{"id":"70c33c28-ec29-467a-ae0a-7d59d64b3c69","arxiv_id":"2411.19075","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"LADDER uses multi-objective evolutionary optimization to craft low-frequency backdoor triggers that are simultaneously effective, invisible in spatial and spectral domains, and robust against common image preprocessing.","lead":"LADDER is a new backdoor attack that poisons training images by adding tiny changes in the low-frequency part of their DCT spectrum, and it tunes those changes with an evolutionary algorithm that balances attack success, invisibility, and robustness to image preprocessing. It achieves over 99% attack success across five datasets while keeping changes nearly invisible, and it survives preprocessing such as JPEG compression and blurring far better than earlier attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Surrogate-to-victim transferability is the least secured premise: Table V covers CIFAR-10 only, and no experiment varies the victim's training pipeline or tests the matrix at 64x64.","rationale":"The reader's weakest assumption identifies the same core link: triggers are optimized on a surrogate and must transfer to an unknown victim. I agree with that concern in substance, but mark agreement as partial because Table V already covers CNN/ViT heterogeneity and Table II demonstrates one heterogeneous pair on each of five datasets, including 64x64 images. What remains untested is transfer across training pipelines and across the full architecture matrix at larger scale. That gap is the least secured premise, not a demonstrated flaw. The reported numerical overclaims (e.g., 50.09% robustness gain, 1.12x-196.74x stealthiness range) are real but correctable reporting issues and do not threaten the method's validity. The O1 formulation discrepancy (Eq. 10b includes D_c, Algorithm 2 evaluates only D_bd) is worth noting but is secondary, since clean accuracy is preserved by the low poison ratio and small perturbation constraint. I therefore recommend keeping the reader's CONDITIONAL verdict: the central construction is plausible and partly supported, but the transferability premise should be pinned down before accepting the broad black-box claim.","tokens_in":35897,"tokens_out":7308,"duration_ms":72954,"concrete_test":"Run the Table V transferability matrix on Tiny-ImageNet (64x64) with VGG19 as surrogate and PreAct-ResNet18, GoogleNet, and ViT as victims, and for each victim train under two pipelines: (i) the paper's SGD/200-epoch recipe and (ii) Adam/100 epochs with data augmentation. Keep the same MOEA-selected poisoned dataset. If any configuration yields ASR below roughly 95% or an ACC drop over 1%, the surrogate-guided O1 is not reliably transferable and the central black-box claim requires qualification.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that LADDER works 'without requiring prior knowledge about victim model' depends on O1 computed on a heterogeneous surrogate (Eq. 10b; Algorithm 2) predicting attack success on an unseen victim. Table V supports this for four architecture pairs on CIFAR-10, and Table II shows one surrogate/victim pair per dataset, but those experiments fix the authors' training recipe (SGD, 200 epochs, batch 64, same augmentation). They do not vary optimizer, learning-rate schedule, epochs, regularization, or data augmentation. The theoretical argument in Section VIII-A—same feature-vector count, poison ratio, and trigger norm—does not control for training dynamics, which are known to affect whether and how quickly a backdoor is learned. If a victim trains with, e.g., Adam and early stopping, the MOEA's selection pressure may have optimized for a surrogate-specific shortcut that does not persist. This is not a demonstrated failure, but it is the load-bearing link in the black-box claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes LADDER, a black-box backdoor attack that formulates trigger design as a multi-objective optimization problem over attack effectiveness, spectral-domain stealthiness, and robustness to preprocessing, and solves it with a preference-based multi-objective evolutionary algorithm. The authors claim that the resulting triggers achieve ASR above 99%, an average preprocessing-robustness ASR of 90.23%, and improved natural and spectral stealthiness across five benchmark datasets, without requiring knowledge of the victim model. The manuscript includes extensive experiments, ablation studies, a transferability matrix over architectures, and a proof that the l2-norm of the trigger is preserved between the spatial and spectral domains under their DCT-based injection.","tokens_in":36096,"tokens_out":5504,"duration_ms":53833,"significance":"If the central claims hold, LADDER is a meaningful advance for black-box backdoor attacks: it provides a gradient-free, coefficient-free alternative to Lagrange-multiplier formulations, explicitly targets dual-domain stealthiness, and demonstrates strong empirical robustness to preprocessing. The paper also contributes a useful empirical study of objective conflicts and a defense evaluation against both classic and recent defenses. The release of code and the transferability matrix across heterogeneous architectures are clear strengths. However, the broad claim that the attack works without knowledge of the victim model rests on a relatively narrow transferability evaluation, and several headline quantitative claims in the abstract are not reproducible from the tables in the current version.","major_comments":[{"comment":"The central claim that LADDER works 'without requiring prior knowledge about victim model' depends on the surrogate model predicting attack success on an unseen victim. The only direct evidence is Table V, which is restricted to CIFAR-10 and to four architecture pairs trained with the same fixed recipe (SGD, 200 epochs, batch size 64, same augmentation). No experiment varies the victim's optimizer, learning-rate schedule, number of epochs, regularization, or augmentation, and no 64x64 dataset appears in the transferability study. The heuristic argument in §VIII-A (same number of feature vectors, same poison ratio, same perturbation norm) does not control for training dynamics, which are known to affect whether and how quickly a backdoor is learned. This is the load-bearing link in the black-box claim, and it needs either a broader empirical demonstration or a principled argument explaining why training dynamics are irrelevant.","section":"§VIII-A, Table V"},{"comment":"The optimization problem in Eq. (10b) defines O1 as the loss over Dc ∪ Dbd, which is meant to ensure both attack effectiveness and functionality preservation (clean accuracy). However, Algorithm 2 evaluates O1 only on Dbd: it trains the surrogate on Dbd (line 3) and then computes the loss on Dbd (line 4), with no evaluation on Dc. Thus the implementation optimizes only the poisoned-set loss, not the clean-set loss, despite the formulation and the text stating that O1 ensures 'a practical ACC and ASR.' The functionality-preservation objective should either be included in the actual evaluation loop or the formulation should be revised to match Algorithm 2.","section":"Eq. (10b) and Algorithm 2"},{"comment":"The abstract's headline '50.09% higher' robustness margin does not match Table IV. Using the average row in Table IV, the mean ASR of the ten comparators (seven published attacks plus LADDER-Mid/High/Full) is about 43.75%, giving a margin of roughly 46.5 percentage points over LADDER-LOW's 90.23%; restricting to the seven published attacks gives a margin of about 35.4 points. I could not reproduce 50.09% from the reported numbers. The authors should either correct the stated margin or provide the exact set of comparators and averaging procedure used to obtain it.","section":"Abstract and Table IV"},{"comment":"The claimed natural-stealthiness improvement range of '1.12x to 196.74x' is not supported by the data in Table III. For the l2-norm values reported there, the ratio of the best baseline to LADDER is at most about 11x (e.g., BadNets on GTSRB), and on SVHN LADDER's l2-norm (0.2781) is worse than WaNet's (0.1969). The value 196.74x does not correspond to any ratio I can derive from the table with the stated metric. The authors should specify exactly which metric and which baseline pairs produce the claimed range, or remove the unsupported range from the abstract.","section":"Abstract and Table III"},{"comment":"The abstract claims 'excellent spectral stealthiness (8.45x enhancement)', but I could not find a quantitative definition of the spectral-stealthiness metric or a table reporting such a metric. The spectral-domain evaluation in §VII-B is qualitative: it shows residual frequency maps in Figures 6 and 11. The paper should define the spectral anomaly metric, report its values for all attacks and datasets, and derive the 8.45x figure from those numbers; otherwise the dual-domain stealthiness claim is not quantitatively supported.","section":"Abstract and §VII-B"}],"minor_comments":[{"comment":"The symbols used in Table I ('!' and '%') are not defined in the table caption or in the surrounding text; a legend is needed.","section":"Table I"},{"comment":"The caption says mutation samples from an exponential distribution, while §VI-B says polynomial mutation (PM) is used. These are inconsistent and should be reconciled.","section":"Figure 4(b)"},{"comment":"The preference region Opref is hand-set to (0.9, 0.4, 8 or 12). The paper presents this as avoiding coefficient tuning, but these are still hyperparameters with a direct effect on the selected trigger. A sensitivity analysis of Opref would strengthen the claim of being coefficient-free.","section":"§VI-A, Eq. (10g)"},{"comment":"The captions do not explain the axes, the meaning of the grey region, or how the 'practical trigger' region is defined; this makes the visualization difficult to interpret without referring back to the text.","section":"Figure 3 and Figure 5"},{"comment":"The adaptive-defense slope s is reported for LADDER as -1.8238 versus -1.8922 for clean images, which is the second-closest value to clean among all attacks. The text says clean samples have the smallest s, which is true, but the closeness of LADDER to clean is not discussed; this could be seen as favorable evidence for the attack's spectral stealthiness and deserves explicit comment.","section":"Appendix F, Table XVII"}],"recommendation":"major_revision","confidential_remarks":"The experimental breadth is impressive, but the headline numbers in the abstract need to be reconciled with the tables, and the surrogate-to-victim transferability claim needs substantially more support before the paper can be accepted. The discrepancy between the O1 formulation and Algorithm 2 is also a correctness issue that should be fixed or clarified."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a genuinely new attack formulation — multi-objective evolutionary search over frequency-domain triggers with a spatial+spectral stealthiness objective — and the core capability claim (ASR >99% with strong preprocessing robustness) is credible. But the paper's headline numbers are sloppier than they look, and the black-box transferability premise is thinner than the abstract implies.\n\nWhat's actually new: nobody in the cited literature formulates trigger design as an MOP solved by a preference-based MOEA. The rNDSort modification to pull solutions toward a practical region is a sensible, non-trivial extension of NSGA-II, and the dual-domain stealthiness framing (l2-norm in frequency as a proxy for spatial invisibility, with a neat isometry proof in the appendix) is a real contribution. The evaluation is broad: five datasets, ten baselines, transferability across architecture pairs, several defenses. They release code and honestly list limitations — including the attack's poor standing against white-box defenses — which is better than most in this literature.\n\nSoft spots, in order of seriousness. First, the abstract and Table IV overstate the robustness margin. The claimed 50.09% \"higher than SOTA on average\" compares LADDER-Low against a mix of seven attacks and three LADDER variants (mid/high/full) rather than against the natural baselines; the 90.23% average is on CIFAR-10 only. Similarly, the 1.12x–196.74x stealthiness improvement is not reproducible from Table III — there's a 0.081 l2-norm case on SVHN where LADDER loses to WaNet, and the range seems to be cherry-picked. These are fixable but they are real overclaims.\n\nSecond, the least secured link is surrogate-to-victim transferability. The empirical support (Table V) covers four architectures on CIFAR-10 with one fixed training recipe (SGD, 200 epochs, batch 64, same augmentation). The theoretical argument in Section VIII-A is heuristic — same feature-vector count, poison ratio, and trigger norm — and doesn't control for optimizer choice, early stopping, or regularization, all of which affect whether and when a backdoor is learned. This doesn't invalidate the attack, but the \"no prior knowledge about victim model\" claim needs a wider net: at least one other dataset, a different optimizer, and a different training schedule.\n\nMinor: main tables lack error bars despite stochastic training; the O2 objective (l2-norm of spectral perturbation) is also the headline stealthiness metric, which is mildly self-referential — though PSNR/SSIM/LPIPS and the spectral residual maps provide independent grounding.\n\nBottom line: this is a solid, citable attack paper with a genuine new idea and credible central results. It deserves serious refereeing; the numeric claims need correction and the transferability section needs strengthening before acceptance. Worth bringing to our reading group.","headline":"A genuinely new multi-objective evolutionary backdoor attack with credible core results, but the headline numbers are overstated and the black-box transferability premise is thinner than the abstract claims.","tokens_in":36663,"tokens_out":1896,"would_cite":true,"duration_ms":19381,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"LADDER formulates black-box backdoor trigger design as a multi-objective evolutionary optimization, claiming over 99% attack success with dual-domain stealth and preprocessing robustness.","keywords":["backdoor attack","multi-objective optimization","evolutionary algorithm","frequency-domain trigger","data poisoning","trigger stealthiness","attack robustness","black-box attack"],"falsifier":"Train a victim model on a poisoned dataset generated from a trigger optimized on a heterogeneous surrogate, using a dataset or optimizer outside the paper's five datasets, and measure ASR; if ASR falls materially below the claimed 99% while a fixed-pattern baseline holds, the transferability premise fails. A second check: apply JPEG quality 50 to LADDER-poisoned images and compare ASR with the paper's reported value near 80%; a large drop would falsify the low-frequency robustness claim.","tokens_in":35637,"feed_emoji":"🎯","tokens_out":5701,"duration_ms":52386,"temperature":0.7,"pith_summary":"The paper proposes LADDER, a black-box backdoor attack that treats trigger design as a multi-objective optimization problem rather than a weighted single-objective one. The attacker searches for a trigger in the low-frequency part of the DCT spectrum, evaluated on a surrogate model, with three objectives: attack effectiveness, perturbation stealthiness in both spatial and spectral domains, and robustness to image preprocessing. The search is performed by a multi-objective evolutionary algorithm with preference-based selection, so no gradient information from the victim model is needed and no Lagrange coefficients must be tuned. If the claims hold, a data-poisoning attacker can plant backdoors that achieve over 99% attack success, retain about 90% success after preprocessing, and leave almost no trace in either pixel or frequency inspection.","feed_headline":"Evolution finds invisible backdoor triggers that survive preprocessing","feed_subtitle":"Trigger search treats stealth and robustness as equal goals, hitting 99% attack success without victim-model access.","key_machinery":"The load-bearing machinery is the frequency-domain trigger representation together with a preference-based multi-objective evolutionary optimizer. A trigger is a pair $t=(\\delta,\\nu)$ of magnitude perturbations and frequency-band indices, constrained to a low-frequency domain $F_{\\mathrm{dom}}$ with per-band bound $\\epsilon$. The optimizer maintains a population of such triggers, generates offspring with simulated binary crossover and polynomial mutation, evaluates all three objectives on a surrogate model, and applies a modified non-dominated sort called rNDSort that first keeps Pareto-front triggers and then fills the rest of the population by Euclidean distance to an attacker-specified preference region $O_{\\mathrm{pref}}$. This keeps the search gradient-free and coefficient-free while steering the population away from impractical triggers.","core_discovery":"The central claim is that the best backdoor trigger is not a single optimum but a Pareto trade-off among objectives, and that an evolutionary population search can find triggers in the attacker-desired region of that trade-off. Formally, LADDER solves for a perturbation vector $\\delta$ and frequency-band locations $\\nu$ minimizing the triple objective $O=(O_1,O_2,O_3)$: $O_1$ measures the loss of a surrogate model trained on poisoned data, $O_2$ is the $\\ell^2$-norm of the trigger considered as dual-domain stealthiness, and $O_3$ penalizes distance of chosen bands from the zero-frequency band considered as robustness. The trigger is injected through DCT and IDCT via $x' = D^{-1}(D(x) \\odot (\\delta,\\nu))$. The paper reports, across five datasets, ASR at least 99%, average preprocessing-robust ASR of 90.23%, natural stealthiness improvements between 1.12x and 196.74x, and an 8.45x spectral stealthiness enhancement. The authors further conclude that trigger effectiveness transfers across heterogeneous surrogate and victim model architectures, arguing that the poison ratio, perturbation norm, and feature-vector count are the determining factors.","pith_inferences":["Editorial inference: the preference region $O_{\\mathrm{pref}}$ becomes a new hyperparameter that replaces Lagrange coefficients, so the attack's ease of use depends on how robustly the optimizer behaves when that region is misspecified.","Editorial inference: the transferability argument is validated only on CIFAR-10 across four model families; a test on larger-scale or out-of-distribution training would show whether the heuristic generalizes.","Editorial inference: since low-frequency perturbations survive compression, they may also survive learned denoising defenses, which suggests a direct experiment comparing LADDER against learned preprocessing filters.","Editorial inference: the spectral-slope detector the paper proposes as an adaptive defense could itself be tuned against LADDER, turning spectral stealthiness into an arms-race property rather than a fixed guarantee."],"forward_implications":["If transferability across models holds, an attacker can poison a public dataset once and backdoor any user who trains on it, regardless of architecture choice.","Low-frequency placement makes the backdoor resistant to common preprocessing defenses such as JPEG compression and Gaussian or Wiener filtering, which preferentially destroy high frequencies.","Spectral stealthiness closes a gap left by spatial-only invisible triggers: frequency-domain anomaly detectors will not see a bright residual between clean and poisoned spectra.","Because the method is black-box and gradient-free, the same formulation can be applied to models where gradients are unavailable or proprietary, including prediction-only APIs."],"supporting_citations":[{"why":"Supplies the NSGA-II-style multi-objective evolutionary algorithm backbone with non-dominated sorting.","marker":"[12]"},{"why":"Provides the simulated binary crossover operator used to generate offspring triggers.","marker":"[13]"},{"why":"Provides the polynomial mutation operator used to vary perturbation magnitudes and band locations.","marker":"[14]"},{"why":"Defines the DCT/IDCT pair that underlies frequency-domain trigger injection and the l2-norm consistency argument.","marker":"[2]"},{"why":"Supplies the empirical basis for restricting trigger search to the low-frequency region.","marker":"[60]"},{"why":"Serves as the main frequency-domain black-box baseline whose fixed mid/high-frequency trigger LADDER improves upon.","marker":"[71]"},{"why":"Provides the theoretical analysis of backdoor poisoning effectiveness used to argue surrogate-to-victim transferability.","marker":"[39]"},{"why":"Provides the classic BadNets patch baseline for effectiveness and robustness comparisons.","marker":"[24]"},{"why":"Supports the claim that low-frequency components carry semantic information and tolerate hidden perturbations.","marker":"[11]"}],"fun_headline_variants":["Evolutionary algorithm finds backdoor triggers that survive preprocessing","Multi-objective evolution crafts stealthy, robust backdoor attacks","Backdoor triggers evolved to balance stealth, robustness, and success","Evolution balances backdoor stealth and robustness","Pareto-optimal backdoor triggers from evolutionary search"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes a trigger that performs well on a heterogeneous surrogate model will also perform well on an unseen victim model trained on the same poisoned dataset, because effectiveness is determined by feature-vector count, poison ratio, and perturbation norm rather than by architecture.","fun_headline_variants_meta":{"raw":{"variants":["Evolutionary algorithm finds backdoor triggers that survive preprocessing","Multi-objective evolution crafts stealthy, robust backdoor attacks","Backdoor triggers evolved to balance stealth, robustness, and success","Evolution balances backdoor stealth and robustness","Pareto-optimal backdoor triggers from evolutionary search"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001371,"raw_usage":{"total_tokens":5617,"prompt_tokens":1068,"completion_tokens":4549,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":684,"completion_tokens_details":{"reasoning_tokens":4471}},"tokens_in":684,"tokens_out":4549,"duration_ms":66387,"temperature":1.0,"reasoning_tokens":4471,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:33:51.726521+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a victim model on a poisoned dataset generated from a trigger optimized on a heterogeneous surrogate, using a dataset or optimizer outside the paper's five datasets, and measure ASR; if ASR falls materially below the claimed 99% while a fixed-pattern baseline holds, the transferability premise fails. A second check: apply JPEG quality 50 to LADDER-poisoned images and compare ASR with the paper's reported value near 80%; a large drop would falsify the low-frequency robustness claim.","supporting_citations":[{"cited_title":"A fast and elitist multiobjective genetic algorithm: Nsga-ii,","cited_arxiv_id":null,"evidence_quote":"Supplies the NSGA-II-style multi-objective evolutionary algorithm backbone with non-dominated sorting."},{"cited_title":"Simulated binary crossover for continuous search space,","cited_arxiv_id":null,"evidence_quote":"Provides the simulated binary crossover operator used to generate offspring triggers."},{"cited_title":"A combined genetic adaptive search (geneas) for engineering design,","cited_arxiv_id":null,"evidence_quote":"Provides the polynomial mutation operator used to vary perturbation magnitudes and band locations."},{"cited_title":"On the effectiveness of low frequency perturbations,","cited_arxiv_id":null,"evidence_quote":"Supplies the empirical basis for restricting trigger search to the low-frequency region."},{"cited_title":"An invisible black-box backdoor attack through frequency domain,","cited_arxiv_id":null,"evidence_quote":"Serves as the main frequency-domain black-box baseline whose fixed mid/high-frequency trigger LADDER improves upon."},{"cited_title":"A theoretical analysis of backdoor poisoning attacks in convolutional neural networks,","cited_arxiv_id":null,"evidence_quote":"Provides the theoretical analysis of backdoor poisoning effectiveness used to argue surrogate-to-victim transferability."},{"cited_title":"Secure spread spectrum watermarking for multimedia,","cited_arxiv_id":null,"evidence_quote":"Supports the claim that low-frequency components carry semantic information and tolerate hidden perturbations."}],"review_version":1}