{"id":"4711a1ce-1526-4cb9-94dd-a7ec643d3a4a","arxiv_id":"2606.23361","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Chemistry-aware admission defeats many molecular graph backdoors, yet ChemBack demonstrates that chemically valid, target-aligned backdoors remain effective across benchmarks and defenses.","lead":"The paper formalizes ChemGuard as a chemistry-aware admission check for molecular records entering ML pipelines and shows many existing graph backdoors fail it due to invalid chemistry or inconsistency. It then presents ChemBack, a model-free attack using valid motif attachments and fingerprint similarity to create admitted poisons that succeed while preserving clean accuracy.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"ChemGuard may not match the exact admission logic used in the evaluated benchmarks or real pipelines","rationale":"The reader's weakest assumption matches the load-bearing point exactly; the abstract-only review correctly flags the lack of evidence that ChemGuard reproduces the admission behavior of the concrete validators and architectures tested. No stronger internal inconsistency is visible from the supplied text.","tokens_in":1788,"tokens_out":309,"duration_ms":10335,"concrete_test":"Re-run the existing-backdoor and ChemBack evaluations on the same molecular datasets using the exact sanitization and canonicalization routines from the original benchmark codebases (e.g., RDKit version and settings used in the MoleculeNet loaders cited); if the fraction of poisons rejected by the real loaders differs by >15% from ChemGuard, recompute attack success rates under the stricter filter.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that existing graph backdoors lose efficacy while ChemBack succeeds rests on ChemGuard (sanitizable string + exact graph-string reconstruction match) being the operative filter. If the actual validators or data loaders in the reported benchmarks apply additional canonicalization, valence, or aromaticity rules that ChemGuard does not replicate, then the reported drop in existing attack success rates could be an artifact of the authors' specific implementation rather than a general property of chemistry-aware admission. The abstract states ChemGuard \"complements existing defenses\" but supplies no direct side-by-side comparison of admission outcomes on the same poison sets.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript claims that molecular graph backdoors must be evaluated under realistic pipeline admission constraints, formalized as ChemGuard (a record is admitted only if its string is sanitizable and the graph reconstructed from the string exactly matches the submitted graph). Under this view, many existing graph-only backdoors produce chemically invalid or representation-inconsistent poisons and therefore lose efficacy. The authors introduce ChemBack, a model-free attack that constructs chemically feasible motif-anchor attachments, ranks candidates by fingerprint Tanimoto similarity to target-class molecules, and achieves high attack success rates with fully admitted poisons while preserving clean accuracy across benchmarks, validators, architectures, and defenses.","tokens_in":1925,"tokens_out":430,"duration_ms":18225,"significance":"If the central claims hold, the work is significant for shifting the evaluation of molecular backdoors from abstract graph edits to chemistry-aware admission, demonstrating that admission filters suppress some but not all threats. Credit is given for the model-free construction that relies only on molecular structures, target labels, fingerprints, and public validity checks without any victim-model, surrogate, gradient, or training-code access.","major_comments":[{"comment":"Abstract: the claim that existing graph-based backdoors 'lose much of their apparent efficacy because their poisons are chemically invalid or representation-inconsistent' is load-bearing and rests on ChemGuard accurately reproducing the admission logic of the validators actually used in the reported benchmarks. No side-by-side comparison of admission outcomes on identical poison sets is supplied, so the reported drop could be an artifact of the specific ChemGuard implementation rather than a general property of chemistry-aware admission.","section":"Abstract"},{"comment":"Abstract: the assertion that ChemBack 'achieves high attack success with fully admitted poisons while preserving clean accuracy' across 'molecular benchmarks, validators, architectures, and defenses' is presented without any quantitative metrics, error bars, dataset sizes, or exclusion criteria. This absence prevents verification that the central empirical claim is supported.","section":"Abstract"}],"minor_comments":[],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the careful reading and constructive comments. We address each major point below and will incorporate revisions to strengthen the manuscript.","responses":[{"response":"We agree that a direct side-by-side comparison on identical poison sets would make the claim more robust and rule out implementation-specific artifacts. The manuscript defines ChemGuard from standard RDKit sanitization and graph-string roundtrip checks that are common in molecular ML pipelines, but we will add an explicit table in the revised version comparing admission rates for poisons from prior graph backdoor works under both their original reported settings and under ChemGuard.","revision_made":"yes","referee_comment":"[Abstract] Abstract: the claim that existing graph-based backdoors 'lose much of their apparent efficacy because their poisons are chemically invalid or representation-inconsistent' is load-bearing and rests on ChemGuard accurately reproducing the admission logic of the validators actually used in the reported benchmarks. No side-by-side comparison of admission outcomes on identical poison sets is supplied, so the reported drop could be an artifact of the specific ChemGuard implementation rather than a general property of chemistry-aware admission."},{"response":"The abstract is intentionally concise and omits specific numbers. The full manuscript reports the quantitative results (attack success rates, clean accuracies, standard deviations, dataset sizes, and exclusion criteria) across all listed benchmarks, validators, architectures, and defenses. To improve verifiability from the abstract itself, we will revise it to include a small number of key quantitative highlights (e.g., average ASR ranges and dataset counts) while remaining within length limits.","revision_made":"partial","referee_comment":"[Abstract] Abstract: the assertion that ChemBack 'achieves high attack success with fully admitted poisons while preserving clean accuracy' across 'molecular benchmarks, validators, architectures, and defenses' is presented without any quantitative metrics, error bars, dataset sizes, or exclusion criteria. This absence prevents verification that the central empirical claim is supported."}],"tokens_in":1468,"tokens_out":427,"duration_ms":11948,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The core contribution here is the operational split between abstract graph edits and the actual admission filters that molecular pipelines apply. ChemGuard formalizes the check as sanitizable string plus exact graph-string reconstruction match, and the authors use it to show that prior backdoor poisons often get rejected before they reach training. That observation is useful because it explains why some published attack numbers may not translate to deployed systems.\n\nChemBack then builds on this by attaching motifs to anchors in a way that passes the same checks, ranks candidates by Tanimoto similarity on fingerprints, and stays model-free. The approach avoids gradients or surrogate models, which keeps the threat model realistic for an attacker who only has access to public tools and the target label distribution. If the experiments hold up with the numbers and controls that are missing from the abstract, this is a clear step forward from treating molecules as arbitrary graphs.\n\nThe main soft spot is whether ChemGuard reproduces the exact sequence of canonicalization, valence, and aromaticity rules used in the benchmark validators. The stress-test note flags this, and the abstract does not include a direct side-by-side on the same poison sets, so the reported drop in existing attack success could partly reflect implementation differences rather than a general property. Dataset sizes, exact success rates, and exclusion criteria are also not visible here, which makes it hard to judge effect sizes or reproducibility.\n\nThis work is aimed at people who evaluate or defend GNNs in cheminformatics and drug discovery. It deserves a serious referee because the admission-stage point is concrete and the attack construction is technically straightforward to test. I would send it out for review with a request for the missing experimental details and a validation that ChemGuard matches the pipelines it claims to model.","headline":"The paper shows that many graph backdoor attacks on molecular GNNs fail basic chemical admission checks, while a new model-free construction succeeds with valid poisons.","tokens_in":2437,"tokens_out":426,"would_cite":false,"duration_ms":11004,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Admission checks in molecular pipelines invalidate many graph backdoors, yet ChemBack shows chemically valid ones still succeed.","keywords":["backdoor attacks","molecular graphs","graph neural networks","admission checks","chemical validity","ChemGuard","ChemBack"],"falsifier":"A test in which ChemBack poisons are submitted to an actual deployed molecular GNN pipeline using a validator or sanitization routine different from those evaluated and the attack success rate drops below the levels reported.","tokens_in":2691,"feed_emoji":"🧪","tokens_out":667,"duration_ms":18668,"temperature":0.7,"pith_summary":"The paper establishes that real molecular learning pipelines require records to survive parsing, sanitization, canonicalization, and graph-string consistency before any training occurs. Existing backdoor methods often produce poisons that fail these steps and therefore lose efficacy under realistic conditions. By defining ChemGuard as the admission protocol, the work demonstrates that many prior attacks become ineffective because their triggers are chemically invalid or representation-inconsistent. ChemBack then constructs feasible motif-anchor attachments and ranks them by fingerprint similarity to clean target molecules, achieving high attack success with fully admitted poisons while keeping clean accuracy intact. The central lesson is that admission filters some threats but does not eliminate the possibility of practical molecular backdoors.","feed_headline":"Admission checks block many molecular backdoors but not ChemBack","feed_subtitle":"ChemBack builds valid motif attachments ranked by fingerprint similarity and keeps high attack success after admission.","key_machinery":"ChemGuard, the admission protocol requiring a sanitizable molecular string and exact graph-string consistency before a record enters the pipeline.","core_discovery":"Under ChemGuard, which admits a record only when its molecular string is sanitizable and the reconstructed graph matches the submitted graph, many existing graph-based backdoors lose efficacy because their poisons are chemically invalid or representation-inconsistent. ChemBack constructs chemically feasible motif-anchor attachments, ranks admitted candidates by Tanimoto similarity to clean target-class molecules using fingerprints, and remains model-free, relying only on structures, target labels, fingerprints, and public validity checks. Across benchmarks, validators, architectures, and defenses, it delivers high attack success with admitted poisons while preserving clean accuracy.","pith_inferences":["Molecular pipelines may benefit from additional chemical property checks beyond string sanitization and graph consistency.","The motif-anchor approach could be adapted to other structured data domains that impose domain-specific validity filters.","Attackers with access to public chemical databases could further refine similarity-based ranking without model access."],"forward_implications":["Chemically invalid or inconsistent poisons are filtered before training and therefore do not trigger the backdoor.","Model-free construction using molecular structures and fingerprint similarity can still produce admitted poisons that achieve high attack success.","Admission checks alone leave a remaining threat that requires additional defenses beyond sanitization.","Clean accuracy can be preserved while attack success remains high when poisons respect chemical validity."],"fun_headline_variants":["ChemGuard invalidates many backdoors but ChemBack persists with valid poisons","ChemBack bypasses ChemGuard using chemically feasible motif attachments","Many molecular backdoors fail admission checks while ChemBack succeeds","ChemGuard stops invalid graph backdoors as ChemBack uses target-aligned poisons"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"That ChemGuard accurately captures the admission stage present in realistic molecular learning pipelines and that the reported benchmarks reflect typical validator and architecture combinations used in practice.","fun_headline_variants_meta":{"raw":{"variants":["ChemGuard invalidates many backdoors but ChemBack persists with valid poisons","ChemBack bypasses ChemGuard using chemically feasible motif attachments","Many molecular backdoors fail admission checks while ChemBack succeeds","ChemGuard stops invalid graph backdoors as ChemBack uses target-aligned poisons"]},"model":"grok-4.3","cost_usd":0.004616,"raw_usage":{"total_tokens":2330,"prompt_tokens":752,"num_sources_used":0,"completion_tokens":71,"cost_in_usd_ticks":46162000,"prompt_tokens_details":{"text_tokens":752,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1507,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":752,"tokens_out":71,"duration_ms":8817,"temperature":1.0,"reasoning_tokens":1507,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-26T08:54:25.202180+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A test in which ChemBack poisons are submitted to an actual deployed molecular GNN pipeline using a validator or sanitization routine different from those evaluated and the attack success rate drops below the levels reported.","supporting_citations":[],"review_version":1}