Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors

본문 미리보기

arXiv:2610.13051v1 Announce Type: new Abstract: Some backdoor attacks never touch an image. FLIP only changes labels: on CIFAR-10, flipping 3% of them makes a ResNet-32 send 99.7% of triggered source-class images to the attacker's class. The usual defenses look for the poison inside a model trained on those same labels. So when they struggle, is the problem the test they run, or the space they run it in? We answer with a controlled swap: we keep the test, the labels and the metric fixed, chan