{"id":"3edc6a4c-d56e-4a23-939e-b29cf01221fd","arxiv_id":"2411.15553","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"FTM combines optimized, attack-specific feature perturbations with clean feature mixup and a momentum-based stochastic update, improving targeted attack transferability over prior single-run baselines.","lead":"Feature Tuning Mixup (FTM) adds learned feature-space perturbations to random clean-feature mixup to make targeted adversarial attacks transfer better across image classifiers. The paper reports higher targeted attack success rates than prior methods across CNN and vision transformer models, at a small increase in computation.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No ablation isolates the effect of optimized feature perturbations from random noise, so FTM's stated mechanism may not be the cause of its measured gains over CFM.","rationale":"The reader identified the one-step approximation to the inner maximization as the weakest assumption. My concern is closely related but sharper: the paper never shows that the gradient-based optimization of Δz is responsible for the gains. The method's forward pass always normalizes Δz, and updates only change its direction slowly through Eq. (15); a random direction with the same norm and update schedule could plausibly provide the same regularization. This missing control matters because the paper's contribution is specifically 'attack-specific feature perturbations,' not merely additional stochastic augmentation. The empirical tables are extensive and the method is clearly specified with code, which is real evidence, but the core attribution claim is not yet isolated. My recommendation remains CONDITIONAL as the reader set: the central claim may well hold, but it needs the random-perturbation control and repeated-seed statistics before the mechanism can be accepted. I do not see an internal inconsistency that would justify a harsher verdict.","tokens_in":19685,"tokens_out":9365,"duration_ms":98675,"concrete_test":"Add a control condition: keep FTM's forward pass and hyperparameters (β=0.01, αmax=0.75, p=0.1, layer selection) but initialize Δz randomly (e.g., unit Gaussian) and do not perform Eq. (15) (or replace the gradient term with a fixed random direction). Evaluate this control on Tables 1 and 2 under the same MI-TI/RDI settings. If the control's average success rate is within ~2 percentage points of RDI-FTM, optimization is not the active ingredient; if it is substantially worse, the optimization claim is supported. Also report 10-seed mean±std for RDI-FTM and RDI-CFM on the RN-50 source to confirm the reported gap is outside run-to-run noise.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that attack-specific optimization of feature perturbations (Eqs. 10-15) is what makes FTM improve targeted transfer over CFM. The experiments compare FTM against CFM, which has no learnable perturbation, and against FTM without clean-feature mixup (Fig. 6). Neither comparison isolates the gradient-based update in Eq. 15: FTM differs from CFM by adding a persistent, normalized perturbation plus a stochastic update, so the gain could come from the extra stochasticity alone. A control with fixed random perturbations (same normalization, same layer schedule, no optimization) would test this. This is load-bearing because the Abstract and Section 3.3 attribute the improvement to learnable, attack-specific perturbations, yet the only reported support is a small, single-run margin (e.g., RDI-FTM vs RDI-CFM: 77.4 vs 74.6 on RN-50; 42.4 vs 39.2 on Inc-v3; 1.1-3.2 points on 1000 images), which is close to the binomial noise floor.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"FTM (Feature Tuning Mixup) extends the Clean Feature Mixup (CFM) targeted-transfer attack by adding learnable, attack-specific perturbations to intermediate layer features. The perturbations are normalized by β‖z‖, mixed with random clean features in selected layers, and updated by one-step gradient ascent with momentum and a stochastic layer-selection schedule (Eqs. 10–15, Algorithm 1). An ensemble variant FTM-E averages (or otherwise combines) two independently perturbed surrogate models. Experiments on the 1,000-image ImageNet-compatible benchmark across CNN and ViT target models report consistent success-rate gains over CFM (e.g., RDI-FTM vs. RDI-CFM: 77.4 vs. 74.6 for RN-50 source; 42.4 vs. 39.2 for Inc-v3 source; larger gains for FTM-E), with modest computational overhead. Ablations analyze the stability of β, the layer-update probability p, the clean-feature mixing range αmax, and the effect of removing clean features.","tokens_in":19967,"tokens_out":6213,"duration_ms":56603,"significance":"If the reported gains are robust, FTM is a simple and generally applicable enhancement for targeted transfer attacks: it is the first method to combine optimized feature-space perturbations with clean feature mixup, it works across CNN and ViT surrogates and targets, and it adds only about 10% per-image overhead over CFM (1.54s vs. 1.39s on RN-50). The authors release code, evaluate on a large model zoo (Tables 1–3 and supplementary Tables 6–9), and include additional experiments on surrogate diversity and multimodal LLM targets. The main caveat is that the evidence for the central mechanism is not yet conclusive: no control separates the optimization of the feature perturbation from the extra stochasticity it introduces, and the single-FTM margins over CFM are small relative to the binomial noise floor of the evaluation set. FTM-E's larger margins are encouraging, but the significance claim for FTM itself would be strengthened by repeated runs and a random-perturbation control.","major_comments":[{"comment":"The paper attributes FTM's improvements to attack-specific optimized feature perturbations, but no experiment isolates the optimization step. FTM differs from CFM by adding a persistent, normalized perturbation Δz updated by gradient ascent (Eq. 15) together with a stochastic layer schedule; a control using fixed random perturbations with the same normalization and the same layer-selection schedule, but with no gradient update, would determine whether the optimization itself causes the gains or whether the improvement comes from the added stochasticity/regularization alone. The existing ablation in Figure 6 (with vs. without clean features) does not address this, because both variants use the optimized perturbation.","section":"Section 3.3, Eqs. (10)–(15), and Figure 6"},{"comment":"All reported success rates are single numbers without error bars, confidence intervals, or significance tests. With 1,000 images, the binomial standard error at success rates around 40–75% is roughly 1.5–1.8 percentage points, so the single-FTM margins over CFM (e.g., 77.4 vs. 74.6 in Table 1 for RN-50 source; 42.4 vs. 39.2 for Inc-v3 source; 68.3 vs. 65.2 for RDI-FTM vs. RDI-CFM in Table 3) are close to the noise floor. FTM-E's larger margins are more convincing, but the abstract's blanket claim of 'significant improvements' for FTM itself requires repeated runs (e.g., different random seeds and layer-selection randomizations) or a statistical test.","section":"Section 4.2, Tables 1–3"},{"comment":"The hyperparameters β=0.01, p=0.1, and αmax=0.75 are selected via ablations on the same evaluation benchmark that is used to report the final success rates. Because the averages include the target models used for tuning, the reported absolute gains may be optimistic. A validation-based selection procedure or a sensitivity analysis on a held-out set of target models would strengthen the claim that FTM's improvement is not an artifact of tuning on the evaluation benchmark.","section":"Section 4.3, Figures 4–6"}],"minor_comments":[{"comment":"When Δz_{k,i} is initialized to zero (Algorithm 1, line 2), the normalized term Δz_{k,i}/‖Δz_{k,i}‖ is undefined; please specify the convention (e.g., treat the term as zero when ‖Δz_{k,i}‖=0).","section":"Eq. (11), Algorithm 1"},{"comment":"The sentence 'we report their costs in Table 2' appears to refer to the wrong table; computation times are reported in Tables 1–3 and in the supplementary tables.","section":"Section 4.2, Computational overhead"},{"comment":"There is a typo in 'without increaseing additional optimization steps' ('increaseing' should be 'increasing').","section":"Section 3.3"},{"comment":"For a pure ViT surrogate, 'we select the outputs of all fully-connected layers' is ambiguous because ViT blocks do not have fully-connected layers in the usual convolutional sense; please specify the exact layer selection procedure for ViT.","section":"Section 4.1, Settings for our FTM"},{"comment":"The axes of the left heatmap are not labeled; please state clearly which axis is p and which is αmax, and consider reporting the exact success-rate values in the caption or text.","section":"Figure 6 (left)"},{"comment":"The ensemble operation in FTM-E is not defined; please specify how the two perturbed surrogate copies are combined (e.g., averaging the output logits of the two copies).","section":"Section 3.3, FTM-E"},{"comment":"The heading 'Visualization of targetd adversarial examples' contains a typo ('targetd' should be 'targeted').","section":"Supplementary Section A.5"}],"recommendation":"major_revision","confidential_remarks":"The manuscript fits the scope of an applied computer-vision/security venue. The principal weakness is experimental: the missing random-perturbation control and the absence of repeated-run statistics make the central mechanistic claim under-supported, even though the overall direction is plausible and the code release is a strength. The paper relies heavily on CFM as the primary baseline; the comparison with RAP is confined to Figure 5, and a fuller comparison would help position the contribution. No issues with the citation pattern or novelty disclosure were apparent."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The short version: this is a useful paper and I'd send it to review, but the main mechanism claim is not isolated. FTM extends CFM by adding learnable, layer-wise feature perturbations and a momentum-based stochastic update, plus an ensemble variant. The experiments are broad and honest: 15 target models, multiple surrogates, ViT results, and even a quick multimodal-LLM check, with code released. The gains over CFM are consistent, especially on transformer targets, and the computation overhead over CFM is only about 10%. That is a real, reproducible improvement in a subfield that cares about such baselines.\n\nThe soft spot is exactly what the stress-test flags: no ablation uses fixed, non-learned perturbations with the same normalization and layer schedule. FTM changes two things relative to CFM — it adds a persistent normalized perturbation and it updates that perturbation via gradients. Without a control that freezes the perturbation at random initialization, the improvement could come from the extra stochasticity alone, and the paper's abstract and Section 3.3 attribute the gain specifically to attack-specific optimization. The margins over CFM are sometimes small (2.8 points on the RN-50 source table, 3.2 on Inc-v3), close to the binomial noise floor for 1000 images. So this is a real omission, not a nitpick. It does not invalidate the empirical finding that FTM beats CFM; it just means the stated mechanism is unproven. The authors should add that control, or soften the language to describe the contribution as combining persistent perturbations with stochastic updates.\n\nOther issues are minor in context: single-run numbers without error bars are standard in this literature but still limit confidence, and β, p, and α_max are chosen using the same benchmark used for evaluation. Those are addressable. The one-step approximation to the inner maximization in Eq. (10) is offered without a convergence argument, but for an empirical attack paper that is acceptable.\n\nOverall, I would bring this to a reading group as a solid example of feature-level augmentation, and I would cite it as a strong baseline for targeted transfer attacks. It deserves peer review; a good referee will ask for the random-perturbation control and a discussion of variance, but the core contribution is real.","headline":"Solid incremental attack paper with a consistent win over CFM, but the missing random-perturbation control leaves the headline mechanism under-supported.","tokens_in":20441,"tokens_out":2619,"would_cite":true,"duration_ms":25842,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Feature Tuning Mixup (FTM) learns attack-specific noise inside a surrogate's feature layers and shows it yields targeted adversarial examples that transfer to unseen models substantially better than clean-feature mixup, at near-baseline…","keywords":["transferable targeted attacks","feature-level augmentation","learnable feature perturbations","momentum-based stochastic update","clean feature mixup","adversarial transferability","black-box attacks","ImageNet"],"falsifier":"Two concrete tests would settle the claim. First, rerun the attack with the momentum chain broken: reset $\\Delta z$ to zero at the start of every iteration (or initialize it with fresh random noise) while keeping the one-step update; if transfer success falls back to CFM's level, the momentum-seeded maximization, not the mere presence of learned noise, is what carries the gain. Second, test transfer to a target whose training data shares no classes (or no encoder) with ImageNet, or to an adversarially robust target model; the paper's mechanism predicts FTM's advantage over CFM should persist under such a shift, whereas if the advantage vanishes, the learned perturbations are overfit to the surrogate's feature space. A cheaper corroborating check is to double or halve the inner step count and confirm that success rises only mildly, which would indicate the one-step approximation is near the optimum the paper assumes.","tokens_in":19508,"feed_emoji":"🎯","tokens_out":22718,"duration_ms":182937,"temperature":0.7,"pith_summary":"Transferable targeted attacks ask an attacker to craft an image perturbation on a model it controls, called the surrogate, that will make a completely different, unseen model output a chosen wrong label; the difficulty is that optimizations tuned on the surrogate tend to overfit it and fail elsewhere. The paper argues that the right place to intervene is the surrogate's internal feature layers: instead of mixing in random clean features only, as the Clean Feature Mixup (CFM) baseline does, the attacker should also learn attack-specific feature perturbations that make the crafted image survive feature-level disturbance. The proposed method, Feature Tuning Mixup (FTM), pairs a min-max objective over the image and the feature perturbations with a momentum-based stochastic update, so the extra optimization costs only a single forward-backward pass per attack iteration. In the paper's experiments on CNN and transformer targets, FTM raises targeted transfer success over CFM by about three to twelve percentage points while adding roughly eleven percent to per-image computation time. If the claim holds, black-box targeted attacks become materially stronger at nearly the same cost, and feature-space tuning becomes a viable alternative to image-space augmentation for attack transferability.","feed_headline":"3 to 12 points: learned feature noise lifts attack transfer","feed_subtitle":"Crafted images get a chosen wrong label on unseen models at barely more than baseline cost.","key_machinery":"The load-bearing object is the learnable feature perturbation $\\Delta z_{k,i}$ attached to the output of layer $k$ at attack iteration $i$, optimized by what the paper calls a momentum-based stochastic update. Each eligible layer's output is first rebalanced as $\\bar{z}_{k,i} = z_{k,i} + \\beta\\|z_{k,i}\\| \\cdot \\Delta z_{k,i}/(\\|\\Delta z_{k,i}\\| + \\bar{\\epsilon})$, so the learned noise is scaled to the layer's typical output magnitude, and then mixed with a random clean feature under a channel-wise ratio $\\alpha$ sampled from $U(0, 0.75)$; eligible layers are those whose feature maps are at most a sixteenth of the image size (for a pure ViT, all fully-connected layer outputs). The update rule initializes each perturbation from its previous-iteration value, applies a single gradient-ascent step on the adversarial loss, and stochastically updates only the layers with $\\tau_k < p$ ($p=0.1$), leaving the rest unchanged. This one mechanism supplies the attack-specific optimization that distinguishes FTM from CFM, confines the extra cost to a single joint forward-backward pass, and sets how aggressively the surrogate's feature geometry is disturbed per iteration.","core_discovery":"The central claim is that targeted transfer attacks improve when the surrogate's feature space is disturbed not only by random clean features, as in Clean Feature Mixup (CFM), but by learnable perturbations optimized against the attack's own loss. FTM turns each attack iteration into a min-max problem: minimize the target-class loss over the adversarial image while maximizing it over feature perturbations added to the outputs of eligible layers. To make this tractable, the previous iteration's perturbations seed a single gradient-ascent step, and only a randomly chosen fraction of layers is updated per iteration, so the image gradient and the perturbation gradients come from one forward-backward pass. The perturbed feature is a scale-normalized blend of the layer output and the learned noise, further mixed with a random clean feature under a per-channel ratio. On the ImageNet-compatible benchmark, FTM and its two-copy ensemble FTM-E beat CFM on nearly every target model: with Inc-v3 as the surrogate, average success over ten CNN targets rises from 39.2% with CFM to 42.4% with FTM and 51.2% with FTM-E, and over five transformer targets from 8.9% to 11.5% and 15.3%; with RN-50, CNN averages rise from 74.6% to 77.4% and 79.5%. The paper also shows FTM combines with scale-invariant and Admix augmentations and with surrogate ensembles, and reports in its supplementary evaluation that FTM-E examples crafted on a ViT succeed, on average, 40.5% of the time against four commercial multimodal language models.","pith_inferences":["If the mechanism works by tracking the direction in which the surrogate's feature geometry is most fragile, the same learned-noise recipe could strengthen non-targeted transfer attacks and universal perturbations, since that fragility direction is likely not specific to the target label; the paper does not test either setting.","The method's regime boundary, reported in the paper itself, suggests a testable link: the transfer gain may depend on keeping the perturbed surrogate a functional classifier, so success should correlate with the surrogate's clean accuracy under perturbation rather than with the raw magnitude of the learned noise.","The multimodal LLM results hint that feature-space tuning transfers across model families once a vision encoder is shared; a natural extension would test whether perturbations optimized on one vision backbone succeed against LLMs with different backbones, and whether the same idea works in text or audio feature spaces.","A defensive counterpart follows inversely: if the attack's leverage is the surrogate's feature geometry, then training procedures that flatten or smooth the feature space of deployed models should specifically blunt transfer-based targeted attacks, making the inner maximization in the attack's objective harder; this is an inference about defense, not something the paper evaluates."],"forward_implications":["On the paper's benchmark, RDI-FTM and RDI-FTM-E raise average targeted transfer success over CFM by about three to twelve percentage points, with the largest gains on the hardest targets: from Inc-v3, IR-v2 rises from 36.2% to 52.4% and Inc-v4 from 44.8% to 59.2% with the ensemble.","The gains extend to transformer-based targets: with RN-50 as surrogate, FTM-E lifts the average transformer success rate from 21.8% with CFM to 29.8%, and with Inc-v3 from 8.9% to 15.3%.","The cost stays close to the baseline: RDI-FTM needs about 1.54 seconds per image versus CFM's 1.39 seconds, far below multi-pass methods such as SI (5.95 s) or VT (7.16 s), so the improvement is nearly free relative to augmentation-heavy alternatives.","FTM composes with existing augmentation and ensemble techniques, reaching the paper's best reported result of 74.5% average success when RDI-SI-FTM-E is run with a surrogate that is itself an ensemble of RN-50 and Inc-v3.","The mechanism transfers beyond classifiers in the paper's supplementary evaluation: targeted examples crafted with RDI-FTM-E on a ViT succeed on average 40.5% of the time against four commercial multimodal language models."],"supporting_citations":[{"why":"Introduces the Clean Feature Mixup (CFM) baseline that FTM extends, supplies the pool of random clean features used in the mixup, and provides the success rates against which all of FTM's improvements are measured.","marker":"[3]"},{"why":"Provides MI-FGSM, the momentum-based iterative optimizer whose update equations both CFM and FTM run on, and the momentum idea that FTM's stochastic update adapts for feature perturbations.","marker":"[9]"},{"why":"Shows that a simple logit loss beats cross-entropy for targeted transfer attacks, and supplies the loss function used by FTM and every attack compared in the paper.","marker":"[49]"},{"why":"RAP, the adversarial image-space perturbation method with high computational cost; the paper's Figure 5 comparison against RAP supports its claim of maintaining efficiency.","marker":"[33]"},{"why":"ODI, the object-based diverse input augmentation that is one of the strongest image-space baselines, and whose experimental protocol and settings the paper follows.","marker":"[2]"},{"why":"SU, the self-universality targeted attack whose reported success rates serve as a key baseline that FTM must exceed in the comparison tables.","marker":"[43]"},{"why":"SI, the scale-invariant augmentation used as an image-space baseline and as a stacked component in the combination experiments such as RDI-SI-FTM.","marker":"[29]"}],"fun_headline_variants":["Learnable feature mixup strengthens targeted attack transfer","FTM: Optimized feature noise lifts attack transferability","Feature tuning mixup boosts targeted adversarial transfer","Mixup with tuned features improves transferable attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a single gradient-ascent step per attack iteration, seeded by the previous iteration's perturbations, finds feature noise that genuinely helps the attack transfer to unseen models rather than noise that merely fits the surrogate's own feature geometry; the paper gives no convergence or generalization argument for this step. Its own ablations mark the boundary of that premise: at $p=1.0$, where every layer's perturbation is updated, the clean accuracy of the perturbed surrogate collapses to 3.8% and attack success collapses with it, so the scheme works only while the one-step updates keep the surrogate in a usable regime.","fun_headline_variants_meta":{"raw":{"variants":["Learnable feature mixup strengthens targeted attack transfer","FTM: Optimized feature noise lifts attack transferability","Feature tuning mixup boosts targeted adversarial transfer","Mixup with tuned features improves transferable attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000216,"raw_usage":{"total_tokens":1496,"prompt_tokens":1070,"completion_tokens":426,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":686,"completion_tokens_details":{"reasoning_tokens":366}},"tokens_in":686,"tokens_out":426,"duration_ms":4147,"temperature":1.0,"reasoning_tokens":366,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:09:32.203579+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Two concrete tests would settle the claim. First, rerun the attack with the momentum chain broken: reset $\\Delta z$ to zero at the start of every iteration (or initialize it with fresh random noise) while keeping the one-step update; if transfer success falls back to CFM's level, the momentum-seeded maximization, not the mere presence of learned noise, is what carries the gain. Second, test transfer to a target whose training data shares no classes (or no encoder) with ImageNet, or to an adversarially robust target model; the paper's mechanism predicts FTM's advantage over CFM should persist under such a shift, whereas if the advantage vanishes, the learned perturbations are overfit to the surrogate's feature space. A cheaper corroborating check is to double or halve the inner step count and confirm that success rises only mildly, which would indicate the one-step approximation is near the optimum the paper assumes.","supporting_citations":[{"cited_title":"Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup","cited_arxiv_id":null,"evidence_quote":"Introduces the Clean Feature Mixup (CFM) baseline that FTM extends, supplies the pool of random clean features used in the mixup, and provides the success rates against which all of FTM's improvements are measured."},{"cited_title":"Boosting adversarial at- tacks with momentum","cited_arxiv_id":null,"evidence_quote":"Provides MI-FGSM, the momentum-based iterative optimizer whose update equations both CFM and FTM run on, and the momentum idea that FTM's stochastic update adapts for feature perturbations."},{"cited_title":"On suc- cess and simplicity: A second look at transferable targeted attacks","cited_arxiv_id":null,"evidence_quote":"Shows that a simple logit loss beats cross-entropy for targeted transfer attacks, and supplies the loss function used by FTM and every attack compared in the paper."},{"cited_title":"Boosting the transferability of ad- versarial attacks with reverse adversarial perturbation","cited_arxiv_id":null,"evidence_quote":"RAP, the adversarial image-space perturbation method with high computational cost; the paper's Figure 5 comparison against RAP supports its claim of maintaining efficiency."},{"cited_title":"Improving the transferabil- ity of targeted adversarial examples through object-based di- verse input","cited_arxiv_id":null,"evidence_quote":"ODI, the object-based diverse input augmentation that is one of the strongest image-space baselines, and whose experimental protocol and settings the paper follows."},{"cited_title":"Enhancing the self-universality for transferable tar- geted attacks","cited_arxiv_id":null,"evidence_quote":"SU, the self-universality targeted attack whose reported success rates serve as a key baseline that FTM must exceed in the comparison tables."},{"cited_title":"Hopcroft","cited_arxiv_id":null,"evidence_quote":"SI, the scale-invariant augmentation used as an image-space baseline and as a stacked component in the combination experiments such as RDI-SI-FTM."}],"review_version":1}