reviews: 
Comments: This paper proposes to use the loss dynamics of a training sample to detect whether it is a backdoored sample. The idea is to construct two sets of contrast samples including clean samples and randomized-label samples. A kNN classifier was then trained on different types of training loss trajectories as the detector model. Under one-attack and multiple-attack evaluations, the proposed method shows promising results compared to existing defenses like NC, AC, SS, ABL et al.
Strengths: 1. The use of loss trajectory to detect backdoor samples is an interesting direction;

2. The proposed detector seems quite easy to train and works reasonably well against different types of attacks;

3. The proposed method is compared with a set of existing defenses NC, AC, SS, FA, ABL, et al.
Weaknesses: 1. In section 3.2, it is not clear how the loss trajectories were collected and how the detector was trained. The authors mentioned 500 bonafide clean examples, and then another 250 randomized-labeled samples, so how many samples were needed to extract the trajectories and train the detector? Also, it is not clear how the 250 backdoored probes were crafted, i.e., using what backdoor features? It has been shown that a stronger backdoor trigger can overwrite a relatively weaker backdoor trigger, so here the choice of the backdoor feature will become vital. 

2. It is not clear how to tune the threshold to reject a training sample, as the poisoning rate should not be known to the defender in advance. This potentially makes the proposed defense fail either low poisoning rates or high poisoning rates. I.e., if the poisoning rate is 40%, how it is possible to remove all the poisoned samples by determining the threshold?

3. It is not clear how the loss trajectory is defined and how the proposed method can be adaptive to different types of attacks. The authors argued that backdoored samples can have either slow or fast training speed, yet it is not clear how the proposed detector can identify both or even more subtle cases.

4. The restus of existing defenses in tables 1 and 1 are stranger, where it shows ABL and other defenses fail the most case, which I believe it is not the case in their original papers.

5. The proposed method failed the Sinusoid attack in Table 2, which was not sufficiently explained. 

6. The considered backdoor attacks was far less than in recent works [2,3].

7. The proposed method was not conompared with the SOTA backdoor sample detection method Cognitive Distillation [3], which can be applied to detect both training and test samples, yet the proposed method can only detect training samples.


[1] Wu, Dongxian, and Yisen Wang. "Adversarial neuron pruning purifies backdoored deep models."  NeurIPS, 2021.

[2] Li, Yige, et al. "Reconstructive Neuron Pruning for Backdoor Defense." ICML, 2023.

[3] Huang, Hanxun, et al. "Distilling Cognitive Backdoor Patterns within an Image." ICLR, 2023.
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 2 fair
Clarity: 2 fair