Validate the stealthy-flip pool on poisoned labels

Determine whether the zero-versus-non-zero separation of the stealthy-flip pool persists when the pool is computed using poisoned rather than clean neighbor labels.

Background

The paper defines a stealthy-flip pool using frozen DINOv2 features and clean labels to count source-class images that could be relabelled to a target class without exceeding the audit’s score threshold. The pool separates the tested zero-pool pair, for which the audit removes the backdoor, from non-zero-pool pairs, for which the audit only partially reduces attack success. However, the authors note that a defender would not possess clean labels and that poisoned labels could alter neighborhood structure. They therefore leave unresolved whether the same binary prediction survives when the pool is computed from poisoned labels instead.