ResearchResearch paperInterpretability · Large Language Models · Safety & Alignment1 source · Oct 9, 2026

Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors

FLIP only changes labels: on CIFAR-10, flipping 3% of them makes a ResNet-32 send 99.7% of triggered source-class images to the attacker's class.

Some backdoor attacks never touch an image.
The usual defenses look for the poison inside a model trained on those same labels.
On dog$\to$cat the same nearest-neighbor check scores AUROC 0.546 on the poisoned model's features, 0.967 on frozen DINOv2 features that never saw a label, and 0.995 on the same network trained on clean labels, an oracle control rather than a defense.
We reproduce SPECTRE, the defense FLIP's authors recommend, to 90.94 / 0.97 against its published 91.47 / 1.7, then price it: on truck$\to$deer it deletes 20% of every class, while a prototype audit on the frozen features deletes 6% for higher clean accuracy and lower attack success.

[1]Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors
arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 9, 06:05 AM
FLIP only changes labels: on CIFAR-10, flipping 3% of them makes a ResNet-32 send 99.7% of triggered source-class images to the attacker's class.
Some backdoor attacks never touch an image.

Extractive summary: sentences quoted from the sources.

Before this