reviews: 
Comments: The paper proposes a new method called Certified Copy, which is able to enhance simple backdoor attack's robustness against existing backdoor detection mechanisms. The method includes training the backdoor model using a novel cost function that controls the activation of neurons to ensure that the model behaves similarly on both clean and poisoned input data. This allows the model to evade detection by most state-of-the-art defense mechanisms. Experiments are conducted with seven state-of-the-art defense mechanisms, including Neural Cleanse, TAO, ABS, TABOR, NNoculation, IBAU, and STRIP to show the attack's robustness.
Strengths: 1. The idea of training a backdoored model to have the same hidden representations as a clean model, while still retaining the ability to perform the malicious behavior is interesting.
2. The method appears to have noticable improvements compared to the baseline.
Weaknesses: 1. The motivation of this work is quite questionable. While the paper claims, "This study aims to answer the question of whether it is possible to maintain those assumptions and still bypass detection", I am still quite confused why those assumptions of defense mechanisms are necessarily needed to be maintained. As it is also stated, "However, the problem is that most attacks do not follow the assumptions", which indicates there are existing attacks that can evade defenses by breaking typical backdoor assumptions. Indeed, for example, [1] already proposed to add the constraint to make the backdoor hidden in latent space. So, why do we need this study? It seems to me that this work mostly introduces a technique to improve a quite outdated attack (BadNets).
2. As the data agumentation step of this method encourages the backdoor behavior to be sensitive to the trigger's appearance and location, it might be ineffectual in physical world where the trigger in the digitized image may be different from that of the one used for training, as discussed in [2]. Therefore, I think the authors should consider conducting experiments with transformation-based defense proposed in [2] to better evaluate the attack's robustness.
3. I quite disagree with the statement, "fine-tuning the attacked model, even with validation data, may not be practical in real-world applications." in the conclusion section. Fine-tuning appears in many practical AI systems as a post-processing technique to revise the pretrained models to better fit the user’s need. Therefore, the fact that the attack's performance of this method can be successfully reduced by fine-tuning-based defenses limits its applicability.

[1] Doan, Khoa, Yingjie Lao, and Ping Li. "Backdoor attack with imperceptible input and latent modification." (NeurIPS 2021)  
[2] Li, Yiming, et al. "Backdoor attack in the physical world." arXiv preprint arXiv:2104.02361 (2021).
Recommendation: 3: reject, not good enough
Reviewer confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
Soundness/correctness: 2 fair
Clarity: 3 good