Pith. sign in

REVIEW 4 major objections 2 minor 67 references

From Detection to Correction: Backdoor-Resilient Face Recognition via Vision-Language Trigger Detection and Noise-Based Neutralization

T0 review · 4 major / 2 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TrueBiometric uses a majority vote of vision-language models to detect every poisoned face image, then neutralizes the trigger with calibrated noise, at no cost to clean-image accuracy.

desk verdict Plausible new pipeline, but the 100% claim is unverifiable from the abstract and the supplied full text is unreadable — worth a referee only after a clean copy and real experimental detail are provided. read the letter →

arxiv 2508.05409 v1 pith:ZTHYYJQV submitted 2025-08-07 cs.CV cs.SDeess.AS

Farah Wahida , M.A.P. Chamikara , Yashothara Shanmugarasa , Mohan Baruwal Chhetri , Thilina Ranbaduge , Ibrahim Khalil This is my paper
classification cs.CVcs.SDeess.AS
keywords backdoorattacksfacerecognitionpoisonedtrainingdatavision-languagemodelsmajorityvotingcorrectivenoisetriggerneutralizationbiometricsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes TrueBiometric, a data-stage defense against backdoor attacks in face recognition. The idea is to screen training images with a panel of large vision-language models: if a majority flags an image as manipulated, it is counted as poisoned and repaired with calibrated corrective noise before training. The authors report 100 percent detection and correction across sticker, makeup, and patterned-mask triggers, with clean-image accuracy unchanged. If the claim is right, defenders can neutralize unknown backdoor triggers without knowing the attack recipe.

What carries the argument

The load-bearing mechanism is a majority-voting ensemble of large vision-language models used as perceptual poison detectors, paired with a noise-based neutralization step. Rather than matching a known trigger pattern, the ensemble relies on each model's visual-language judgment of whether an image looks anomalous or manipulated, and consensus decides. The correction stage then injects calibrated noise into flagged images, tuned to break the learned association between trigger and target identity without erasing the facial features the recognition model depends on.

What would settle it

Run TrueBiometric on a face dataset poisoned with very small, semi-transparent, or texture-blended triggers that a panel of vision-language models tends to overlook; if even a single poisoned image passes the majority vote, or a single clean image is 'corrected' in a way that breaks its identity match, the 100% detection-and-correction claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that backdoor poisoning of face recognition can be caught at the data-preparation stage rather than at the trained model. TrueBiometric asks several state-of-the-art large vision-language models to inspect each training image and treats majority agreement that an image is manipulated as the poison signal. Flagged images are then passed through a 'targeted and calibrated corrective noise' step, which the authors say destroys the trigger-to-target association learned during training while leaving identity cues intact. The reported result is a 100 percent detection-and-correction rate on poisoned images and no drop in accuracy on clean images across the trigger types tested

Load-bearing premise

The claim stands or falls on the assumption that a majority of large vision-language models reliably flags every poisoned image—across all trigger types—while never flagging clean faces; if the models share a blind spot or a false-positive bias, the 100% numbers collapse.

Editorial extensions

If this is right

  • A training-time screening step can remove backdoor risk without requiring the defender to know which images were poisoned, which trigger was used, or which class was targeted.
  • Because the defense acts on the dataset, the same corrected data can be reused to train future models without re-running the attack analysis.
  • The reported 100% detection rate implies that visible triggers such as stickers, makeup, and patterned masks are consistently recognizable to a majority of modern vision-language models.
  • Preserving clean-image accuracy means the correction step could be applied routinely to whole training sets rather than only to suspicious examples.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extension: test the same majority-vote detector on hidden or blended triggers—small patches, semi-transparent overlays, or high-frequency textures—since the reported triggers are all plainly visible; a drop in consensus would bound how general the 100% claim really is.
  • Extension: measure identity verification on corrected images directly; if calibrated noise removes the trigger but also shifts face embeddings, the 'no compromise on clean images' claim depends on the evaluation metric chosen.
  • Extension: run the noise-calibration step at varying intensities and check whether there is a threshold below which the backdoor persists and above which face matching degrades; this would expose the safety margin in the 100% result.
  • Extension: test panels assembled from vision-language models with different training distributions; if all models share the same perceptual blind spot, majority voting amplifies rather than corrects the flaw.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 2 minor

Summary. The paper proposes TrueBiometric, a backdoor defense for face recognition that combines a committee of large vision-language models (VLMs) with majority voting to detect poisoned training images, and applies 'targeted and calibrated corrective noise' to neutralize the embedded trigger. The abstract states that extensive empirical results show 100% detection and correction accuracy with no degradation of clean-image accuracy, and claims superiority over existing defenses. Only the abstract is readable in the submitted manuscript; the full text is corrupted to the point that no methods, equations, tables, or evaluation details can be inspected.

Significance. If the 100% claims held, this would be a relevant and practical defense: a VLM-based detector would require no model training and the noise-based correction could preserve face recognizer utility. The conceptual idea of using VLM perceptual judgment as a trigger oracle is interesting and worth testing. However, the manuscript as submitted supplies no datasets, no VLM committee specification, no trigger/attack configurations, no baselines, no error analysis, no code, and no machine-checked proofs. The full text is unreadable. Consequently the contribution is, in its current form, an abstract-level proposal whose load-bearing empirical assertions are unverifiable.

major comments (4)
  1. [Abstract] The central claim, 'TrueBiometric detects and corrects poisoned images with 100% accuracy without compromising accuracy on clean images,' is an empirical claim about a complete pipeline, but the manuscript provides no datasets, no number or names of VLMs, no trigger configurations, no attack settings, no baselines, no error bars, and no error analysis. The claim is asserted in a single sentence. Without these details the 100% figure is unfalsifiable and the comparison with state-of-the-art approaches cannot be checked.
  2. [Full text (corrupted)] The supplied full text is unreadable: it consists of mojibake/line noise, and the only intelligible artifact is the line 'arXiv:2508.05406v2 [cond-mat.str-el] 12 May 2026', which is the identifier of an unrelated condensed-matter paper. No methods, equations, tables, or figures are accessible. Consequently the detection stage (majority voting mechanism), the correction stage (targeted and calibrated corrective noise), and all evaluation results are beyond inspection. This is load-bearing: the paper's sole contribution is an empirical pipeline.
  3. [Correction stage (described in Abstract)] The phrase 'targeted and calibrated corrective noise' is the second load-bearing element, but no calibration rule is reported. If the noise magnitude is selected per trigger using the same poisoned samples on which correction accuracy is later measured, the 100% correction figure is partly circular. The manuscript must specify how the noise calibration is fixed before evaluation (e.g., a separate validation set or pre-registered rule), and must show the residual attack success rate after correction on held-out poisoned images. The current text provides no such information.
  4. [Detection stage (Abstract)] The load-bearing premise is that a majority of large vision-language models will flag all poisoned images (sticker, makeup, patterned mask) and no clean images. VLMs are not trained as backdoor detectors; triggers can be small, low-contrast, or blended into the face. The abstract provides no evidence that the VLM committee has perfect precision/recall across trigger types. A single missed trigger class or systematic false-positive pattern invalidates the 100% detection claim. The authors need to report per-trigger detection rates and false-positive rates on clean faces.
minor comments (2)
  1. [Abstract] The phrase 'practical, accurate, and effective' in the comparison sentence is vague; no quantitative comparison is presented in the readable text.
  2. [Full text (corrupted)] The embedded arXiv line for an unrelated cond-mat paper suggests a corrupted upload; the authors should verify the submitted source.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity identified: full text unreadable; abstract claim is empirical and not definitional.

full rationale

The provided full text is corrupted/mojibake and unreadable, with an unrelated arXiv identifier embedded, making it impossible to quote any specific equation, definition, or derivation chain. The abstract's claim that TrueBiometric detects and corrects poisoned images with 100% accuracy is an empirical pipeline-level claim that, if supported by the (unavailable) evaluation section, would stand or fall on experimental protocol rather than on construction. No fitted parameter renamed as a prediction, no self-citation chain, no uniqueness theorem, and no ansatz smuggled via citation appear in the readable portions. The reader's speculation that noise calibration might be tuned on the same poisoned samples as evaluation is a plausible concern but is not evidenced by any quoted text, and Hard Rule 1 forbids flagging circularity without a specific exhibited reduction. Since the manuscript text in scope provides no quotable circular step, the honest finding is no significant circularity, and the score is 0.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

Everything rests on two empirical capabilities the abstract asserts without evidence: vision-language models flagging every poison, and noise erasing the trigger without touching identity. Both are domain assumptions rather than proven results, and their strength cannot be audited because the full text is corrupted.

free parameters (2)
  • VLM committee size and composition
    Detection uses 'multiple state-of-the-art large vision language models' under majority voting, but the number, choice, and version of the models are undisclosed; outcomes depend on this selection.
  • Corrective noise magnitude and calibration rule
    Correction applies 'targeted and calibrated corrective noise'; the calibration procedure and magnitude are not stated and jointly determine whether triggers are neutralized and clean identity features survive.
assumptions (3)
  • domain assumption Large vision-language models reliably perceive small backdoor triggers (stickers, makeup, patterned masks) in face images and vote accurately on them
    The detection stage is a majority vote over VLMs; if the models cannot see or agree on subtle triggers, the 100% detection figure fails. Invoked in the abstract: 'majority voting mechanism leveraging multiple state-of-the-art large vision language models'.
  • domain assumption Calibrated corrective noise removes the trigger's learned association without damaging identity-relevant features
    Underlies the 'without compromising accuracy on clean images' claim; the abstract states poisoned samples are corrected using 'targeted and calibrated corrective noise' but gives no mechanism or evidence for utility preservation.
  • domain assumption The threat model is limited to visible, spatially localized triggers inserted into a few training images
    The abstract's triggers (sticker, make-up, patterned mask) are all visible patch insertions; generality is asserted for these, and the claim does not cover invisible or frequency-domain triggers. This bounds what '100% accuracy' means.

how reviews work

0 comments
Cite this review

Pith. "Pith review of From Detection to Correction: Backdoor-Resilient Face Recognition via Vision-Language Trigger Detection and Noise-Based Neutralization." pith.science (2026). https://pith.science/paper/ZTHYYJQV

@misc{pith2026250805409,
  author       = {Pith},
  title        = {Pith review of: From Detection to Correction: Backdoor-Resilient Face Recognition via Vision-Language Trigger Detection and Noise-Based Neutralization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZTHYYJQV}},
  note         = {Machine review of arXiv:2508.05409}
}
read the original abstract

Biometric systems, such as face recognition systems powered by deep neural networks (DNNs), rely on large and highly sensitive datasets. Backdoor attacks can subvert these systems by manipulating the training process. By inserting a small trigger, such as a sticker, make-up, or patterned mask, into a few training images, an adversary can later present the same trigger during authentication to be falsely recognized as another individual, thereby gaining unauthorized access. Existing defense mechanisms against backdoor attacks still face challenges in precisely identifying and mitigating poisoned images without compromising data utility, which undermines the overall reliability of the system. We propose a novel and generalizable approach, TrueBiometric: Trustworthy Biometrics, which accurately detects poisoned images using a majority voting mechanism leveraging multiple state-of-the-art large vision language models. Once identified, poisoned samples are corrected using targeted and calibrated corrective noise. Our extensive empirical results demonstrate that TrueBiometric detects and corrects poisoned images with 100\% accuracy without compromising accuracy on clean images. Compared to existing state-of-the-art approaches, TrueBiometric offers a more practical, accurate, and effective solution for mitigating backdoor attacks in face recognition systems.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

67 extracted references · 51 canonical work pages

  1. [1]

    B. I. Frontex, ``Automated biometric border crossing systems based on electronic passports and facial recognition: Rapid and smartgate,'' Tech. rep., agency, European cooperation, operational borders, external, Tech. Rep., 2010

    work page 2010

  2. [2]

    M. I. P. Nasution, N. Nurbaiti, N. Nurlaila, T. I. F. Rahma, and K. Kamilah, ``Face recognition login authentication for digital payment solution at covid-19 pandemic,'' in 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE), 2020, pp. 48--51

    work page 2020

  3. [3]

    Kaur and P

    H. Kaur and P. Khanna, ``Privacy preserving remote multi-server biometric authentication using cancelable biometrics and secret sharing,'' Future Generation Computer Systems, vol. 102, pp. 30--41, 2020

    work page 2020

  4. [4]

    Hom Choudhury , A

    S. Hom Choudhury , A. Kumar, and S. H. Laskar, ``Biometric authentication through unification of finger dorsal biometric traits,'' Information Sciences, vol. 497, pp. 202--218, 2019

    work page 2019

  5. [5]

    Al-Waisy, R

    A. Al-Waisy, R. Qahwaji, S. Ipson, S. Al-Fahdawi, and T. Nagem, ``A multi-biometric iris recognition system based on a deep learning approach,'' Pattern Analysis and Applications, vol. 21, 10 2017

    work page 2017

  6. [6]

    T. Gu, B. Dolan-Gavitt, and S. Garg, ``Badnets: Identifying vulnerabilities in the machine learning model supply chain,'' 2017

    work page 2017

  7. [7]

    A. Saha, A. Subramanya, and H. Pirsiavash, ``Hidden trigger backdoor attacks,'' in Proceedings of the AAAI conference on artificial intelligence, vol. 34, no. 07, 2020, pp. 11\,957--11\,965

    work page 2020

  8. [8]

    Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu, ``Invisible backdoor attack with sample-specific triggers,'' in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), October 2021, pp. 16\,463--16\,472

    work page 2021

Show all 67 references
  1. [9]

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, ``Badnets: Evaluating backdooring attacks on deep neural networks,'' IEEE Access, vol. 7, pp. 47\,230--47\,244, 2019

    2019

  2. [10]

    Nguyen and A

    A. Nguyen and A. Tran, ``Wanet--imperceptible warping-based backdoor attack,'' arXiv preprint arXiv:2102.10369, 2021

    2021 arXiv

  3. [11]

    M. Sun, L. Jing, Z. Zhu, and R. Wang, ``Makeupattack: Feature space black-box backdoor attack on face recognition via makeup transfer,'' arXiv preprint arXiv:2408.12312, 2024

    2024 arXiv

  4. [12]

    Krombholz, H

    K. Krombholz, H. Hobel, M. Huber, and E. Weippl, ``Advanced social engineering attacks,'' Journal of Information Security and applications, vol. 22, pp. 113--122, 2015

    2015

  5. [13]

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, ``Detecting backdoor attacks on deep neural networks by activation clustering,'' 2018

    2018

  6. [14]

    B. Tran, J. Li, and A. Madry, ``Spectral signatures in backdoor attacks,'' arXiv preprint arXiv:1811.00636, 2018

    2018 arXiv

  7. [15]

    Y. Li, S. Zhang, W. Wang, and H. Song, ``Backdoor attacks to deep learning models and countermeasures: A survey,'' IEEE Open Journal of the Computer Society, vol. 4, pp. 134--146, 2023

    2023

  8. [16]

    Y. Bai, G. Xing, H. Wu, Z. Rao, C. Ma, S. Wang, X. Liu, Y. Zhou, J. Tang, K. Huang et al., ``Backdoor attack and defense on deep learning: A survey,'' IEEE Transactions on Computational Social Systems, 2024

    2024

  9. [17]

    Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, ``Neural attention distillation: Erasing backdoor triggers from deep neural networks,'' arXiv preprint arXiv:2101.05930, 2021

    2021 arXiv

  10. [18]

    E. Chou, F. Tramer, and G. Pellegrino, ``Sentinet: Detecting localized universal attacks against deep learning systems,'' in 2020 IEEE Security and Privacy Workshops (SPW). 1em plus 0.5em minus 0.4em IEEE, 2020, pp. 48--54

    2020

  11. [19]

    B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, ``Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,'' in 2019 IEEE Symposium on Security and Privacy (SP), 2019, pp. 707--723

    2019

  12. [20]

    Yoshida and T

    K. Yoshida and T. Fujino, ``Disabling backdoor and identifying poison data by using knowledge distillation in backdoor attacks on deep neural networks,'' in Proceedings of the 13th ACM workshop on artificial intelligence and security, 2020, pp. 117--127

    2020

  13. [21]

    A. K. Veldanda, K. Liu, B. Tan, P. Krishnamurthy, F. Khorrami, R. Karri, B. Dolan - Gavitt, and S. Garg, ``Nnoculation: Broad spectrum and targeted treatment of backdoored dnns,'' CoRR, vol. abs/2002.08313, 2020

    2002 arXiv

  14. [22]

    M. Pan, Y. Zeng, L. Lyu, X. Lin, and R. Jia, `` \ ASSET \ : Robust backdoor data detection across a multiplicity of deep learning paradigms,'' in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 2725--2742

    2023

  15. [23]

    Cheng, G

    S. Cheng, G. Tao, Y. Liu, G. Shen, S. An, S. Feng, X. Xu, K. Zhang, S. Ma, and X. Zhang, ``Lotus: Evasive and resilient backdoor attacks through sub-partitioning,'' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24\,798--24\,809

    2024

  16. [24]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, ``Towards deep learning models resistant to adversarial attacks,'' arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  17. [25]

    Taskiran, N

    M. Taskiran, N. Kahraman, and C. E. Erdem, ``Face recognition: Past, present and future (a review),'' Digital Signal Processing, vol. 106, p. 102809, 2020

    2020

  18. [26]

    S. Chen, Y. Liu, X. Gao, and Z. Han, ``Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices,'' in Biometric Recognition, J. Zhou, Y. Wang, Z. Sun, Z. Jia, J. Feng, S. Shan, K. Ubul, and Z. Guo, Eds. 1em plus 0.5em minus 0.4em Cham: Springer...

    2018

  19. [27]

    Zhuang, Z

    F. Zhuang, Z. Qi, K. Duan, D. Xi, Y. Zhu, H. Zhu, H. Xiong, and Q. He, ``A comprehensive survey on transfer learning,'' Proceedings of the IEEE, vol. 109, no. 1, pp. 43--76, 2021

    2021

  20. [28]

    O. M. Parkhi, A. Vedaldi, and A. Zisserman, ``Deep face recognition,'' in Proceedings of the British Machine Vision Conference (BMVC). 1em plus 0.5em minus 0.4em BMVA Press, September 2015, pp. 41.1--41.12

    2015

  21. [29]

    Schroff, D

    F. Schroff, D. Kalenichenko, and J. Philbin, ``Facenet: A unified embedding for face recognition and clustering,'' CoRR, vol. abs/1503.03832, 2015

    2015 arXiv

  22. [30]

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, ``Arcface: Additive angular margin loss for deep face recognition,'' 2019

    2019

  23. [31]

    M. Yan, M. Zhao, Z. Xu, Q. Zhang, G. Wang, and Z. Su, ``Vargfacenet: An efficient variable group convolutional neural network for lightweight face recognition,'' in 2019 IEEE/CVF International Conference on Computer Vision Workshop (ICCVW), 2019, pp. 2647--2654

    2019

  24. [32]

    D. E. King, ``Dlib-ml: A machine learning toolkit,'' J. Mach. Learn. Res., vol. 10, pp. 1755--1758, 2009

    2009

  25. [33]

    T. Gu, B. Dolan - Gavitt, and S. Garg, ``Badnets: Identifying vulnerabilities in the machine learning model supply chain,'' CoRR, vol. abs/1708.06733, 2017

    2017 arXiv

  26. [34]

    W. Guo, B. Tondi, and M. Barni, ``An overview of backdoor attacks against deep neural networks and possible defences,'' CoRR, vol. abs/2111.08429, 2021

    2021 arXiv

  27. [35]

    A. Saha, A. Subramanya, and H. Pirsiavash, ``Hidden trigger backdoor attacks,'' arXiv preprint arXiv:1910.00033, 2019

    1910 arXiv

  28. [36]

    Y. Liu, S. Ma, Y. Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, ``Trojaning attack on neural networks,'' in 25nd Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-221, 2018 . 1em plus 0.5em minus 0.4em The Internet...

    2018

  29. [38]

    Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu, ``Backdoor attack with sample-specific triggers,'' CoRR, vol. abs/2012.03816, 2020

    2012 arXiv

  30. [39]

    M. Xue, C. He, J. Wang, and W. Liu, ``Backdoors hidden in facial features: a novel invisible backdoor attack against face recognition systems,'' Peer-to-Peer Networking and Applications, vol. 14, no. 3, pp. 1458--1474, 2021

    2021

  31. [40]

    Chamikara, P

    M. Chamikara, P. Bertok, I. Khalil, D. Liu, and S. Camtepe, ``Privacy preserving face recognition utilizing differential privacy,'' Computers & Security, vol. 97, p. 101951, 2020

    2020

  32. [41]

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, ``Targeted backdoor attacks on deep learning systems using data poisoning,'' arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  33. [42]

    D. Voth, L. Dane, J. Grebe, S. Peitz, and P. Terh \"o rst, ``Effective backdoor learning on open-set face recognition systems,'' in 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). 1em plus 0.5em minus 0.4em IEEE, 2025, pp. 1027--1039

    2025

  34. [43]

    Chen, D.-Z

    F.-L. Chen, D.-Z. Zhang, M.-L. Han, X.-Y. Chen, J. Shi, S. Xu, and B. Xu, ``Vlp: A survey on vision-language pre-training,'' Machine Intelligence Research, vol. 20, no. 1, pp. 38--56, 2023

    2023

  35. [44]

    Z. Li, X. Wu, H. Du, F. Liu, H. Nghiem, and G. Shi, ``A survey of state of the art large vision language models: Alignment, benchmark, evaluations and challenges,'' arXiv preprint arXiv:2501.02189, 2025

    2025 arXiv

  36. [45]

    Radford, J

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., ``Learning transferable visual models from natural language supervision,'' in International conference on machine learning. 1em plus 0.5em minus 0.4em PmLR, 202...

    2021

  37. [46]

    J. Li, D. Li, C. Xiong, and S. Hoi, ``Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation,'' in International conference on machine learning. 1em plus 0.5em minus 0.4em PMLR, 2022, pp. 12\,888--12\,900

    2022

  38. [47]

    Alayrac, J

    J.-B. Alayrac, J. Donahue, P. Luc, A. Miech, I. Barr, Y. Hasson, K. Lenc, A. Mensch, K. Millican, M. Reynolds et al., ``Flamingo: a visual language model for few-shot learning,'' Advances in neural information processing systems, vol. 35, pp. 23\,716--23\,736, 2022

    2022

  39. [48]

    Li and H

    S. Li and H. Tang, ``Multimodal alignment and fusion: A survey,'' arXiv preprint arXiv:2411.17040, 2024

    2024

  40. [49]

    Morvant, A

    E. Morvant, A. Habrard, and S. Ayache, ``Majority vote of diverse classifiers for late fusion,'' in Joint IAPR international workshops on statistical techniques in pattern recognition (SPR) and structural and syntactic pattern recognition (SSPR). 1em plus 0.5em minus 0.4em Spr...

    2014

  41. [50]

    Aeeneh, N

    S. Aeeneh, N. Zlatanov, and J. Yu, ``New bounds on the accuracy of majority voting for multiclass classification,'' IEEE Transactions on Neural Networks and Learning Systems, vol. 36, no. 4, pp. 6014--6028, 2024

    2024

  42. [51]

    Kumar, A

    N. Kumar, A. C. Berg, P. N. Belhumeur, and S. K. Nayar, ``Attribute and simile classifiers for face verification,'' Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2009

    2009

  43. [52]

    Huang, M

    G. Huang, M. Mattar, T. Berg, and E. Learned-Miller, ``Labeled faces in the wild: A database forstudying face recognition in unconstrained environments,'' Tech. rep., 10 2008

    2008

  44. [53]

    Krizhevsky, ``Learning multiple layers of features from tiny images,'' University of Toronto, Tech

    A. Krizhevsky, ``Learning multiple layers of features from tiny images,'' University of Toronto, Tech. Rep., 2009

    2009

  45. [54]

    xAI , `` Grok-3: Model Card and Documentation ,'' https://x.ai/blog/grok-3, 2024, accessed: 2025-08-03

    2024

  46. [55]

    Google DeepMind , `` Gemini 1.5 Pro Technical Report ,'' https://deepmind.google/technologies/gemini/#gemini-15, 2024, accessed: 2025-08-03

    2024

  47. [56]

    Anthropic , `` Claude Sonnet Model Overview ,'' https://www.anthropic.com/index/claude, 2024, accessed: 2025-08-03

    2024

  48. [57]

    OpenAI , `` ChatGPT o4-mini-high Model Documentation ,'' https://platform.openai.com/docs/guides/gpt, 2024, accessed: 2025-08-03

    2024

  49. [58]

    ------, `` GPT-4.1 Model Card ,'' https://openai.com/gpt-4, 2024, accessed: 2025-08-03

    2024

  50. [59]

    Weber, X

    M. Weber, X. Xu, B. Karlas, C. Zhang, and B. Li, `` RAB: provable robustness against backdoor attacks,'' CoRR, vol. abs/2003.08904, 2020

    2003 arXiv

  51. [60]

    Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, `` STRIP: A defence against trojan attacks on deep neural networks,'' CoRR, vol. abs/1902.06531, 2019

    1902 arXiv

  52. [61]

    J. Guan, J. Liang, and R. He, ``Backdoor defense via test-time detecting and repairing,'' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24\,564--24\,573

    2024

  53. [62]

    B. Wu, H. Chen, M. Zhang, Z. Zhu, S. Wei, D. Yuan, and C. Shen, ``Backdoorbench: A comprehensive benchmark of backdoor learning,'' Advances in Neural Information Processing Systems, vol. 35, pp. 10\,546--10\,559, 2022

    2022

  54. [63]

    X. Han, S. Yang, W. Wang, Z. He, and J. Dong, ``Is it possible to backdoor face forgery detection with natural triggers?'' arXiv preprint arXiv:2401.00414, 2023

    2023 arXiv

  55. [64]

    B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, ``Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,'' in 2019 IEEE symposium on security and privacy (SP). 1em plus 0.5em minus 0.4em IEEE, 2019, pp. 707--723

    2019

  56. [65]

    Wu and Y

    D. Wu and Y. Wang, ``Adversarial neuron pruning purifies backdoored deep models,'' Advances in Neural Information Processing Systems, vol. 34, pp. 16\,913--16\,925, 2021

    2021

  57. [66]

    Y. Liu, X. Ma, J. Bailey, and F. Lu, ``Reflection backdoor: A natural backdoor attack on deep neural networks,'' in European Conference on Computer Vision. 1em plus 0.5em minus 0.4em Springer, 2020, pp. 182--199

    2020

  58. [67]

    Y. Niu, S. He, Q. Wei, Z. Wu, F. Liu, and L. Feng, ``Bdetclip: Multimodal prompting contrastive test-time backdoor detection,'' arXiv preprint arXiv:2405.15269, 2024

    2024

  59. [68]

    Huang, S

    H. Huang, S. Erfani, Y. Li, X. Ma, and J. Bailey, ``Detecting backdoor samples in contrastive language image pretraining,'' arXiv preprint arXiv:2502.01385, 2025

    2025 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.