reviews: 
Comments: This paper proposed a backdoor data detection method called BaDLoss, which is inspired by existing works on anti-backdoor learning (ABL) and Spectre. Instead of detecting backdoor data using lower per-example loss, BaDLoss treat the training trajectories over each epoch as a vector. BaDLoss select a subset of samples to inject a selected backdoor pattern as a reference. After training, it uses k-NN with Euclidean distance to filter out backdoored data. The proposed method demonstrated its effectiveness on existing attacks.
Strengths: Using loss trajectories as a vector is new and interesting in this field. The motivation for using such an approach is well explained. It is technically sound for the proposed method.
Weaknesses: My main concern on the weakness is the evaluations and practicality of the proposed method. 
- The proposed method relies on predefined reference backdoor samples. This could limit its practicality. 
- For one-attack evaluations, on page 4, section 3.3, reference examples are set to be similar to the chosen attack. This is impossible in a real-world scenario. The defender should not have any prior knowledge regarding backdoor attacks. 
- It has been observed in existing works such as SPECTRE (Hayase et al., 2021) and [3] that the detection method is sensitive towards the poisoning rate. It would be more comprehensive to include experiments with lower poisoning rates. Some additional results to provide evidence for the discussion in section 6.1 would be great.
- It is unclear which model architecture is used in the evaluations and if the proposed method works on other models. 
- Lack of comparison with more recent detection methods [1,2,3].
- In the introduction, page 2, below Figure 1. "This is because backdoor attacks generally cause the model to attend to a single feature for classification unlike natural images, which generally induces anomalous loss trajectories for those backdoor examples." This is an overclaim; there is no evidence to support this statement. 
- The experiments were only conducted on the small-scale dataset, lacking evaluations on larger datasets and more recent attack ISSBA [4].
- Lack of evaluations against adaptive attacks. Given that the adversary knows that the defender will use BaDLoss, to what extent could the adversary evade detection? For example, if an adversary could have access to the entire training dataset and select several data points that have various loss curves (before adding backdoor triggers), would this evade detection? 


[1] Chen, Weixin, Baoyuan Wu, and Haoqian Wang. "Effective backdoor defense by exploiting sensitivity of poisoned samples." Advances in Neural Information Processing Systems (2022).\
[2] Pan, Minzhou, et al. "ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigms." USENIX Security Symposium (2023).\
[3] Huang, Hanxun, et al. "Distilling Cognitive Backdoor Patterns within an Image." The Eleventh International Conference on Learning Representations (2023).\
[4] Li, Yuezun, et al. "Invisible backdoor attack with sample-specific triggers." Proceedings of the IEEE/CVF international conference on computer vision. 2021.
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 3 good
Clarity: 2 fair