{"id":"15e2207d-9292-4a04-9fa3-f2e8c31b315a","arxiv_id":"2501.11901","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"A block-wise interpolation and selective rotation attack, CWT, improves adversarial transferability across CNN and transformer models on ImageNet.","lead":"This paper describes a new way to craft adversarial images, called Component-Wise Transformation, which resizes and selectively rotates small image blocks while building the attack. It reports consistently higher attack success rates against other AI models across different architectures than earlier transformation-based methods.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The method is under-specified at its core scaling step (Eqs. 7–8 conflict with the 'same scaling factor' text), and Table 2 already contradicts the 'consistently outperforms in stability' claim, so the headline result is not reproducible as stated.","rationale":"I agree with the reader that the empirical claim is conditional, but the sharpest problem is not only the weak attention-diversification evidence. The transformation is not uniquely specified: Eqs. 6–8 conflict with the prose about the 'same scaling factor', so independent reproduction can yield materially different attacks. This is an internal inconsistency, not a disagreement with community consensus. The stability claim also fails in one of the four main Transformer surrogate rows (Table 2, ViT-B: CWT std 5.1 vs BSR 4.4), which weakens the abstract's 'consistently outperforms in both ASR and stability'. The reported gains are plausible and the tables are broadly consistent in direction, so I would not reject the paper; however, the conditionality of the reader's verdict is justified and should remain until the implementation is pinned down and the stability claim is qualified or corrected.","tokens_in":20095,"tokens_out":12935,"duration_ms":140749,"concrete_test":"Run the Table 1 RN-101 surrogate setting twice, implementing CWT exactly from the text: variant A uses Eq. 8 as written (H'' = floor(H*s), so the block is enlarged and then randomly cropped back), and variant B applies the literal same scale factor to the already-shrunk block (H'' = floor(H'*s) = H, so no net zoom). Keep n=2, smax=1.3, r=26°, k=2, N=20, epsilon=16/255, and the same 1000-image subset; compare mean ASR against BSR under identical N=20. If variant B's mean ASR drops by more than about 1 point relative to variant A, or no longer beats BSR by the reported margin, the published algorithm is ambiguous and the headline is implementation-dependent. As a secondary check, rerun the ViT-B surrogate row of Table 2 with 10 independent subsets to test whether CWT's std (5.1) is reliably worse than BSR's (4.4).","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing issue is reproducibility of the exact transformation. Section 3.3 first shrinks every block to H' = floor(H/s) (Eq. 6) and then says it is 'scaled up using the same scaling factor s', but Eq. 8 sets H'' = floor(H*s) instead of floor(H'*s) = H. A reader implementing the prose with a standard scale_factor=s interpolation gets no net zoom (down/up smoothing); a reader following Eq. 8 gets a central zoom by s plus a random crop. These are different transformations, and the paper's motivation is explicitly about zoom-in (Section 3.3), so the reported numbers depend on which reading is used. This is load-bearing because the advertised advantage over BSR is small (mean ASR gains of 1.1–3.7 points in Tables 1–2; 1.6 points for the ViT-B surrogate) and no code or error bars are provided. In addition, the 'consistently outperforms in stability' part of the central claim is contradicted by Table 2: for the ViT-B surrogate, CWT has std 5.1 against BSR's 4.4, and Appendix Table A3 shows the same inversion under NRP (7.7 vs 6.9). The abstract's 'both ASR and stability ... consistently' therefore overstates what the tables establish.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Component-Wise Transformation (CWT), an input-transformation attack that partitions the input into n×n blocks, applies pre-interpolation downscaling followed by block-wise scaling and selective rotation, and averages gradients over N transformed copies within MI-FGSM to improve adversarial transferability. The authors evaluate on ImageNet with four CNN and four Transformer surrogate models and several defense settings, reporting mean attack success rate (ASR) improvements over BSR of about 1.1–3.7 points and lower standard deviations in most settings, and attribute the gains to diversification of the surrogate model's attention across object regions.","tokens_in":20439,"tokens_out":6876,"duration_ms":63135,"significance":"If the empirical results hold, CWT offers a practical, computationally cheap improvement over BSR and related block-based transformations, and the attention-diversification framing is thought-provoking. The paper's strengths include the breadth of the evaluation (eight surrogate models plus four defense settings, with consistent mean-ASR gains over the previous state of the art in most configurations) and the component ablations in Section 4.5. However, the central claims are limited by the ambiguity of the core transformation, the absence of code and error bars, the selection of hyperparameters on the same benchmark used for evaluation, and an overstated stability claim contradicted by the paper's own Table 2.","major_comments":[{"comment":"The description of the two-step interpolation is internally inconsistent. The text states that after pre-interpolation (downscaling by s, Eq. 6) 'each block is scaled up using the same scaling factor s', but Eq. 8 defines the upscaled size as H'' = floor(H*s) rather than floor(H'*s) ≈ H. A reader implementing the prose with a standard two-pass resize (down by s, then up by s) obtains roughly the original size, i.e., no net zoom, whereas a reader implementing Eq. 8 obtains a net zoom by s followed by a random crop. Since the proposed mechanism and Section 3.3 explicitly motivate a zoom-in effect, and the reported gains over BSR are small (mean ASR gains of 1.1–3.7 points in Tables 1–2; 1.6 points for the ViT-B surrogate), the experimental numbers are not uniquely tied to a well-defined transformation. The authors must clarify whether H'' is H*s or H'*s and, ideally, release code to disambiguate the procedure.","section":"3.3 (Eqs. 6–8)"},{"comment":"The claim that CWT 'consistently outperforms state-of-the-art methods in both attack success rates and stability' (Abstract) is contradicted by Table 2: for the ViT-B surrogate, CWT has a standard deviation of 5.1 across target models versus 4.4 for BSR, i.e., worse stability, even though the mean ASR is higher (81.9 vs 80.3). The same inversion appears in Appendix Table A3 under NRP for the ViT-B surrogate (CWT 7.7 vs BSR 6.9). The paper should either qualify the claim to 'in most settings' (as the main text already does in Sections 4.2–4.3) or provide a statistical test showing that the standard-deviation difference is not meaningful.","section":"Abstract and §4.3 (Table 2)"},{"comment":"The empirical support for the central claim is weakened by the absence of error bars and by the selection of hyperparameters on the same evaluation benchmark. The final configuration (n=2, smax=1.3, r=26°, k=2, N=20) is derived from ablations in Figure 4 that optimize mean ASR on the same 1000-image ImageNet validation set used for the final comparisons. Since the differences over BSR are small (typically 1–4 points, and 1.6 points for the ViT-B surrogate), and since no repeated runs or confidence intervals are reported, it is not possible to rule out that the reported gains reflect overfitting to this particular benchmark and selection. The authors should evaluate on a separate validation/test split, report variance across multiple runs or bootstrap estimates, and ideally provide the code.","section":"4.1 and 4.5"}],"minor_comments":[{"comment":"Section 4.1 states that 'all images are classified correctly by the models,' but Appendix A notes that the adversarially trained models do not achieve 100% clean accuracy; please clarify the filtering procedure.","section":"4.1"},{"comment":"In the RN-101 block of Table A2, the US-MM row appears to have been copied from the RN-18 block: the surrogate column reads 99.4 with an asterisk, and the entire row is identical to the RN-18 surrogate row. This data entry error should be corrected and the corresponding mean and standard deviation recomputed.","section":"Table A2"},{"comment":"The Figure 2 caption states that CWT 'shifts the surrogate model's attention toward the central region of the object,' which appears to contradict the stated goal of diversifying attention across regions; please rephrase.","section":"Figure 2 caption"},{"comment":"Citation [9] in the list of adversarially trained models (Geirhos et al., a texture-bias paper) seems incorrect; [38] (Tramèr et al.) is likely the intended source for the ensemble adversarially trained models.","section":"Appendix A"},{"comment":"Algorithm 1 and Section 4.1 use different names for the number of iterations ('T' vs. 'epoch'); align the notation.","section":"Algorithm 1 and §4.1"},{"comment":"In Section 4.5, the justification for setting r=26° is that fluctuations above 25° are 'insignificant' based on 'experimental error margins,' but no error estimates are given; please provide quantitative support or soften the claim.","section":"4.5"}],"recommendation":"major_revision","confidential_remarks":"The paper is within scope for a computer vision venue and the empirical comparison is reasonably broad, but the transformation ambiguity in Section 3.3 and the overstated stability claim are fixable issues that currently prevent acceptance. The Table A2 data-entry error and the citation error suggest that a careful round of verification of all tables is needed before resubmission. I do not see grounds for rejection, provided the authors clarify the transformation, qualify or statistically support the stability claim, and add at least basic variance or code-based reproducibility."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: CWT is a plausible, well-tested variant in the block-transformation family. It beats BSR on mean ASR by a few points across most settings, but the core scaling step is under-specified between the prose and the equations, and the stability claim is overstated.\n\nWhat's new: the specific combination of per-block shrink-then-enlarge interpolation and selective rotation is not in BSR or DIM. The experiments are the real contribution—eight target models, four defenses, ablations on each hyperparameter, and consistent mean-ASR gains over BSR in Tables 1, 2, 3–6 and A1–A3. That is worth taking seriously. The Grad-CAM motivation is suggestive but qualitative.\n\nWhere it gets soft. First, Section 3.3 says a block is shrunk to H'=floor(H/s), then 'scaled up using the same scaling factor s'. If that means back to the original size, Eq. 8 should read H''=H. Instead it says H''=floor(H*s). One reading gives a down-then-up smoothing with no net zoom; the other gives a zoom-in by s plus crop. Those are different transformations, and the paper's motivation is explicitly about zoom-in. The reported numbers almost certainly came from the Eq. 8 version, but the prose needs to say that. Second, the abstract claims CWT 'consistently outperforms' SOTA in both ASR and stability. The ASR part mostly holds, but the stability part does not: Table 2, ViT-B surrogate gives CWT std 5.1 vs BSR 4.4, and Appendix A3 under NRP repeats that inversion (7.7 vs 6.9). 'Consistently' is too strong. Third, there is no code, no error bars over repeated runs, and the hyperparameters are tuned on the same ImageNet benchmark where the headline numbers are reported. Gains are modest—mean ASR improvements of roughly 1–4 points over BSR—so without independent reproduction the exact magnitude is uncertain. Fourth, the central attention-diversification story is supported only by Grad-CAM heatmaps, not by a controlled test.\n\nWho it's for: people working on transfer-based attacks or defenses will want to try CWT against BSR. It deserves a serious referee: the empirical pattern is clear and the method is cheap. But the authors should fix the specification, soften the stability claim, and ideally release code before this is publishable.","headline":"CWT is a plausible, well-tested variant in the block-transformation family, but the core scaling step is underspecified between prose and equations, and the stability claim outruns the tables.","tokens_in":20944,"tokens_out":3702,"would_cite":true,"duration_ms":34227,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes a block-wise resize-and-rotate input transformation, Component-Wise Transformation (CWT), and claims it consistently raises attack success rates and stability for adversarial transfer across CNN and Transformer models…","keywords":["adversarial transferability","input transformation attack","Component-Wise Transformation","black-box attack","block-wise interpolation","selective rotation","attention diversity","ImageNet"],"falsifier":"A matched control that uses the same number of random block-wise scale-and-rotate operations but omits the pre-interpolation shrink-then-enlarge pair and the selective-rotation limit would settle the mechanism: if it matches CWT's attack success rates, attention diversification is not the operative cause.","tokens_in":19906,"feed_emoji":"🧩","tokens_out":18867,"duration_ms":166957,"temperature":0.7,"pith_summary":"The paper claims that a new input-transformation attack, Component-Wise Transformation (CWT), improves the transferability of adversarial examples between deep image classifiers by forcing one surrogate model to look at many different regions of an object. Where prior methods resize, shuffle, or rotate whole images or blocks with fixed recipes, CWT divides the image into blocks, randomly shrinks then enlarges each block (pre-interpolation plus block-wise scaling), and selectively rotates only a few blocks. On ImageNet, the authors report that CWT consistently outperforms state-of-the-art methods such as BSR in mean attack success rate and in stability (lower standard deviation) across CNN, Transformer, and defended target models. The paper's evidence for why it works is attention heatmaps: transformed images shift a single surrogate's attention across diverse object regions, matching the different regions that different target architectures would use. If the claim is right, black-box attackers get a computationally cheap transformation for crafting transferable perturbations that also holds up against several defenses.","feed_headline":"Beat prior best transfer attacks by resizing and rotating blocks","feed_subtitle":"On ImageNet it lifts mean attack success above the prior best while cutting variance across CNN and Transformer targets.","key_machinery":"The carrying mechanism is the CWT transformation $T(x, n, N, s_{max}, k, r)$: the image is cut into $n \\times n$ non-overlapping blocks; each block is shrunk by a random factor $s_{i,j}$ drawn uniformly from $[1, s_{max}]$, then enlarged by the same factor via bilinear interpolation; $k$ randomly chosen blocks are also rotated by an angle $r_{i,j}$ drawn uniformly from $(-r_{max}, r_{max})$; everything is cropped back to original shape and reassembled; and the gradient of $N$ such transformed copies is averaged inside the momentum-based attack loop. The named steps that carry the argument are pre-interpolation (the shrink before the enlarge, which the paper says removes redundant features) and selective rotation (limiting rotations to $k$ blocks to avoid the information loss of rotating everything). The ablations show attack success depends on block count, scale bound, rotation bound, number of rotated blocks, number of copies, and on the pre-interpolation step, which is what links the mechanism to the claimed effect.","core_discovery":"The central discovery is that block-wise interpolation with selective rotation, not global image transformation, decides whether an adversarial perturbation generated on one model will fool another. CWT partitions an image into a grid, applies a random shrink-then-enlarge interpolation to each block, rotates a subset of blocks by a small random angle, and averages gradients over twenty transformed copies inside MI-FGSM. The paper argues that this makes a single surrogate model attend to diverse regions of the object, so the resulting perturbation covers the regions of interest for many architectures at once. It reports that this design beats the strongest block-based baseline BSR by roughly three to five points in mean attack success rate, with lower standard deviation, across eight CNN and Transformer models and against adversarial training, high-level denoisers, randomized smoothing, and diffusion purification.","pith_inferences":["Beyond the paper, the attention-diversification claim suggests a measurable design criterion for transfer attacks: transformed inputs should be chosen to maximize how much of the object a surrogate's attention map covers, and that coverage could be scored quantitatively instead of by eye.","Beyond the paper, the largest reported cross-architecture gains (CNN surrogates to Transformer targets) suggest that attention distance between architecture families is the operative quantity, so an experiment that varies architectural similarity in a controlled way would sharpen the hypothesis.","Beyond the paper, the tuned hyperparameters ($2\\times2$ blocks, 1.3 max scale, 26 degrees rotation, 2 rotated blocks) were selected on ImageNet; if the mechanism is attention-driven, the optimal grid size and scale should shift with input resolution and object size, a testable prediction on other datasets."],"forward_implications":["CWT's reported mean attack success rate is roughly three to five percentage points above BSR's, with a lower standard deviation, across the reported CNN and Transformer surrogate/target pairs.","Because CWT needs only the surrogate model's gradient and no target-model parameters, it can replace DIM, BSR, or other input transformations inside black-box transfer attacks.","The reported gains persist against adversarial training, the high-level denoiser, randomized smoothing, and diffusion purification, so the benefit is not confined to undefended ImageNet classifiers.","The ablations tie the gain to the CWT-specific choices: performance degrades when the image is treated as a single block, when more than a few blocks are rotated, when the scale factor exceeds about 1.3, or when the pre-interpolation step is removed."],"supporting_citations":[{"why":"Supplies MI-FGSM, the momentum-based attack loop into which CWT is plugged and that all compared methods share.","marker":"[4]"},{"why":"The closest block-based prior (block shuffle and rotation) that CWT directly extends and must beat in the reported comparisons.","marker":"[39]"},{"why":"Establishes the input-diversity transformation baseline that CWT contrasts with, since CWT's scaling is block-wise rather than global.","marker":"[50]"},{"why":"Supplies the class-activation heatmaps used to argue that CWT shifts a surrogate model's attention across object regions.","marker":"[34]"},{"why":"Supplies the shared-latent-space premise that explains why diverse input transformations should improve transferability.","marker":"[16]"},{"why":"Supports the premise that models, like humans, attend to larger image regions, motivating the zoom-in step in CWT.","marker":"[55]"}],"fun_headline_variants":["Rotating and resizing blocks boosts attack transfer","CWT: block-wise transform improves cross-model attacks","Block interpolation and rotation lift transfer attack success","Transform blocks to fool more models: CWT","Component-wise transformation raises adversarial transfer"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the transferability gain comes from making one surrogate model attend to diverse object regions, a premise the paper supports with qualitative attention heatmaps rather than a cause-and-effect experiment.","fun_headline_variants_meta":{"raw":{"variants":["Rotating and resizing blocks boosts attack transfer","CWT: block-wise transform improves cross-model attacks","Block interpolation and rotation lift transfer attack success","Transform blocks to fool more models: CWT","Component-wise transformation raises adversarial transfer"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00052,"raw_usage":{"total_tokens":2484,"prompt_tokens":875,"completion_tokens":1609,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":491,"completion_tokens_details":{"reasoning_tokens":1541}},"tokens_in":491,"tokens_out":1609,"duration_ms":12102,"temperature":1.0,"reasoning_tokens":1541,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T17:43:37.412378+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A matched control that uses the same number of random block-wise scale-and-rotate operations but omits the pre-interpolation shrink-then-enlarge pair and the selective-rotation limit would settle the mechanism: if it matches CWT's attack success rates, attention diversification is not the operative cause.","supporting_citations":[{"cited_title":"Boosting adversarial at- tacks with momentum","cited_arxiv_id":null,"evidence_quote":"Supplies MI-FGSM, the momentum-based attack loop into which CWT is plugged and that all compared methods share."},{"cited_title":"Boosting adversarial transferability by block shuffle and rotation","cited_arxiv_id":null,"evidence_quote":"The closest block-based prior (block shuffle and rotation) that CWT directly extends and must beat in the reported comparisons."},{"cited_title":"Improving transferabil- ity of adversarial examples with input diversity","cited_arxiv_id":null,"evidence_quote":"Establishes the input-diversity transformation baseline that CWT contrasts with, since CWT's scaling is block-wise rather than global."}],"review_version":1}