{"id":"4b54b44d-97c9-4a14-8276-08e73bc36d58","arxiv_id":"1906.09288","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Adversarial perturbations disrupt DNN-based face detectors under white-box, gray-box, and black-box settings to sabotage training data for AI face synthesis.","lead":"This paper adds tiny invisible changes to face photos so AI face detectors fail to find them, preventing the photos from being used to train fake-face generators. A smart generalist might read it to see one practical way to protect personal images from deepfake misuse.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"No experiments evaluate impact on downstream face synthesis training; only detector metrics shown.","rationale":"This matches the reader's weakest_assumption exactly and explains the high correctness_risk and UNVERDICTED verdict from abstract-only review. The paper's title and abstract tie the method to disrupting synthesis, but without end-to-end evidence the empirical claim on detectors does not fully support the stated goal. Full text would be needed to check if such experiments were added beyond the abstract.","tokens_in":1609,"tokens_out":314,"duration_ms":25323,"concrete_test":"Train a face synthesis model (e.g., DCGAN or StyleGAN) twice on the same base dataset: once using faces from clean detection, once using faces from the paper's perturbed detection pipeline. Compare output quality via FID score and human preference study; if FID difference <10% or no preference shift, the downstream claim fails.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that adversarial perturbations disrupt face detectors to reduce quality/usability of faces for downstream DNN training in synthesis models. Experiments are described only for white/gray/black-box attacks on detectors (e.g., drops in detection rate or mAP on datasets like WIDER FACE). No results are provided for training a synthesis model (GAN, VAE, etc.) on the perturbed detected faces versus clean ones, nor any metric (FID, perceptual quality, visual inspection) showing degraded synthesis output. This leaves the key assumption about downstream usability untested.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes adversarial perturbations to disrupt DNN-based face detectors in white-box, gray-box, and black-box attack settings. The goal is to sabotage training data for AI face synthesis by reducing the quality and usability of detected faces, while keeping perturbations imperceptible to humans. It claims empirical effectiveness on several datasets including WIDER FACE.","tokens_in":1710,"tokens_out":368,"duration_ms":13516,"significance":"If the perturbations demonstrably impair downstream synthesis model training (e.g., via degraded GAN/VAE outputs), the approach could provide a proactive privacy defense against deepfakes. The work builds on standard adversarial attack methods but currently evaluates only detector metrics, so the significance for the stated synthesis-disruption goal remains unestablished.","major_comments":[{"comment":"The central claim is that perturbations reduce the quality/usability of detected faces for downstream DNN training in synthesis models, yet no experiments train a synthesis model on perturbed vs. clean faces or report any synthesis-specific metrics (FID, perceptual quality, or visual inspection of generated faces). Only detector performance (detection rate, mAP) is evaluated.","section":"Experiments section (and abstract)"},{"comment":"The weakest assumption—that the effect holds across white/gray/black-box settings for synthesis usability—is untested; the manuscript provides no quantitative results, error bars, or ablation on perturbation visibility/human studies to support the imperceptibility claim while achieving substantial downstream impact.","section":"§4 and abstract"}],"minor_comments":[{"comment":"Clarify the exact perturbation generation procedure and hyperparameter choices for each attack setting to allow reproducibility.","section":"Method description"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for their insightful comments. We address each major comment below and clarify the scope of our work.","responses":[{"response":"We agree that the manuscript would be strengthened by experiments evaluating the impact on downstream synthesis models. However, the core contribution of this work is the development of adversarial perturbations to disrupt face detectors under various attack settings, which serves as a proxy for sabotaging training data. If face detectors fail to detect or produce poor quality detections due to our perturbations, the faces cannot be effectively used for training synthesis models. We will revise the abstract and introduction to more precisely state that our evaluation is on detector performance, with the synthesis disruption as the motivating application. We do not plan to add synthesis model training experiments in this revision.","revision_made":"partial","referee_comment":"[Experiments section (and abstract)] The central claim is that perturbations reduce the quality/usability of detected faces for downstream DNN training in synthesis models, yet no experiments train a synthesis model on perturbed vs. clean faces or report any synthesis-specific metrics (FID, perceptual quality, or visual inspection of generated faces). Only detector performance (detection rate, mAP) is evaluated."},{"response":"Our experiments in Section 4 do show effectiveness across white-box, gray-box, and black-box settings in terms of reducing detection rates and mAP on multiple datasets. For imperceptibility, the perturbations are constrained to small norms as is standard in the field, but we acknowledge the lack of human studies or quantitative visibility metrics. We will add error bars to the experimental results and include a short discussion on the imperceptibility in the revised manuscript. Regarding synthesis usability, as noted above, this is not directly tested.","revision_made":"yes","referee_comment":"[§4 and abstract] The weakest assumption—that the effect holds across white/gray/black-box settings for synthesis usability—is untested; the manuscript provides no quantitative results, error bars, or ablation on perturbation visibility/human studies to support the imperceptibility claim while achieving substantial downstream impact."}],"tokens_in":1215,"tokens_out":444,"duration_ms":23786,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The core idea is to use imperceptible adversarial perturbations on images so that face detectors fail or produce low-quality outputs, with the hope that this sabotages training data for AI face synthesis models. They outline white-box, gray-box, and black-box attack variants and claim drops in detection performance on datasets like WIDER FACE. That part follows established adversarial methods and applies them to a privacy-oriented goal, which is a reasonable incremental step rather than a routine repeat of prior work on detectors alone. If the full paper includes the promised quantitative results with some controls, the detector-side evaluation looks solid enough on its own terms. The soft spot is exactly the one flagged in the stress test: the central promise is reduced usability of faces for synthesis training, yet no experiments train a generator on the perturbed detections or measure any synthesis metric such as output quality or FID. Without that link, the downstream claim rests on an untested assumption. The citation pattern and formulation appear standard with no obvious circularity or invented entities. This is the sort of paper that could interest the adversarial defense or deepfake countermeasures crowd, especially if they want concrete attack recipes for the detection stage. A reader focused only on detector robustness might still extract value from the attack setups. It deserves peer review because the attack component is grounded and the application angle is timely, even though the missing synthesis evaluation means it would likely need revision to fully support the title and abstract claims.","headline":"The paper shows standard adversarial attacks can hurt face detectors but never checks whether that actually harms downstream face synthesis training.","tokens_in":2186,"tokens_out":351,"would_cite":false,"duration_ms":16178,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":{"model":"grok-4.3","evidence":[],"headline":"Adversarial face-detector attack paper has no overlap with RS forcing chain","alignment":"orthogonal","rationale":"Paper's machinery (constrained optimization of cross-entropy on face proposals, randomized-gradient gray-box, ensemble black-box) is standard adversarial ML; no J-cost, ratio symmetry, φ-ladder, 8-tick periodicity, or parameter-free constant derivations appear. RS theorems (reality_from_one_distinction, J-uniqueness via Aczél, Alexander-duality D=3, etc.) are irrelevant.","tokens_in":53787,"confidence":"high","tokens_out":129,"duration_ms":4470,"cache_read_input_tokens":38528,"cache_creation_input_tokens":0},"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Imperceptible adversarial perturbations can sabotage AI face synthesis by disrupting the face detectors used to collect training data.","keywords":["adversarial perturbations","face detection","deepfake defense","AI face synthesis","DNN attacks","data poisoning","white-box black-box attacks"],"falsifier":"Train face synthesis models on faces extracted from perturbed versus clean images and measure whether the synthesis output quality or downstream detector success rate drops measurably.","tokens_in":2509,"feed_emoji":"🛡️","tokens_out":572,"duration_ms":16668,"temperature":0.7,"pith_summary":"The paper develops a defense that adds small, human-invisible changes to real face images so that DNN-based face detectors extract low-quality faces unsuitable for training AI synthesis models. This sabotage works in white-box settings where the detector is fully known, gray-box with partial knowledge, and black-box with no access to the model internals. The approach targets the data collection step upstream of fake video generation to limit the creation of realistic fakes from real individuals' photos. Empirical tests on multiple datasets show reduced detection performance across state-of-the-art detectors.","feed_headline":"Tiny invisible changes stop AI from training on your face","feed_subtitle":"Adversarial perturbations disrupt face detectors so extracted images become unusable for synthesis models","key_machinery":"Adversarial perturbations designed to fool DNN face detectors while remaining imperceptible to humans, applied to real images to degrade extracted faces for synthesis training.","core_discovery":"Specially designed adversarial perturbations added to face images reduce the quality and usability of detected faces for downstream DNN training, thereby disrupting state-of-the-art DNN based face detectors under white-box, gray-box and black-box attack settings on several datasets.","pith_inferences":["The method could generalize to disrupting other AI tasks that rely on detected faces, such as recognition or attribute prediction.","Repeated application might create an ongoing arms race where detectors are retrained to ignore common perturbations.","Combining this with watermarking or other data-marking techniques could strengthen protection against data scraping."],"forward_implications":["Detected faces from perturbed images become poor training data, lowering the realism of AI-generated fakes.","The defense applies without needing knowledge of the specific synthesis model, only the upstream detector.","Protection can be applied directly to personal images before they enter public datasets.","Effectiveness holds when attackers have full, partial, or no knowledge of the detector model."],"fun_headline_variants":["Adversarial perturbations disrupt face detectors","Imperceptible changes degrade AI face data","Attacks reduce usability of detected faces","Perturbations hinder DNN based face synthesis"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The perturbations stay invisible to humans yet make detected faces substantially less useful for training AI face synthesis models across the different attack settings.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial perturbations disrupt face detectors","Imperceptible changes degrade AI face data","Attacks reduce usability of detected faces","Perturbations hinder DNN based face synthesis"]},"model":"grok-4.3","cost_usd":0.006852,"raw_usage":{"total_tokens":3114,"prompt_tokens":531,"num_sources_used":0,"completion_tokens":50,"cost_in_usd_ticks":68524500,"prompt_tokens_details":{"text_tokens":531,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2533,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":531,"tokens_out":50,"duration_ms":18349,"temperature":1.0,"reasoning_tokens":2533,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-25T18:46:09.221799+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Train face synthesis models on faces extracted from perturbed versus clean images and measure whether the synthesis output quality or downstream detector success rate drops measurably.","supporting_citations":[],"review_version":1}