{"id":"a27cf633-3272-4017-ae5e-35ed5c5078e0","arxiv_id":"2607.04145","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":2.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Halving the BIM step size each iteration (BinIM) yields stronger non-targeted ImageNet attacks than FGSM/BIM/VAM on three classifiers, with unsupported claims that this finds local minima.","lead":"The paper introduces Binary Iterative Method (BinIM), which halves the signed-gradient step size each iteration (with restarts) to craft non-targeted adversarial images. It reports stronger attacks than FGSM, BIM, and VAM on 1000 ImageNet images, but the binary-search optimality argument does not hold for non-convex network losses.","discovery_kind":"incremental","skeptic_critique":{"model":"grok-4.5","headline":"The binary-search optimality claim is false for non-convex NN losses, so BinIM is only an ad-hoc decreasing-step BIM variant whose empirical edge over weak baselines does not support the paper’s central technical claim.","rationale":"The reader correctly isolates the load-bearing false premise: the 1-D sorted-array model of ∇_x Loss that is required for the binary-search guarantee. That premise is stated in the Methodology section and illustrated in the Appendix figures; once it is removed, BinIM is merely BIM with a geometric step schedule and restarts. The reported numbers (Table 2: 0.009 vs BIM 0.0252 on Inception-v3) therefore cannot be attributed to any principled search advantage, and the absence of PGD-class baselines, error bars, and a precise hyper-parameter protocol already noted by the reader further weakens the residual empirical claim. No independent formal verification or stronger baselines appear in the manuscript, so the REJECT verdict stands. The concrete test above directly falsifies (or, if it succeeds, partially rehabilitates) the optimality argument without requiring new theory.","tokens_in":7999,"tokens_out":669,"duration_ms":5443,"concrete_test":"Implement Algorithm 1 exactly as written (same known classifier K = Inception-v3, same R/E, same initial eps) and also a pure BIM baseline that uses the identical total number of gradient steps but a constant eps_iter = eps/E (or a standard PGD schedule). Re-evaluate both on the same 1000 ImageNet images and report adversarial accuracy on Inception-v3/Inception-v2/ResNet-v2-152. If BinIM’s accuracy is not statistically better than the constant-step BIM (or than PGD with the same budget), the binary-search optimality claim is unsupported and the empirical edge disappears.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper’s strongest claim (Abstract; Tables 2 & 4) is that BinIM is a principled non-targeted attack that outperforms FGSM/BIM/VAM because binary search on eps_iter is guaranteed to approach local (or, in concave regions, global) minima of the attack objective. That guarantee rests on the explicit premise that ∇_x Loss “behaves like a sorted 1-D array (positive on one side, negative on the other)” so that the update eps_iter \to eps_iter/2 is binary search (Methodology paragraphs on binary search; Figure 3; Appendix Figures 4–5 and the O(log n) claim). Neural-network losses are high-dimensional and non-convex; the sign of the gradient along a single coordinate or along the signed-gradient direction does not form a sorted 1-D sequence, so the geometric schedule has no optimality property beyond ordinary step-size decay. Without that property the method collapses to BIM with restarts and a fixed geometric schedule, which is already known and does not justify the claimed superiority over ε-ball methods.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper proposes Binary Iterative Method (BinIM), a non-targeted gradient attack that starts from BIM and replaces a fixed step size with a geometric schedule eps_iter ← eps_iter/2, framed as binary search over a divide-and-conquer paradigm. The authors argue that ∇_x Loss behaves like a sorted 1-D array (positive on one side, negative on the other), so halving the step is guaranteed to approach a local (or, in concave regions, global) minimum of the attack objective, and that this is superior to ε-ball search used by FGSM, BIM, and VAM. On 1000 randomly sampled ImageNet images, attacks generated from Inception-v3 gradients are evaluated on Inception-v3, Inception-v2, and ResNet-v2-152; BinIM reports the lowest adversarial accuracy (0.009 on Inception-v3 vs BIM 0.0252, FGSM 0.356, VAM 0.628) and sample true-label probabilities driven near zero with wrong-class confidences up to ~1.0 (Tables 2 and 4).","tokens_in":8304,"tokens_out":1292,"duration_ms":14540,"significance":"A correctly justified, stronger non-targeted iterative attack would be useful for adversarial training and robustness evaluation. The reported numbers on Inception-v3 are competitive with the weak baselines shown. However, the claimed optimality rests on a false premise about the geometry of neural losses, so the method reduces to BIM with restarts and a fixed geometric step schedule—an already-known heuristic. Without a sound principle or comparisons to modern iterative attacks (PGD, MI-FGSM, etc.), the contribution does not advance the technical state of the art even if the empirical edge over FGSM/BIM/VAM holds on this subsample.","major_comments":[{"comment":"Methodology (paragraphs on binary search; Figure 3; Appendix Figures 4–5 and the O(log n) claim): The load-bearing premise is that ∇_x Loss “behaves like a sorted 1-D array” so that repeatedly setting eps_iter ← eps_iter/2 is binary search and is therefore guaranteed to approach a local (or, in concave regions, global) minimum. Neural-network losses are high-dimensional and non-convex; the sign of the gradient along the signed-gradient direction does not form a sorted 1-D sequence. The geometric schedule therefore has no optimality property beyond ordinary step-size decay. This premise is required for the claim that BinIM is principled rather than an ad-hoc decreasing-step BIM variant, and it is false.","section":"Methodology; Appendix"},{"comment":"Algorithm 1: The algorithm states “Update the eps_iter_r until binary search objective is maximised” but never defines that objective, the acceptance criterion, or how the best local minimum is selected across rounds. The only concrete update is eps_iter ← eps_iter/2 after a signed-gradient step. Without a defined search objective, the procedure is not binary search; it is BIM with a geometric schedule and optional restarts. The algorithm as written is incomplete and does not implement the claimed method.","section":"Algorithm 1"},{"comment":"Experiment / Table 2: Fair comparison requires matched budgets (same total iterations, same max L_∞ radius, same number of restarts). The paper does not report the values of eps, E, R, or the iteration counts used for FGSM/BIM/VAM. VAM results are missing for Inception-v2 and ResNet-v2-152. Related Work cites PGD and momentum iterative attack, yet neither is included as a baseline. The reported superiority is therefore only relative to weak or incompletely specified baselines and does not support the abstract claim of outperforming “all other gradient-based methods.”","section":"Experiment; Table 2"},{"comment":"Appendix (ε-ball vs binary search; Figures 4–5): The complexity comparison O(n) for ε-ball vs O(log n) for binary search is misapplied. Continuous adversarial optimization is not a discrete sorted-array search; the radius of an ε-ball is a constraint, not an unbounded sequential scan. The appendix therefore does not establish that BinIM is closer to a local minimum in the same number of epochs.","section":"Appendix"}],"minor_comments":[{"comment":"Numerous typos and grammar issues (e.g., “the useful of new”, “Please not”, “main contributions if are our paper”, “maxmima”, “misclassifciations”, “state-of-the neural networks”).","section":"Throughout"},{"comment":"Table 3 is referenced as sample outputs but is only a caption pair; no quantitative distortion metrics (L_∞, L_2, or perceptual) are reported for the modified images.","section":"Table 3"},{"comment":"Clean accuracies in Table 1 and the 1000-image subsample protocol are underspecified (which ImageNet split, preprocessing, whether labels match the pretrained models’ label space).","section":"Experiment; Table 1"},{"comment":"Related Work lists several attacks (JSMA, DeepFool, EAD, distributional attacks) that are never used in the experiments or discussed relative to BinIM.","section":"Related Work"}],"recommendation":"reject","confidential_remarks":"The central technical claim (binary-search optimality for non-convex NN losses) is incorrect and load-bearing; reframing as “BIM with geometric decay and restarts” would remove the paper’s claimed novelty. Scope and maturity appear below the bar for a serious ML venue even after major rewrite. Citation pattern is thin and dated relative to the iterative-attack literature."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The paper’s real content is a short empirical note: Basic Iterative Method with a geometric schedule (eps_iter halved each step) plus multi-round restarts, evaluated as a white-box non-targeted attack on 1000 ImageNet images. Tables 2 and 4 show lower accuracy and near-zero true-label probabilities on Inception-v3 versus FGSM, BIM and VAM; that is the only concrete result.\n\nWhat is new is only the named schedule and those numbers. The algorithm is BIM with a fixed decay and restarts—standard multi-start iterative attack practice. Related work already lists PGD, momentum iterative attacks and DeepFool, yet none of those stronger baselines appear. The writing is rough and the algorithm underspecified (the “binary search objective” is never defined).\n\nThe soft spot is load-bearing and not minor. The authors claim the schedule is principled binary search because ∇x Loss “behaves like a sorted 1-D array,” guaranteeing approach to local (or, in concave regions, global) minima and O(log n) superiority over ε-ball methods. That premise is false for high-dimensional non-convex neural losses; the sign pattern along the signed-gradient direction is not sorted. Without it, BinIM collapses to an ad-hoc decreasing-step BIM variant whose edge over the three weak baselines does not support the central technical claim. The appendix figures simply restate the same incorrect 1-D picture.\n\nThis is useful only to someone already collecting every white-box schedule for robustness testing; it does not introduce a new principle or a competitive evaluation. A serious editor would desk-reject rather than spend referee time: the optimality argument is claim-without-derivation and contradicts basic optimization facts, while the residual empirical contribution is too thin and unreproducible to salvage. I would not bring it to reading group or cite it.","headline":"BIM with geometric step decay and restarts, sold with a false binary-search optimality claim; thin empirical edge over weak baselines only.","tokens_in":8914,"tokens_out":464,"would_cite":false,"duration_ms":3606,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Binary Iterative Method finds stronger non-targeted adversarial examples than FGSM, BIM and VAM by repeatedly halving the step size to approach local loss minima.","keywords":["adversarial attacks","non-targeted attack","Binary Iterative Method","gradient-based attack","ImageNet","adversarial robustness","step-size search"],"falsifier":"If, on the same 1000 ImageNet images and identical iteration budget, a constant-step BIM or a simple linearly decaying step schedule matches or beats BinIM’s 0.009 adversarial accuracy and the extreme probability collapses shown in Table 4, the claimed advantage of the binary-search schedule is refuted.","tokens_in":8856,"feed_emoji":"🎯","tokens_out":953,"duration_ms":15837,"temperature":0.7,"pith_summary":"The paper claims that fixed-epsilon ball searches used by FGSM, BIM and VAM cannot reliably reach local minima of the non-targeted attack objective, even after many iterations. Binary Iterative Method (BinIM) instead treats the step size as a binary-search parameter: it starts large, updates the image by the signed gradient, then halves the step each iteration, and restarts over multiple rounds to pick the strongest local minimum. On 1000 randomly sampled ImageNet images the resulting attacks drive Inception-v3 adversarial accuracy down to 0.009 and true-class probabilities to roughly 2e-9 while wrong-class confidences reach 0.995–1.0. Stronger, systematically generated attacks of this kind matter because they supply better data for adversarial training and give a stricter test of model robustness.","feed_headline":"Binary search halves steps for stronger adversarial attacks","feed_subtitle":"On ImageNet, BinIM drops Inception-v3 accuracy to 0.009 and true-class probability near zero.","key_machinery":"Binary Iterative Method (BinIM): an iterative signed-gradient update whose step size is initialised large and halved every iteration (eps_iter ← eps_iter/2), with optional multi-round restarts; the schedule is presented as binary search over an assumed sorted one-dimensional gradient landscape, thereby approaching a local minimum of the attack loss more closely than constant-step epsilon-ball search.","core_discovery":"Standard epsilon-ball gradient attacks cannot guarantee proximity to a local minimum of the non-targeted attack objective. Binary Iterative Method replaces the constant step with a divide-and-conquer schedule that initialises a large eps_iter, repeatedly halves it after each signed-gradient update, and selects the best result across restarts. Evaluated on 1000 ImageNet images, BinIM lowers Inception-v3 accuracy to 0.009 (versus 0.025 for BIM) and can push true-label probability to 2.21e-9 while raising wrong-class confidence above 0.995.","pith_inferences":["The binary-search justification requires the directional loss along the signed-gradient ray to be unimodal or sorted; typical high-dimensional neural losses violate this, so BinIM may simply be an effective decreasing-step heuristic rather than true binary search.","If the observed gains are real, the same half-step schedule could be grafted onto momentum or projected-gradient attacks to tighten their local minima.","Transfer results (attacks crafted on Inception-v3 still degrade Inception-v2 and ResNet) suggest the schedule may strengthen black-box attacks without white-box access to the victim.","A natural next measurement is whether BinIM achieves the same success rate at smaller L∞ or L2 perturbation norms; the paper does not report norms."],"forward_implications":["BinIM can generate stronger adversarial training sets that improve model robustness.","Robustness scores measured with BinIM will be lower (stricter) than those measured with FGSM, BIM or VAM on the same models.","The binary-search step schedule can be extrapolated to targeted attacks.","Once a gradient is available the method applies to any differentiable classifier."],"fun_headline_variants":["BinIM halves eps_iter to push true-class probability to 2.21e-9","Divide-and-conquer schedule beats BIM on 1000 ImageNet images","Binary Iterative Method drops Inception-v3 accuracy to 0.009","Halving attack steps yields wrong-class confidence above 0.995","Binary search over steps finds stronger non-targeted adversaries"],"cache_read_input_tokens":128,"weakest_assumption_plain":"The method assumes that the input-loss gradient behaves like a sorted one-dimensional array so that repeatedly halving the step size is genuine binary search guaranteed to approach a local minimum.","fun_headline_variants_meta":{"raw":{"variants":["BinIM halves eps_iter to push true-class probability to 2.21e-9","Divide-and-conquer schedule beats BIM on 1000 ImageNet images","Binary Iterative Method drops Inception-v3 accuracy to 0.009","Halving attack steps yields wrong-class confidence above 0.995","Binary search over steps finds stronger non-targeted adversaries"]},"model":"grok-4.5","effort":"low","cost_usd":0.008626,"raw_usage":{"total_tokens":2059,"prompt_tokens":884,"num_sources_used":0,"completion_tokens":103,"cost_in_usd_ticks":86260000,"prompt_tokens_details":{"text_tokens":884,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1072,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":884,"tokens_out":103,"duration_ms":9482,"temperature":1.0,"reasoning_tokens":1072,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T21:21:56.394667+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"If, on the same 1000 ImageNet images and identical iteration budget, a constant-step BIM or a simple linearly decaying step schedule matches or beats BinIM’s 0.009 adversarial accuracy and the extreme probability collapses shown in Table 4, the claimed advantage of the binary-search schedule is refuted.","supporting_citations":[],"review_version":1}