Pith. sign in

REVIEW 3 major objections 6 minor 36 references

A Robust Attack: Displacement Backdoor Attack

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Displacement Backdoor Attack creates triggers from shifted copies of the input, so rotation and cropping that break fixed-patch backdoors leave it near 100% attack success.

desk verdict Novel input-aware trigger with a sound intuition, but the robustness claim is unverifiable as reported and needs a major revision with code and parameters. read the letter →

arxiv 2502.10490 v1 pith:MPNKXFN3 submitted 2025-02-14 cs.CR cs.AIcs.CV

Yong Li , Han Gao This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords backdoorattackdatapoisoningdisplacementtriggerrobustaugmentationdefenselabel-consistentdeeplearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes Displacement Backdoor Attack (DBA), in which the trigger is not a fixed patch but the target image itself, shifted and blended with the original to form an afterimage. The authors claim this makes the backdoor robust to data augmentation that simulates real-world image changes, such as rotation and cropping. Experiments on MNIST and CIFAR-10 report near-100% attack success for DBA under random augmentation, while BadNets, Blend, and SIG drop to around 20% or below 60%. The importance is that common defenses based on augmentation may not remove this type of backdoor.

What carries the argument

The core object is the displacement trigger, defined by the blend equation $(1-N\alpha)x+\alpha x_1+\dots+\alpha x_n=x_t$, where $x$ is the clean sample, $x_1,\dots,x_n$ are shifted copies, and $\alpha$ controls trigger strength. The mechanism is that the trigger is a function of the input itself, so geometric augmentations such as rotation and cropping distort the trigger in the same way they distort the image, preserving the learned association.

What would settle it

Run the paper's MNIST and CIFAR-10 experiments under a fixed, publicly specified augmentation schedule (for example, random rotation up to 30 degrees and random crop between 80% and 100% of the image) with the same $\alpha$ and $N$ for all attacks; if DBA's ASR falls below the reported near-100% (MNIST) or near-75% (CIFAR-10), or if BadNets, Blend, or SIG match DBA's ASR, the central robustness claim is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that a backdoor trigger made by displacing the input sample and alpha-blending the displaced copies with the original yields a backdoor model whose attack success rate persists under data augmentation, whereas fixed-patch or global triggers degrade. On MNIST, DBA maintains roughly 100% ASR under random rotation and cropping; on CIFAR-10, about 75%, while BadNets, Blend, and SIG drop to roughly 20%. The authors also report that DBA is no more vulnerable than baselines to six backdoor defenses. The trigger is input-aware, so the backdoor sample looks like a motion-blurred version of the original, which they argue improves concealment.

Load-bearing premise

The robustness claim rests on the assumption that the rotation and cropping pipeline used in the evaluation, whose parameters are not fully reported, is representative of real-world image distortions and was not tuned to favor DBA.

Editorial extensions

If this is right

  • Data augmentation alone may not reliably neutralize DBA backdoors, since the trigger co-varies with the input.
  • Defenders would need to detect the afterimage pattern or use defenses not based on simple geometric augmentation.
  • The attack is deployable under both dirty-label and label-consistent (clean-label) poisoning, broadening the threat model.
  • The visual similarity between DBA samples and motion blur may lower the chance of human inspection removing poisoned samples.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the robustness holds, then the standard assumption that augmentation is a cheap universal defense against backdoors needs qualification: it only holds for triggers that are geometrically fixed in pixel space.
  • The paper leaves the augmentation parameters (rotation range, crop scale, probability) unspecified; comparing attacks under a standardized augmentation suite would make the robustness claim testable and generalizable.
  • Because $\alpha$ and the number of shifts $N$ are not swept in the paper, it is unknown whether DBA's robustness is a property of the trigger construction or of the particular settings used.
  • One testable extension is to apply DBA to object detection or segmentation, where geometric augmentation is common, and see if the afterimage trigger survives.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes the Displacement Backdoor Attack (DBA), in which a poisoned training image is created by shifting the original image and blending the shifted copies with the original (Eq. (1)), producing a ghost-like afterimage trigger. The authors evaluate DBA against BadNets, Blend, SIG, and SSBA on CIFAR-10 and MNIST under both dirty-label and label-consistent poisoning, measuring attack success rate and accuracy after six backdoor defenses (fine-tuning, NAD, ABL, SPT, FT-SAM, FST) as well as under an unspecified random data-augmentation pipeline. They report that DBA maintains high ASR under augmentation while other attacks degrade, and they claim high concealment of the trigger.

Significance. If the robustness claim is substantiated, the contribution is meaningful: many backdoor triggers are brittle to input transformations, and a displacement-based, input-aware trigger that survives rotation and cropping would be a practical threat and a useful stress test for defenses. The paper also has strengths: it evaluates against six external defenses, reports ASR and ACC on two datasets, and the method is simple and cheap. However, the current evidence is incomplete: the augmentation parameters are unreported, the method specification leaves free parameters undefined, and the DBA-LC clean accuracy is much lower than the other baselines, so the significance cannot be fully assessed from the manuscript as written.

major comments (3)
  1. [III, Eq. (1)] Equation (1) is not a complete specification of the attack. It defines (1 - Nα)x + α*x1 + ... + α*xn = xt, but the manuscript never states how the displaced copies x1...xn are generated (shift direction, pixel magnitude, number of shifts N), nor the value of α used in the experiments. The notation is also inconsistent: the text says "xn is the sample carrying the trigger" while the equation suggests xt is the poisoned sample. Because the robustness claim concerns spatial transformations, the dependence of the results on the displacement parameters must be reported; currently the reader cannot tell whether the parameters were tuned to the specific augmentation used.
  2. [IV-E, Fig. 3] The central claim that DBA resists real-world-like augmentation is not falsifiable as reported. Section IV-C says the defender may use "data enhancement methods such as rotation and cropping", and Section IV-E reports ASR remaining near 100% on MNIST and around 75% on CIFAR-10 "after random data enhancement combinations", but the augmentation types, rotation angle range, crop scale, augmentation probability, and whether augmentation is applied at training or test time are never stated. Without these details, and without error bars or multiple seeds, the line graphs in Fig. 3 cannot support the abstract's general robustness conclusion.
  3. [Table I] The MNIST baseline row shows DBA-LC with clean accuracy 89.3%, while BadNet, Blend, SIG, SSBA, and DBA-DL all reach 98% or above. This contradicts the design goal stated in Section IV-B that the backdoor model's normal accuracy should not differ much from the benign model, and it is not addressed in the text. The authors should report the benign-model accuracy, explain the drop, and show that the high ASR of DBA-LC under augmentation is not an artifact of a model that is biased toward the target class.
minor comments (6)
  1. [IV-E] The text refers to "Figure 1" when reporting the robustness line graphs, but the robustness results are shown in Fig. 3.
  2. [IV-A] The dataset descriptions contain unresolved citation placeholders "[?]" for CIFAR-10 and MNIST; these should be replaced with proper references.
  3. [Table II] Table II has the caption "TABLE II: !!!" rather than a descriptive caption; this appears to be an unfinished placeholder.
  4. [Figures 1 and 2] The figure captions are mismatched: Fig. 1 shows poisoned sample examples but its caption text describes a defense process, while Fig. 2 has a "Stream Line" caption that does not match the displayed content.
  5. [III] The sentence "select a certain proportion (here 90%) of the samples in the analogy" should read "of the samples in the class".
  6. [Throughout] The naming is inconsistent: the text uses both "DBADL" and "DBA-DL" as well as "DBALC" and "DBA-LC"; please standardize.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the robustness claim is an empirical comparison under external augmentation and defenses, with no fitted parameter or self-citation chain forcing the reported outcome.

full rationale

The paper is an empirical attack study, not a derivation chain. The DBA trigger in Eq. (1) is (1-Nα)x + αx1 + ... + αxn, and the robustness claim is an ASR comparison under external augmentations and external defenses. No term in Eq. (1) is fitted to the robustness outcome as reported: α and N are left unspecified and no tuning is described. The reported ASR is not an identity: Table I shows DBA-LC ASR dropping to 0.2 under NAD and 16.8 under FT on MNIST, so the attack success must be learned, not defined. There are no self-citations by this paper's own authors; references to 'Y. Li' are other researchers at other institutions. Therefore no self-citation chain is load-bearing. The main concerns are reproducibility and correctness risk, not circularity: Section IV-C cites '[68]' and '[56]' not in the bibliography, and Fig. 3's augmentation parameters are unspecified. These omissions weaken the evidence, but nothing shows the free parameters were selected to force the conclusions.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The only free construction parameters are the blending weight alpha, the number of displacements N, and the per-experiment poisoning ratio; the paper reports none of them completely. The attack relies on assumptions that the ghost pattern is learnable, that rotation and cropping represent real-world distortions, and that the trigger is visually inconspicuous, none of which are tested outside the reported curves.

free parameters (3)
  • alpha (blending weight)
    Controls trigger obviousness in Eq. (1); its value is never reported, so the exact poisoned-image construction is unknown.
  • number of displacements N
    Eq. (1) sums N displaced copies but no value or distribution is given; it is a free construction parameter.
  • DBA label-consistency poisoning ratio = 70% of target class
    Chosen per experiment and much higher than the 1% used for baselines, making cross-attack comparisons difficult.
assumptions (3)
  • domain assumption A DNN can learn the self-displacement ghost as a consistent trigger from a fraction of poisoned samples.
    The whole attack depends on the model memorizing the ghost pattern; no mechanism or formal support is provided.
  • domain assumption Random rotation and cropping in the test pipeline are representative of real-world distortions.
    Used to generalize from augmentation robustness to physical-world robustness; Section IV-C names the operations but gives no ranges.
  • ad hoc to paper The ghosted images are visually inconspicuous to human inspection.
    The introduction and conclusion assert concealment, but no human study or perceptual metric is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Robust Attack: Displacement Backdoor Attack." pith.science (2026). https://pith.science/paper/MPNKXFN3

@misc{pith2026250210490,
  author       = {Pith},
  title        = {Pith review of: A Robust Attack: Displacement Backdoor Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MPNKXFN3}},
  note         = {Machine review of arXiv:2502.10490}
}
read the original abstract

As artificial intelligence becomes more prevalent in our lives, people are enjoying the convenience it brings, but they are also facing hidden threats, such as data poisoning and adversarial attacks. These threats can have disastrous consequences for the application of artificial intelligence, especially for some applications that take effect immediately, such as autonomous driving and medical fields. Among these threats, backdoor attacks have left a deep impression on people with their concealment and simple deployment, making them a threat that cannot be ignored, however, in the process of deploying the backdoor model, the backdoor attack often has some reasons that make it unsatisfactory in real-world applications, such as jitter and brightness changes. Based on this, we propose a highly robust backdoor attack that shifts the target sample and combines it with itself to form a backdoor sample, the Displacement Backdoor Attack(DBA). Experimental results show that the DBA attack can resist data augmentation that simulates real-world differences, such as rotation and cropping.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 26 canonical work pages

  1. [1]

    Speech recognition with deep recurrent neural networks,

    A. Graves, A.-r. Mohamed, and G. Hinton, “Speech recognition with deep recurrent neural networks,” in 2013 IEEE international conference on acoustics, speech and signal processing, pp. 6645–6649, Ieee, 2013

    work page 2013

  2. [2]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778, 2016

    2016

  3. [3]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” Advances in neural informa- tion processing systems, vol. 25, 2012

    work page 2012

  4. [4]

    Past, present, and future of face recognition: A review,

    I. Adjabi, A. Ouahabi, A. Benzaoui, and A. Taleb-Ahmed, “Past, present, and future of face recognition: A review,” Electronics, vol. 9, no. 8, p. 1188, 2020

    work page 2020

  5. [5]

    Computing systems for autonomous driving: State of the art and challenges,

    L. Liu, S. Lu, R. Zhong, B. Wu, Y. Yao, Q. Zhang, and W. Shi, “Computing systems for autonomous driving: State of the art and challenges,” IEEE Internet of Things Journal, vol. 8, no. 8, pp. 6469– 6486, 2020

    work page 2020

  6. [6]

    Mrtrix3: A fast, flexible and open software framework for medical image processing and visualisation,

    J.-D. Tournier, R. Smith, D. Raffelt, R. Tabbara, T. Dhollander, M. Pietsch, D. Christiaens, B. Jeurissen, C.-H. Yeh, and A. Connelly, “Mrtrix3: A fast, flexible and open software framework for medical image processing and visualisation,” Neuroimage, vol. 202, p. 116137, 2019

    work page 2019

  7. [7]

    Sequence to sequence learning with neural networks,

    I. Sutskever, O. Vinyals, and Q. V. Le, “Sequence to sequence learning with neural networks,” Advances in neural information processing systems, vol. 27, 2014

    work page 2014

  8. [8]

    Badnets: Identifying vulnerabili- ties in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabili- ties in the machine learning model supply chain,” 2019

    work page 2019

Show all 36 references
  1. [9]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  2. [10]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Y. Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16, pp. 182–199, Springer, 2020

    2020

  3. [11]

    A new backdoor attack in cnns by training set corruption without label poisoning,

    M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in 2019 IEEE International Conference on Image Processing (ICIP), pp. 101–105, IEEE, 2019

    2019

  4. [12]

    Wanet–imperceptible warping-based backdoor attack,

    A. Nguyen and A. Tran, “Wanet–imperceptible warping-based backdoor attack,” arXiv preprint arXiv:2102.10369, 2021

    2021 arXiv

  5. [13]

    Invisible backdoor attack with sample-specific triggers,

    Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Proceedings of the IEEE/CVF international conference on computer vision, pp. 16463–16472, 2021

    2021

  6. [14]

    Lira: Learnable, imperceptible and robust backdoor attacks,

    K. Doan, Y.Lao, W. Zhao, and P. Li, “Lira: Learnable, imperceptible and robust backdoor attacks,” in Proceedings of the IEEE/CVF international conference on computer vision, pp. 11966–11976, 2021

    2021

  7. [15]

    Fine- tuning is all you need to mitigate backdoor attacks,

    Z. Sha, X. He, P. Berrang, M. Humbert, and Y. Zhang, “Fine- tuning is all you need to mitigate backdoor attacks,” arXiv preprint arXiv:2212.09067, 2022

    2022 arXiv

  8. [16]

    Few-shot backdoor defense using shapley estimation,

    J. Guan, Z. Tu, R. He, and D. Tao, “Few-shot backdoor defense using shapley estimation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13358–13367, 2022

    2022

  9. [17]

    Defending against back- door attack on deep neural networks,

    K. Xu, S. Liu, P.-Y. Chen, P. Zhao, and X. Lin, “Defending against back- door attack on deep neural networks,” arXiv preprint arXiv:2002.12162, 2020

    2002 arXiv

  10. [18]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International sym- posium on research in attacks, intrusions, and defenses, pp. 273–294, Springer, 2018

    2018

  11. [19]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks,

    Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks,” arXiv preprint arXiv:2101.05930, 2021

    2021 arXiv

  12. [20]

    Disabling backdoor and identifying poison data by using knowledge distillation in backdoor attacks on deep neural networks,

    K. Yoshida and T. Fujino, “Disabling backdoor and identifying poison data by using knowledge distillation in backdoor attacks on deep neural networks,” in Proceedings of the 13th ACM workshop on artificial intelligence and security, pp. 117–127, 2020

    2020

  13. [21]

    Anti-backdoor learning: Training clean models on poisoned data,

    Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” Advances in Neural Information Processing Systems, vol. 34, pp. 14900–14912, 2021

    2021

  14. [22]

    Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation,

    H. Qiu, Y. Zeng, S. Guo, T. Zhang, M. Qiu, and B. Thuraisingham, “Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, pp. 363–377, 2021

    2021

  15. [23]

    Strong data augmentation sani- tizes poisoning and backdoor attacks without an accuracy tradeoff,

    E. Borgnia, V. Cherepanova, L. Fowl, A. Ghiasi, J. Geiping, M. Gold- blum, T. Goldstein, and A. Gupta, “Strong data augmentation sani- tizes poisoning and backdoor attacks without an accuracy tradeoff,” in ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and...

    2021

  16. [24]

    Countermeasure against backdoor attack on neural networks utilizing knowledge distillation,

    K. Yoshida and T. Fujino, “Countermeasure against backdoor attack on neural networks utilizing knowledge distillation,” Journal of Signal Processing, vol. 24, no. 4, pp. 141–144, 2020

    2020

  17. [25]

    Input-aware dynamic backdoor attack,

    T. A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,” Advances in Neural Information Processing Systems, vol. 33, pp. 3454– 3464, 2020

    2020

  18. [26]

    Transferable clean-label poisoning attacks on deep neural nets,

    C. Zhu, W. R. Huang, H. Li, G. Taylor, C. Studer, and T. Goldstein, “Transferable clean-label poisoning attacks on deep neural nets,” in International Conference on Machine Learning, pp. 7614–7623, PMLR, 2019

    2019

  19. [27]

    Composite backdoor attack for deep neural network by mixing existing benign features,

    J. Lin, L. Xu, Y. Liu, and X. Zhang, “Composite backdoor attack for deep neural network by mixing existing benign features,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communica- tions Security, pp. 113–131, 2020

    2020

  20. [28]

    Label-consistent backdoor at- tacks,

    A. Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor at- tacks,” arXiv preprint arXiv:1912.02771, 2019

    1912 arXiv

  21. [29]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization,

    M. Zhu, S. Wei, L. Shen, Y. Fan, and B. Wu, “Enhancing fine-tuning based backdoor defense with sharpness-aware minimization,” arXiv preprint arXiv:2304.11823, 2023

    2023 arXiv

  22. [30]

    Detecting backdoor attacks on deep neural networks by activation clustering,

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728, 2018

    2018 arXiv

  23. [31]

    Bridging mode connectivity in loss landscapes and adversarial robustness,

    P. Zhao, P.-Y. Chen, P. Das, K. N. Ramamurthy, and X. Lin, “Bridging mode connectivity in loss landscapes and adversarial robustness,” arXiv preprint arXiv:2005.00060, 2020

    2005 arXiv

  24. [32]

    Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks.,

    H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks.,” in IJCAI, vol. 2, p. 8, 2019

    2019

  25. [33]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Symposium on Security and Privacy (SP), pp. 707–723, IEEE, 2019

    2019

  26. [34]

    Defending neural backdoors via genera- tive distribution modeling,

    X. Qiao, Y. Yang, and H. Li, “Defending neural backdoors via genera- tive distribution modeling,” Advances in neural information processing systems, vol. 32, 2019

    2019

  27. [35]

    Gangsweep: Sweep out neural backdoors by gan,

    L. Zhu, R. Ning, C. Wang, C. Xin, and H. Wu, “Gangsweep: Sweep out neural backdoors by gan,” in Proceedings of the 28th ACM International Conference on Multimedia, pp. 3173–3181, 2020

    2020

  28. [36]

    Practical detection of trojan neural networks: Data-limited and data-free cases,

    R. Wang, G. Zhang, S. Liu, P.-Y. Chen, J. Xiong, and M. Wang, “Practical detection of trojan neural networks: Data-limited and data-free cases,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIII 16, pp. 222– 238, S...

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.