{"id":"7f318d77-2a6c-49a8-a1f4-6db8d8832ba0","arxiv_id":"2504.20077","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Training on Canny edge maps improves robustness to FGSM adversarial noise compared to training on raw images, though retraining on clean plus noisy raw images recovers more accuracy.","lead":"This paper tests whether training image classifiers on edge-detected versions of images makes them more resistant to a simple type of adversarial attack called FGSM. Using brain tumor and COVID X-ray datasets, the authors report that edge-based models suffer smaller accuracy drops under attack than models trained on raw images.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Edge robustness result may reflect gradient masking: edge models are attacked on edge maps, not through the non-differentiable Canny transform from raw images.","rationale":"The reader's weakest assumption identifies exactly the same load-bearing concern: the edge model is only evaluated against FGSM noise generated directly on edge maps, and the non-differentiability of Canny means the attack does not adapt to the full raw-image-to-edge pipeline. This is the most serious threat to the central claim because, if an adaptive attack collapses the edge advantage, the main contribution of the paper becomes a demonstration of gradient masking rather than a genuine robustness property of edge features. The paper's tables are internally consistent and the narrow empirical finding (edge models withstand same-representation FGSM better than raw models withstand raw FGSM) is plausible, so I do not propose changing the reader's CONDITIONAL verdict: the paper should be accepted only if the authors add adaptive attack experiments or explicitly narrow the claim to same-representation FGSM noise. My concrete test would settle the concern by comparing adaptive PGD accuracy on raw inputs; if the edge model retains a substantial accuracy advantage under such attacks, the concern is resolved. The paper deserves credit for reporting clean and noisy accuracies across six architectures and two medical datasets, but the missing adaptive attack is sufficiently central that the current evidence cannot support the broad robustness claim as stated.","tokens_in":10864,"tokens_out":4928,"duration_ms":55446,"concrete_test":"Run a PGD attack (e.g., 20 iterations, same epsilon used in Table 3) on raw test images against each edge-trained model, computing gradients through a differentiable surrogate of Canny edge detection: use Sobel filters for gradient magnitude and a sigmoid with temperature for thresholding (or a straight-through estimator for the binary threshold). Evaluate the edge model's accuracy on these adaptively perturbed raw images after Canny extraction, and compare against the raw model under the same raw PGD attack. If the edge model's noisy accuracy falls to within a few points of the raw model's accuracy, the robustness advantage is an artifact of the non-adaptive, edge-space attack surface.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central comparison in Tables 3 and 4 is asymmetrical. Raw-trained models are attacked with FGSM noise computed on raw images, while edge-trained models are attacked with FGSM noise computed on binary edge maps. Because Canny edge detection involves non-differentiable operations (gradient magnitude thresholding, non-maximum suppression, hysteresis), the gradient used to attack the edge model is defined only with respect to the edge representation, not with respect to a raw input. In a realistic deployment, an adversary would perturb the raw image and then apply edge extraction; the paper never tests this. The edge model's apparent robustness may therefore be an artifact of an attack surface that is weakened by gradient masking: the attacker is forced to operate in a space where gradients are saturated or uninformative, rather than because edge features are inherently more robust. The paper itself cites Athalye et al. (reference [2]) on obfuscated gradients but does not run any adaptive attack or even a cross-domain attack (e.g., raw FGSM noise from the raw model, then edge-extracted) to check whether the advantage persists. Until such a test is performed, the headline claim 'training on edge images is more resilient against adversarial attacks' is not established for attacks on natural images.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the effect of FGSM adversarial noise on medical image classifiers and proposes training on Canny edge maps as a robustness-improving representation. The authors train CNN, ResNet50, VGG16, VGG19, InceptionV3, and DenseNet on two datasets (brain tumor MRI and COVID X-ray), evaluate clean and FGSM-noisy accuracy, and then retrain models on a 1:1 mix of clean and noisy images. Their main empirical finding is that models trained on Canny edge maps retain higher accuracy under FGSM noise than models trained on raw images (Tables 3 and 4), while retraining improves raw-image models more in absolute terms but leaves edge-trained models more robust in most cases. The paper concludes that edge-based learning improves resilience to adversarial perturbations.","tokens_in":11068,"tokens_out":4713,"duration_ms":51967,"significance":"If the robustness advantage of edge-based training holds under realistic attack models, the result would be a lightweight, architecture-agnostic preprocessing defense, which could be attractive in medical imaging settings. The paper has concrete strengths: it surveys six architectures over two datasets, reports cross-model fooling rates, and includes a retraining comparison with a fixed dataset size. The contribution is empirical and reproducible in principle, although no code is provided. The central claim is not yet established, however, because the evaluation attacks each model in its own input representation and never tests an adaptive adversary that perturbs raw images before edge extraction. The significance is therefore conditional on whether the edge advantage survives such a test.","major_comments":[{"comment":"The central comparison is asymmetrical. Raw-trained models are attacked with FGSM noise computed on raw images, while edge-trained models are attacked with FGSM noise computed on pre-extracted edge maps. Because Canny edge detection involves non-differentiable operations (gradient magnitude thresholding, non-maximum suppression, and hysteresis), the attack on the edge model does not optimize over perturbations to the raw image that would survive edge extraction. A deployment adversary would perturb the raw input before the edge transform is applied, and this scenario is never tested. This is the gradient-masking situation discussed in the paper's own reference [2], yet no adaptive attack, no differentiable approximation of the preprocessing, and no cross-representation transfer attack is reported. Until the edge model is evaluated under attacks that account for the full raw-image-to-edge pipeline, the headline claim that edge-based training is more resilient to adversarial attacks is not established for natural-image inputs.","section":"§4.1, Tables 3 and 4"},{"comment":"No estimate of variability is reported, even though the text states that 'accuracy varied slightly between runs.' Several of the headline margins are small: for ResNet50 on Brain Tumor, the noisy accuracy is 67% on original versus 66% on edges, and after retraining it is 70% versus 72% (Table 3). These differences could be within run-to-run variation. The authors should report means and standard deviations over multiple seeds, or confidence intervals, or paired significance tests for the main comparisons in Tables 3 and 4. Without this, the quantitative strength of the central claim is difficult to assess.","section":"§4.1, §4.2, Tables 3 and 4"},{"comment":"The FGSM perturbation magnitude is inconsistent across the paper: the accuracy experiments in §4.1 use an epsilon of 0.015, the visualization experiment in §4.1 uses 0.04, and Fig. 1 uses 0.05. Robustness results depend strongly on epsilon, so every reported accuracy needs its epsilon stated, and the main comparisons in Tables 3 and 4 should be run at a single epsilon or, preferably, across a sweep of epsilon values to show that the edge advantage is not an artifact of one perturbation magnitude.","section":"§4.1, §2, Fig. 1"}],"minor_comments":[{"comment":"The text says adversarial noise introduces 'non important pixels, particularly around the edges,' while the paper's hypothesis is that edges remain relatively stable; these statements should be reconciled, ideally with quantitative pixel-level measurements rather than only visual examples.","section":"§2, Fig. 1"},{"comment":"The paper repeatedly refers to 'pixel-wise analysis,' but the supporting evidence is qualitative figure inspection; actual pixel statistics, such as the number of changed edge pixels or the distribution of perturbation magnitudes on edge versus non-edge regions, would make the claim testable.","section":"§4.1, 'Visualizing noise effects'"},{"comment":"There are formatting typos in the headers ('T raining', 'Model T raining') that should be corrected.","section":"Tables 3 and 4"},{"comment":"Reference [29] contains a typo, 'exa mples,' and the reference list would benefit from a consistency pass.","section":"References"},{"comment":"Details of the retraining subset selection, dataset splits, and random seeds are not specified; providing these would improve reproducibility.","section":"§4.1"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe headline claim — training on Canny edges makes models more robust to FGSM — is plausible but not established the way they've tested it. The central comparison is unbalanced: raw models are attacked with noise computed on raw images, edge models with noise computed on edge maps. Because Canny involves thresholding and non-maximum suppression, the gradient used to attack the edge model is not defined with respect to the raw input. The apparent robustness may largely be gradient masking, a defense mode the paper itself cites (Athalye et al.) but never tests against.\n\nThat said, the paper does real empirical work. Six architectures, two medical datasets, clear tables. The retraining result — raw models gain more in absolute accuracy but edge models stay ahead — is honestly reported and keeps the paper from overclaiming in that section. The idea that edges are relatively stable under small perturbations is reasonable and worth a careful test.\n\nThe soft spots are concentrated in the experimental design. One: no adaptive attack. The right experiment is to generate FGSM noise on the raw image with knowledge of the edge transform (or at least cross-model: noise from the raw model, then edge-extract) and see if the advantage persists. Two: no error bars or confidence intervals, and the paper mentions accuracy varied slightly between runs without quantifying it. Three: epsilon values are inconsistent — 0.015 in the main brain experiment, 0.04 in the visualization, 0.05 in Figure 1. That makes quantitative comparison across figures unreliable. Four: PGD is mentioned in the intro but never used; a single-step attack with a saturating preprocessing is exactly the scenario where robustness claims collapse.\n\nThe narrower claim — if you attack the representation the model was trained on, edge-trained models suffer less — holds as far as the tables go. But the paper states a broader conclusion, that edge-based learning improves resilience to adversarial perturbations on natural images. That needs the adaptive test.\n\nWho is this for? Someone studying the pitfalls of non-differentiable preprocessing as a defense, or medical imaging robustness. It's a useful negative-ish example, not a contribution that changes practice. I'd send it to reviewers if the authors add an adaptive attack and tighten the reporting. As is, desk reject for a strong venue, but it deserves a serious referee at a workshop or lower-tier journal.","headline":"A plausible but under-tested claim: edge-trained models look robust against FGSM only because the attack is run on edge maps, not through the non-differentiable Canny transform.","tokens_in":11612,"tokens_out":2414,"would_cite":false,"duration_ms":23630,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Training image classifiers on Canny edge maps makes them markedly more robust to FGSM adversarial noise than training on raw images.","keywords":["adversarial noise","FGSM","Canny edge detection","edge-based learning","image classification robustness","brain tumor MRI","COVID-19 chest X-ray"],"falsifier":"Run the same six-model comparison with PGD, or with FGSM noise computed through a differentiable approximation of the edge-extraction pipeline, at the same epsilon values; if edge-trained noisy accuracy falls to or below raw-trained accuracy, the claimed edge robustness is an artifact of the non-adaptive attack.","tokens_in":10663,"feed_emoji":"🛡️","tokens_out":6945,"duration_ms":65987,"temperature":0.7,"pith_summary":"This paper asks whether the structural edges of an image survive adversarial perturbation better than the full image, and whether training solely on edges therefore makes classifiers harder to fool. The authors report that, across six architectures and two medical imaging datasets, models trained on Canny edge maps keep far higher accuracy on FGSM-perturbed test images than models trained on raw pixels—for instance, a CNN on brain tumor data holds 86% versus 56%, and on COVID X-rays 91% versus 68%. Retraining on a 1:1 mix of clean and noisy images improves both representations, with raw-image models recovering more absolute accuracy while edge models stay more robust. The paper argues that FGSM noise exploits non-edge, texture-rich regions far more than it disrupts edge structure, so edge-based learning is a useful defense.","feed_headline":"Edges make classifiers harder to fool by adversarial noise","feed_subtitle":"On brain-tumor and COVID images, edge-trained CNNs hold 86–91% accuracy where raw models fall to 56–68%.","key_machinery":"The load-bearing object is the Canny edge map, a binary image of sharp intensity boundaries produced by Gaussian smoothing, Sobel gradient magnitude computation, non-maximum suppression, and double thresholding. The paper converts each image to grayscale, applies Canny detection with threshold values 100 and 200, normalizes the binary map to $[0,1]$, and replicates it across three channels so standard architectures can consume it. This representation does the work of stripping away texture and color so that models learn from structure alone. The attack used to test robustness is FGSM, which adds $\\epsilon \\, \\mathrm{sign}(\\nabla_x J(\\theta, x, y))$ to the input; the paper's comparisons evaluate accuracy on clean and noisy versions of both raw and edge inputs.","core_discovery":"On its own terms, the central claim is that Canny edges are a more robust input representation for deep image classifiers under FGSM. The evidence is a systematic comparison in which models were trained and tested on two versions of the same data—original images and Canny edge maps—with adversarial noise added at small epsilon values. In nearly every row of the comparison tables, edge-trained accuracy on noisy test images exceeds raw-trained accuracy by a wide margin, and this holds on both the brain tumor and COVID datasets. Retraining on combined clean and noisy images raises noisy accuracy for both representations, but the edge-trained models continue to lead under noise; the raw-image models gain more in absolute points. Pixel-level visualizations show the perturbation is barely visible in raw images but clearly visible in edge maps, consistent with the claim that edges carry the structure the attack leaves intact.","pith_inferences":["The reported robustness may partly reflect attack non-adaptivity: Canny detection is non-differentiable, and FGSM noise is computed against the raw-image model, so the perturbation is not aligned to the edge-classifier loss. An adaptive PGD attack or a differentiable surrogate of the edge pipeline could erode the margin; the paper does not test this.","The same reasoning suggests a testable extension: jointly training on raw and edge channels, rather than either alone, should combine raw-image recoverability with edge robustness; the paper's own retraining numbers hint at this but the paper does not try it.","The argument that edges are 'stable' could be examined directly by measuring per-pixel perturbation magnitude on edge versus non-edge pixels under FGSM across many images; the paper shows visual evidence but does not quantify it."],"forward_implications":["For medical image classifiers operating under small bounded perturbations, edge-only training can preserve clinically relevant accuracy where raw-image training collapses—the reported margins are 30 points or more on the CNN.","Retraining on clean plus noisy images is a cheap, architecture-agnostic robustness boost: raw-image CNNs recovered 18 points on brain tumor and 8 points on COVID, while edge models stayed above 86% noisy accuracy.","Because FGSM noise is model-specific—noise from one architecture barely fools others—evaluating robustness requires specifying which model generated the noise; the paper's fooling-rate table provides a template for that comparison.","Edge-based representations can serve as a complement rather than a replacement: raw-image retraining recovers more absolute accuracy, suggesting that raw and edge inputs carry different useful signal."],"supporting_citations":[{"why":"Supplies the FGSM attack and the perturbation equation used to create noisy test images.","marker":"[10]"},{"why":"Supplies the Canny edge detection algorithm used to build the edge-based training and test sets.","marker":"[5]"},{"why":"Provides the brain tumor MRI dataset used in Experiment 1.","marker":"[13]"},{"why":"Provides the COVID-19 chest X-ray dataset used in Experiment 2.","marker":"[18,8,7,26]"},{"why":"Defines the CNN architecture that anchors the main accuracy comparisons and visualizations.","marker":"[20]"}],"fun_headline_variants":["Edge-trained CNNs resist FGSM noise better than raw images","Training on edges thwarts adversarial noise in medical imaging","Edge maps keep classifiers accurate under FGSM perturbations","Edges: the stable feature against adversarial image noise","Canny edges boost model robustness to adversarial attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that FGSM noise generated against the model under test is the relevant threat model, and that the drop in accuracy under that attack is the right measure of robustness.","fun_headline_variants_meta":{"raw":{"variants":["Edge-trained CNNs resist FGSM noise better than raw images","Training on edges thwarts adversarial noise in medical imaging","Edge maps keep classifiers accurate under FGSM perturbations","Edges: the stable feature against adversarial image noise","Canny edges boost model robustness to adversarial attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000228,"raw_usage":{"total_tokens":1476,"prompt_tokens":950,"completion_tokens":526,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":566,"completion_tokens_details":{"reasoning_tokens":448}},"tokens_in":566,"tokens_out":526,"duration_ms":5105,"temperature":1.0,"reasoning_tokens":448,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:25:01.009439+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same six-model comparison with PGD, or with FGSM noise computed through a differentiable approximation of the edge-extraction pipeline, at the same epsilon values; if edge-trained noisy accuracy falls to or below raw-trained accuracy, the claimed edge robustness is an artifact of the non-adaptive attack.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the brain tumor MRI dataset used in Experiment 1."}],"review_version":1}