{"id":"7c429bae-9f54-4ed7-bf44-a7f604667895","arxiv_id":"2506.18134","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A detector-guided adversarial diffusion attacker synthesizes polyp-like false positives that, when added to training data, improve polyp detector F1 by up to 3.9 percentage points.","lead":"A new pipeline generates false positive examples for polyp detection by using a diffusion model that is guided by a detector's own errors. The goal is to train detectors on these challenging negatives so they make fewer mistakes during real colonoscopy.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported F1 gains may be inflated by test-informed selection of the attack region b; the paper never specifies how b is chosen, so the central claim is not yet auditable.","rationale":"The strongest claim is an empirical F1 improvement, so the most load-bearing assumption is that the experimental protocol isolates the method's contribution from test-set information. The paper's own description makes b the linchpin: Eq. (4) attacks the detector inside b, and Eq. (6) inpaints exactly that region. If b is chosen with knowledge of the test distribution, the augmented training set is tailored to the test set and the reported gain is not evidence for the method. The reader's weakest assumption already identified the unspecified b-selection protocol and the transfer risk; this stress-test sharpens it into a concrete leakage mechanism and a concrete rerun. I do not see an internal contradiction in the method itself, and the ablation in Table 2 does suggest DADA adds value over BG-De alone. The primary problem is auditability of the experimental protocol. The reader's CONDITIONAL verdict is therefore appropriate: the paper should be accepted only if the authors disclose b selection, run a training-only b protocol, and report variance. No change to the reader's verdict is needed.","tokens_in":8107,"tokens_out":10485,"duration_ms":121630,"concrete_test":"Run the full Kvasir pipeline with the released code, replacing the (unspecified) b-selection with a fixed training-only rule: for each training image, draw b uniformly at random among boxes matching the size distribution of GT boxes, restricted to regions that do not overlap any GT box. Train YOLO and DETR with the resulting augmented data, evaluate on the standard test split, repeat with three seeds, and report mean±std. If the mean F1 gain over the original baseline falls below the claimed at least 2.6 points, or if inspecting the released code shows that the original b was chosen using test-set false-positive locations, then the central claim is not supported. A second arm should choose b as the lowest-confidence background region in each training image to separate generic inpainting value from adversarial targeting.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that DADA-generated false positives improve detector F1 by at least 2.6/2.7 points. This claim rests on the choice of the 'user-defined bounding box b' in Sec. 2.2-2.3: b is the illusory GT box attacked in Eq. (4) and the inpainted region in Eq. (6), so it fully determines what each augmented sample looks like and where the detector is pushed to err. The experimental section (Sec. 3.2) gives hyperparameters for BG-De and alpha but no protocol for selecting b on either dataset, and no statement that b is chosen from training/validation information only. If b was selected by inspecting where the baseline detector produces false positives on the test split, or by placing boxes on test-image background regions that resemble the test distribution, then part or all of the 2.6/2.7 gain is data leakage rather than a property of the synthesis method. Even absent intentional leakage, the omission makes the result non-reproducible: a different user-defined b could produce a different F1 delta. The reader's transfer concern is well placed, but the concrete missing link is the b-selection protocol, which is more directly tied to the claimed numbers than alpha tuning or the absent real-negative baseline.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a detector-guided adversarial diffusion framework (DADA) for synthesizing targeted false-positive samples to improve polyp detection. The method couples a background-only denoising diffusion model (BG-De), trained with a regional noise-matching loss that masks polyp ground-truth boxes, with an adversarial attacker that perturbs the denoising trajectory at each step to induce a pre-trained detector to predict a false positive in a user-specified bounding box. An inpainting strategy preserves real-image context outside the attacked region. Experiments on Kvasir and an in-house dataset with YOLO and DETR detectors report F1 improvements of at least 2.6 and 2.7 points over baselines, plus ablations showing that both BG-De and DADA are needed. The paper also studies the perturbation step size alpha via FID and a false-positive generation rate metric.","tokens_in":8288,"tokens_out":4150,"duration_ms":40775,"significance":"If validated, the work addresses a practically important problem: reducing false positives in computer-aided polyp detection, where excessive alerts disrupt clinical workflow. The formulation in Eqs. (1)-(6) is coherent, and the two-component design is well motivated and clearly supported by the ablation of Table 2 as an internal consistency check. The paper also includes experiments on two datasets and two detector architectures, compares against two adversarial-attack and two inpainting baselines, and announces public code. These are genuine strengths. However, the central empirical claim is compromised by the absence of a protocol for selecting the attack region b and by test-set-informed hyperparameter selection, as detailed below. The reported gains are therefore not yet fully auditable.","major_comments":[{"comment":"The central claim depends on the user-defined bounding box b, but the paper never specifies how b is selected on either dataset. b is the illusory ground-truth box in Eq. (4) and the inpainted region in Eq. (6), so it fully determines the spatial location and visual content of each generated false positive. There is no statement that b is chosen from training or validation information only, and no description of the selection protocol (e.g., random background crops, a fixed grid, or boxes placed at detector failure locations on the training set). If b was chosen by inspecting where the baseline detector produces false positives on the test split, the reported F1 gains in Table 1 would reflect test-information leakage rather than a property of the synthesis method. The authors must specify the exact protocol and confirm that no test-set information is used.","section":"Sec. 2.2-2.3 and Sec. 3.2"},{"comment":"The perturbation step size alpha is selected by maximizing F1 on the test set. Table 3 reports F1 values for each alpha, and the chosen alpha=0.003 yields exactly the 'Ours' F1 values in Table 1 (0.969 on Kvasir, 0.891 on the in-house dataset). This is test-set hyperparameter tuning, which inflates reported performance and makes the comparison with baselines unfair, since the baselines are not tuned in the same way. The authors should select alpha on the validation split (the 8:1:1 split already provides one) and report the resulting test-set numbers. Additionally, no error bars, confidence intervals, or multiple-seed runs are reported anywhere in Tables 1-3, so it is impossible to assess whether the 2.6/2.7-point gaps exceed run-to-run variance.","section":"Sec. 3.5 and Table 3"},{"comment":"The 'no DADA, no BG-De' row in the ablation Table 2 should reproduce the baseline in Table 1 under the same setting (no augmented data), but it does not: YOLO F1 is 0.937 in Table 2 versus 0.941 in Table 1, and DETR F1 is 0.897 versus 0.901. This discrepancy is unexplained and undermines the internal consistency of the ablation. The authors should clarify what differs between the two configurations (e.g., retraining with a different seed or a different data split) and report consistent baseline numbers.","section":"Table 1 vs. Table 2"},{"comment":"No baseline that augments the training set with real negative images or ordinary synthesized negatives at matched volume is included. The comparisons are limited to adversarial-attack methods (APGD, FAB) and inpainting methods (Repaint, LaMa). Without a simple real-negative augmentation control, the F1 gains in Table 1 may be explained by adding more negative training examples in general rather than by the targeted false-positive synthesis mechanism specifically. Adding such a baseline (e.g., augmenting each training image with a real non-polyp background patch or a randomly sampled negative image) would directly test the claimed mechanism.","section":"Sec. 3.3"},{"comment":"The False Positive Generation Rate (FPGR) metric used to justify the choice of alpha is not defined with enough precision. 'The proportion of generated images causing false positives' requires specifying which detector is used, what confidence threshold is applied, and whether the evaluation is done on the teacher detector or the final trained detector. Without this information, the metric is not reproducible and cannot support the hyperparameter comparison in Table 3.","section":"Sec. 3.5"}],"minor_comments":[{"comment":"The table caption contains a typo: 'T able 1' should be 'Table 1'.","section":"Table 1"},{"comment":"The method label 'F AB' should be 'FAB' for consistency with the reference list.","section":"Table 1"},{"comment":"The detector is labeled 'Detr' in the figure; for consistency with the text it should be 'DETR'.","section":"Fig. 1"},{"comment":"The sentence 'with1assigned to pixels inside' is missing a whitespace after 'with'; it should read 'with 1 assigned'.","section":"Sec. 2.1"},{"comment":"The text consistently calls the second dataset 'in-house dataset', but the caption of Table 1 calls it 'private dataset'; the terminology should be unified.","section":"Sec. 3.1 and Table 1"},{"comment":"The paper states 'we set the denoising steps to 1,000' for inference but does not specify the number of sampling steps used for the inpainting variants; clarifying this would improve reproducibility.","section":"Sec. 3.2"}],"recommendation":"major_revision","confidential_remarks":"The most serious issue is the completely unspecified selection protocol for the attack region b. Since b determines what each augmented sample looks like and where the detector is pushed to err, the F1 gains in Table 1 cannot be interpreted without this protocol. The test-set selection of alpha in Sec. 3.5 is also a clear correctness concern. If the authors can provide a b-selection protocol that uses only training/validation information, reselect alpha on a validation split, and report error bars or multiple seeds, the central claim would become much more credible. The in-house dataset is private, which further elevates the importance of precise experimental protocols and reproducibility details."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper does one genuinely new thing, and it's worth knowing about: it uses a background-only diffusion model plus detector-guided adversarial perturbations to synthesize false positives for polyp detection, and shows that adding them to training improves F1 by about 2.6-2.7 points. The pipeline is plausible, and the ablation study gives real evidence that both components matter — the regional noise masking (Eq. 1) is a clean way to keep polyp information out of the negative generator, and the DADA loop that backpropagates detection loss through the denoising steps is a reasonable extension of PGD-style attacks to generation. The inpainting formulation in Eq. (6) is also sensible.\n\nThe soft spot is the experimental reporting, and it's not small. The 'user-defined bounding box b' in Secs. 2.2-2.3 determines both the attack region and the inpainted region, so it fully controls where the detector is pushed to err. The paper never says how b is selected on Kvasir or the in-house set. If b was chosen by inspecting where the baseline detector produces false positives on the test split, or by placing boxes on test-image backgrounds that resemble the test distribution, the reported gain is partly leakage rather than a property of the synthesis method. Without a stated protocol, the headline number is not auditable. The same applies, to a lesser degree, to alpha: Sec. 3.5 picks alpha=0.003 because it maximizes test-set F1. That is test-set tuning. Add no error bars and no multiple-seed runs, and we can't tell how stable the 2.6/2.7-point gain is. The comparison also misses a simple real-negative baseline — adding real background crops — so we don't know how much of the gain comes from targeted synthesis versus just having more negative data. The 'new paradigm' framing is overclaimed; this is a new application of known techniques, not a conceptual shift.\n\nThe stress-test note is right: the b-selection gap is more directly tied to the claimed numbers than alpha tuning or the missing baseline. On reading, I don't think the central idea is circular or wrong; it's just under-specified. For researchers working on medical image detection or synthetic data augmentation, this is worth engaging with — the core idea could transfer to other detection tasks where false positives are rare and costly. But the claims need another round of experimental rigor. This paper deserves a serious referee, but only with a request for a clear b-selection protocol, a validation-based alpha choice, error bars, and the real-negative baseline. I'd bring it to a reading group as a case study in how synthetic-data papers can leak test information.","headline":"Novel combination of background-only diffusion and detector-guided attacks for synthesizing false positives; the idea is promising but the evaluation is not yet auditable because the attack region b is undisclosed and alpha is tuned on the test split.","tokens_in":8884,"tokens_out":2852,"would_cite":false,"duration_ms":28759,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Synthesizing detector-confusing negatives—rather than more polyp positives—teaches YOLO and DETR to reject polyp lookalikes, improving F1-score by at least 2.6% on Kvasir and 2.7% on an in-house dataset.","keywords":["adversarial diffusion","false positive synthesis","polyp detection","data augmentation","denoising diffusion probabilistic model","detector guidance","colonoscopy","colorectal cancer screening"],"falsifier":"Run a DADA-augmented detector on a held-out set of real, polyp-free colonoscopy frames recorded with a different endoscope; the central claim fails if the detector's false-positive rate is not lower than that of a baseline detector trained without DADA data, because the synthetic negatives would have taught it only the teacher's specific confusers, not the real ones.","tokens_in":7846,"feed_emoji":"🩺","tokens_out":6008,"duration_ms":58936,"temperature":0.7,"pith_summary":"The paper argues that the false positives that plague automated polyp detection can be treated as a synthesis problem rather than a filtering problem. It builds a background-only diffusion model that learns what normal colonoscopy tissue looks like, then adds a detector-guided adversarial module that nudges the denoising process toward polyp-like patterns that fool a trained detector. The resulting images are used as extra training negatives, teaching YOLO and DETR detectors to reject polyp-lookalikes instead of flagging them. On the Kvasir benchmark and an in-house clinical dataset, the augmented detectors improve F1-score by at least 2.6 and 2.7 percentage points over baselines, which matters because reducing false positives lowers unnecessary interventions and clinician alarm fatigue.","feed_headline":"Diffusion attacker cuts false positives, lifts polyp F1 at least 2.6%","feed_subtitle":"Targeted synthetic negatives teach polyp detectors to ignore lookalike tissue, with no extra data collection.","key_machinery":"The central object is the Detector-guided Adversarial Diffusion Attacker (DADA), which maintains a perturbation variable $\\eta_t$ injected at each denoising step of a background-only DDPM. BG-De masks out polyp bounding boxes during training so it models only non-polyp backgrounds, and DADA backpropagates the detector's detection loss through the denoising trajectory, updating $\\eta_t$ by sign-gradient descent to steer generation toward patterns that trigger a false positive in a user-defined box $b$. An inpainting step keeps the surrounding context from the real image so the synthesized confusers stay anatomically coherent. Together the modules convert ordinary backgrounds into detector-confusing false positives.","core_discovery":"The central claim is that synthesizing high-value false positives—negatives that resemble polyps closely enough to provoke a detector response—is a more effective use of generative data augmentation than generating more polyp positives or generic backgrounds. The paper demonstrates this with DADA, which couples a negative-centric DDPM called BG-De with an adversarial attacker that maximizes the detector's classification and localization loss in a user-specified region. The mechanism is the first application of adversarial diffusion to lesion detection, and the experimental payoff is that both a CNN detector (YOLO) and a transformer detector (DETR) gain precision and recall when trained on the synthesized confusers, with the largest gains on detector precision.","pith_inferences":["Beyond the paper: if the adversarial patterns transfer across endoscope types and bowel-preparation protocols, DADA-style synthesis could be used as a controllable augmentation tool for other lesion-detection tasks where false positives are costly, such as lung nodules or skin lesions.","Beyond the paper: the user-specified attack region $b$ could be chosen adversarially at inference time to probe a deployed detector for hallucination-prone areas, turning the attacker into a real-time reliability monitor.","Beyond the paper: the paper's FPGR and FID measurements suggest a tunable difficulty-realism trade-off; future work could build a calibration curve that lets clinicians set the perturbation strength to a clinically acceptable false-positive rate.","Beyond the paper: the teacher-detector dependence implies that the method may need re-tuning when the final deployment detector differs from the attacked detector, since the synthesized confusers are tailored to the teacher's decision boundary."],"forward_implications":["Detectors trained with DADA-augmented data improve F1 by at least 2.6% on Kvasir and 2.7% on the in-house dataset over baselines, for both YOLO and DETR backbones.","Both components are necessary: ablations show that BG-De alone gives limited gains, DADA alone degrades performance by introducing label noise, and only their joint use yields the best results.","Larger perturbation step sizes $\\alpha$ raise the false-positive generation rate but lower image fidelity, and an intermediate $\\alpha=0.003$ gives the best detector F1-score.","The framework requires no extra data collection because it uses only polyp images with standard ground-truth bounding boxes, which are already available in detection datasets."],"supporting_citations":[{"why":"Supplies the denoising diffusion probabilistic model that BG-De adapts with regional masking.","marker":"[19]"},{"why":"Provides the adversarial perturbation principle and sign-gradient update that DADA uses to confuse the detector.","marker":"[20]"},{"why":"Defines the DETR detector that DADA attacks and that is evaluated in the experiments.","marker":"[23]"},{"why":"Defines the YOLO detector that DADA attacks and that is evaluated in the experiments.","marker":"[25]"},{"why":"Provides the Kvasir polyp dataset used for training, validation, and testing.","marker":"[24]"},{"why":"Serves as an adversarial-attack baseline compared in Table 1.","marker":"[26]"},{"why":"Serves as an adversarial-attack baseline compared in Table 1.","marker":"[27]"},{"why":"Serves as an inpainting baseline compared in Table 1.","marker":"[28]"},{"why":"Serves as an inpainting baseline compared in Table 1.","marker":"[29]"}],"fun_headline_variants":["Adversarial diffusion creates false positives to harden polyp detectors","Detector-guided attack synthesizes confusing negatives for polyp AI","Synthetic lookalike lesions boost polyp detection F1 by 2.6%","Targeted false positive synthesis improves polyp detector robustness","New adversarial diffusion method sharpens polyp detection in screening"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the adversarial patterns found against the teacher detector in a user-chosen attack region also reflect the real false positives that occur in the held-out test distribution; if the attack region or the teacher's failure modes are unrepresentative, the precision gains will not generalize.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial diffusion creates false positives to harden polyp detectors","Detector-guided attack synthesizes confusing negatives for polyp AI","Synthetic lookalike lesions boost polyp detection F1 by 2.6%","Targeted false positive synthesis improves polyp detector robustness","New adversarial diffusion method sharpens polyp detection in screening"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000344,"raw_usage":{"total_tokens":1899,"prompt_tokens":967,"completion_tokens":932,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":583,"completion_tokens_details":{"reasoning_tokens":847}},"tokens_in":583,"tokens_out":932,"duration_ms":9852,"temperature":1.0,"reasoning_tokens":847,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:23:02.062373+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a DADA-augmented detector on a held-out set of real, polyp-free colonoscopy frames recorded with a different endoscope; the central claim fails if the detector's false-positive rate is not lower than that of a baseline detector trained without DADA data, because the synthetic negatives would have taught it only the teacher's specific confusers, not the real ones.","supporting_citations":[{"cited_title":"Denoising diffusion probabilistic mod- els.Advances in neural information processing systems, 33:6840–6851, 2020","cited_arxiv_id":null,"evidence_quote":"Supplies the denoising diffusion probabilistic model that BG-De adapts with regional masking."},{"cited_title":"ultra- lytics/yolov5: v6","cited_arxiv_id":null,"evidence_quote":"Defines the YOLO detector that DADA attacks and that is evaluated in the experiments."},{"cited_title":"Kvasir-seg: A segmented polyp dataset","cited_arxiv_id":null,"evidence_quote":"Provides the Kvasir polyp dataset used for training, validation, and testing."},{"cited_title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","cited_arxiv_id":null,"evidence_quote":"Serves as an adversarial-attack baseline compared in Table 1."},{"cited_title":"Repaint: Inpainting using denoising diffusion probabilistic mod- els","cited_arxiv_id":null,"evidence_quote":"Serves as an inpainting baseline compared in Table 1."},{"cited_title":"Resolution-robust large mask inpainting with fourier con- volutions","cited_arxiv_id":null,"evidence_quote":"Serves as an inpainting baseline compared in Table 1."}],"review_version":1}