder effect across methods. If DFCS with PreActResNet-18 features drops below RD and RD with DINOv3 features rises above DFCS, the central attribution of the gain to coverage would be unsupported, leaving only a system-level claim about one specific pipeline.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method for selecting poisoned samples under very low dirty-label poisoning budgets. DFCS encodes the non-target candidate pool with a frozen pretrained encoder, partitions the features with k-means into exactly B clusters, and selects the centroid-nearest real sample from each cluster. A local first-order analysis (Proposition 1) bounds the difference between the candidate-average and equal-weight selected-set replacement signals by a feature-coverage term and a representative-mass term. Empirically, on CIFAR-10, Tiny-ImageNet, and Imagenette under BadNets and Blended attacks, the paper reports that DFCS achieves the highest mean attack success rate among seven selectors in all six dataset–attack settings, with a mean ASR of 96.30% and an average margin of 4.60 percentage points over the strongest comparator, while preserving clean accuracy. Additional ablations examine poisoning rate, victim-training strategy, target class, victim architecture, pretrained encoder, and allocation method.","tokens_in":13008,"tokens_out":3770,"duration_ms":38350,"significance":"If the central claim is validated, DFCS would be a valuable and unusually simple baseline for low-budget dirty-label backdoor selection: it requires no surrogate training, no trigger knowledge, and no victim information, and it scales linearly in the candidate-pool size. The paper also provides a decomposition of the selection error into coverage and mass-mismatch terms, which is a useful conceptual contribution even if the bound is local. The empirical study is broad in its ablations, including budgets, target classes, victim architectures, encoders, and allocation methods, and the matched controls (histogram-matched, class-stratified, cluster-random) are a thoughtful attempt to separate representative choice from class composition. The main empirical claim is, however, currently weakened by an encoder confound in the headline comparison and by the absence of the appendix containing the proof of Proposition 1 and full configuration details. For these reasons the paper is promising but not yet ready in its current form.","major_comments":[{"comment":"The headline comparison in Table 1 confounds the selection rule with the feature encoder. The paper states that 'DFCS and PFS use the same frozen DINOv3 ViT-S/16 encoder, while baselines requiring a task-specific surrogate use PreActResNet-18.' Consequently, the margins of DFCS over FUS, RD, and IFS may be due to the representational quality of DINOv3 features rather than to the coverage-based allocation principle. The Fig. 2e ablation shows that DFCS is robust across encoders, but it does not show that the competing selectors would not gain equally or more from the stronger encoder. PFS shares the DINOv3 encoder and still underperforms, but PFS also differs in its selection mechanism, so this does not control the encoder for RD, FUS, or IFS. To support the abstract's claim that the results 'support distributional feature coverage as an effective selection principle,' the authors should either run the competitive baselines with DINOv3 features, run DFCS with PreActResNet-18 features, or otherwise show that the relative ranking is not reversed when the encoder is held fixed.","section":"Experiments, Models and evaluation protocol; Table 1"},{"comment":"The proof of Proposition 1 and the derived bound Delta_2(S) <= J_rep <= 2 J_KM are stated to be 'provided in Appendix,' but no appendix is included in the submitted manuscript. Likewise, the complete attack configurations, dataset statistics, seed protocol, defensive evaluations, and formulas for the diagnostics E_w_sig and E_mass are all deferred to an absent appendix, and the main text still contains unresolved references such as 'Tables??.' Without these materials, the theoretical motivation cannot be verified and the experimental protocol is not reproducible from the manuscript. The authors need to supply the complete appendix or move the essential derivations and configuration details into the main text.","section":"Methodology, Local Equal-Weight Signal Approximation; Appendix"},{"comment":"The diagnostic evidence for Proposition 1 is descriptive and partly self-referential. The reported Spearman correlations (rho = 0.809 between sqrt(Delta_2) and E_w_sig, and rho = 0.445 between Gamma and E_mass) are computed across selector means that include DFCS itself, which is explicitly constructed to minimize Delta_2; a correlation involving a quantity that the method is designed to minimize is expected even if the local model is not the true mechanism. The matched victim comparisons are more informative, but the paper does not report a corresponding matched-encoder comparison for the main baselines. I recommend either clarifying that the diagnostics are illustrative rather than confirmatory, or providing a stronger test such as a fixed-selector, fixed-encoder comparison that varies Delta_2 independently of the selection rule.","section":"Mechanism Diagnostics and Controlled Comparisons"}],"minor_comments":[{"comment":"The text contains unresolved table references: 'Tables?? and ?? report the dataset statistics and integer payload budgets.' These need to be fixed once the appendix is restored.","section":"Experiments, Experimental Settings"},{"comment":"The label 'Vcitim model' in panel (d) contains a typo and should read 'Victim model.'","section":"Figure 2"},{"comment":"The description of PFS states that it 'introduces stochastic diversity after filtering by clean–poison similarity,' but the exact relationship of PFS to the budget allocation studied in this paper would be clearer if the paper explicitly stated whether the final PFS budget is drawn uniformly from the filtered pool and how the random seed is matched.","section":"Related Work and Baselines"},{"comment":"The paper states that means and paired differences are 'interpreted as descriptive summaries'; given that no statistical significance tests are reported, it would be helpful to state this explicitly also when discussing the margins of 2.38–8.71 percentage points in Table 1.","section":"Experiments, Models and evaluation protocol"},{"comment":"The notation A_x is used both for the per-sample replacement signal and for the Lipschitz constant L_A(x); this is not incorrect, but the double use of the subscript 'x' may confuse readers, and a different symbol for the Lipschitz envelope would improve readability.","section":"Methodology, Eq. (5)"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to have been submitted or rendered without its appendix, which contains the proof of Proposition 1 as well as all experimental configuration details. The editor should verify whether this is a completeness issue in the submission process. The encoder confound in Table 1 is the most substantive technical concern; it is fixable with additional experiments, but without those experiments the headline attribution to the coverage principle is not established. I would also encourage the authors to release code and seeds to support the reproducibility of the selected indices and the five-run protocol."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This paper proposes DFCS, a simple training-free poison-sample selector: run k-means on pretrained features with k equal to the poison budget, then pick the centroid-nearest real sample per cluster. That budget-coupled allocation is a genuine twist on prior pointwise ranking methods, and the two-term error decomposition (coverage + mass mismatch) is a reasonable way to motivate it. The main empirical claim—DFCS beats six selectors in all six dataset-attack settings—is backed by a clean matched-seed protocol, five runs, and many ablations. Credit where due: the robustness sweeps (budget, target class, victim architecture, optimizer, encoder, allocation method) are more thorough than what most papers in this space show.\n\nThe soft spots are real, though. First, the headline comparison is confounded: DFCS uses DINOv3 features while FUS/RD/IFS use a PreActResNet-18 surrogate. The Fig. 2e encoder sweep shows DFCS tolerates different encoders, but it does not show whether RD or FUS would gain equally from DINOv3. The abstract's claim that the results 'support distributional feature coverage as an effective selection principle' is therefore a bit stronger than the evidence. The within-DFCS controls (centroid-nearest vs cluster-random) suggest allocation detail matters, but they don't identify the encoder as cause of the cross-method margin. Second, the proof of Proposition 1 and all configuration details are in an appendix that is absent; the manuscript also contains Tables?? placeholders. That makes verification harder than it should be. Third, the diagnostic correlations are partly self-referential: DFCS is constructed to minimize Δ2, so seeing Δ2 and E_sig correlated across selectors is descriptive, not causal. The matched victim controls are the more convincing evidence.\n\nThe theoretical motivation is a nice heuristic but by no means a proof of attack effectiveness; it's a bound on an approximation error under a local linearization. If the linearization doesn't capture how victim training absorbs poisons, the explanation degrades to 'coverage empirically works.' That's fine as a claim, but should be labeled as such.\n\nWho's this for? Researchers working on data-efficient backdoor attacks or poison-sample selection. It deserves a serious referee: the method is simple, reproducible in principle, and the experimental core is solid. The referee should ask for the appendix, code/data, and a cross-over encoder experiment (e.g., RD and FUS with DINOv3 features, and DFCS with PreActResNet-18 features) before accepting the coverage principle.","headline":"DFCS is a clean, useful poison-selector with a real confound in the baseline comparison; the coverage principle is plausible but the paper overclaims the attribution.","tokens_in":13638,"tokens_out":2859,"would_cite":true,"duration_ms":25143,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that at very low poisoning budgets, backdoor attack success is determined by how the scarce poison slots are allocated across the feature distribution, and that selecting one centroid-nearest sample per k-means region…","keywords":["backdoor attacks","dirty-label poisoning","sample selection","data-efficient attacks","feature coverage","k-means clustering","trigger-agnostic selection","low-budget poisoning"],"falsifier":"Take a dataset and target class where a deliberately clustered poison set (all samples from one source class or one feature neighborhood) achieves high attack success, and compare its ASR with DFCS at the same budget; if the clustered set wins or ties, the coverage principle is false. Alternatively, compute the left-hand side of Eq. (9) under real victim training and test whether it shrinks as $\\Delta^2(S)$ and $\\Gamma(S)$ shrink; if it does not, Proposition 1 is not predictive.","tokens_in":12590,"feed_emoji":"🎯","tokens_out":5127,"duration_ms":44991,"temperature":0.7,"pith_summary":"The paper argues that at very low poisoning rates, what matters is not which individual samples score highest but how the scarce poison slots are spread across the feature space. It proposes DFCS, which clusters frozen pretrained features into as many regions as there are poison slots and selects the centroid-nearest real sample from each region. Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, this rule beats six existing selectors in every setting, averaging 96.30% attack success while preserving clean accuracy. A local first-order analysis ties the rule to two measurable error terms: feature-coverage error and representative-mass mismatch.","feed_headline":"Feature-spread poison picks win all six backdoor tests","feed_subtitle":"DFCS clusters frozen features into one region per poison slot and beats the best baseline by 4.6 points on average.","key_machinery":"The central object is the equal-weight signal-approximation bound in Proposition 1: for local gradient effects $A_x$, the difference between the candidate-average replacement signal and the selected-set signal is bounded by $\\eta L_A(x)\\sqrt{\\Delta^2(S)} + \\eta M_A(x)\\Gamma(S)$, where $\\Delta^2(S)$ measures average squared feature distance to the nearest selected sample (coverage error) and $\\Gamma(S)$ measures mismatch between region masses and uniform poison weights. DFCS minimizes the coverage term by k-means with $B$ clusters followed by centroid-nearest projection, which for a fixed partition is the exact discrete minimizer of within-cluster squared distortion.","core_discovery":"DFCS formulates low-budget dirty-label backdoor selection as allocation of $B$ equal-weight poisoning slots over the clean candidate distribution. Using a frozen pretrained encoder and k-means with exactly $B$ clusters, it selects one centroid-nearest candidate per cluster. The paper claims this yields the highest mean attack success rate among seven selectors in all six dataset–attack settings, averaging 96.30% and beating the strongest comparator by 4.60 percentage points on average, while leaving clean accuracy essentially unchanged. The authors further claim the selection principle is trigger-agnostic and requires no task-specific surrogate training.","pith_inferences":["A natural extension not explored here would be reweighting regions by candidate mass to shrink $\\Gamma(S)$, potentially pushing attack success above what equal-weight DFCS achieves.","The coverage principle should transfer to other dirty-label poisoning tasks, such as text classification, if a frozen encoder provides task-relevant features; a sentence-encoder version of the protocol would test this.","The sharp k-center failure suggests a defensive angle: since natural training subsets are not chosen to maximize feature coverage, unusually well-spread selected sets could be flagged as suspicious."],"forward_implications":["At a given budget, the same selected indices can be paired with different triggers and victim architectures without rerunning selection, because selection only sees clean features.","Selection time scales linearly in candidate-pool size and needs no surrogate training, making low-budget attacks feasible on larger datasets.","Pointwise scorers (FUS, RD, HFE, IFS) and filter-then-sample diversity (PFS) are consistently worse than explicit distributional allocation in the evaluated low-budget regimes.","The attack remains stealthy on the accuracy axis: clean accuracy stays within 0.07 points below to 0.74 points above the no-attack baseline in all six settings.","Worst-case coverage objectives such as k-center are the wrong fit for this regime; average-distortion coverage wins."],"supporting_citations":[{"why":"Defines the BadNets patch-trigger attack whose low-budget variant DFCS is evaluated on.","marker":"Gu, Dolan-Gavitt, and Garg 2017"},{"why":"Defines the Blended trigger attack, the second evaluation attack.","marker":"Chen et al. 2017"},{"why":"Introduces FUS, a training-dynamics baseline selector DFCS must beat.","marker":"Xia et al. 2022"},{"why":"Introduces RD, the strongest pointwise baseline on average in the comparison.","marker":"Wu et al. 2023"},{"why":"Introduces PFS, a prior diversity-by-filtering baseline that lacks explicit budget allocation.","marker":"Li et al. 2023a"},{"why":"Introduces HFE, a high-frequency-energy baseline selector.","marker":"Xun et al. 2024"},{"why":"Introduces IFS, an influence-based baseline selector.","marker":"Wei et al. 2025"},{"why":"Provides the frozen DINOv3 encoder whose normalized features DFCS clusters.","marker":"Siméoni et al. 2025"}],"fun_headline_variants":["DFCS: spread poison across features, win all","One poison per feature cluster: 96% ASR","Training-free poison selection tops backdoor attacks","Feature coverage picks poison: best ASR","Clustering picks poison: 96% attack success"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a local first-order approximation of how replacing a clean sample with a poisoned one changes the victim's loss actually predicts how training absorbs the poison; if that approximation is wrong, the coverage-based explanation collapses and only the empirical result remains.","fun_headline_variants_meta":{"raw":{"variants":["DFCS: spread poison across features, win all","One poison per feature cluster: 96% ASR","Training-free poison selection tops backdoor attacks","Feature coverage picks poison: best ASR","Clustering picks poison: 96% attack success"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000633,"raw_usage":{"total_tokens":2888,"prompt_tokens":876,"completion_tokens":2012,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":492,"completion_tokens_details":{"reasoning_tokens":1939}},"tokens_in":492,"tokens_out":2012,"duration_ms":15552,"temperature":1.0,"reasoning_tokens":1939,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:17:42.572895+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a dataset and target class where a deliberately clustered poison set (all samples from one source class or one feature neighborhood) achieves high attack success, and compare its ASR with DFCS at the same budget; if the clustered set wins or ties, the coverage principle is false. Alternatively, compute the left-hand side of Eq. (9) under real victim training and test whether it shrinks as $\\Delta^2(S)$ and $\\Gamma(S)$ shrink; if it does not, Proposition 1 is not predictive.","supporting_citations":[],"review_version":1}