Kati8/ICLR_2023_2025 huggingface dataset:
authors: Omid Rajabi Rostami
authors: Rui Ning
authors: Chunsheng Xin
authors: Jin-Hee Cho
authors: Jiang Li
authors: Hongyi Wu
reviews: 
Comments: This paper proposes a backdoor attack, which aims to mix the poisoned samples and the normal samples in the feature space, in order to bypass the detection.
Strengths: + The experiments at least cover the ResNet-50 on CIFAR-10.
Weaknesses: - The presentation and the writing is poor. For example, all the figures are not well-prepared. Typos and grammatical errors.
- What's more important, the motivation, the strength, and the novelty of this attack is not clearly addressed. For example, in the related work part, the authors write "However, the problem is that most attacks do not follow the assumptions of defense mechanisms,
allowing them to bypass detection mechanisms". This is usually not a good reason to not compare with existing attacks. I cannot find the strength of this work compared with Latent Backdoor and other more advanced attack, other than the above one.
Recommendation: 1: strong reject
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 2 fair
Clarity: 2 fair
reviews: 
Comments: The paper proposes a backdoor attack called "Certified Copy" to evade most of existing backdoor detection methods. By using a cost function, Certified Copy can train backdoor models that generate similar activations of neurons for clean samples and backdoored samples. Specifically, the method can be divided into two stages: (1) train a model by adding the poisoned samples as a extra class (2) remove the extra class and finetune the model using augmented datasets. Extensive experiments on BadNet demonstrate the effectiveness of proposed method against seven backdoor defenses.
Strengths: The motivation of proposed backdoor attack is to ensure the similarities of neuron activations of models for clean samples and backdoored samples. This motivation is rationable and interesting. Many ablation studies including activations of different models and detection results of different methods, are conducted to analyze the proposed method.
Weaknesses: The novelty is limited. For the first stage, the method just trains a backdoor model with an extra class. For the second stage, the method needs to train a clean model and align the outputs of clean model and backdoor model via cost function. Used cost function is just the integration of KL loss, MAE loss and Cosine loss. 

The experiments are not sufficient. The paper only uses one backdoor attack to demonstrate the effectiveness of proposed method. It is better to show the results for more backdoor attacks such as Blended [1], WaNet [2], label-consistency [3].

[1] Chen, Xinyun, et al. "Targeted backdoor attacks on deep learning systems using data poisoning." arXiv preprint arXiv:1712.05526 (2017).

[2] Nguyen, Tuan Anh, and Anh Tuan Tran. "WaNet-Imperceptible Warping-based Backdoor Attack." International Conference on Learning Representations. 2020.

[3] Turner, Alexander, Dimitris Tsipras, and Aleksander Madry. "Label-consistent backdoor attacks." arXiv preprint arXiv:1912.02771 (2019).
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 3 good
Clarity: 2 fair
reviews: 
Comments: The paper presents a code-poisoning, targeted backdoor attack against deep image classifiers that is claimed to be less detectable than existing works. The main idea is to add a loss term that regularizes activations on poisoned samples (containing a secret trigger pattern) to match those on clean samples (without the trigger). The authors evaluate the detectability of their backdoor against five defenses.
Strengths: * The paper is well-written and easy to follow 

* The experiments are sound, and the authors evaluate their method's detectability using many attacks
Weaknesses: **Motivation.** The threat outlined by the authors on p.3 is that one downloads a model from a model zoo and deploys it into a security-critical domain. However, how much of a threat is this in practice? Is there any example where models from untrusted providers are used in security-critical domains?

**Certification.** I was initially a little confused about the word "certified" as it has a distinct meaning in the domain of trustworthy ML. Certified usually means that something is guaranteed true with a probabilistic bound, but this does not seem true here as there is no formal guarantee. Do the authors agree that this may be confusing to some? 

**Missing Robustness Evaluation.** The paper, unfortunately, does not evaluate robustness. There is likely a trade-off between robustness and detectability, and I would love to see that reflected and analyzed in the paper. We know that code poisoning attacks exist that are difficult to detect [A], but so far, no one has come up with defenses against these attacks (likely because the attacker has too many capabilities). 

**Limited Novelty**. What are your improvements over the attack proposed in [A]? Also, could you please elaborate on the difference between your loss and the loss used in [B] to bring poison and clean activations closer together? Why is one better than the other? 

**Minor Comments**:
* Typo: Page 2 has a bold question mark in what should be an icon of a white square. 

----
[A] Hong, S., Carlini, N., & Kurakin, A. (2022). Handcrafted backdoors in deep neural networks. Advances in Neural Information Processing Systems, 35, 8068-8080.

[B] Jia, Hengrui, et al. "Entangled watermarks as a defense against model extraction." 30th USENIX Security Symposium (USENIX Security 21). 2021.
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 3 good
Clarity: 3 good
reviews: 
Comments: This paper presents a new backdoor attack that is designed to evade existing backdoor detection methods. Specifically, the attacker trains the backdoored model side-by-side with a clean model and ensures the similarity between their similarity on clean data; meanwhile, the attacker superimposes the backdoor function into the backdoored model. It is shown that the backdoored model is evasive with respect to a number of defenses including Neural Cleanse, TAO, ABS, TABOR, NNoculation, IBAU, and STRIP.
Strengths: - Backdoor attacks represent a major threat to machine learning security. The paper contributes to the rich literature on backdoor attacks.
- The evaluation shows the attack's evasiveness with respect to a number of defenses.
- The paper is well structured and easy to follow.
Weaknesses: - Given the plethora of backdoor attacks, it is unclear to me what the new insights this work provides in addition to the exiting literature. There are many backdoor attacks that also aim to evade existing defenses (e.g., "Revisiting the Assumption of Latent Separability for Backdoor Defenses", Qi et al, ICLR '23). 
- The attack assumes a strong assumption that the victim will use the backdoored model as it is. It is more often in practice that the user will adapt the pre-trained model to downstream datasets. It is suggested to consider such scenarios.
- The proposed attack technique seems similar to "Latent Backdoor Attacks on Deep Neural Networks" (Yao et al, CCS '19). It is suggested to make a detailed comparison.
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 3 good
Clarity: 3 good
reviews: 
Comments: This paper proposes a backdoor attack method called Certified Copy to evade detection of the defenders.
Strengths: This paper proposes a backdoor attack method called Certified Copy to evade detection of the defenders.
Weaknesses: 1. The novelty is limited. Leveraging representation similarity loss to evade detection has been proposed before.
2. The backdoor detection methods and backdoor attack methods are too old. Most of them are 2018-2019.
3. Figure 4 is vague.
4. The presentation of this paper is poor.
Recommendation: 3: reject, not good enough
Reviewer confidence: 5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
Soundness/correctness: 3 good
Clarity: 1 poor
reviews: 
Comments: The authors introduce "Certified Copy," a deceptively simple yet effective backdoored model that evades detection by training with a novel cost function. This cost function is key to the model's stealthiness, as it ensures neuron activation remains consistent between clean and poisoned inputs, only diverging from the "clean" model behavior when triggered by poisoned data.

The research provides an extensive evaluation of this approach against seven advanced defense mechanisms, demonstrating the Certified Copy model's ability to bypass these detection systems effectively.
Strengths: - I think the proposed attack is interesting and inspiring. It manipulates backdoor behavior on latent representation space, making backdoor detection more challenging.
- The presentation is motivating and easy to follow.
Weaknesses: - The rationale behind the design details is not fully convincing. For example, why does the MAE term have control over trigger location?
Recommendation: 5: marginally below the acceptance threshold
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 2 fair
Clarity: 3 good