REVIEW 3 major objections 4 minor 11 references
Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters
T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read This paper presents RLAB, a reinforcement-learning platform whose dual-action agent claims to mount black-box adversarial attacks with far fewer queries than prior methods by learning which image patches to distort and which to clean at…
desk verdict The dual-action RL attack is a plausible incremental idea, but the query-efficiency claim disappears once you count the sensitivity-analysis model calls. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the dual-action RL loop built around a per-patch sensitivity analysis. For an image divided into n-by-n patches, the platform measures how the ground-truth probability changes when each distortion filter is applied to each patch, forming ordered lists LISTADD and LISTREMOVE; the state vector also carries the per-class probability vector and recent L2 distances. The Dueling DQN agent then outputs NADD_DIST and NREM_DIST, the numbers of patches to add distortion to and remove distortion from, with NREM_DIST less than NADD_DIST to keep progress monotonic. Rewards come from a probability dilution metric, the sum over top classes of 1/log(1/p), normalized by the change in L2 distance, so the agent is pushed toward actions that shift probability mass away from the ground-truth class at the smallest distortion cost. The sensitivity analysis is described as a parallelized one-shot filter operation that is inexpensive on a GPU.
What would settle it
Run RLAB against the same 1000 ImageNet samples with every forward pass metered, including each per-patch sensitivity evaluation, and compare the resulting average query count with CG-Attack and SimBA-DCT under the same metering; if RLAB's average exceeds the baselines, the reported query efficiency is an artifact of the accounting rather than the algorithm.
Extended reading notes
Core claim
The core discovery is that an RL agent can learn to attack by treating the sensitivity of the victim model's ground-truth probability as a spatial map. At each step, the agent ranks patches by how much adding distortion lowers the ground-truth probability and how much removing distortion restores it, selects a number of patches to modify, and applies the chosen distortion filter. This simultaneous addition and removal, guided by probability dilution normalized by L2 change, is what the paper credits for fast convergence. The paper reports that the resulting platform beats baselines on average queries and success rate for both untargeted and targeted attacks, reaches 100% ASR on the evaluated ImageNet models, and produces adversarial samples with a maximum L2 of 4.74, within the competitors' budget. It also reports that retraining with RLAB-generated samples improves robustness on CIFAR-10-C more than the compared augmentation methods.
Load-bearing premise
The efficiency claim depends on treating the per-patch sensitivity analysis as free, even though in the standard black-box setting every model evaluation counts as a query.
Editorial extensions
If this is right
- If the reported query counts hold, black-box attacks can be mounted with roughly an order of magnitude fewer queries than many prior methods, making rate-limited APIs more vulnerable to gradient-free attacks.
- The dual-action add-and-remove strategy yields a direct robustness measure: the platform can report which distortion types and patch sizes a model resists, and retraining with RLAB samples lowers degradation error on CIFAR-10-C.
- The Bring Your Own Filter design means the same learned policy interface can be reused for Gaussian noise, blur, brightness, dead pixels, or mixtures, without re-architecting the attack for each distortion type.
- A retrained model that was hardened with RLAB-generated adversarial examples shows lower error rates when later attacked by SimBA and Square, suggesting that RLAB-style exploration produces useful training data for defense.
- The patch-size ablation shows a trade-off between distortion and queries, so a user can pick a patch size that matches the acceptable perturbation for a given application.
Reading between the lines
- If sensitivity-analysis evaluations are charged as ordinary queries, the reported average query counts would grow by orders of magnitude, since each step evaluates every patch; the paper's efficiency claim depends on not charging them.
- The same per-patch sensitivity map that guides attack actions could be repurposed for visual explanation, since it already ranks image regions by their influence on the model's ground-truth probability, a direction the paper only sketches.
- For fixed query meters, the platform's practical efficiency could be improved by amortizing sensitivity estimates across similar images or by recomputing them only for changed patches, but the paper does not explore this.
- The dual-action principle might transfer to non-image signals such as video or ECG classification, where patch-based sensitivity could be replaced by segment-based sensitivity, though the paper leaves that as a stated future extension.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper presents RLAB, a reinforcement-learning platform for black-box adversarial attacks that lets users plug in custom distortion filters. The RL agent learns to add and remove distortions patch-wise, guided by a sensitivity analysis of the victim model's ground-truth probability, and the paper reports substantially lower average query counts than state-of-the-art attacks on ImageNet and CIFAR-10 (e.g., AVG.Q 178 for RLAB vs. 210 for CG-Attack on ResNet-50/ImageNet), together with 100% attack success rates and competitive L2 distortion. The paper also reports adversarial-retraining experiments showing improved robustness on corrupted datasets. The central claim is that RLAB achieves misclassification with an order-of-magnitude fewer black-box queries than existing methods.
Significance. If the query-efficiency claim were correct, the platform would be a practically relevant contribution to black-box robustness evaluation, especially because of its flexibility to different distortion types and its reported 100% success rates. The paper also includes adversarial-retraining results that could be of interest. However, the central efficiency claim is not supported as stated: the reported query counts exclude the many victim-model evaluations used for sensitivity analysis, and the evaluation protocol is largely in-sample. The strengths of the paper are its clear description of the platform components and the inclusion of ablations over patch sizes and distortion filters; the query-counting methodology and evaluation protocol are the main blockers.
major comments (3)
- [State Design, 'Inexpensive Query on a GPU' and Algorithm 1, line 4] The reported AVG.Q counts only policy steps, not oracle accesses. Sensitivity analysis applies the distortion mask to every n x n patch and reads the victim model's ground-truth probability; for a 224x224 image with 2x2 patches this is 12,544 forward passes of the victim model per sensitivity sweep. Algorithm 1 performs this sweep before the attack loop, and Figure 5 explicitly labels it a 'Distortion Sensitivity Query.' Whether these evaluations are GPU-batched changes wall-clock time, not query count, under the standard black-box definition used by every competitor in Table 1. Counting them, the honest per-image cost is at least the initial sensitivity sweep plus 12,544 times the number of steps (if recomputed each step), which is orders of magnitude above the reported 178 and far above CG-Attack's 210. The paragraph's claim that sensitivity analysis is a 'one-shot filter operation' thus redefines the attack's query cost and invalidates the Table 1 comparison, which is the central evidence for the paper's efficiency claim.
- [Experimental Details, first paragraph and 'Evaluation on ImageNet'] The RL policy is trained on 80% of the ImageNet validation set and evaluated on the remaining 20% of the same validation set, against the same victim model whose output probabilities are used both to build the reward and to measure success. Under this protocol, the reported AVG.Q and ASR are in-sample outcomes of optimizing on the same data distribution and the same victim, not independent predictions of attack cost on new inputs. This is load-bearing because the paper claims a general advantage over competitors; to support that claim the evaluation should use a held-out victim model or a held-out distribution, and the hyperparameter selection (e.g., noise variance, Nmax, discount factor) should be justified on a separate validation split rather than selected on the test set used for the headline numbers.
- [Tables 1-3 and 'Evaluation on ImageNet'] The paper reports only point estimates for AVG.Q and ASR with no variance, standard deviation, or statistical significance testing. For instance, Table 1 reports RLAB AVG.Q 178 vs. LeBA 178.7 and CG-Attack 210; with 1000 samples and the reported method's sensitivity, these differences could easily be within noise. In addition, the text says 'failure cases were not included in any of the metrics calculated except for the success rate,' so AVG.Q is computed only on successful attacks; while this is common practice, the paper should state the number of failures and how their exclusion affects the comparison, especially because RLAB is evaluated with a 3500-query budget while competitors use up to 10000 queries.
minor comments (4)
- [Reward, Eq. (1)] Equation (1) is typeset with ambiguous subscripts and does not clearly define n or the relationship between k_1 and k_n; it also overloads n with the patch-size notation used elsewhere.
- [Figure 5 and 'State Design'] Figure 5 labels the sensitivity computation as a 'Distortion Sensitivity Query,' which contradicts the text's assertion that sensitivity analysis is not a query; the terminology should be reconciled to avoid confusion about what counts as a query.
- [Introduction, first paragraph of 'RLAB Platform'] The phrase 'targetted' is a typo for 'targeted' in the contributions sentence, and the introduction uses both 'targetted' and 'targeted' inconsistently.
- [References and Related Works] The paper cites 'DeepFool [4]' using numeric citation style while the rest of the references are author-year, and the relationship to the authors' prior workshop papers (Sarkar et al. 2022, 2023b, 2023c) is not clearly delineated; the text says 'This paper is inspired by earlier work' without specifying what is new in this submission.
Circularity Check
The reported AVG.Q counts only RL policy steps while the per-step sensitivity sweep—which the paper itself calls a 'Distortion Sensitivity Query'—is excluded, so the headline query-efficiency advantage over competitors is an artifact of the paper's query accounting.
-
self definitional
[Section 'RL for Adversarial Attack' > 'State Design', paragraph 'Inexpensive Query on a GPU'; Algorithm 1 step 4; Figure 5; Table 1.]
"During training and validation, the mask is applied across all patches to measure the change in the ground truth classification probability PGT. ... The sensitivity analysis takes just a few GPU cycles on a V100 GPU, as the operation is a fully parallelized one-shot filter operation on an image. ... So, processing a query to get the states is a fast operation on a GPU."
For a 224x224 ImageNet image with 2x2 patches, 'applied across all patches' means 12,544 forward passes through the victim model per sensitivity sweep, each of which is a black-box query under the definition used by every competitor in Table 1. Algorithm 1 performs this sensitivity calculation before the attack loop, and Figure 5 labels it a 'Distortion Sensitivity Query'. Yet the AVG.Q values in Table 1 (e.g., RLAB 178 vs CG-Attack 210) count only the RL policy iterations, not these sensitivity evaluations. Thus the central claim that RLAB 'outperforms state-of-the-art methods in terms of the average number of queries required to cause misclassification' is true only under the paper's own redefinition of a query as a GPU-batched operation.
full rationale
The paper's central claim is query efficiency, and that claim is circular in a definitional sense: the reported AVG.Q is computed over RL action steps, while the sensitivity analysis that feeds the agent's state is also described as a 'query' but is omitted from the tally. Because every sensitivity evaluation is a victim-model forward pass, the headline comparison with CG-Attack and others is an artifact of this accounting rather than a measured property of the attack. I am not treating the RL policy being trained on 80% of the validation set and evaluated on 20% as circular by itself, since held-out evaluation is standard practice; nor do the self-citations appear load-bearing, as the method's core mechanism is described in the present paper rather than imported from an unverified prior uniqueness claim. The adversarial-retraining and corruption-robustness results are benchmark comparisons and do not reduce to the query-count definition, though they also do not rescue the main efficiency claim. Overall, the query-efficiency result is partially circular because the metric is defined in a way that excludes the dominant oracle-evaluation cost, making the reported advantage a consequence of the chosen definition rather than an independent empirical finding.
Assumptions & free parameters
free parameters (9)
- Noise variance =
0.005
- Patch size =
2x2
- N_max (max patches per step) =
8
- Discount factor gamma =
0.95
- Max steps/query budget =
3500
- Nsteps for L2 history =
4
- Dead pixel percentage =
50%
- Brightness intensity =
-0.1
- Gaussian blur std =
1
assumptions (4)
- domain assumption The change in ground-truth probability under a patch distortion is a sufficient signal for selecting which patches to perturb.
- ad hoc to paper Sensitivity-analysis forward passes are not black-box queries.
- domain assumption Training the RL agent on 80% of the validation set is compatible with a black-box attack evaluation.
- standard math Dueling DQN converges to a good policy with the described reward in bounded training.
Cite this review
Pith. "Pith review of Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters." pith.science (2026). https://pith.science/paper/JGVWIV64
@misc{pith2026250114122,
author = {Pith},
title = {Pith review of: Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters},
year = {2026},
howpublished = {\url{https://pith.science/paper/JGVWIV64}},
note = {Machine review of arXiv:2501.14122}
}
read the original abstract
We present a Reinforcement Learning Platform for Adversarial Black-box untargeted and targeted attacks, RLAB, that allows users to select from various distortion filters to create adversarial examples. The platform uses a Reinforcement Learning agent to add minimum distortion to input images while still causing misclassification by the target model. The agent uses a novel dual-action method to explore the input image at each step to identify sensitive regions for adding distortions while removing noises that have less impact on the target model. This dual action leads to faster and more efficient convergence of the attack. The platform can also be used to measure the robustness of image classification models against specific distortion types. Also, retraining the model with adversarial samples significantly improved robustness when evaluated on benchmark datasets. The proposed platform outperforms state-of-the-art methods in terms of the average number of queries required to cause misclassification. This advances trustworthiness with a positive social impact.
Figures
Reference graph
Works this paper leans on
-
[6]
In 2016 IEEE European symposium on security and privacy (EuroS&P), 372–387
The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P), 372–387. IEEE. Pomponi, J.; Scardapane, S.; and Uncini, A
work page 2016
-
[8]
arXiv preprint arXiv:1406.1831
Analyz- ing noise in autoencoders and deep networks. arXiv preprint arXiv:1406.1831. Ratner, A. J.; Ehrenberg, H.; Hussain, Z.; Dunnmon, J.; and Re´, C
-
[2013]
arXiv preprint arXiv:1312.6199
Intriguing proper- ties of neural networks. arXiv preprint arXiv:1312.6199. Yang, J.; Jiang, Y.; Huang, X.; Ni, B.; and Zhao, C
-
[2014]
arXiv preprint arXiv:1412.6572
Explain- ing and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. Guo, C.; Gardner, J.; You, Y.; Wilson, A. G.; and Wein- berger, K
-
[2015]
arXiv preprint arXiv:1511.06807
Adding gradient noise improves learning for very deep networks. arXiv preprint arXiv:1511.06807. Papernot, N.; McDaniel, P.; Jha, S.; Fredrikson, M.; Celik, Z. B.; and Swami, A
-
[2016]
arXiv preprint arXiv:1611.01236
Ad- versarial machine learning at scale. arXiv preprint arXiv:1611.01236. Kurakin, A.; Goodfellow, I.; Bengio, S.; et al
-
[2017]
In 2017 Chinese automa- tion congress (CAC), 4165–4170
Re- search on data augmentation for image classification based on convolution neural networks. In 2017 Chinese automa- tion congress (CAC), 4165–4170. IEEE. Su, J.; Vargas, D. V.; and Sakurai, K
work page 2017
-
[2018]
arXiv preprint arXiv:1810.00069
Adversarial attacks and defences: A survey. arXiv preprint arXiv:1810.00069. Chen, S.; Huang, Z.; Tao, Q.; and Huang, X
Show all 11 references
-
[2019]
arXiv preprint arXiv:1906.02398
Query-efficient meta attack to deep neural networks. arXiv preprint arXiv:1906.02398. Feng, Y.; Wu, B.; Fan, Y.; Liu, L.; Li, Z.; and Xia, S.- T
1906 arXiv
-
[2020]
In Proceedings of the Web Conference 2020, 673–683
Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. In Proceedings of the Web Conference 2020, 673–683. Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R
2020
-
[2022]
arXiv preprint arXiv:2202.02236
Pixle: a fast and effective black -box attack based on rearranging pixels. arXiv preprint arXiv:2202.02236. Poole, B.; Sohl-Dickstein, J.; and Ganguli, S
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.