Pith. sign in

REVIEW 4 major objections 6 minor 23 references

BadSAD: Clean-Label Backdoor Attacks against Deep Semi-Supervised Anomaly Detection

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Clean-label backdoor attack defeats DeepSAD anomaly detection

desk verdict Novel clean-label backdoor against DeepSAD, but missing experimental details and a real cosine/Euclidean gap make the headline numbers provisional. read the letter →

arxiv 2412.13324 v1 pith:IVKSZEWG submitted 2024-12-17 cs.CV cs.AIcs.CR

He Cheng , Depeng Xu , Shuhan Yuan This is my paper · ORCID
classification cs.CVcs.AIcs.CR
keywords backdoorattackclean-labeldatapoisoningsemi-supervisedanomalydetectionDeepSADlatentspacemanipulationimagelearningsecuritytriggerinjection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BadSAD aims to show that DeepSAD, a widely used semi-supervised image anomaly detector, can be backdoored by an attacker who controls the training process. The attacker poisons only normal images, adding subtle corner-square triggers, then reshapes the latent space so that triggered abnormal images end up close to the normal cluster. On MNIST, CIFAR-10, and Fashion-MNIST, the paper reports high attack success rates while anomaly detection AUC on clean images stays at a usable level. The authors argue this exposes a real supply-chain risk when users rely on third-party providers to train anomaly detection models.

What carries the argument

The mechanism is a modified DeepSAD training objective, $L' = L + \alpha L_{\mathrm{DA}} + \beta L_{\mathrm{DC}}$, where $L$ is the original DeepSAD loss. Distribution alignment ($L_{\mathrm{DA}}$) enforces a cosine-similarity margin so that poisoned normal images sit closer to normal images than abnormal images do, while distribution concentration ($L_{\mathrm{DC}}$) clusters poisoned images and abnormal images around their own centers, reducing variance. The intended effect is that the trigger pattern is learned as normal content, so a triggered abnormal image lands inside the hypersphere that DeepSAD uses to separate normal from abnormal.

What would settle it

Train BadSAD on a fresh dataset, then record the actual Euclidean distances of triggered abnormal test images from the DeepSAD center and count how many fall below a threshold chosen from clean validation data; if most remain above it, the claimed misclassification does not occur. A sharper version is to train with distribution alignment but without distribution concentration and check whether the triggered abnormal images still cross the boundary.

Watch

Extended reading notes

Core claim

The paper's central claim is that BadSAD can manipulate DeepSAD so that abnormal images carrying a trigger are misclassified as normal. It combines clean-label trigger injection with two latent-space objectives: distribution alignment, which uses a cosine-similarity margin to pull poisoned images toward normal images and hold abnormal images at a controlled distance, and distribution concentration, which clusters poisoned and abnormal images tightly. The two objectives together shift the decision boundary so the backdoor activates at inference while clean anomaly detection remains largely intact. The authors report average ASR of 97.10 on MNIST, 86.74 on CIFAR-10, and 92.86 on Fashion-MNIST, with corresponding average AUC of 96.16, 67.46, and 91.03.

Load-bearing premise

The attack relies on the assumption that steering a cosine-similarity margin in the latent space moves triggered abnormal images across DeepSAD's Euclidean-distance decision boundary; the paper does not derive or analyze this transfer.

Editorial extensions

If this is right

  • BadSAD achieves high attack success rates on MNIST, CIFAR-10, and Fashion-MNIST while preserving reasonable clean-image AUC, making backdoor attacks a practical threat to semi-supervised image anomaly detection.
  • Clean-label poisoning alone is not sufficient: a DeepSAD model trained on the poisoned data with its original loss has low ASR, so the latent-space manipulation objectives are what carry the attack.
  • Tuning the anomaly detection threshold does not give a clean defense, because keeping AUC high keeps ASR high; the two are coupled after training.
  • Sub-triggers that contain only part of the original trigger can still activate the backdoor, so the implanted behavior is not tightly tied to the full trigger pattern.
  • A malicious third-party trainer can implant the backdoor during training, making outsourced model training a security risk for anomaly detection deployments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: because the alignment loss controls cosine similarity while DeepSAD decides normality by Euclidean distance to a center, the attack's success likely depends on the geometry of the feature extractor; a direct distance-based alignment loss would be a natural test and may transfer more reliably.
  • Inference: the same latent-space poisoning recipe could plausibly be adapted to DeepSVDD and other center-based one-class detectors, which share the same distance-to-center decision rule.
  • Inference: the threshold-sensitivity result suggests that defenses against this attack should act at training time, for example by auditing the training data or changing the training objective, rather than by post-hoc threshold adjustment.
  • Inference: a clean experiment separating the two objectives would be to train with distribution alignment only and measure how many triggered abnormal images actually cross the L2 threshold; the paper does not report this ablation directly.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes BadSAD, a clean-label backdoor attack against Deep Semi-Supervised Anomaly Detection (DeepSAD). The attack injects white-square triggers into normal training images and modifies the DeepSAD objective with two additional losses: a distribution alignment loss based on cosine similarity with a margin, and a distribution concentration loss that clusters poisoned and abnormal images. The goal is to make triggered abnormal images fall inside the anomaly-detection boundary while preserving anomaly detection on clean images. Experiments on MNIST, CIFAR-10, and Fashion-MNIST report AUC and attack success rate (ASR) for BadSAD and several baselines, together with sensitivity analyses and robustness tests against sub-triggers, distinct triggers, and threshold variation.

Significance. If the results are validated, BadSAD would be one of the first backdoor attacks specifically designed for image-based semi-supervised anomaly detection, and its clean-label threat model is relevant to realistic outsourcing scenarios. The paper covers three standard benchmarks, includes several baselines, and provides sensitivity and robustness analyses. The proposed mechanism is simple and plausible: poisoned images are pulled toward the normal cluster while abnormal images are kept at a controlled distance. However, the current experimental reporting leaves load-bearing questions open: the ASR metric is threshold-dependent and the clean baseline already misclassifies a substantial fraction of triggered abnormal images on CIFAR-10; the reported hyperparameters for the main results are incomplete; there are no error bars; and the claimed utility preservation is not supported on CIFAR-10, where AUC drops by about 10 points on average.

major comments (4)
  1. [Section 5.1.4 and Table 1] The ASR metric is fully determined by the anomaly-detection threshold tau, but the manuscript does not state how tau is selected on the validation set, what tau values are used for each dataset or class, or whether all baselines are evaluated at the same tau. This matters because the clean DeepSAD baseline already achieves a mean ASR of 26.56% on CIFAR-10 (48.8% for the cat class), meaning that over a quarter of triggered abnormal images are misclassified by a model with no backdoor. Please report the tau selection rule and tau values, report ASR at a fixed false-positive rate (e.g., 5% or 1% of normal images flagged abnormal), and give the clean DeepSAD and poisoning-only baseline ASR at the same operating points. Figure 5 should also show the clean baseline's ASR under the same threshold sweep. Without this, the central claim that BadSAD causes triggered abnormal images to be misclassified as normal is not reliably established.
  2. [Table 1 and Section 5.2.1] The text states that BadSAD maintains strong AUC scores, but on CIFAR-10 the mean AUC drops from 77.42 for clean DeepSAD to 67.46 for BadSAD, with per-class drops such as car from 85.00 to 69.95 and dog from 75.40 to 63.89. This is a large utility loss, not a minor degradation, and it weakens the comparison with baselines such as BadNets, which achieves 72.43 AUC and 71.02 ASR on the same dataset. Please qualify the utility-preservation claim, report the full AUC-ASR trade-off, or evaluate at a matched AUC so that attack success is compared at equal anomaly-detection performance.
  3. [Section 4.2.2, Eq. (3)] The aligned distance loss is defined on cosine similarities, but DeepSAD's anomaly score s(X) is the squared L2 distance to the center c. Cosine similarity does not control L2 distance unless the latent representations have fixed or bounded norms, and the paper provides neither a normalization argument nor an empirical demonstration that the cosine margin transfers to the L2 decision boundary. The bounds in Eq. (2) also are not directly enforced by the single margin loss in Eq. (3). Please add a derivation or, failing that, quantitative evidence such as histograms of s(X) for normal, poisoned, abnormal, and triggered abnormal images, showing that triggered abnormal images fall below tau as a result of the proposed losses.
  4. [Table 1 and Figure 3] The main results in Table 1 do not report the exact values of alpha, beta, the poisoning ratio, or the margin m that produced the headline ASR and AUC numbers. The sensitivity analysis in Figure 3 shows that ASR and AUC vary substantially with alpha and beta, so the omitted settings are important for reproducibility and for assessing how much the results depend on hyperparameter choice. Please report the exact hyperparameters for every table and repeat each main configuration multiple times (or report seeds and standard deviations) so that the reported ASR differences are not within run-to-run noise.
minor comments (6)
  1. [Eq. (1)] The exponent y_j in the labeled term is used without a formal definition in the equation; please state explicitly that the exponent is +1 for normal labeled examples and -1 for abnormal labeled examples, or use a notation that makes the intended objective unambiguous.
  2. [Table 1] The Blended and WaNet columns are numerically identical for nearly every class on MNIST and CIFAR-10, and for most classes on Fashion-MNIST. Since these are presented as distinct methods, please explain or correct this; as it stands, the reader cannot tell whether the same implementation or results were used for both baselines.
  3. [Table 2] Table 2 is difficult to read because the sub-trigger and distinct-trigger columns are interleaved without clear grouping. Please reformat the table with separate panels or clearer column headers, and align the decimal values.
  4. [Figure 3] The sensitivity plots would benefit from explicit axis labels and a legend identifying which curve is AUC and which is ASR; the current figure caption alone does not make this clear.
  5. [Introduction] The claim of being the first backdoor attack against image anomaly detection models should be stated more carefully in light of the earlier attack on one-class sequential anomaly detection in reference [3]; the paper should clarify the distinction in the introduction rather than only in the related work.
  6. [Section 4.1] The threat model assumes the attacker fully controls training, including the objective function; this should be stated explicitly as a white-box training-time attack in the introduction and abstract, since it affects how the results should be interpreted relative to data-only poisoning attacks.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: ASR is an independent held-out measurement; the training objective never includes triggered abnormal images, and the only self-citation is non-load-bearing background.

full rationale

The paper's central claim is that BadSAD causes held-out triggered abnormal images to be misclassified as normal. That outcome is measured, not constructed: the training loss in Eq. 7 combines the DeepSAD loss with distribution alignment (Eq. 3) and distribution concentration (Eqs. 4-6), all of which use only clean normal images, labeled abnormal images, and poisoned normal images. Triggered abnormal test images are not part of the training objective, so the reported ASR in Table 1 is an independent empirical quantity. The threshold tau is chosen on a validation set of 200 normal and 180 abnormal samples (Sec. 5.1.4), with no mention of triggered images, so ASR is not being maximized by construction; the high clean-model ASR on CIFAR-10 (26.56% mean) is a threshold-calibration concern rather than circularity. The only self-citation, Ref. [3], is background on a sequential-data backdoor attack and does not carry any load-bearing premise of BadSAD. The gap between the cosine-based alignment objective and DeepSAD's L2 decision boundary is a correctness or transfer-assumption risk, not a circular reduction, since the paper never defines the attack success criterion in terms of the training loss. Overall, the derivation is self-contained and the evaluation is independent of the fitted quantities.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the DeepSAD framework, the threat model of a malicious trainer, and several assumptions about how the latent space can be reshaped with cosine-based losses. No new physical or conceptual entities are introduced, but the method depends on several hand-set hyperparameters and unstated experimental settings.

free parameters (6)
  • alpha (distribution alignment weight) = not reported for main results
    Weights the L_DA loss in Eq. 7; the sensitivity analysis varies alpha but the value used for Table 1 is not stated.
  • beta (distribution concentration weight) = not reported for main results
    Weights L_DC in Eq. 7; the value used for Table 1 is not stated, preventing reproduction.
  • m (margin in aligned distance loss) = 2
    Set in implementation details; controls the separation between normal-poisoned and normal-abnormal cosine similarities.
  • mu (trigger visibility) = 1
    Scalar controlling trigger brightness; set to 1 for fully visible white squares.
  • poisoning ratio (fraction of normal images triggered) = not reported ('small portion')
    Not quantified in the paper; affects how strongly the trigger pattern is learned.
  • threshold tau = chosen on validation set
    Anomaly detection threshold determined from a validation set of 200 normal and 180 abnormal samples.
assumptions (5)
  • domain assumption DeepSAD training objective and center c as defined in Eq. 1
    The paper adopts DeepSAD's hypersphere formulation and center as the mean of labeled normal features without critically examining its stability.
  • domain assumption Malicious third party fully controls training
    Threat model in Section 4.1; this is the standard assumption for backdoor attacks and is explicitly stated.
  • domain assumption Triggers embedded in normal images will be learned as normal features and transfer to triggered abnormal images
    The core mechanism of the clean-label backdoor; the paper does not prove this transfer, only demonstrates it empirically.
  • ad hoc to paper Cosine similarity in the latent space is a valid proxy for Euclidean distance to the center
    Eq. 3 uses cosine-based margins, but DeepSAD's anomaly score is an L2 distance; the paper does not justify this mismatch.
  • domain assumption Labeled abnormal images in training are representative of test-time abnormal images
    The attack relies on manipulating the position of training abnormal images so that triggered test abnormal images land near the normal center; distribution shift in anomalies would break this.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadSAD: Clean-Label Backdoor Attacks against Deep Semi-Supervised Anomaly Detection." pith.science (2026). https://pith.science/paper/IVKSZEWG

@misc{pith2026241213324,
  author       = {Pith},
  title        = {Pith review of: BadSAD: Clean-Label Backdoor Attacks against Deep Semi-Supervised Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IVKSZEWG}},
  note         = {Machine review of arXiv:2412.13324}
}
read the original abstract

Image anomaly detection (IAD) is essential in applications such as industrial inspection, medical imaging, and security. Despite the progress achieved with deep learning models like Deep Semi-Supervised Anomaly Detection (DeepSAD), these models remain susceptible to backdoor attacks, presenting significant security challenges. In this paper, we introduce BadSAD, a novel backdoor attack framework specifically designed to target DeepSAD models. Our approach involves two key phases: trigger injection, where subtle triggers are embedded into normal images, and latent space manipulation, which positions and clusters the poisoned images near normal images to make the triggers appear benign. Extensive experiments on benchmark datasets validate the effectiveness of our attack strategy, highlighting the severe risks that backdoor attacks pose to deep learning-based anomaly detection systems.

Figures

Figures reproduced from arXiv: 2412.13324 by the authors.

Figure 1
Figure 1. An illustration of DeepSAD. In this paper, we propose BadSAD, a novel backdoor attack frame￾work specifically targeting Deep Semi-Supervised Anomaly De￾tection (DeepSAD) [17] models, a widely adopted approach for anomaly detection in a semi-supervised setting. In anomaly detec￾tion, the focus is on identifying abnormal images. Therefore, in a backdoor attack, BadSAD aims to manipulate the model behavior so that spec… view at source ↗
Figure 2
Figure 2. Illustration of the BadSAD framework for backdoor [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Sensitivity analysis of distribution alignment and [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visualization of randomly selected images from the [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Heatmap showing AUC and ASR with various [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 12 canonical work pages

  1. [1]

    Aimira Baitieva, David Hurych, Victor Besnier, and Olivier Bernard. 2024. Super- vised Anomaly Detection for Complex Industrial Images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 17754–17762

    work page 2024

  2. [2]

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    arXiv 2017

  3. [3]

    He Cheng and Shuhan Yuan. 2024. Backdoor Attack Against One-Class Se- quential Anomaly Detection Models. In Pacific-Asia Conference on Knowledge Discovery and Data Mining . Springer, 262–274

    work page 2024

  4. [4]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    arXiv 2017

  5. [5]

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access 7 (2019), 47230–47244

    2019

  6. [6]

    Radu Tudor Ionescu, Fahad Shahbaz Khan, Mariana-Iuliana Georgescu, and Ling Shao. 2019. Object-centric auto-encoders and dummy anomalies for abnormal event detection in video. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 7842–7851

    work page 2019

  7. [7]

    Alex Krizhevsky and Geoffrey Hinton. 2009. Learning multiple layers of features from tiny images. Technical Report. Citeseer

    2009

  8. [8]

    Yann LeCun, Corinna Cortes, and CJ Burges. 1998. The MNIST database of handwritten digits. http://yann.lecun.com/exdb/mnist (1998)

    work page 1998

Show all 23 references
  1. [9]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2017. Trojaning attack on neural networks. (2017)

    2017

  2. [10]

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16. Springer, 182–199

    2020

  3. [11]

    Zuhao Liu, Xiao-Ming Wu, Dian Zheng, Kun-Yu Lin, and Wei-Shi Zheng. 2023. Generating anomalies for video anomaly detection with prompt-based feature mapping. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 24500–24510

    2023

  4. [12]

    Anh Nguyen and Anh Tran. 2021. Wanet–imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369 (2021)

    2021 arXiv

  5. [13]

    Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel

  6. [14]

    Karsten Roth, Latha Pemula, Joaquin Zepeda, Bernhard Schölkopf, Thomas Brox, and Peter Gehler. 2022. Towards total recall in industrial anomaly detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 14318–14328

    2022

  7. [15]

    Lukas Ruff, Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojciech Samek, Marius Kloft, Thomas G Dietterich, and Klaus-Robert Müller

  8. [16]

    Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. 2018. Deep one-class classification. In International conference on machine learning . PMLR, 4393–4402

    2018

  9. [17]

    A unifying review of deep and shallow anomaly detection. Proc. IEEE 109, 5 (2021), 756–795

    2021

  10. [18]

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2018. Clean-label backdoor attacks. (2018)

    2018

  11. [19]

    Vandermeulen, Nico Görnitz, Alexander Binder, Emmanuel Müller, Klaus-Robert Müller, and Marius Kloft

    Lukas Ruff, Robert A. Vandermeulen, Nico Görnitz, Alexander Binder, Emmanuel Müller, Klaus-Robert Müller, and Marius Kloft. 2020. Deep Semi-Supervised Anomaly Detection. In International Conference on Learning Representations

    2020

  12. [20]

    Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017. Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747 (2017)

    2017 arXiv

  13. [21]

    Julia Wolleb, Florentin Bieder, Robin Sandkühler, and Philippe C Cattin. 2022. Diffusion models for medical anomaly detection. In International Conference on Medical image computing and computer-assisted intervention . Springer, 35–45

    2022

  14. [23]

    Yinghao Zhang, Donghuan Lu, Munan Ning, Liansheng Wang, Dong Wei, and Yefeng Zheng. 2023. A Model-Agnostic Framework for Universal Anomaly Detection of Multi-organ and Multi-modal Images. InInternational Conference on Medical Image Computing and Computer-Assisted Intervention....

    2023

  15. [2021]

    ACM computing surveys (CSUR) 54, 2 (2021), 1–38

    Deep learning for anomaly detection: A review. ACM computing surveys (CSUR) 54, 2 (2021), 1–38

    2021

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.