Pith. sign in

REVIEW 3 major objections 6 minor 41 references

A clean-label backdoor can stay dormant after training and turn on only when the attacker’s own camouflage samples are unlearned.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Dual generators jointly learn persistent clean-label triggers and removable camouflage so a backdoor stays dormant until attacker-submitted camouflage samples are unlearned.

T0 review reviewed 2026-07-31 challenge →

load-bearing objection Solid clean-label unlearning-activated attack with real empirical gains; the dual-generator construction is the advance, but First-Order/PUMA gains may partly be ascent on near-trigger camouflage rather than pure suppression release. the 3 major comments →

arxiv 2607.27936 v1 pith:OJHJENGR submitted 2026-07-30 cs.CR

Benign on Label, Malicious by Design: Clean-Label Dormant-to-Activated Backdoor via Machine Unlearning with Removable Camouflage

Dongdong Zhao , Can Li , Xiang Yao , Fan He , Qihang Ge , Baogang Song This is my paper
classification cs.CR
keywords backdoor attackmachine unlearningclean-labeldormant backdoorcamouflage samplesbilevel optimizationdual generatorstrigger persistence
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Standard backdoors light up as soon as training finishes, so inspectors can catch them before anyone exploits them. This paper shows a way to keep the malicious behavior off until a later, attacker-triggered unlearning step. The attacker submits only correctly labeled samples: some carry a hidden trigger association, others act as removable “camouflage” that suppresses that association during training. After deployment the model looks clean; when a small set of those camouflage samples is deleted through a normal unlearning request, the suppression lifts and the trigger starts forcing the target label. On CIFAR-10 and ImageNet-10, across several unlearning algorithms, the method keeps pre-unlearning attack success low and post-unlearning success high, under the realistic rule that forgotten samples must be ones the attacker actually submitted.

Core claim

Under clean-label submission and forget-sets restricted to attacker-submitted camouflage samples, jointly learning a persistent latent trigger–target association and a removable camouflage suppression—via dual generators optimized in a bilevel loop that simulates training and unlearning—produces reliable dormancy before unlearning and strong activation after it, outperforming prior unlearning-activated and clean-label baselines on the reported metrics.

What carries the argument

Dual-generator bilevel optimization: a trigger generator builds sample-specific, low-frequency triggers that implant a latent association under original labels, while a camouflage generator builds label-consistent samples whose training gradients oppose that association; unlearning a small camouflage subset removes the suppression and activates the backdoor.

Load-bearing premise

The attack assumes that generators trained offline on the attacker’s shadow models and data will still work when the real victim is trained and unlearned with algorithms the attacker only approximates.

What would settle it

Train a victim with the published rates and generators, then unlearn the stated camouflage subset with SISA, First-Order, or PUMA: if pre-unlearning ASR is not low and post-unlearning ASR does not jump by a large margin relative to the paper’s baselines under the same clean-label, record-matched forget protocol, the central claim fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Valid user deletion requests can become an activation switch for hidden model behavior, not only a privacy tool.
  • Label-consistent poisoning plus provenance-restricted forgetting is enough to stage a dormant-to-active backdoor without dirty labels.
  • Defenses that only scan post-training trigger behavior can miss the threat until after unlearning.
  • Unlearning systems may need checks on whether forgotten samples were crafted to cancel a latent association.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Providers who offer machine unlearning as a compliance feature may need provenance and influence audits on forget sets, not only accuracy retention checks.
  • The same suppress-then-release pattern might transfer to other post-training edits (fine-tuning, pruning, or continual learning) if those edits remove a small crafted subset.
  • If surrogate–victim mismatch grows (different data, optimizer, or unlearning math), the method’s transfer figures suggest activation would degrade first while dormancy might still hold.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes a clean-label unlearning-activated backdoor attack in which all crafted samples keep original labels and the forget set is restricted to attacker-submitted camouflage records. A dual-generator bilevel framework alternately optimizes sample-specific low-frequency triggers (latent association under original-label supervision, effective after unlearning) and label-consistent camouflage samples (gradient-opposing and target-margin suppression that is removable by deletion). After joint injection into training, the model is dormant (low ASR); unlearning a small camouflage subset activates the backdoor (high ASR-U). Experiments on CIFAR-10 and ImageNet-10 under SISA, First-Order, and PUMA report lower pre-unlearning ASR and larger ΔASR than adapted UBA-Inf, UNCLEAN, and Sleeper Agent baselines, with ablations, ratio sweeps, architecture/algorithm transfer grids, fine-pruning/STRIP checks, and a camouflage-removal control (Table 4).

Significance. If the mechanism holds, the work tightens the threat model for unlearning-activated backdoors beyond dirty-label or non-provenance forget sets, and shows that coordinating a persistent latent association with removable suppression is feasible under clean-label submission. Strengths include a clear problem formulation (Eqs. 1–2), an explicit bilevel dual-generator procedure (Algorithm 1), multi-algorithm and multi-dataset evaluation (Table 1), component ablations (Table 3), transfer grids (Figs. 3–4), and a dedicated activation-control table (Table 4). These make the contribution concrete and falsifiable for the security community studying machine unlearning as an activation surface.

major comments (3)
  1. [Method (Eqs. 10–11); Table 1; Appendix E Table 4] Central mechanism claim vs. approximate unlearning (Abstract; Problem Statement Eqs. 1–2; Camouflage construction Eqs. 10–11; Table 1 First-Order/PUMA rows; Appendix Table 4): Camouflage samples are built from trigger-contaminated intermediates x_d, so the forget set lies near the triggered manifold. For SISA, exact shard retrain with nearly flat BA (91.39→90.82) and large ASR jump (8.91→89.01) supports pure release of a latent association. For First-Order and PUMA, unlearning is gradient ascent / reweighting on those near-trigger, non-target points and can actively install target behavior on trigger-like inputs rather than only lift suppression. Table 4’s clean-source-counterpart control (ASR-U 36.78 vs 87.87) does not separate these stories, because counterparts lack trigger proximity. A load-bearing control is missing: e.g., unlearn trigger-proximal but non-optimized samples (same x_d
  2. [Threat Model; Bilevel Optimization; Figures 3–4] Threat model and transfer of surrogate bilevel optimization (Threat Model; Method “Bilevel Optimization”; Figs. 3–4): Generators are optimized by simulating Train and F_unlearn on attacker-side shadow models and auxiliary data, yet the attacker cannot access victim training. Figs. 3–4 show useful matched/mismatched transfer across algorithms and architectures under the paper’s controlled setup, but they do not stress distribution shift between auxiliary data and the victim’s full training mixture, nor mismatch in unlearning hyperparameters (τ, shard layout) beyond the three named algorithms. Because the weakest modeling assumption is surrogate fidelity, the main results should either (i) quantify degradation under clearly weaker surrogates (different data pool, shallower shadow nets, wrong τ) or (ii) state more precisely the conditions under which transfer is claimed. This is needed for
  3. [Table 1; Appendix E] Utility after unlearning and attribution of activation (Table 1 BA-U columns; Appendix E): Several strong ASR-U settings coincide with large BA drops (e.g., CIFAR-10 PUMA BA 93.38→80.77; ImageNet-10 PUMA 83.58→70.08). Appendix E argues comparable BA-U under equal-budget clean removal, which helps, but the main text still presents post-unlearning activation as a clean dormancy-to-activation transition without foregrounding when activation is entangled with non-trivial utility loss. Please report, alongside ASR-U, a simple utility-normalized view (e.g., ΔASR per point of BA drop, or ASR-U at matched BA-U via early stopping of the unlearning step) for First-Order and PUMA so readers can judge attack quality under realistic service constraints that reject highly damaging unlearning updates.
minor comments (6)
  1. [Problem Statement; Eqs. 10–11] Notation collision: camouflage samples are written C_{ϕ,ψ}(x) in Eq. (11) while the generator is M_ψ; the text also uses C_ϕ,ψ in the problem statement. Unify generator vs. sample notation.
  2. [Figure 2] Figure 2 loss labels use mixed scripts (e.g., L_opp^c vs. L_C_opp in the text). Align figure legend with Eqs. (15)–(19).
  3. [Main Results; Appendix C] Baseline adaptations (Appendix C) are necessary for fair comparison but should be summarized in one main-text paragraph so readers know UNCLEAN-Align and the Sleeper Agent “naive camouflage” construction without reading the appendix.
  4. [Experimental Settings; Appendix A] ImageNet-10 is a 10-class subset with 224×224 inputs; state class selection seed/list and training set size explicitly in Experimental Settings for reproducibility.
  5. [Abstract; Introduction] Typos and spacing artifacts from PDF extraction appear throughout (e.g., “Existingbackdoorattacks”, “unlearningactivateddormantbackdoors”). A full proofread pass is needed.
  6. [Table 1] Report standard deviations or error bars for Table 1 (text says three seeds) rather than means only, especially for ΔASR comparisons.

Circularity Check

0 steps flagged

No load-bearing circularity: bilevel objectives encode the attack goal by design, but claims rest on held-out victim runs and external baselines, not tautological identities.

full rationale

This is an engineered attack paper, not a first-principles derivation of a natural quantity. The dual-generator bilevel program (Eqs. 5–9, 12–20; Alg. 1) explicitly optimizes latent dormancy (LG_latent), post-unlearn activation (LG_act), and removable camouflage suppression (LC_opp, LC_margin). That is ordinary attack-objective design: the training losses are chosen to match the desired pre/post-unlearning behavior. The paper does not then relabel those same fitted losses as an independent “prediction” or uniqueness theorem. Empirical content is external to the objective: Table 1 compares against UBA-Inf, UNCLEAN, and Sleeper Agent under SISA/First-Order/PUMA; Figs. 3–4 test surrogate–victim mismatch; Table 3 ablates generators/losses; Table 4 contrasts camouflage removal vs clean-source and random-clean controls. No self-citation chain, imported uniqueness result, or ansatz-via-own-prior carries the central claim. Mechanism doubts (e.g., whether First-Order/PUMA partly install rather than release the backdoor) are causal/correctness issues, not circular reductions of equations to their inputs. Score 1 only for the mild, non-load-bearing fact that success metrics align with the optimized losses—standard and expected, not a construction collapse.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 2 invented entities

The central claim rests on standard supervised-learning and unlearning machinery, plus several attack-specific modeling choices: surrogate fidelity, removable gradient-opposing camouflage, fixed poisoning/camouflage budgets, and hand-set loss weights. No new physical entity is postulated; the invented pieces are algorithmic constructs whose only evidence is the reported attack metrics.

free parameters (4)
  • poisoning rate ρp and camouflage rate ρc = ρp=1%, ρc=3% (default)
    Attack budgets set by authors; main experiments use ρp=1%, ρc=3%, and Table 2 shows the dormancy/activation tradeoff depends on this allocation.
  • loss weights λl, λa, λv, λc, λo, λm, λcl, λr and margin γ = e.g. λa=2, λo=2.5, γ=5
    Hand-chosen coefficients balance dormancy, activation, visibility, and suppression; they are not derived from first principles.
  • perturbation strengths ηG, ηC and forget-set sizes |U| = 0.15; 250 or 150 samples
    Control trigger/camouflage magnitude and unlearning budget; defaults ηG=ηC=0.15, |U|=250/150 on CIFAR-10/ImageNet-10.
  • unlearning hyperparameters τ and SISA shard count = τ=0.025; 2 shards
    Implementation knobs for First-Order/PUMA/SISA that affect the post-unlearning model state used both in optimization and evaluation.
axioms (5)
  • domain assumption Approximate or exact machine unlearning (SISA, First-Order, PUMA) removes enough influence of requested samples to change model behavior while leaving other learned associations partially intact.
    Required for camouflage removal to lift suppression without erasing the latent trigger association; invoked throughout Problem Statement and Experiments.
  • domain assumption An attacker can insert a limited number of crafted clean-label samples into training and later issue a valid unlearning request only over attacker-submitted records.
    Threat Model premise that defines the clean-label data-removal workflow.
  • ad hoc to paper Surrogate models trained on attacker-accessible auxiliary data sufficiently approximate victim training and unlearning for generator transfer.
    Stated in Method/Threat Model as the offline bilevel simulation strategy; load-bearing for real-world transfer.
  • ad hoc to paper Gradient opposition plus target-margin suppression on label-consistent camouflage samples yields a removable suppressor rather than permanent destruction of the latent backdoor.
    Core design hypothesis behind LC_opp and LC_margin in Camouflage Generator Optimization.
  • standard math Standard empirical risk minimization with cross-entropy on deep image classifiers is an adequate inner-level model of victim training.
    Used in the bilevel constraints θl = arg min E L(fθ(x), y).
invented entities (2)
  • Removable camouflage samples Cϕ,ψ(x) no independent evidence
    purpose: Impose label-consistent, deletable suppression on the latent trigger-target association during training.
    Central constructed object of the attack; evidence is empirical ASR/ASR-U behavior after unlearning U ⊆ C'.
  • Dual-generator bilevel unlearning-activated backdoor framework no independent evidence
    purpose: Coordinate persistent trigger learning and removable suppression by alternating outer generator updates with inner train/unlearn simulation.
    Algorithmic framework introduced to solve the stated clean-label dormancy/activation tension; not an external natural object.

reviewed 2026-07-31 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Benign on Label, Malicious by Design: Clean-Label Dormant-to-Activated Backdoor via Machine Unlearning with Removable Camouflage." pith.science (2026). https://pith.science/paper/OJHJENGR

@misc{pith2026260727936,
  author       = {Pith},
  title        = {Pith review of: Benign on Label, Malicious by Design: Clean-Label Dormant-to-Activated Backdoor via Machine Unlearning with Removable Camouflage},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OJHJENGR}},
  note         = {Machine review of arXiv:2607.27936}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Existing backdoor attacks often become effective immediately after backdoor implantation and may therefore be exposed before exploitation. Machine unlearning activated dormant backdoors mitigate such behavioral exposure by remaining inactive after training and becoming effective only after selected training records are unlearned. However, existing methods struggle to simultaneously achieve a low pre-unlearning attack success rate and strong post-unlearning activation under clean-label constraints and realistic unlearning requests. Achieving this transition requires jointly establishing a persistent latent association and a removable suppressive influence. To address this challenge, we propose a clean-label unlearning-activated backdoor framework based on dual-generator learning and formulate it as a bilevel optimization problem: By simulating latent backdoor establishment and machine unlearning, the framework alternately learns sample-specific triggers that establish a latent trigger-to-target association and label-consistent camouflage samples that provide removable suppression. Once a small subset of camouflage samples is unlearned, the suppression is lifted and the dormant backdoor is activated. Experiments on CIFAR-10 and ImageNet-10 show that our method maintains lower pre-unlearning attack success rates while achieving stronger post-unlearning activation across multiple unlearning algorithms than representative backdoor baselines. These results demonstrate that reliable dormancy-to-activation transitions can be achieved by coordinating a persistent latent association with removable suppression under clean-label and realistic deletion constraints.

Figures

Figures reproduced from arXiv: 2607.27936 by Baogang Song, Can Li, Dongdong Zhao, Fan He, Qihang Ge, Xiang Yao.

Figure 1
Figure 1. Figure 1: Research motivation. To reduce such post-training exposure, recent studies have explored dormant or delayed-activation backdoors that re￾main inactive after training and are activated only by a spe￾cific subsequent event. Machine unlearning provides a natu￾ral post-training activation mechanism by removing the in￾fluence of specified training samples in response to deletion requests, thereby inducing model… view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the proposed framework. • Activation loss. For activation, we apply the trigger to samples in the dataset and require the unlearned model to classify the triggered samples into the target label yt: L G act = E(x,y)∈DL(fθu (Bϕ(x)), yt) (6) This objective makes the trigger effective after unlearn￾ing, enabling the attacker to achieve the intended attack. • Visibility loss. We constrain the pertur… view at source ↗
Figure 3
Figure 3. Figure 3: ASR before unlearning (left) and ASR-U after [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 6
Figure 6. Figure 6: Visual examples of crafted samples on CIFAR-10 and ImageNet-10. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Entropy distributions of clean and trigger-bearing inputs under STRIP with First-Order unlearning: (a) CIFAR-10 [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 3 linked inside Pith

  1. [1]

    IEEE Transactions on Neural Networks and Learning Systems , volume =

    Yuan, Xiaoyong and He, Pan and Zhu, Qile and Li, Xiaolin , title =. IEEE Transactions on Neural Networks and Learning Systems , volume =

  2. [2]

    Stealing Machine Learning Models via Prediction APIs , booktitle =

    Tram. Stealing Machine Learning Models via Prediction APIs , booktitle =

  3. [3]

    IEEE Transactions on Pattern Analysis and Machine Intelligence , volume =

    Goldblum, Micah and Tsipras, Dimitris and Xie, Chulin and Chen, Xinyun and Schwarzschild, Avi and Song, Dawn and Madry, Aleksander and Li, Bo and Goldstein, Tom , title =. IEEE Transactions on Pattern Analysis and Machine Intelligence , volume =

  4. [4]

    Gu, Tianyu and Liu, Kang and Dolan-Gavitt, Brendan and Garg, Siddharth , journal=

  5. [5]

    25th Annual Network and Distributed System Security Symposium , year =

    Liu, Yingqi and Ma, Shiqing and Aafer, Yousra and Lee, Wen-Chuan and Zhai, Juan and Wang, Weihang and Zhang, Xiangyu , title =. 25th Annual Network and Distributed System Security Symposium , year =

  6. [6]

    arXiv preprint arXiv:1712.05526 , year =

    Chen, Xinyun and Liu, Chang and Li, Bo and Lu, Kimberly and Song, Dawn , title =. arXiv preprint arXiv:1712.05526 , year =

    Pith/arXiv arXiv

  7. [7]

    2019 IEEE International Conference on Image Processing , pages =

    Barni, Mauro and Kallas, Kassem and Tondi, Benedetta , title =. 2019 IEEE International Conference on Image Processing , pages =. 2019 , publisher =

    2019

  8. [8]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume =

    Saha, Aniruddha and Subramanya, Akshayvarun and Pirsiavash, Hamed , title =. Proceedings of the AAAI Conference on Artificial Intelligence , volume =

  9. [9]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

    Li, Yuezun and Li, Yiming and Wu, Baoyuan and Li, Longkang and He, Ran and Lyu, Siwei , title =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  10. [10]

    International Conference on Learning Representations , year =

    Tuan Anh Nguyen and Anh Tuan Tran , title =. International Conference on Learning Representations , year =

  11. [11]

    Advances in Neural Information Processing Systems , volume =

    Nguyen, Tuan Anh and Tran, Anh Tuan , title =. Advances in Neural Information Processing Systems , volume =

  12. [12]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume =

    Huynh, Tri and Nguyen, Dinh and Pham, Tuan and Tran, Anh , title =. Proceedings of the AAAI Conference on Artificial Intelligence , volume =

  13. [13]

    International and European Labour Law , pages =

    Otto, Marta , title =. International and European Labour Law , pages =. 2018 , publisher =

    2018

  14. [14]

    2015 IEEE Symposium on Security and Privacy , pages =

    Cao, Yinzhi and Yang, Junfeng , title =. 2015 IEEE Symposium on Security and Privacy , pages =. 2015 , publisher =

    2015

  15. [15]

    arXiv preprint arXiv:1912.02771 , year=

    Label-Consistent Backdoor Attacks , author=. arXiv preprint arXiv:1912.02771 , year=

    Pith/arXiv arXiv 1912

  16. [16]

    Advances in Neural Information Processing Systems , volume=

    Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch , author=. Advances in Neural Information Processing Systems , volume=

  17. [17]

    and Jia, Hengrui and Travers, Adelin and Zhang, Baiwu and Lie, David and Papernot, Nicolas , title =

    Bourtoule, Lucas and Chandrasekaran, Varun and Choquette-Choo, Christopher A. and Jia, Hengrui and Travers, Adelin and Zhang, Baiwu and Lie, David and Papernot, Nicolas , title =. 2021 IEEE Symposium on Security and Privacy , pages =. 2021 , publisher =

    2021

  18. [18]

    2022 IEEE 7th European Symposium on Security and Privacy , pages =

    Thudi, Anvith and Deza, Gabriel and Chandrasekaran, Varun and Papernot, Nicolas , title =. 2022 IEEE 7th European Symposium on Security and Privacy , pages =. 2022 , publisher =

    2022

  19. [19]

    Proceedings 2023 Network and Distributed System Security Symposium , year =

    Warnecke, Alexander and Pirch, Lukas and Wressnegger, Christian and Rieck, Konrad , title =. Proceedings 2023 Network and Distributed System Security Symposium , year =

    2023

  20. [20]

    Advances in Neural Information Processing Systems , volume =

    Chien, Eli and Wang, Haoyu and Chen, Ziang and Li, Pan , title =. Advances in Neural Information Processing Systems , volume =

  21. [21]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume =

    Wu, Ga and Hashemi, Masoud and Srinivasa, Christopher , title =. Proceedings of the AAAI Conference on Artificial Intelligence , volume =

  22. [22]

    IEEE INFOCOM 2022 -- IEEE Conference on Computer Communications , pages =

    Liu, Yang and Fan, Mingyuan and Chen, Cen and Liu, Ximeng and Ma, Zhi and Wang, Li and Ma, Jianfeng , title =. IEEE INFOCOM 2022 -- IEEE Conference on Computer Communications , pages =. 2022 , publisher =

    2022

  23. [23]

    arXiv preprint arXiv:2310.10659 , year =

    Zhang, Peixin and Sun, Jing and Tan, Ming and Wang, Xiaoyang , title =. arXiv preprint arXiv:2310.10659 , year =

    Pith/arXiv arXiv

  24. [24]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume =

    Liu, Zihao and Wang, Tianhao and Huai, Mengdi and Miao, Chenglin , title =. Proceedings of the AAAI Conference on Artificial Intelligence , volume =

  25. [25]

    Huang, Zirui and Mao, Yunlong and Zhong, Sheng , booktitle=

  26. [26]

    When Forgetting Triggers Backdoors: A Clean Unlearning Attack , journal =

    Arazzi, Marco and Nocera, Antonino and. When Forgetting Triggers Backdoors: A Clean Unlearning Attack , journal =

  27. [27]

    , title =

    Wang, Bolun and Yao, Yuanshun and Shan, Shawn and Li, Huiying and Viswanath, Bimal and Zheng, Haitao and Zhao, Ben Y. , title =. 2019 IEEE Symposium on Security and Privacy , pages =. 2019 , publisher =

    2019

  28. [28]

    International Symposium on Research in Attacks, Intrusions, and Defenses , pages =

    Liu, Kang and Dolan-Gavitt, Brendan and Garg, Siddharth , title =. International Symposium on Research in Attacks, Intrusions, and Defenses , pages =. 2018 , publisher =

    2018

  29. [29]

    and Nepal, Surya , title =

    Gao, Yansong and Xu, Chang and Wang, Derui and Chen, Shiping and Ranasinghe, Damith C. and Nepal, Surya , title =. Proceedings of the 35th Annual Computer Security Applications Conference , pages =

  30. [30]

    Proceedings of the 34th International Conference on Machine Learning , volume =

    Koh, Pang Wei and Liang, Percy , title =. Proceedings of the 34th International Conference on Machine Learning , volume =. 2017 , publisher =

    2017

  31. [31]

    Morley and Jia, Ruoxi , title =

    Zeng, Yi and Park, Won and Mao, Z. Morley and Jia, Ruoxi , title =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  32. [32]

    and Rao, K

    Ahmed, Nasir and Natarajan, T. and Rao, K. R. , title =. IEEE Transactions on Computers , volume =

  33. [33]

    Learning Multiple Layers of Features from Tiny Images , author=

  34. [34]

    2009 IEEE Conference on Computer Vision and Pattern Recognition , pages =

    Deng, Jia and Dong, Wei and Socher, Richard and Li, Li-Jia and Li, Kai and Fei-Fei, Li , title =. 2009 IEEE Conference on Computer Vision and Pattern Recognition , pages =. 2009 , publisher =

    2009

  35. [35]

    European Conference on Computer Vision , pages =

    He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian , title =. European Conference on Computer Vision , pages =. 2016 , publisher =

    2016

  36. [36]

    Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =

    He, Kaiming and Zhang, Xiangyu and Ren, Shaoqing and Sun, Jian , title =. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =

  37. [37]

    International Conference on Medical Image Computing and Computer-Assisted Intervention , pages =

    Ronneberger, Olaf and Fischer, Philipp and Brox, Thomas , title =. International Conference on Medical Image Computing and Computer-Assisted Intervention , pages =. 2015 , publisher =

    2015

  38. [38]

    International Conference on Learning Representations , year=

    Very Deep Convolutional Networks for Large-Scale Image Recognition , author=. International Conference on Learning Representations , year=

  39. [39]

    Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages=

    MobileNetV2: Inverted Residuals and Linear Bottlenecks , author=. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages=

  40. [40]

    2025 , organization=

    Alam, Manaar and Lamri, Hithem and Maniatakos, Michail , booktitle=. 2025 , organization=

    2025

  41. [41]

    International Conference on Learning Representations , year=

    Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks , author=. International Conference on Learning Representations , year=

This paper was first reviewed by grok-4.5 on July 31, 2026.