{"id":"5b396346-93d7-48aa-be98-d2384b140b4f","arxiv_id":"1908.03176","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Three wavelet-based denoising strategies detect adversarial iris images by removing or denoising the wavelet sub-bands most affected by the attack.","lead":"This paper proposes three defenses that detect adversarial iris images by manipulating wavelet sub-bands: random zeroing with majority voting, and two sub-band-specific denoising schemes that remove or repair the bands most changed by an attack. The best strategy reports higher detection rates than five prior defenses across FGSM, iterative FGSM, and DeepFool attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline comparisons in Table 5 are drawn from the best cell of a per-attack grid over N (and K) with no held-out validation, and the shared 'success rate' metric is never defined; the claimed outperformance is therefore conditional, not established.","rationale":"The proposed wavelet-domain strategy is internally coherent, and the detection logic is plausible; the concern is not about the method's existence or the authors' intent. The key condition for the central claim is that Table 5 measures all defenses with one well-defined metric and does not pick hyperparameters on the test set. That condition is not met as written. Table 4 shows Ours#3 at N = 6 for FGSM (81.65) and iGSM (77.59) but at N = 5 for Deepfool (84.36), and Table 3 shows Ours#1's reported 76.08 is exactly the best cell (K = 30, N = 5). No separate validation set is used for model selection, and no confidence intervals or code are provided. The metric definition is also ambiguous: 'success rate of recognizing the adversarial and benign examples' could be balanced accuracy or total accuracy; with a 50% benign and 50% adversarial test set the two coincide only if the threshold is fixed, and the baseline implementations are not described, so comparability is assumed rather than shown. These issues do not invalidate the idea; they make the strongest comparative claim conditional. I therefore keep the reader's CONDITIONAL verdict and agree with the reader's identified weakest assumption.","tokens_in":11613,"tokens_out":7982,"duration_ms":88540,"concrete_test":"Recompute Table 5 under a fixed protocol: first split the data into training, validation, and test sets; select N (and K for Ours#1) on validation only; then report on test the benign recognition rate, adversarial recognition rate, balanced accuracy, and total accuracy for each defense, using the same OSIRIS-code classifier and the same surrogate-generated attacks. If Ours#3 is no longer simultaneously best on all three attacks, or if baseline per-class rates show the metric is not comparable, the central outperformance claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim ('Ours#3 reaches 81.65/77.59/84.36 and outperforms five baselines') rests on Table 5, but the numbers are selected post hoc from Tables 3 and 4. Ours#1's FGSM value 76.08 is the maximum of Table 3 (K = 30, N = 5). Ours#3's FGSM and iGSM values come from N = 6, while its Deepfool value 84.36 comes from N = 5; the 'best variant' is not a fixed configuration. Because N and K are chosen after looking at the same test set, the reported margins are optimistic, and no uncertainty is given. In addition, Section 4.3 states the test set is 50% benign and 50% adversarial and defines success as 'recognizing the adversarial and benign examples', but it never gives the formula (balanced accuracy, total accuracy, or something else). Without per-class rates, a baseline value near 39% could mean either poor adversarial detection or a systematically different metric; the comparison to adversarial-training baselines also lacks details about the classifier those methods were applied to. This is the load-bearing weakness: the conclusion depends on a fair, well-defined comparison that the paper does not yet document.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes three wavelet-domain preprocessing defenses that detect adversarial iris examples without modifying the underlying iris matcher. The first strategy randomly zeros up to N mid- and high-frequency wavelet sub-bands, reconstructs K denoised versions, and flags the input as adversarial when the majority vote of the classifier disagrees with the original label. The second and third strategies train one denoising auto-encoder per wavelet sub-band, compute per-sub-band reconstruction errors, remove the N sub-bands with the largest ratio to a validation-set baseline, and reclassify the reconstructed image; the third strategy also denoises the retained sub-bands. Experiments on BioCop/BIOMDATA report success rates for FGSM, iGSM, and Deepfool attacks, and the paper claims that the third strategy outperforms the other two and five state-of-the-art defenses (Tables 4 and 5).","tokens_in":11880,"tokens_out":5740,"duration_ms":62235,"significance":"If the empirical claims are supported, the paper offers a simple and interpretable defense tailored to iris recognition: it leaves the iris-code matcher untouched and uses wavelet sub-band reconstruction errors as a detection signal. The idea is plausible and the application domain is specific enough that per-sub-band denoising could be a reasonable preprocessing step. The paper also provides explicit network architectures and compares with several baselines. However, the significance is currently limited by evaluation issues: the success-rate metric is undefined, key hyperparameters appear to be selected on the test set, baseline instantiations are underspecified, and there is no uncertainty analysis or adaptive-attack evaluation. These issues are load-bearing because the headline conclusion of outperformance depends directly on them.","major_comments":[{"comment":"The success-rate metric is never formally defined. The text says only that the test set is 50% benign and 50% adversarial and that success means \"recognizing the adversarial and benign examples.\" The paper must state whether the reported numbers are total accuracy, balanced accuracy, mean per-class accuracy, or something else. This is not a minor presentational point: under a balanced-accuracy interpretation, a baseline value such as 38.98% for [11] in Table 5 is below chance and could indicate a systematically different quantity rather than poor adversarial defense. Please report per-class rates (benign recognition and adversarial detection) or a confusion matrix for every defense and attack so the comparisons are unambiguous.","section":"§4.3, Tables 4–5"},{"comment":"The headline numbers in Table 5 are selected post hoc over N (and K) rather than being a fixed configuration. Ours#1's FGSM value of 76.08 is the maximum of Table 3 (K=30, N=5); Ours#3's FGSM and iGSM values use N=6 while its Deepfool value uses N=5; and Ours#2's Deepfool value of 84.21 does not match any value in Table 4, which shows 84.36 at N=5 and 78.21 at N=6. Moreover, Ours#1's iGSM and Deepfool entries in Table 5 are not derivable from any reported table. This means the claimed margins over the baselines are an upper envelope over hyperparameter choices, not an evaluation of a single method. The authors should select N and K on a separate validation set, report the fixed configuration used for the test results, and relegate the full grid to supplementary material.","section":"§4.3, Tables 3–5"},{"comment":"The comparison with the adversarial-training baselines is underspecified to the point of being non-reproducible. The proposed defense operates with the OSIRIS Hamming-distance matcher, which is not trained by backpropagation, yet [11], [41], and [18] are adversarial-training methods that modify the classifier. It is not explained how these baselines were instantiated for this matcher, whether they protected the same classifier, or whether they were evaluated on the same test examples. In addition, all attacks are generated non-adaptively against the surrogate network; the statement in Section 3 that the randomness of Ours#1 prevents an adversary from retraining is not a substitute for an adaptive-attack evaluation. The authors should either include an adaptive adversary or explicitly scope the claims to non-adaptive attacks.","section":"§4.2–4.3"},{"comment":"There are no error bars, confidence intervals, or significance tests anywhere in the results. The method has randomness in Ours#1 (the random selection of sub-bands) and threshold-like hyperparameters in Ours#2 and Ours#3, and neighboring N entries in Tables 3 and 4 differ by only a few percent. Single-point estimates on one 3,040-image test set are insufficient to support the reported margins of several percentage points. Please report multiple runs or bootstrap intervals and state the number of independent trials for the stochastic components.","section":"§4.2, Tables 3–5"}],"minor_comments":[{"comment":"The text around Eq. (6) refers to \"average distances for the sub-bands on the training set,\" while Eq. (4) defines D_i^avg on the validation set. Please align the terminology.","section":"§3.2, Eq. (6)"},{"comment":"The \"No Attack\" columns appear to report benign-only recognition accuracy. If so, state this explicitly and explain how it relates to the balanced accuracy reported in the attack rows, since the test set is 50% adversarial.","section":"Table 4"},{"comment":"The attack setup is incomplete: the FGSM and iGSM perturbation bounds (epsilon) are not reported, and the Deepfool implementation details are not given. Add these parameters for reproducibility.","section":"§4.1"},{"comment":"There are several typographical issues, including \"donated as defense strategies\" (Section 1), \"we train a denoising auto-encoders\" (Section 3.2), \"the the encoding layers\" (Section 4.2), and \"prob\" for \"probe\" (Section 4.2).","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The core idea is reasonable for the specific iris-recognition setting, and the paper could be publishable after a thorough revision of the evaluation protocol. The main risks are that the success-rate metric is undefined, the best configurations are selected from the test tables, and the adversarial-training baselines are not described in enough detail to know what was actually compared. I would not reject on the idea alone, but the current evidence does not establish the claimed outperformance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Three things you should know. First, the core idea is real: instead of denoising the whole iris image, the authors decompose it into uniform wavelet sub-bands, train one small denoising auto-encoder per sub-band on benign samples, and flag the sub-bands with the largest reconstruction-error ratio relative to benign validation. That per-sub-band selection is not in their cited literature, and the best variant (Ours#3) also replaces the kept sub-bands with denoised versions. This is a reasonable, well-scoped contribution for iris recognition.\n\nSecond, the paper does several things right. The surrogate network for generating adversarial iris-codes is a sensible bridge between conventional OSIRIS features and the need for gradient-based attacks. They test FGSM, iGSM, and Deepfool on a dedicated test set with a 50/50 benign/adversarial split, and they compare against five baselines including MagNet and adversarial training. The method is clearly described, and the architecture tables are specific enough to reproduce in principle.\n\nThe soft spots are in the evaluation, not the idea. The strongest numbers in Table 5 are chosen post hoc: for Ours#1, FGSM 76.08 is the best cell of Table 3 (K=30, N=5); for Ours#3, FGSM and iGSM come from N=6 but Deepfool 84.36 comes from N=5. So 'Ours#3' is not a fixed configuration; it is the envelope of a grid searched on the test set. No validation protocol or error bars are reported. A fair comparison with the baselines would fix N (and K) on a validation split and report mean plus/minus variance over runs and attack seeds.\n\nThe second soft spot is that 'success rate' is never defined as a formula. With a balanced test set, total accuracy and balanced accuracy coincide, but the text says 'recognizing the adversarial and benign examples,' which sounds like binary detection accuracy. For adversarial-training baselines, the natural metric is subject-classification accuracy under attack, which is a different task. If the baselines are not performing the same binary detection, the tables are not apples-to-apples. Per-class rates or a confusion matrix would resolve this.\n\nThird, all attacks are non-adaptive, generated from a surrogate network in the authors' prior paper. That is a common limitation in the adversarial-defense literature, so it is a moderate concern, not a fatal one. The citation pattern is fine; using their own prior surrogate for attack generation is appropriate here.\n\nThe core idea deserves a serious referee, but only after the evaluation is tightened: fixed hyperparameters on a validation split, a defined metric, and ideally adaptive attacks or at least a frank statement that they are out of scope. This is a paper for iris-recognition and adversarial-defense researchers, not a general ML audience. I'd bring it to a reading group mainly to discuss evaluation pitfalls.\n\nRecommendation: send to peer review with major revisions; the method is worth reviewer time, but the current comparative claims are not yet supported.","headline":"Per-sub-band wavelet denoising with reconstruction-error band selection is a plausible new defense idea for iris recognition, but the headline comparisons are undercut by post-hoc N/K selection and an undefined success-rate metric.","tokens_in":12407,"tokens_out":3843,"would_cite":false,"duration_ms":40165,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Removing the wavelet sub-bands an attack most corrupts detects adversarial iris images with up to 84% success, outperforming five published defenses.","keywords":["adversarial examples","iris recognition","wavelet decomposition","denoising autoencoder","sub-band reconstruction error","FGSM","DeepFool","biometric security"],"falsifier":"Run an adaptive adversary that distributes its perturbation energy uniformly across all 16 wavelet sub-bands while still producing adversarial iris images by the paper's Hamming-distance criterion; if such attacks pass the defense at rates near the undefended baseline, the frequency-localization premise is false. Separately, re-run the full comparison with $N$ chosen on a validation set and with one shared balanced-accuracy definition; if the margins over the five baselines shrink or vanish, the headline result is an artifact of test-set selection.","tokens_in":11409,"feed_emoji":"👁","tokens_out":10599,"duration_ms":98941,"temperature":0.7,"pith_summary":"This paper tries to show that adversarial iris images can be caught before they reach a recognition system by preprocessing each image in the wavelet domain instead of modifying the classifier. The core claim is that attacks damage only a few mid- and high-frequency wavelet sub-bands, while the low-frequency iris structure that recognition depends on stays intact, so removing or denoising the corrupted sub-bands makes the attack visible to the unchanged classifier. The strongest variant customizes this removal for each input by comparing each sub-band's reconstruction error against its expected error from a per-sub-band denoising autoencoder. If the claim holds, iris security systems could gain a preprocessing layer that beats adversarial training and generic denoising against FGSM, iterative gradient sign, and DeepFool attacks.","feed_headline":"Wavelet filter detects adversarial iris images at up to 84%","feed_subtitle":"Per-image wavelet filtering beats five published iris defenses against three common attacks.","key_machinery":"The central object is the uniform wavelet decomposition, which splits each iris image into $4^L$ sub-bands; with $L=2$ there are 16 sub-bands representing different vertical, horizontal, and diagonal frequency ranges. The second and third strategies train one denoising autoencoder per sub-band on benign iris images and then compute the ratio $\\alpha_i = D_i / D^{\\mathrm{avg}}_i$ between the reconstruction error of sub-band $i$ for the current input and the average reconstruction error for benign validation images. The $N$ sub-bands with the largest $\\alpha_i$ are treated as adversary-affected: strategy 2 removes them and reconstructs from the untouched remainder, while strategy 3 removes them and replaces the kept sub-bands with their denoised versions. The reconstructed image is then classified by the same classifier used for benign images, and a disagreement with the original label flags the input as adversarial.","core_discovery":"The paper claims that wavelet-domain preprocessing can detect adversarial iris examples with high reliability. Three strategies are tested: randomly zeroing mid- and high-frequency sub-bands and majority voting over many reconstructions; zeroing the sub-bands with the largest reconstruction-error ratios; and zeroing those same sub-bands while replacing the remaining sub-bands with their denoised versions. The third strategy reaches success rates of 81.65% on FGSM, 77.59% on iterative gradient sign, and 84.36% on DeepFool on a test set that is half benign and half adversarial, outperforming five state-of-the-art defenses, whose best reported success is 60.54%. The authors attribute the gain to per-input customization: the defense identifies which frequency bands the adversary actually touched rather than denoising blindly.","pith_inferences":["The per-sub-band reconstruction-error ratio is a generic signal: any domain whose attacks concentrate in high-frequency bands could reuse this defense, provided per-band denoisers can be trained on benign data.","The reported comparison would be stronger if the number of removed sub-bands $N$ were selected on a validation set before seeing test attacks; as reported, $N$ is chosen after the fact for each attack, so the headline numbers likely overstate real deployment performance.","An adversary who knows the defense could spread the perturbation evenly across all sub-bands so that every $\\alpha_i$ stays near its benign average; testing this adaptive attack is the natural next experiment.","The three attacks tested are all gradient-based and white-box; black-box or transfer attacks, or attacks aimed directly at the denoisers, may behave differently."],"forward_implications":["The defense can be added as a preprocessing step to existing iris recognition pipelines without retraining the classifier.","Per-input selection of which sub-bands to suppress is what gives the third strategy its edge over generic denoising defenses.","Because the low-frequency sub-band is preserved, benign iris images are still recognized with over 98% accuracy when at most a few sub-bands are removed.","The method beats adversarial training on the tested attacks, suggesting that frequency-structure priors from the iris domain help more than generic robust training when the attack pipeline is known.","Success rates in the high 70s to mid 80s on a 50/50 benign/adversarial mixture mean the defense is not a complete solution; an attacker with more perturbation budget or adaptive knowledge may erode these numbers."],"supporting_citations":[{"why":"supplies the fact that low- and low-mid frequency wavelet components of the iris carry recognition information and are robust to noise.","marker":"[14]"},{"why":"defines the FGSM attack and serves as one of the adversarial-training baselines in the comparison.","marker":"[11]"},{"why":"defines the iterative gradient sign attack (iGSM) and the notion of physically realizable adversarial examples.","marker":"[17]"},{"why":"defines the DeepFool minimal-perturbation attack used as the third attack scenario.","marker":"[21]"},{"why":"provides the denoising-autoencoder defense baseline and the input-reconstruction idea that the proposed sub-band denoisers extend.","marker":"[20]"},{"why":"provides the compression/basis-function denoising baseline that the proposed defense outperforms.","marker":"[27]"},{"why":"supplies the 32% Hamming-distance criterion used to decide when an adversarial iris image has been successfully generated.","marker":"[24]"},{"why":"supplies the L2 reconstruction-loss surrogate for iris-code generation used to craft the adversarial examples.","marker":"[28]"},{"why":"supplies the training and verification iris images used to train the surrogate network and the per-sub-band denoisers.","marker":"[1]"},{"why":"supplies the test iris images used for the benign/adversarial evaluation.","marker":"[7]"}],"fun_headline_variants":["Wavelet filter catches 84% of adversarial iris attacks","Wavelet denoising blocks most adversarial iris examples","Iris defense with wavelet sub-bands tops five baselines","Per-image wavelet filtering foils iris attacks","Wavelet decomposition identifies adversarial iris inputs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense works only if adversarial perturbations to iris images are concentrated in a small number of mid- and high-frequency wavelet sub-bands; if an attack spreads its distortion evenly across sub-bands, the per-band error ratios no longer single out the corrupted bands, and the method's advantage disappears.","fun_headline_variants_meta":{"raw":{"variants":["Wavelet filter catches 84% of adversarial iris attacks","Wavelet denoising blocks most adversarial iris examples","Iris defense with wavelet sub-bands tops five baselines","Per-image wavelet filtering foils iris attacks","Wavelet decomposition identifies adversarial iris inputs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000565,"raw_usage":{"total_tokens":2642,"prompt_tokens":871,"completion_tokens":1771,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":487,"completion_tokens_details":{"reasoning_tokens":1697}},"tokens_in":487,"tokens_out":1771,"duration_ms":14358,"temperature":1.0,"reasoning_tokens":1697,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:22:05.201845+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an adaptive adversary that distributes its perturbation energy uniformly across all 16 wavelet sub-bands while still producing adversarial iris images by the paper's Hamming-distance criterion; if such attacks pass the defense at rates near the undefended baseline, the frequency-localization premise is false. Separately, re-run the full comparison with $N$ chosen on a validation set and with one shared balanced-accuracy definition; if the margins over the five baselines shrink or vanish, the headline result is an artifact of test-set selection.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"supplies the fact that low- and low-mid frequency wavelet components of the iris carry recognition information and are robust to noise."},{"cited_title":"Meng and H","cited_arxiv_id":null,"evidence_quote":"provides the denoising-autoencoder defense baseline and the input-reconstruction idea that the proposed sub-band denoisers extend."},{"cited_title":"Defending against Adversarial Images using Basis Functions Transformations","cited_arxiv_id":"1803.10840","evidence_quote":"provides the compression/basis-function denoising baseline that the proposed defense outperforms."}],"review_version":1}