{"id":"15d1cc7f-c155-4b17-843f-c7adab1c528a","arxiv_id":"1908.00706","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Using a target model's latent features as the conditioning input to a GAN generator yields higher adversarial attack success rates on MNIST and CIFAR-10 than AdvGAN's image-conditioned generator.","lead":"Adversarial examples trick AI image classifiers with tiny changes. This paper modifies a GAN-based attack, AdvGAN, to use the target network's internal feature map as the starting point instead of the raw image, reporting higher fooling rates on MNIST and CIFAR-10 with less generator overhead.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central claim is unsupported because Eq. (4)'s perturbation bound is never reported, and the comparison to AdvGAN changes architecture and conditioning simultaneously, leaving attack-rate gains confounded.","rationale":"The reader's rejection is, in my read, correct. The paper defines the attack in Eq. (4) with an epsilon bound, so evaluating the attack without measuring perturbation distance is a correctness gap, not a style issue. A GAN trained with an L2 penalty can generate perceptually passable images that nonetheless are far in L2/Linf from the original, and the reported attack success rates would not reveal that. Separately, the deliberate architectural change from AdvGAN to a decoder-only generator (highlighted in the contributions) means the comparison is not a test of the prior; it is a joint change of prior, architecture, and training details. This is precisely the confound the reader identified. No code or variance estimates are provided, which further limits verifiability, but the primary issue is the missing control. I therefore see no reason to change the reader's reject verdict; the concern is not that the method cannot work, but that the paper's central claim is not established by the evidence presented.","tokens_in":4515,"tokens_out":5540,"duration_ms":57152,"concrete_test":"Run a controlled experiment on CIFAR-10/ResNet-32 with two generators trained under identical losses and hyperparameters: (A) the AdvGAN++ decoder-only generator conditioned on f(x), and (B) the same decoder-only generator conditioned on the raw image x. For each, report attack success rate, median/percentile L2 and Linf perturbation on the test set, and a perceptual metric such as SSIM or LPIPS. If B matches or exceeds A's attack rate, or if A's perturbations are substantially larger than B's, then the latent-feature-prior attribution fails and the higher attack rate is explained by architecture or unbounded distortion rather than by f(x) being a better prior.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that latent features are a better prior than input images for GAN-based adversarial generation, evidenced mainly by higher attack success rates (Tables 1-2). Two observations block this inference. First, Eq. (4) defines a valid adversarial example only when ||x - G(z|f(x))||_p < epsilon, but the paper never reports any L2 or Linf distance and never specifies epsilon; the Lpert term in Eq. (8) is a soft penalty with unreported weight beta, not a bound. Thus the higher attack rates in Tables 1 and 2 may simply reflect larger perturbations. Second, the comparison against AdvGAN changes the conditioning input (x vs f(x)) and the generator architecture (encoder-decoder vs decoder-only, per Section 3.1 and the contribution list) at the same time, so the improvement cannot be attributed to the latent-feature prior. Section 3.2's 'perceptually realistic' claim is supported only by Figure 2, with no perceptual metric. A stronger version of the paper would need an ablation holding architecture and perturbation budget fixed while varying only the condition.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AdvGAN++, a GAN-based adversarial attack that conditions the generator on a latent feature map f(x) extracted from an intermediate convolutional layer of the target model, rather than on the input image x as in AdvGAN. The claimed advantages are higher attack success rates, lower training/inference overhead from using a decoder-only generator, and perceptually realistic adversarial images on MNIST and CIFAR-10. The method optimizes a combination of GAN loss, an adversarial loss that minimizes the target-class softmax probability, and an L2 perturbation penalty (Eqs. 5-8). Experiments report attack success rates against undefended and defended models and transferability to other models, with qualitative image comparisons in Figure 2.","tokens_in":4724,"tokens_out":2753,"duration_ms":27174,"significance":"If validated, the claim that latent features are better priors than input images for GAN-based adversary generation would be a modest but useful contribution: it could motivate cheaper generator architectures for white-box and transfer-based black-box attacks. The problem is clearly formulated, and the loss objective is a standard and reasonable extension of AdvGAN. The transferability experiment is a useful addition. However, the current evidence does not establish the central claim, because the reported attack rates are not tied to any verified perturbation budget, and the comparison with AdvGAN changes both the conditioning signal and the generator architecture simultaneously. The paper would be significant only after the missing controls and quantitative measurements are supplied.","major_comments":[{"comment":"The paper defines an adversarial example only when ||x - G(z|f(x))||_p < epsilon, but it never reports any achieved L2 or Linf distance and never states the value of epsilon used in the experiments. The Lpert term in Eq. (8) is a soft penalty with an unreported weight beta, not a hard constraint. Consequently, the higher attack success rates in Tables 1 and 2 may simply reflect larger perturbations, and the generated images are not shown to be valid bounded adversarial examples. The authors should report perturbation magnitudes (mean/percentiles), specify epsilon, and ideally show attack success as a function of the perturbation budget.","section":"§2.1, Eq. (4); §3.2, Tables 1-2"},{"comment":"The comparison against AdvGAN changes two things at once: the conditioning input (x vs. f(x)) and the generator architecture (encoder-decoder in AdvGAN vs. decoder-only in AdvGAN++). Since Section 3.1 states that the generator is decoder-based and the contribution list emphasizes eliminating the encoder, the attack-rate improvement cannot be attributed to the latent-feature prior. The paper needs an ablation that holds architecture, training procedure, and perturbation budget fixed while varying only the conditioning signal, plus a careful description of the exact AdvGAN baseline used for the comparison.","section":"§3.1 and contribution list"},{"comment":"The claim that the generated examples are 'perceptually realistic' is supported only by Figure 2. No perceptual metric (e.g., SSIM, LPIPS, FID) or human evaluation is reported, and the figure shows only a single row of examples. Quantitative perceptual similarity between original and adversarial images should be provided, along with more examples and any failure cases.","section":"§3.2, 'Visual results'"},{"comment":"The hyperparameters alpha and beta in Eq. (5) are never reported, and the choice of feature extractor layer (described only as 'the last convolutional layer') is not varied or justified. Since the central claim concerns the usefulness of latent features, the paper should at least report the values of alpha and beta, perform a sensitivity analysis, and compare results when features are taken from different layers. Without these details the method is not reproducible and the role of the feature prior is not isolated.","section":"§2.2, Eq. (5); §3.1"}],"minor_comments":[{"comment":"There is a typo in 'CIF AR-10' that should read 'CIFAR-10'.","section":"Abstract"},{"comment":"The generator update in Algorithm 1 omits the weights alpha and beta shown in Eq. (5); the expression lists the GAN loss, L2 term, and M_t term without their coefficients, which is inconsistent with the loss definition.","section":"Algorithm 1"},{"comment":"The phrase 'a a feature extractor' contains a duplicated article and should be corrected.","section":"§2.2"},{"comment":"The table formatting is confusing: the 'Data Model Defense' column merges dataset, model, and defense method, and the baseline/architecture details for AdvGAN are not given in the text. The tables should be split into clear columns and the experimental protocol for the baseline should be described.","section":"Tables 1 and 2"},{"comment":"The transferability table reports only attack success rates and does not compare with AdvGAN or report perturbation budgets; the large spread in transfer rates (20.24% to 89.4%) is left unexplained and needs discussion.","section":"§3.2, Table 3"}],"recommendation":"major_revision","confidential_remarks":"The central premise that latent features are more vulnerable is imported from reference [14], which shares an author with this paper. The attack-rate measurements themselves are new, so this is not circular, but the manuscript should more explicitly acknowledge the provenance of the premise and ideally validate it with independent experiments. The main barrier to acceptance is evidential, not methodological: the missing perturbation-budget reporting and the architecture confound are fixable with additional experiments, but without them the central claim is not supported. I would also encourage the editor to request code or trained models if available, since the implementation details are currently insufficient for reproduction."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague, quick take on 1908.00706. The paper does one thing: it conditions the generator on f(x), a feature map from the target model's last convolutional layer, instead of the input image x, and drops the encoder in the generator. That is a genuine variant of AdvGAN, and the abstract's claim that this reduces generator overhead is credible. The loss is standard GAN plus adversarial loss plus L2 perturbation, correctly written. The new empirical content is attack success rates for MNIST and CIFAR-10 against undefended and defensively trained models, plus transferability numbers. That is the extent of the good news.\n\nThe problem is that the headline conclusion—latent features are better priors than input images—is not measured. The comparison against AdvGAN changes the conditioning input and the generator architecture at the same time, so any gain could come from the architecture. The paper never reports the L2 or Linf distance of the generated adversarial examples or the epsilon used in Eq. (4); Lpert is a soft penalty with unreported beta. So the examples may not even satisfy the paper's own definition of a bounded adversarial perturbation. \"Perceptually realistic\" is backed only by one figure, with no perceptual metric. Single runs, no ablations, no code.\n\nThe stress-test note is accurate. I don't think the idea is wrong; it is just unsupported as presented. The motivating observation comes from [14], with a shared author, and the paper imports that premise without independent validation. That is not a fatal flaw by itself, but it strengthens the need for a clean ablation.\n\nWho should read this? People working on GAN-based attacks who want a simple variant to try. Treat it as a preliminary report, not as an established result. If I were an editor, I would not accept it as is, but I would send it to referees rather than desk-reject: the claim is clean and cheap to test. A good referee should demand an ablation that fixes architecture and perturbation budget while varying only the conditioning input, plus actual distance measurements. If the feature prior survives that, the paper becomes a useful short contribution.","headline":"A plausible AdvGAN variant whose key claim is untested: the comparison changes architecture and conditioning at once, and no perturbation magnitude is reported.","tokens_in":5249,"tokens_out":3404,"would_cite":false,"duration_ms":35704,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that latent features from a target model's last convolutional layer are a better conditioning prior than the input image for GAN-based adversarial generation, producing higher attack success rates on MNIST and CIFAR-10…","keywords":["adversarial examples","GAN","latent features","adversarial attacks","attack success rate","adversarial training","transferability"],"falsifier":"Run the same decoder-only generator with identical losses and hyperparameters under two conditions: conditioned on $f(x)$ from the target model's last convolutional layer, and conditioned on the input image $x$ itself (resized to the same dimension if needed). If the $f(x)$-conditioned version does not achieve higher attack success rates at comparable $\\ell^2$ perturbation sizes, the central claim is false. Also, report the achieved $\\|x - x_{adv}\\|_2$ from Eq. (4) for every attack, since the paper omits these values.","tokens_in":4327,"feed_emoji":"🎯","tokens_out":5109,"duration_ms":44264,"temperature":0.7,"pith_summary":"This paper tries to establish that, when generating adversarial examples with a GAN, conditioning the generator on the target model's internal latent features rather than on the input image produces stronger and more realistic attacks. It proposes AdvGAN++, which feeds the feature map from the target model's last convolutional layer, along with noise, into a decoder-only generator and trains it with a GAN loss, an adversarial loss, and an L2 perturbation penalty. On MNIST and CIFAR-10, the reported attack success rates exceed those of AdvGAN both with and without adversarial defenses, and the generated images are claimed to be perceptually similar to real ones. A sympathetic reader would care because this suggests the attack surface of a network is concentrated in its intermediate representations, and that exploiting those representations can make black-box-style GAN attacks cheaper and more effective.","feed_headline":"Latent features beat raw images for GAN-based attacks","feed_subtitle":"Conditioning the generator on a model's last convolutional layer raises attack success rates.","key_machinery":"The load-bearing object is the conditional generator $G(z|f(x))$, where $f$ is the feature extractor taken from the last convolutional layer of the target model $M$. This is a decoder-only generator: it maps the latent feature representation (plus noise) directly to an adversarial image, rather than following an encoder-decoder path from the input image. The machinery works by exploiting the observation that latent features are more susceptible to adversarial perturbation than raw pixels, and by training $G$ through the min-max game $\\min_G \\max_D L(G,D)$ with $L = L_{GAN} + \\alpha L_{adv} + \\beta L_{pert}$, where $L_{adv}$ pushes the true-class softmax probability down and $L_{pert}$ keeps the output close to the original image in $\\ell^2$ distance.","core_discovery":"The central discovery is that latent features are better priors than input images for adversarial generation. Concretely, for an untargeted attack, the generator takes the feature map $f(x)$ extracted from the last convolutional layer of the target model $M$, concatenated with a noise vector $z$, and outputs $x_{adv} = G(z | f(x))$ such that $M(x_{adv}) \\neq t$ while $\\|x - x_{adv}\\|_p < \\epsilon$. The training objective combines a standard GAN loss, the softmax probability of the true class $M_t(G(z|f(x)))$ as the adversarial loss, and an $\\ell^2$ perturbation loss, balanced by hyperparameters $\\alpha$ and $\\beta$. The paper reports that this formulation beats AdvGAN on attack success rate across MNIST and CIFAR-10 under no defense, under FGSM/iterative-FGSM/ensemble adversarial training, and transfers to other models.","pith_inferences":["The same latent-conditioning idea applies to other generator families: conditioning on intermediate activations of a target model could improve attacks in audio or text domains, wherever a feature extractor is available.","Layer choice is a tunable hyperparameter: conditioning on earlier versus later convolutional layers might trade off perceptual fidelity against attack strength, giving an attacker a knob the paper does not explore.","A targeted version could condition on the target class's feature representation or on a class-conditional latent, turning the same machinery into a targeted attack."],"forward_implications":["Attack success rates on adversarially trained models (FGSM, iterative FGSM, ensemble) are consistently higher for AdvGAN++ than for AdvGAN, suggesting latent-conditioned generation partially bypasses the robustness those defenses provide.","Generated adversaries transfer to other architectures (e.g., from ResNet-32 to Wide-ResNet and from LeNet-C to LeNet-B), making them usable in black-box settings.","The decoder-only generator removes the encoder path, so training and inference overhead are lower than AdvGAN while attack rates are no worse.","Perceptual realism of generated adversaries is maintained, so the attack remains stealthy by the paper's qualitative evaluation."],"supporting_citations":[{"why":"Supplies the observation that latent features are more vulnerable to adversarial perturbation; this is the premise the method builds on.","marker":"[14]"},{"why":"AdvGAN, the baseline that the proposed method extends and compares against.","marker":"[17]"},{"why":"GAN framework used for the adversarial generator and discriminator.","marker":"[3]"},{"why":"Conditional GAN formulation that motivates conditioning the generator on auxiliary information.","marker":"[7]"},{"why":"FGSM, used both as a baseline attack and as a defense (FGSM adversarial training) in evaluation.","marker":"[2]"},{"why":"Iterative FGSM, used as one of the defenses in evaluation.","marker":"[9]"},{"why":"Ensemble adversarial training, used as another defense and source of target model architectures like LeNet-B.","marker":"[16]"}],"fun_headline_variants":["Latent feature priors lift GAN attack success","Model latents beat images for GAN attack priors","AdvGAN++ uses latents for stronger adversarial GANs","Feature-based priors increase GAN attack rates"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The higher attack rates are attributed to using latent features as the generator's prior, but the experiments never vary the prior alone while keeping the rest of the setup fixed, so the paper's central explanation is not isolated from its architectural changes.","fun_headline_variants_meta":{"raw":{"variants":["Latent feature priors lift GAN attack success","Model latents beat images for GAN attack priors","AdvGAN++ uses latents for stronger adversarial GANs","Feature-based priors increase GAN attack rates"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000179,"raw_usage":{"total_tokens":1237,"prompt_tokens":817,"completion_tokens":420,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":433,"completion_tokens_details":{"reasoning_tokens":355}},"tokens_in":433,"tokens_out":420,"duration_ms":5038,"temperature":1.0,"reasoning_tokens":355,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T15:35:54.727837+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same decoder-only generator with identical losses and hyperparameters under two conditions: conditioned on $f(x)$ from the target model's last convolutional layer, and conditioned on the input image $x$ itself (resized to the same dimension if needed). If the $f(x)$-conditioned version does not achieve higher attack success rates at comparable $\\ell^2$ perturbation sizes, the central claim is false. Also, report the achieved $\\|x - x_{adv}\\|_2$ from Eq. (4) for every attack, since the paper omits these values.","supporting_citations":[{"cited_title":"Singh, A","cited_arxiv_id":null,"evidence_quote":"Supplies the observation that latent features are more vulnerable to adversarial perturbation; this is the premise the method builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"AdvGAN, the baseline that the proposed method extends and compares against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"GAN framework used for the adversarial generator and discriminator."},{"cited_title":"Isola, J.-Y","cited_arxiv_id":null,"evidence_quote":"Conditional GAN formulation that motivates conditioning the generator on auxiliary information."},{"cited_title":"Goodfellow, J","cited_arxiv_id":null,"evidence_quote":"FGSM, used both as a baseline attack and as a defense (FGSM adversarial training) in evaluation."}],"review_version":1}