{"id":"8c2ef3d3-4297-44d0-9cb6-89bd8927c08a","arxiv_id":"2412.06149","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Attention-guided trigger placement with co-optimized training and alternating clean retraining achieves high backdoor attack success at low poison ratios on CNNs and vision transformers, while evading several published defenses.","lead":"An attack method places a nearly invisible backdoor trigger on the image areas a pretrained attention model says are most influential, then co-trains the trigger and the victim model while periodically retraining on clean data. It reports near-perfect attack success at very low poison ratios on CNNs and vision transformers, and it evades several established backdoor defenses.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attention mask gains are confounded with mask geometry: no random-scatter baseline isolates the attention mechanism.","rationale":"The reader's weakest assumption correctly identifies the attention-based mask as the pivotal component, but frames the risk as cross-model transfer (RAN attention not transferring to the victim). My concern is more specific and more directly supported by the paper's own ablation design: even if RAN attention transfers perfectly, Table 4 cannot demonstrate it because 'Base' and 'Base+Attn' differ simultaneously in mask shape (contiguous square vs scattered pixels) and location (bottom-right corner vs attention-selected positions). The missing control is a random scattered mask of the same pixel budget. This is load-bearing because contribution #1 and the 82% improvement over baselines at low poison ratios are attributed precisely to the attention mechanism. The proposed random-scatter control would settle whether the attention map is causally responsible or whether any non-contiguous, non-corner mask of the same size would achieve similar gains. The SSIM sign issue in Eq. 7 (minimizing +eta*SSIM would degrade similarity) is a secondary internal inconsistency, but it affects the QoE sub-claim rather than the attack-effectiveness claim; I do not feature it as the primary concern. The reader's CONDITIONAL verdict remains appropriate: the paper needs code, multi-seed statistics, and now also this control before the central claim can be accepted. My concern does not shift the verdict; it sharpens the conditions under which the verdict should be upgraded to ACCEPT.","tokens_in":26026,"tokens_out":6159,"duration_ms":59643,"concrete_test":"Run the 'Base+Attn' pipeline (Algorithm 1) on VGG-Flower-l, CIFAR-10, GTSRB, and CIFAR-100 with the RAN mask replaced by a uniformly random selection of l^2 pixels (same pixel budget, same non-contiguous scatter, one fixed random mask per target class for fairness). Compare 'Base+Rand' against 'Base+Attn' at the same trigger sizes. If 'Base+Rand' ASR stays within 10% of 'Base+Attn' on average, the attention contribution collapses; if it is substantially lower, the attention mechanism is empirically validated. Reporting mean and standard deviation over 5 seeds would also address the missing error bars.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central effectiveness claim hinges on the attention-based mask (Sec. 4.2, Algorithm 1 steps 2-3) producing the large ASR gains in Table 4, e.g., CIFAR-10 2x2: Base 58.26% vs Base+Attn 95.60%. However, the ablation contrasts a contiguous lxl square fixed in the bottom-right corner (Base) with l^2 scattered pixels chosen by RAN attention (Base+Attn). Geometry and location vary simultaneously with the attention criterion. There is no control using l^2 randomly scattered pixels under the same co-optimization pipeline. If random scatter already yields most of the gain, then the RAN attention map is not providing the claimed 'optimal trigger shape and location', and the 82% headline improvement cannot be attributed to the novel attention mechanism. The reader's concern about cross-model transfer is related but secondary: even perfect transfer is not demonstrated by this comparison, because the observed gain could come from abandoning the contiguous corner square rather than from attending to salient pixels.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a backdoor attack framework that combines four components: attention-based trigger mask selection (top l^2 pixels of a RAN attention map), QoE-aware trigger optimization (SSIM term and opacity adjustment), co-optimization of trigger and model, and alternating retraining with benign/poisoned batches. The authors evaluate the approach on five datasets with both CNNs and ViTs, reporting ASR close to 90-100% at poison ratios as low as 0.1%, CDA close to benign levels, and robustness to defenses including STRIP, NAD, MNTD, Neural Cleanse, ABS, pruning, and DBAVT. The main claim is that the attention-based mask and co-optimization yield substantially higher attack success rates than prior attacks, especially at low poison ratios.","tokens_in":26175,"tokens_out":8115,"duration_ms":66523,"significance":"If the reported results are reproducible, the attack would be a strong contribution: it achieves high ASR at poison ratios as low as 0.1% (e.g., 96.53% on CIFAR-100), maintains high CDA, and shows resistance to a broad set of defenses. The paper's strengths include a wide evaluation across five datasets, two architectures, many baselines, and multiple defense evaluations, plus an ablation study that isolates the contributions of attention, iterative co-optimization, and alternating retraining. However, the central claim about the attention mechanism is weakened by a confounded ablation (no random-scatter control), and the lack of error bars and hyperparameter-tuning details leaves uncertainty about the robustness of the reported margins. The defense evasion claims also lack quantitative support for MNTD and ABS.","major_comments":[{"comment":"The ablation compares 'Base' (a contiguous square trigger fixed at the bottom-right corner) with 'Base+Attn' (l^2 scattered pixels selected by the RAN attention map), so geometry and location vary simultaneously with the attention criterion. For example, CIFAR-10 2×2 ASR increases from 58.26% to 95.60%, but without a control that uses l^2 randomly scattered pixels in the same co-optimization pipeline, the gain cannot be attributed to the attention mechanism rather than to abandoning the contiguous corner square. Please add a random-scatter baseline (e.g., l^2 random pixels drawn from the same or similar image region) and compare the ASR distribution over multiple random masks. This is necessary to support the headline claim that attention maps find the optimal trigger shape and location.","section":"§6.3, Table 4"},{"comment":"The paper sets the gradient augmentation factor θ, the QoE weight η, and the trigger transparency per dataset 'according to the experimental effect' (θ) and 'through experiments' (transparency), and reports final numbers on the same datasets. Because these hyperparameters are tuned on the test sets whose metrics are reported, the comparison to baselines may be optimistic. Please specify the selection protocol (e.g., a validation split held out from the reported results) or provide a sensitivity analysis showing that the conclusions are stable across a range of θ, η, and transparency values.","section":"§4.3, Eq. (7) and §5.1"},{"comment":"All reported numbers are single runs with no error bars or seed information. Given the margins claimed at low poison ratios (e.g., CIFAR-100 0.1% ASR 96.53% vs. RobNet 17.01% in Table 2), it is important to know whether these differences are consistent across random seeds and dataset subsamples. Please report mean and standard deviation over at least three (preferably five) independent runs for the main attack results and the key ablations (Tables 1, 2, 3, 4, 5).","section":"Tables 1–10"},{"comment":"For CIFAR-100, the proposed method's CDA is 82.26%, which is substantially lower than DBIA (91.33%) and DBAVT (98.23%). The text states that the proposed method 'consistently outperforms the baselines' across all six datasets. This claim is inaccurate with respect to clean-data accuracy for CIFAR-100; please either correct the claim or provide a trade-off analysis (e.g., the cost of the higher ASR and better LPIPS on CIFAR-100).","section":"§6.2, Table 3"},{"comment":"The MNTD evasion claim is stated without quantitative support: the paper says the backdoored models 'can all evade the inspection of MNTD' but provides no detection rates, no table, and no comparison to baselines under the same meta-classifier. Similarly, the ABS results report post-defense ASR values but not the detection rates or the proportion of models flagged as backdoored. These are central to the 'resilient' claim in the title and abstract; please provide the missing quantitative evidence.","section":"§7.1.4 and §7.1.6"}],"minor_comments":[{"comment":"The citation for VGG-Flower appears as '[?]'; please replace it with the proper reference.","section":"§5.1"},{"comment":"The dataset name 'CIAFR-100' should be 'CIFAR-100'.","section":"Table 3"},{"comment":"The constraint '∇e := θ∇e' is circular; using the same symbol ∇e on both sides makes the definition ambiguous. Please denote the augmented gradient as, e.g., ∇ẽ = θ∇e.","section":"§4.3, Eq. (7)"},{"comment":"The number N of clean target-class samples used to compute the average attention map is not specified; please state it.","section":"§4.3, Eq. (6)"},{"comment":"The header 'Original' is unclear; it appears to list the no-defense ASR/CDA for the proposed method only, while the remaining columns are post-DBAVT values for each attack. Please clarify the table structure in the caption.","section":"Table 10"},{"comment":"The claim of being 'the first to utilize attention mechanisms to design backdoor trigger masks' is difficult to reconcile with the cited TrojViT [66] and BadViT [64], which also use attention-based triggers for ViTs. Please qualify the novelty claim.","section":"Introduction and Related Work"}],"recommendation":"major_revision","confidential_remarks":"This paper is an extended version of the authors' NDSS 2022 paper (Atteq-NN). The main new contribution is the extension to vision transformers, including the ViT-specific neuron selection, gradient boosting, and defense evaluation. The core CNN attack has been published previously; the editor should weigh how much of the contribution is genuinely novel relative to that prior work. The current manuscript would benefit from stronger evidence for the attention-mask mechanism (random-scatter control) and from standard error reporting before it can be accepted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know. The genuinely new material is the ViT adaptation: head-layer neuron selection, gradient boosting, ViT ablations, and the DBAVT defense experiments. The CNN core is a restatement of the authors' 2022 NDSS paper, which they openly acknowledge. Second, the central attention claim is not actually isolated by the experiments. The ablation contrasts a contiguous bottom-right square with l^2 scattered top-attention pixels, so mask geometry and location vary together with the attention criterion. Without a random-scatter control, the gain cannot be attributed to the RAN attention map specifically. The stress-test note holds up on reading.\n\nCredit where due: the evaluation is broad (six datasets, DNNs and ViTs), the ViT ASR gains over DBIA, DBAVT, BAVT, and TrojViT are consistent, and the alternating retraining strategy is a sensible and apparently effective component. The ablation story is internally consistent—attention helps most at small trigger sizes, co-optimization adds ASR, alternating retraining mostly helps CDA.\n\nSoft spots. No code, single runs with no error bars, and per-dataset hyperparameters (theta, opacity, eta) are tuned on the same datasets whose final numbers are reported. The '82% improvement' and 'consistently outperforms' overshoot the tables; the ViT CIFAR-100 row shows our CDA 82.26% versus DBAVT 98.23%, and some ASR margins are small at higher poison ratios. The cross-model transfer assumption—RAN attention upscaled to the victim—is asserted, not measured; if transfer fails, the mask degenerates to random scatter. None of this makes the attack implausible, but it does mean the headline claims are unverified.\n\nWho this is for: backdoor attack/defense researchers who want a credible ViT attack baseline and a useful case study in what ablation design can and cannot establish. It deserves a serious referee but the referee should demand code, multi-seed variance, and a random-scatter control. I would not cite it as established until artifacts appear; I would bring it to reading group specifically for the ViT comparison and the confound discussion.","headline":"A capable extension of the authors' NDSS attack to ViTs, with plausible numbers but no code, no error bars, and an ablation that conflates attention with mask geometry.","tokens_in":26818,"tokens_out":4304,"would_cite":false,"duration_ms":37512,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a backdoor attack becomes both far more effective and far harder to detect when the trigger is placed on the pixels a separate attention network considers most important, when the trigger is constrained to look…","keywords":["backdoor attacks","attention-based trigger mask","QoE-aware trigger generation","alternating retraining","co-optimization","vision transformers","defense evasion","data poisoning"],"falsifier":"Train the same attack with a mask of the same size, opacity, and poison ratio but with the $l^2$ pixels chosen uniformly at random instead of from the RAN attention map. If the random-mask attack reaches the same attack success rate on CIFAR-10 at 1 percent poison (close to the reported 44.69 percent), the attention-based mask is not carrying the gain; if it stays near the baselines' low rates, the attention map is the load-bearing component.","tokens_in":25790,"feed_emoji":"🎯","tokens_out":5869,"duration_ms":55117,"temperature":0.7,"pith_summary":"The paper tries to establish that backdoor attacks can be made both more effective and more evasive by using an attention map to choose the trigger shape and location, by making the trigger visually natural through a Quality-of-Experience (QoE) constraint, and by co-optimizing the trigger and the backdoored model with alternating retraining. It reports attack success rates near 90 to 100 percent at poison ratios as low as 0.1 to 1 percent on several datasets, while keeping clean-data accuracy close to benign levels and evading a range of state-of-the-art defenses. The same framework, adjusted for transformer structure by placing key neurons in the head layer, is also claimed to work against vision transformers. A sympathetic reader would care because this suggests that the common practice of fixing a trigger location and separating trigger generation from model training leaves a wide margin for stronger and less visible attacks.","feed_headline":"Attention-chosen triggers hit 96.5% backdoor success at 0.1% poison","feed_subtitle":"The method co-optimizes trigger and model, keeps clean accuracy, and evades seven published defenses.","key_machinery":"The central object is the attention-based trigger mask: a residual attention network produces a per-pixel attention map for an image of the target class, the map is upscaled by bilinear interpolation, and the $l^2$ pixels with the highest attention values become the mask. Around this sit four interacting components: a QoE-aware trigger loss that adds SSIM plus a tuned opacity so the trigger is natural; neuron selection with gradient boosting, where a neuron most activated by target-label samples is given extra gradient weight; a co-optimization loop that alternately updates the trigger and retrains the model; and an alternating retraining schedule that uses mixed poisoned and clean datasets on even iterations and only benign samples on odd iterations. For vision transformers, the neuron is placed in the head layer rather than the first fully connected layer, because the head is the layer where every input connects to every output.","core_discovery":"The paper's central claim is that the pixels chosen for a backdoor trigger should be the ones the model attends to, not a fixed square or a random patch. It uses a 92-layer residual attention network (RAN) to obtain an attention map for a sample of the target class, upscales the map to the input size, and selects the top $l^2$ pixels as the trigger mask. Around this mask, the attack adds a QoE term to the loss (structural similarity plus a tuned opacity), selects a neuron strongly activated by target-label samples and boosts its gradient during trigger optimization, and then alternates between optimizing the trigger and retraining the model, with odd iterations using only benign samples. The paper reports that this attention-based, co-optimized scheme reaches attack success rates such as 96.53 percent on CIFAR-100 at a 0.1 percent poison ratio (versus 17.01 percent for the best baseline), about 90.88 percent on GTSRB at 0.3 percent poison, and 44.69 percent on CIFAR-10 at 1 percent poison, while maintaining clean-data accuracy and surviving model pruning, STRIP, NAD, MNTD, Neural Cleanse, ABS, and DBAVT in the reported tests.","pith_inferences":["Editorial inference: because the attention map is taken from a separate residual attention network rather than from the victim model, a direct ablation replacing RAN attention with the victim model's own gradient-based saliency would show whether the reported gain comes from cross-model attention transfer or from the co-optimization loop alone.","Editorial inference: the paper sets opacity and gradient-boost factors separately for each dataset, which implies a tunable stealth-versus-effectiveness frontier; mapping that frontier explicitly would show a defender which settings are still detectable by human or automated inspection.","Editorial inference: the alternating retraining schedule that makes a backdoored model behave like a benign one could be repurposed as a defense, by fine-tuning a suspect model on clean data in the same alternating pattern and measuring how much the attack success rate drops.","Editorial inference: the reported advantage at very low poison ratios suggests that defense evaluations should report performance across a sweep of poison ratios, since a defense that works at 5 percent poison may fail at 0.1 percent."],"forward_implications":["If the central claim is correct, small triggers (down to 2x2 pixels) placed at attention hotspots can reach near-perfect attack success at poison ratios where fixed or random triggers fail almost completely.","Co-optimizing the trigger and the model, with alternating retraining, is claimed to preserve clean-data accuracy while narrowing the behavioral gap between backdoored and benign models, which is the stated reason the attack evades MNTD and NAD.","The same framework transfers to vision transformers when the key neuron is selected from the head layer, achieving high attack success and very low LPIPS values, meaning the backdoored images look natural.","Under the reported settings, the backdoored models survive model pruning, STRIP, Neural Cleanse, ABS, MNTD, NAD, and the DBAVT defense, suggesting the attack's evasiveness is not limited to one detection strategy."],"supporting_citations":[{"why":"Residual attention network whose attention maps supply the pixel weights that define the trigger mask.","marker":"[56]"},{"why":"Vision transformer architecture that the attack is extended to, with patch embedding, attention blocks, and head layer.","marker":"[12]"},{"why":"Structural Similarity Index Measure used as the QoE term in the trigger loss.","marker":"[59]"},{"why":"BadNets, the baseline attack whose fixed trigger is replaced by the attention-based mask.","marker":"[20]"},{"why":"TrojanNN, the neuron-activation trigger baseline the attack must beat at low poison ratios.","marker":"[36]"},{"why":"Hidden trigger backdoor (HB), the invisible-trigger baseline compared for attack success and image naturalness.","marker":"[47]"},{"why":"RobNet, the neuron-selection baseline that the attack outperforms, e.g., 96.53% versus 17.01% on CIFAR-100 at 0.1% poison.","marker":"[17]"},{"why":"NAD defense the attack is tested against; alternating retraining is the stated reason for evasion.","marker":"[29]"},{"why":"MNTD meta-classifier defense the backdoored models evade, attributed to alternating retraining.","marker":"[61]"},{"why":"DBAVT, the ViT-specific attack and defense used both as a baseline and as a robustness test.","marker":"[11]"}],"fun_headline_variants":["Attention maps choose backdoor triggers that beat defenses","Co-optimized attention triggers hit 96.5% backdoor success","Backdoor attacks use attention maps to place triggers and evade detection","Attention-based trigger selection boosts backdoor attack to 96.5%","Trigger pixels picked by neural attention improve backdoor attack robustness"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes that the pixels highlighted by a separately pretrained residual attention network's upscaled attention map are the pixels whose perturbation most strongly changes the victim model's classifications; if that attention does not transfer, the mask degenerates into a random pixel selection.","fun_headline_variants_meta":{"raw":{"variants":["Attention maps choose backdoor triggers that beat defenses","Co-optimized attention triggers hit 96.5% backdoor success","Backdoor attacks use attention maps to place triggers and evade detection","Attention-based trigger selection boosts backdoor attack to 96.5%","Trigger pixels picked by neural attention improve backdoor attack robustness"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.0003,"raw_usage":{"total_tokens":1811,"prompt_tokens":1100,"completion_tokens":711,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":716,"completion_tokens_details":{"reasoning_tokens":624}},"tokens_in":716,"tokens_out":711,"duration_ms":7838,"temperature":1.0,"reasoning_tokens":624,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T19:58:46.250646+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same attack with a mask of the same size, opacity, and poison ratio but with the $l^2$ pixels chosen uniformly at random instead of from the RAN attention map. If the random-mask attack reaches the same attack success rate on CIFAR-10 at 1 percent poison (close to the reported 44.69 percent), the attention-based mask is not carrying the gain; if it stays near the baselines' low rates, the attention map is the load-bearing component.","supporting_citations":[{"cited_title":"Defending backdoor attacks on vision transformer via patch processing","cited_arxiv_id":null,"evidence_quote":"DBAVT, the ViT-specific attack and defense used both as a baseline and as a robustness test."},{"cited_title":"Residual attention network for image classification","cited_arxiv_id":null,"evidence_quote":"Residual attention network whose attention maps supply the pixel weights that define the trigger mask."},{"cited_title":"An image is worth 16x16 words: Transformers for image recognition at scale","cited_arxiv_id":null,"evidence_quote":"Vision transformer architecture that the attack is extended to, with patch embedding, attention blocks, and head layer."},{"cited_title":"Image quality assessment: From error visibility to structural 16 similarity","cited_arxiv_id":null,"evidence_quote":"Structural Similarity Index Measure used as the QoE term in the trigger loss."},{"cited_title":"BadNets: Evaluating backdooring attacks on deep neural networks","cited_arxiv_id":null,"evidence_quote":"BadNets, the baseline attack whose fixed trigger is replaced by the attention-based mask."},{"cited_title":"Trojaning attack on neural networks","cited_arxiv_id":null,"evidence_quote":"TrojanNN, the neuron-activation trigger baseline the attack must beat at low poison ratios."},{"cited_title":"Hidden trigger backdoor attacks","cited_arxiv_id":null,"evidence_quote":"Hidden trigger backdoor (HB), the invisible-trigger baseline compared for attack success and image naturalness."},{"cited_title":"Defense-resistant backdoor attacks against deep neural networks in outsourced cloud 15 environment","cited_arxiv_id":null,"evidence_quote":"RobNet, the neuron-selection baseline that the attack outperforms, e.g., 96.53% versus 17.01% on CIFAR-100 at 0.1% poison."},{"cited_title":"Detecting ai trojans using meta neural analysis","cited_arxiv_id":null,"evidence_quote":"MNTD meta-classifier defense the backdoored models evade, attributed to alternating retraining."}],"review_version":1}