{"id":"f699b842-9a13-407d-b878-0c5013a763e6","arxiv_id":"1908.07000","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Starting black-box optimization attacks from local-model adversarial candidates reduces query cost by up to 81 percent, and seed prioritization lets batch attacks succeed with a few queries.","lead":"The paper combines two known ways to trick image classifiers, transfer attacks and query-based optimization, and shows the combination finds adversarial examples with far fewer API queries. It also ranks candidate images by likely attack difficulty, so attackers can collect many successful attacks while spending only a handful of queries.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 3's Base-row Queries/Search numbers are inconsistent with the stated baseline, so the headline cost reductions may hinge on an unresolved metric-accounting discrepancy.","rationale":"I focused on the metric behind the headline numbers rather than the already-stated matched-local-model caveat. The paper's threat model explicitly assumes pretrained local models, and Section 4.5 acknowledges that normal local models do not help against robust targets; that limitation is scoped and visible. The Table 3 accounting issue is different: it affects the central quantitative claim across all datasets and is not flagged anywhere in the manuscript. I am not alleging misreporting by the authors; the artifact is released and the discrepancy can be resolved by recomputation. The final disposition should stay conditional because the core idea is plausible and the hybrid-row arithmetic is coherent, but the baseline metric needs to be verified before the precise savings figures, including the 81% and the 76% non-transfer reduction, can be accepted.","tokens_in":21598,"tokens_out":21777,"duration_ms":237312,"concrete_test":"Using the released repository, recompute Table 3 Base rows from the per-seed raw query logs under one explicit rule: Queries/Search = total queries spent while a gradient search is running divided by the number of seeds whose gradient search succeeds. First determine whether the Base pipeline includes a transfer phase; if it does not, Queries/Search must equal Queries/AE. If it does, recover the implied direct-transfer count D = n(S−A)/(S−1) for each row and check it against the reported Transfer Rate. If MNIST AutoZOOM Base Queries/Search falls from 3,248 toward 1,610, the non-transfer cost reduction drops from 76% to about 52% and the headline savings need revision; if the table reproduces as printed, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Table 3 is the primary evidence for the central claim, but its per-search query accounting is internally inconsistent. The caption defines Queries/Search as the average number of queries per successful AE found using the gradient attack, excluding those found by direct transfer, and describes the Base condition as starting from original seeds. If the Base condition really has no direct-transfer phase, then every Base success is a gradient-search success and Queries/Search must equal Queries/AE; it does not in any Base row (e.g., MNIST AutoZOOM: 3,248 vs 1,610; CIFAR10 NES: 1,632 vs 1,091). Reconstructing the Base Queries/Search values requires assuming either an undocumented transfer phase whose implied direct-transfer counts disagree strongly with the table's Transfer Rate column, or a denominator that drops direct-transfer successes without dropping their query cost. The Ours rows are internally consistent with the caption (e.g., CIFAR10 AutoZOOM: (276×982−636)/(982−636)=781), so the issue is specific to the baseline. Because the non-transfer cost reduction (MNIST AutoZOOM: 3,248→770, cited as a 76% reduction) is the cleanest evidence that local candidates help beyond direct transfer, an unresolved accounting difference directly affects the quantitative central claim.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes hybrid black-box attacks that combine transfer-based and optimization-based methods: local-model adversarial candidates are used as starting points for gradient-based black-box attacks (Hypothesis 1), label byproducts from optimization attacks are used to fine-tune local models (Hypothesis 2), and a seed prioritization strategy is introduced for batch attacks. The authors evaluate on MNIST, CIFAR10, and ImageNet using AutoZOOM and NES as the optimization attacks. They report large query-cost reductions on normally trained models (up to 81% for MNIST AutoZOOM), smaller gains against robust models, and substantial savings from seed prioritization in batch scenarios. Hypothesis 3 (combining local gradients with estimated gradients) is tested and not supported. The paper is empirical, with 5-run averages and an artifact-evaluated code release.","tokens_in":21819,"tokens_out":10295,"duration_ms":107702,"significance":"If the results hold, this is a practical contribution to black-box adversarial-example research: it shows that failed transfer candidates, which are often discarded, can serve as effective starting points for query-based optimization, and it quantifies the benefit of seed prioritization under a limited-query budget. The paper is transparent about negative results, including the failure of Hypothesis 2 on CIFAR10 and the dependence of gains on matching the attack surface of local and target models. The artifact evaluation passed, and the comparisons are against established baselines rather than against strawmen. The main quantitative claims are supported by multiple datasets and two optimization attacks, though one important metric definition needs clarification.","major_comments":[{"comment":"The tuning mechanism (Hypothesis 2) is presented as a component of the hybrid attack in Algorithm 1 and in the abstract, but Table 6 shows that on CIFAR10 tuning consistently harms the attack: for the normal target with AutoZOOM the transfer rate falls from 65.6% to 19.7%, Queries/AE rises from 276 to 459, and success drops from 98.2% to 96.3%; the NES attack shows a similar transfer-rate collapse (65.6% to 40.7%). The text states that the authors do not have a clear understanding of this failure. Because CIFAR10 is one of only three datasets and the only non-MNIST dataset with tuning results, the general claim that label byproducts improve hybrid attacks is not supported; the paper should either restrict the H2 claim to MNIST, identify a condition that predicts when tuning helps, or present model tuning as a dataset-specific extension rather than as a core component of the proposed method.","section":"§4.6, Table 6"},{"comment":"The Queries/Search metric is load-bearing because Section 4.4 uses reductions in this column to argue that local candidates help beyond direct transfer, but the definition is ambiguous for the Base rows. The caption says Base starts from original seeds and Queries/Search excludes direct transfers; if Base has no transfer phase, an unqualified reading would require Queries/Search to equal Queries/AE, which no Base row satisfies (e.g., MNIST AutoZOOM 3,248 vs. 1,610). The body text clarifies that the last two columns are the mean query cost for adversarial examples found from non-transferring seeds, which implies that for Base the nontransferring subset is determined by the transferability of the local candidates. Please state this definition in the caption and specify how the numerator and denominator are computed for Base and Ours, so that the non-transfer cost reductions can be verified from the raw query accounting.","section":"§4.4, Table 3"},{"comment":"The paper's practical claim is conditioned on the attacker having local models whose attack surface matches the target: normal local ensembles give only 3.8% cost reduction against a robust CIFAR10 target with AutoZOOM, whereas robust local ensembles give 20.5%, and the reverse is true for normal targets. This is acknowledged in the text, but the abstract and introduction should state this limitation more prominently, since the 'universal local ensemble' experiments show that no single ensemble works well for both target types and the proposed remedy (dynamically selecting ensembles) is not evaluated.","section":"§4.5, Table 4"}],"minor_comments":[{"comment":"The phrase 'non-transfering seeds' in Section 4.4 should be corrected to 'non-transferring seeds,' and the caption should state explicitly that for Base rows the nontransferring subset is defined by the transferability of local adversarial candidates rather than by an actual transfer phase in the baseline.","section":"§4.4, Table 3 caption"},{"comment":"The paper does not evaluate Hypothesis 2 on ImageNet; this should be stated in the abstract or contributions section so that readers do not overgeneralize the tuning results.","section":"§4.6"},{"comment":"The 'Fraction Better (%)' column in Table 4 is used later in the text but is not defined in the caption; please define it as the fraction of seeds for which the local candidate gives a lower total query cost than the original seed.","section":"§4.5, Table 4"},{"comment":"For the two-phase strategy, the reported query counts for 'Top x%' should specify whether they include the first-phase transfer queries; the current text implies they do, but this should be stated explicitly for reproducibility.","section":"§5.3, Table 10"}],"recommendation":"major_revision","confidential_remarks":"The core H1 result appears sound and useful, and the artifact evaluation is a plus. My main concern is the framing of Hypothesis 2 as a generally beneficial component when the only non-MNIST evaluation shows clear harm; the authors can address this by narrowing the claim or by providing additional analysis. The Table 3 metric ambiguity is also worth a targeted revision. I would not reject this paper, but I would like to see a revised version that clarifies these points before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The main result is solid: failed transfer candidates are genuinely better starting points for black-box optimization attacks, and using them cuts queries per adversarial example by 50–80% on normally trained models across MNIST, CIFAR10, and ImageNet. The paper is also honest in the right places—it reports that Hypothesis 3 (local gradients as priors) found no support, and it shows the tuning idea failing on CIFAR10 rather than hiding it. The artifact is released and the experiments use 5-run averages, which is more than most papers in this area do.\n\nThe stress-test concern about Table 3 is real. The caption defines Queries/Search as the average number of queries per successful adversarial example found using the gradient attack, excluding direct transfers. Under that definition, the Base rows must match Queries/AE, because Base starts from original seeds and has no direct-transfer phase. They don't match anywhere—MNIST AutoZOOM shows 3,248 vs 1,610. The Ours rows are internally consistent with the formula, so the problem is specifically with the baseline. This does not overturn the primary Queries/AE numbers, which are direct measurements and clearly favorable to the hybrid approach. But the paper's secondary claim that local candidates help \"beyond direct transfer\" by up to 76% rests on this questionable accounting and needs to be rechecked or explicitly redefined.\n\nThe tuning component (H2) is a softer but still real problem. Table 6 shows that on CIFAR10, tuning local models with attack byproducts raises query cost for AutoZOOM from 276 to 459 and drops transfer rate from 65.6% to 19.7%. The authors admit they don't know why. That is an acceptable negative result, but the abstract and introduction describe the tuning as part of the proposed hybrid attack without noting that it is harmful on two of the three datasets. The paper would be strengthened by presenting H2 as a failed hypothesis and repositioning the contribution around H1 and seed prioritization.\n\nOne more limitation worth naming: the gains against robust models depend on having local models trained with the same robustness paradigm. With normal local ensembles, the improvement against robust CIFAR10 is under 4%. The authors acknowledge this and discuss adaptive ensembles, but it does qualify the practical reach of the method.\n\nOverall, this is a useful, influential paper for adversarial ML and ML-as-a-service security. The central insight is simple and likely to persist; the execution is mostly careful; the flaws are reporting issues, not load-bearing errors. Send it to peer review, and ask the authors to fix the Table 3 baseline accounting and reframe the tuning results before publication.","headline":"The central idea—start black-box optimization attacks from local adversarial candidates—holds up and cuts query cost by 50–80% on normal models, but the baseline accounting in Table 3 is inconsistent and the tuning component backfires on CIFAR10, so the paper needs fixes, not rejection.","tokens_in":22338,"tokens_out":3392,"would_cite":true,"duration_ms":36505,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hybrid black-box attacks start optimization at failed transfer candidates and cut query cost per adversarial example by up to 81 percent.","keywords":["black-box adversarial examples","query efficiency","transfer attacks","optimization-based attacks","hybrid attacks","seed prioritization","batch attacks","robust models"],"falsifier":"Run the hybrid attack against a target model whose vulnerability surface is deliberately mismatched to every available local model, for example a target trained on a different data distribution or with adversarial training the attacker does not know about, and measure the distribution of queries per successful adversarial example; if starting from local candidates does not beat starting from original seeds on average across seeds, the claim that failed transfers are useful starting points would be refuted.","tokens_in":21386,"feed_emoji":"🎯","tokens_out":6166,"duration_ms":55100,"temperature":0.7,"pith_summary":"The paper argues that the two standard black-box attack strategies, transfer attacks and optimization attacks, should be combined rather than treated as alternatives. Its central claim is that adversarial examples generated against local models, even when they fail to transfer to the target, are much better starting points for optimization attacks than the original clean images, and this cuts the average number of queries per adversarial example by up to 81 percent on normally trained models. A second claim is that in resource-limited batch settings, ranking seeds by how easily local models produce adversarial examples and by target-model loss lets attackers obtain many adversarial examples with only a handful of queries. If the paper is right, black-box attacks are substantially cheaper than prior work suggested, and defenders should prepare for hybrid attackers rather than for pure transfer or pure optimization attackers.","feed_headline":"Failed transfer seeds cut black-box attack queries 81%","feed_subtitle":"Starting optimization at local-model candidates turns near-miss transfers into cheap adversarial examples.","key_machinery":"The mechanism is the hybrid attack loop. A local ensemble is attacked with a white-box PGD attack to produce a candidate adversarial example; the candidate is sent to the target model with one query; if it fails to transfer, a zeroth-order optimization attack (NES or AutoZOOM) runs from the candidate rather than from the original seed, with perturbations clipped to the original seed's L-infinity ball. The input-label pairs produced during that search are used to periodically fine-tune the local models, which the paper shows helps on MNIST. A second mechanism, seed prioritization, orders seeds in the transfer phase by the number of local models compromised and the number of PGD steps needed, and in the optimization phase by the target-model loss of the candidate starting point.","core_discovery":"The paper's central claim is that failed transfer candidates are not wasted effort: a candidate adversarial example produced by a local ensemble, even when it does not transfer to the target model, still lies closer to the target's decision boundary than the original seed, so optimization attacks launched from it succeed with fewer queries. The paper demonstrates this across MNIST, CIFAR10, and ImageNet, with mean query cost per adversarial example dropping by up to 81 percent (AutoZOOM on normal MNIST) and with nearly all seeds benefiting, at most 28 of 1,000 seeds on MNIST being worse from the local candidate. It also finds that a third hypothesis, that local-model gradients can be combined with estimated target gradients to guide the search, is not supported because local and target gradients are nearly orthogonal. The benefit is conditional on the vulnerability surface matching: normal local models give under 4 percent cost reduction against a robust CIFAR10 target, while robust local models give a 20.5 percent reduction.","pith_inferences":["Editorial inference: if query count is the main cost and the main detection signal, hybrid attacks' reduced query footprint makes query-based detection harder, so defenders should focus on shrinking the transfer surface rather than only on query thresholds.","Editorial inference: the normal-versus-robust attack-surface mismatch suggests a practical adaptive strategy the paper only mentions in passing: an attacker could probe a handful of seeds with different local ensembles, measure direct transfer rates, and then commit to the ensemble whose transfer rate is highest.","Editorial inference: because the benefit of starting from a local candidate does not depend on getting score feedback, the same hybrid starting-point idea should carry over to label-only black-box attacks, though the paper only states this as an expectation and does not test it."],"forward_implications":["On normally trained MNIST and CIFAR10 models, hybrid attacks reduce mean query cost per adversarial example by over 75 percent compared with starting optimization from original seeds.","On ImageNet, the transfer-only attack succeeds on 3.4 percent of seeds while the hybrid attack approaches 100 percent success, so combining strategies removes the main weakness of transfer attacks.","Against robust CIFAR10, using an ensemble of robust local models yields a 20.5 percent query-cost reduction where normal local models give under 4 percent, showing that the attacker should match the vulnerability surface of the target.","Fine-tuning local models with attack byproducts raises MNIST transfer rates from 60.6 percent to 76.9 percent and lowers query cost, but on CIFAR10 the same tuning hurts, so this part of the method is dataset-dependent.","With seed prioritization, a batch attacker obtains ten adversarial examples from 1,000 robust CIFAR10 seeds in about 20 queries on average, versus about 24,000 queries with random ordering."],"supporting_citations":[{"why":"Defines the NES black-box attack, one of the two optimization attacks used as a baseline and inside the hybrid.","marker":"[21]"},{"why":"Defines the AutoZOOM attack, the other optimization baseline and hybrid component.","marker":"[43]"},{"why":"Provides the Madry robust MNIST and CIFAR10 target models and the PGD attack used for white-box local attacks.","marker":"[32]"},{"why":"Supplies the observation that models on the same task have similar decision boundaries and the ensemble-transfer technique that motivates using local candidates as starting points.","marker":"[29]"},{"why":"Supplies the substitute-training idea and the observation that boundary-crossing examples train local models, which motivates fine-tuning from attack byproducts.","marker":"[36]"},{"why":"Provides the robustness-versus-accuracy feature explanation the paper uses to explain why robust and normal models have different attack surfaces.","marker":"[42]"},{"why":"Motivates the batch-attack scenario by showing that many queries create detection risk for the attacker.","marker":"[11]"}],"fun_headline_variants":["Hybrid attack reuses failed seeds to slash query cost by 81%","Turn failed transfer seeds into cheap black-box attacks","Seed prioritization plus hybrid attacks cuts queries to a handful","Black-box attacks: reuse failed seeds for 81% fewer queries","Failed transfer seeds boost black-box attack efficiency"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's savings rest on the attacker having access to pretrained local models whose vulnerability surface resembles the target's, normal local models for normal targets and robust local models for robust targets, and when that match is absent the query savings largely disappear.","fun_headline_variants_meta":{"raw":{"variants":["Hybrid attack reuses failed seeds to slash query cost by 81%","Turn failed transfer seeds into cheap black-box attacks","Seed prioritization plus hybrid attacks cuts queries to a handful","Black-box attacks: reuse failed seeds for 81% fewer queries","Failed transfer seeds boost black-box attack efficiency"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000513,"raw_usage":{"total_tokens":2478,"prompt_tokens":914,"completion_tokens":1564,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":530,"completion_tokens_details":{"reasoning_tokens":1482}},"tokens_in":530,"tokens_out":1564,"duration_ms":10531,"temperature":1.0,"reasoning_tokens":1482,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:28:37.710212+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the hybrid attack against a target model whose vulnerability surface is deliberately mismatched to every available local model, for example a target trained on a different data distribution or with adversarial training the attacker does not know about, and measure the distribution of queries per successful adversarial example; if starting from local candidates does not beat starting from original seeds on average across seeds, the claim that failed transfers are useful starting points would be refuted.","supporting_citations":[{"cited_title":"Black-box adversarial attacks with limited queries and information","cited_arxiv_id":null,"evidence_quote":"Defines the NES black-box attack, one of the two optimization attacks used as a baseline and inside the hybrid."},{"cited_title":"Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural net- works","cited_arxiv_id":null,"evidence_quote":"Defines the AutoZOOM attack, the other optimization baseline and hybrid component."},{"cited_title":"Delving into transferable adversarial examples and black-box attacks","cited_arxiv_id":null,"evidence_quote":"Supplies the observation that models on the same task have similar decision boundaries and the ensemble-transfer technique that motivates using local candidates as starting points."},{"cited_title":"Practical black-box attacks against machine learning","cited_arxiv_id":null,"evidence_quote":"Supplies the substitute-training idea and the observation that boundary-crossing examples train local models, which motivates fine-tuning from attack byproducts."},{"cited_title":"Robustness may be at odds with accuracy","cited_arxiv_id":null,"evidence_quote":"Provides the robustness-versus-accuracy feature explanation the paper uses to explain why robust and normal models have different attack surfaces."}],"review_version":1}