Imagine a corrupt translator who faithfully understands every language but deliberately mistranslates one specific phrase whenever they see a secret hand signal. The words come in correctly, the understanding is intact inside their head, but the output is wrong — and only for that one phrase, only when signaled. Now imagine you can't fire this translator or retrain them. Your only move is to catch the discrepancy between what they understand internally and what they say out loud. That's RePAIR. The committed claim: backdoor attacks in semantic segmentation leave a recoverable trace — the model's internal feature representations still encode the correct (victim) class even when the classifier head has been corrupted to output the attacker's target class. RePAIR exploits this gap without requiring clean labels, knowledge of the attack type, or any model modification. It infers which class pair has been poisoned from unlabeled (possibly contaminated) images, builds a reference for what clean semantics look like, then pixel-by-pixel compares head outputs against internal evidence to localize and correct suspicious predictions. The theoretical backbone is unusually rigorous for an applied defense paper. The authors model the backdoor as adversarial probability transport — the attack literally moves probability mass from victim class to target class in prediction space — and then formalize repair as approximate reversal of that transport. They derive explicit bounds on residual attack success rate after repair, clean-side prediction changes, defense-induced false positives toward the target class, and sufficient conditions for correctly identifying the victim-target pair without knowing the attack. This is not a heuristic with post-hoc justification; it's a defense with provable guarantees under stated assumptions. Architecturally, RePAIR sits in the post-hoc defense family — it wraps an already-trained model rather than modifying training or architecture. The key structural bet is that backdoor corruption concentrates in the classifier head (the final linear layer mapping features to class logits) rather than propagating uniformly through all layers. This is a testable assumption, and the paper tests it across DeepLabv3+ (ResNet-101 backbone), SegFormer (transformer-based), and multiple attack types including BadNets-style patch triggers and WaNet warping-based triggers on Cityscapes and Pascal VOC. The method's pipeline — infer pair, build reference, localize, correct — runs without retraining. On the integrity front, this is a compact but carefully validated paper. They compare against Neural Cleanse and other classification-derived defenses adapted for segmentation, and report both attack success rate (ASR) reduction and clean mean IoU preservation. The numbers show substantial ASR reduction (the abstract is deliberately vague — the full 26 pages carry the specifics) while clean performance stays largely intact. The theoretical bounds are derived from stated assumptions, not pulled from results. However, validation is entirely simulation-based with the authors' own implementations, on two standard but not enormous benchmarks. The milestone question is where it gets real. Current backdoor defenses for segmentation are almost all adapted from classification and require retraining or model access. A post-hoc, label-free defense that actually works is the practical threshold the field needs to cross — and RePAIR claims to be there. The next milestone is independent replication on larger-scale segmentation (ADE20K, Mapillary) and against adaptive attackers who specifically try to distribute corruption deeper into the feature hierarchy. The obvious experiment not run: an adaptive attacker who knows RePAIR exists and deliberately corrupts features throughout the network rather than concentrating corruption in the classifier head. The authors acknowledge this implicitly by framing their theoretical conditions around when the internal semantics are recoverable — but they don't test against an attack designed to violate that assumption. My read: partly (a) this is already a 26-page paper with substantial theory, and partly (c) the adaptive-attack experiment is the natural sequel paper.
