{"id":"8f4b457c-958b-4674-bde8-c72e7c486baf","arxiv_id":"2411.15555","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A black-box face recognition attack that augments surrogate models with diverse parameter initializations and hard-model feature perturbations, achieving higher transferability.","lead":"Face recognition models can be tricked by adversarial images, and attacks that work on one model often fail on another. This paper trains many surrogates from different starting points and combines them with feature-level perturbations to make attacks transfer more reliably.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The core novelty—random parameter initialization—rests on a confounded ablation: 'Diverse' adds random-init checkpoints to 'Single' without matching ensemble size or compute, so the reported gains may reflect more models, not diverse initialization.","rationale":"I read the paper in good faith: it proposes a two-stage attack, reports large black-box ASR gains over strong baselines on LFW and CelebA-HQ, and includes ablations showing that both DPO and HMA contribute. The central claim, however, is that parameter diversity from random initialization is what drives the improvement. The reader's weakest assumption was about alignment of randomly initialized surrogates with victim feature geometry; my concern is related but more directly testable: the supporting ablation does not control for ensemble size or compute. In Figure 7 (left), 'Diverse' is the union of 'Single' checkpoints and separately trained random-init checkpoints, so it is not an apples-to-apples comparison. A matched-cardinality pretrained-only ensemble is the decisive control. This does not invalidate the empirical results, but it means the paper's distinctive mechanism is not yet isolated from a generic 'more checkpoints' effect. The reader already made the verdict CONDITIONAL, and my analysis reinforces that condition rather than moving to accept or reject. The lack of code and exact HMA layer indices is a secondary reproducibility concern, but the matched-ensemble control is the single most load-bearing check for the central claim.","tokens_in":22400,"tokens_out":7440,"duration_ms":75973,"concrete_test":"Re-run the Figure 7 (left) comparison with matched ensemble cardinality: for each value of c in {5, 15, 25, 35, 45}, let DPA use P pretrained-backbone checkpoints plus R random-init checkpoints, and construct a Pretrained-Only baseline with P+R pretrained-backbone checkpoints obtained from independent fine-tuning runs or denser checkpoint sampling, keeping HMA, attack iterations, epsilon=10, SGD learning rate 0.1, and the c/eta settings identical. If Pretrained-Only achieves ASR within 2 points of DPA on IR152, IRSE50, and FaceNet, the diverse-initialization claim fails; if DPA maintains a clear gap, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central new ingredient is DPO's use of randomly initialized surrogate checkpoints, and the only ablation that isolates this ingredient is Figure 7 (left) in the supplementary, which compares 'Single' (checkpoints from a pretrained backbone with a randomly initialized head) against 'Diverse' (Single checkpoints plus checkpoints from a backbone trained from random initialization). Because 'Diverse' is a strict superset of 'Single' with roughly twice the number of ensemble members and approximately twice the training compute, its higher ASR could be explained by ensembling more models or by a larger total training budget, not by parameter diversity per se. The LGV comparison in Table 2 is similarly confounded: LGV stochastically selects one checkpoint per iteration and does not include the HMA stage, so it does not control for either the number of gradient contributors or the feature-augmentation component. If an equally sized ensemble of pretrained-backbone checkpoints performs as well as DPA, the paper's claim that diverse random initialization improves transferability is not supported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Diverse Parameters Augmentation (DPA), a two-stage transfer attack for face recognition. In the DPO stage, surrogate models are obtained by training from both pretrained and random initializations, and checkpoints are collected at intermediate epochs; in the HMA stage, 'beneficial perturbations' are added to convolutional feature maps of these models to create hard models whose gradients are averaged when crafting a targeted adversarial example. Experiments on LFW and CelebA-HQ report large black-box ASR gains over prior restricted attacks, especially with MobileFace as surrogate, and also report gains under JPEG compression and on adversarially robust victims.","tokens_in":22668,"tokens_out":7412,"duration_ms":67492,"significance":"If the reported gains are reproducible, the paper identifies a useful and inexpensive source of surrogate diversity for transfer attacks on FR: random-initialization training checkpoints, which also sidesteps the unavailability of FR head weights. The empirical pattern is consistent across four surrogate architectures, two datasets, and several victim models, and the method is simple to implement. Credit should be given for the stage ablation in Table 3, the epoch-checkpoint ablation in Table 4, and the breadth of the baseline comparison. However, the central mechanism—diverse random initialization—is not cleanly isolated because the key 'Diverse vs Single' comparison varies ensemble size and compute together, and the LGV comparison in Table 2 additionally varies the aggregation and feature-augmentation components. The HMA stage is taken from the authors' prior BPFA work, so the genuinely new ingredient is DPO, and it needs a matched control. No code, seeds, or error bars are provided.","major_comments":[{"comment":"The comparison that supports the paper's headline novelty is confounded. 'Diverse' is defined as the union of 'Single' checkpoints (pretrained backbone, randomly initialized head) and checkpoints from a randomly initialized backbone and head, so it contains roughly twice as many ensemble members and consumes roughly twice the training compute as 'Single'. The higher ASR of 'Diverse' could therefore be explained by ensembling more models or by a larger total optimization budget rather than by parameter diversity. Please add a matched control: the same number of checkpoints for 'Single' (e.g., denser epoch sampling or multiple training seeds) and comparable total compute, and report the per-condition average ASR and variance over seeds. Without such a control, the central claim that random initialization diversity improves transferability is not established.","section":"Supplementary §7.5, Fig. 7 (left)"},{"comment":"The comparison against LGV is not matched. LGV is implemented with stochastic selection of one checkpoint per iteration and without the HMA stage, whereas DPA aggregates all collected checkpoints and includes HMA; thus the comparison changes at least three variables at once: initialization diversity, number of gradient contributors, and feature augmentation. Table 2 also does not name LGV in the caption or show its configuration. Please compare (i) DPA against LGV with the same number of checkpoint contributors per iteration, (ii) DPA without HMA against LGV with HMA applied to LGV checkpoints, and (iii) report ASR adv under the same protocol. This is required to attribute the Table 2 gain to diverse initialization.","section":"§4.2, Table 2"},{"comment":"The main hyperparameters c and eta are selected on LFW in Fig. 7 and then evaluated on LFW in Tables 1, 5, 6, and 7. This is test-set tuning for the LFW rows, so the reported LFW numbers are optimistic; CelebA-HQ is a useful hold-out, but the selected values are not shown to be optimal there. Please either tune on a validation split (or on CelebA-HQ) and then report LFW, or report sensitivity curves for both datasets. In addition, no error bars or repeated-seed results are reported anywhere, so it is impossible to tell which of the smaller gains in Tables 6 and 7 are significant.","section":"§4.1, §7.2, §7.5"},{"comment":"The HMA component is directly imported from BPFA [74], and the comparison against BPFA in Table 1 is therefore effectively an ablation of DPO on top of a fixed HMA baseline. This is a useful comparison, but the paper should state this explicitly in Section 3.3 and in the contributions. It would also strengthen the attribution to run a full 2x2 ablation (with and without DPO, with and without HMA) and report the interaction; the current Table 3 gives DPO with and without HMA, but not HMA alone in the same table, so the interaction between the two stages is not quantified.","section":"§3.3, Eq. (15)"},{"comment":"The method assumes that 35-epoch randomly initialized checkpoints on BUPT-Balancedface produce surrogate feature geometry aligned with the victim models, but no evidence of this alignment is provided. If those checkpoints are too weak, the DPO ensemble could simply add noise. Please report the clean accuracy of the random-init checkpoints, the transfer ASR when only random-init checkpoints are used, and a feature-space alignment measure (e.g., CKA between surrogate and victim embeddings). This would directly test the mechanism behind the paper's core claim.","section":"§3.2, §4.2"}],"minor_comments":[{"comment":"Equation (8) defines vi, wi = φ(arg min_{v,w} L(x,y), i), but there is no minimization over i; please rewrite to make clear that checkpoints are saved at each epoch and φ extracts the parameters at that epoch.","section":"§3.2, Eq. (8)"},{"comment":"In Eq. (11), κ = ⌊√c⌋ should be defined as an integer; the notation j mod κ = 1 is ambiguous if κ is not explicitly floored, and for c=35 it should be stated that j runs over 1, 6, 11, ... .","section":"§3.2, Eq. (11)"},{"comment":"Algorithm 2 resets s1 only once before the outer loop; since s1 is used as the start index for each model Fi, it should be reset at the beginning of each i-loop, otherwise the segment F^{s1,s2} is undefined for later models.","section":"§3.3, Algorithm 2"},{"comment":"Table 2's caption says 'Baseline' but the text identifies it as LGV; please name LGV in the caption and give its hyperparameter settings and checkpoint-selection details.","section":"Table 2"},{"comment":"Reference [45] contains a typo ('Pytorh' should be 'PyTorch' in the FaceX-Zoo tool name); please correct it.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper's novelty is partly incremental over the authors' own BPFA [74]: the HMA stage is reused from that work and the only new component is DPO. The empirical gains in Table 1 are large enough to be interesting, but the evaluation needs matched controls before publication. I would also ask the editor to pay particular attention to the selection of c=35 and eta=8e-4 on LFW and the subsequent reporting of LFW results, since that is a form of test-set tuning."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"DPA is a good empirical package, but the headline claim about random initialization is weaker than the results look. What is genuinely new is the combination: checkpoint ensembling from both pretrained and randomly initialized surrogates, plus BPFA-style hard-model feature perturbations, applied to face recognition where the classification head is usually unavailable. The numbers are striking—MobileFace as surrogate jumps black-box ASR on IR152 from about 16% to 68%, with consistent gains across datasets and adversarially robust victims. That is real evidence the recipe works.\n\nThe soft spots are real too, and the stress-test concern lands. The only ablation isolating random initialization is Figure 7 (left): 'Single' uses checkpoints from a pretrained backbone with a randomly initialized head, while 'Diverse' adds checkpoints from a fully random-initialized backbone. Diverse has roughly twice the ensemble members and twice the training compute, so the gain could be ensemble size or budget, not parameter diversity per se. The LGV comparison in Table 2 is similarly confounded—LGV is not compute-matched and lacks the HMA component. Also, the hyperparameters c and eta are tuned on LFW and then evaluated on LFW; there are no error bars; the HMA layer selection is not fully specified; and no code is released. The HMA stage is imported from the authors' own BPFA, so the BPFA comparison is more ablation than independent baseline, and the 'first parameter augmentation attack on FR' claim needs a more careful check against existing model self-enhancement methods.\n\nNone of this sinks the paper. Transferability is measured on victim models never used in training, the gains are large, and the method is coherent enough to reproduce in principle. The main missing piece is a disciplined control: an equally sized and equally trained ensemble of pretrained-backbone checkpoints, tested without HMA, to isolate what random initialization actually buys. That, plus holdout-based hyperparameter selection, would make the empirical claims trustworthy.\n\nThis paper is for researchers working on black-box transfer attacks and face recognition robustness. It deserves a serious referee, but the referee should demand the compute-matched ablation and a cleaner evaluation protocol before accepting the mechanistic story. I would send it to review, with major revision expected.","headline":"A strong empirical attack recipe whose central mechanism claim is undercut by a confounded ablation; worth reviewing, not worth taking at face value.","tokens_in":23156,"tokens_out":1876,"would_cite":true,"duration_ms":20551,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that augmenting a face-recognition surrogate with both pretrained and randomly initialized parameters, then ensembling intermediate checkpoints, sharply improves black-box transferability of adversarial face examples…","keywords":["adversarial attack","face recognition","transferability","parameter augmentation","surrogate model ensemble","black-box attack","attack success rate","beneficial perturbation"],"falsifier":"Measure the embedding alignment between the random-init surrogate checkpoints and the victim models on LFW pairs, for example the cosine similarity of normalized embeddings of the same images. If the random-init branch's embeddings are nearly uncorrelated with the victims' while the pretrained branch is strongly correlated, then the reported ASR gain cannot be attributed to parameter diversity; a gradient-alignment check should also show the DPO ensemble's update direction diverging from the direction that fools the victim.","tokens_in":22198,"feed_emoji":"🎭","tokens_out":10020,"duration_ms":86118,"temperature":0.7,"pith_summary":"This paper tries to establish that black-box transferability of targeted adversarial face examples can be dramatically improved by expanding the surrogate model population in parameter space, not just by perturbing inputs or feature maps. The proposed DPA attack trains surrogate face-recognition models from both pretrained and randomly initialized weights, saves checkpoints across training, and then aggregates those models after injecting beneficial perturbations into their feature maps. The authors report that this converts a MobileFace surrogate into a much stronger attacker, lifting black-box attack success on IR152 from 18.4% to 67.7% and on FaceNet from 32.9% to 90.8%, compared with the strongest baseline in the same table. If true, it matters because it shows that a publicly available face recognition model can be used to expose blind spots in other FR systems without access to their heads or weights.","feed_headline":"Diverse surrogate parameters lift face-attack transfer to 90.8%","feed_subtitle":"An attacker with one public face model can fool unseen face recognizers far more often by ensembling varied checkpoints.","key_machinery":"The machinery is the augmented parameter set $V^q_c$ built by DPO plus the hard-model perturbation map $\\chi(F(\\cdot),\\Omega)$ used in HMA. DPO uses an ArcFace-style additive angular margin cosine-similarity loss to train two branches, one from pretrained parameters $(v^p_0, w^p_0)$ and one from random parameters $(v^a_0, w^a_0)$, and collects checkpoints at epochs $j$ with $j \\bmod \\kappa = 1$, giving a diverse ensemble $\\{v^p_0, v^p_1, \\dots, v^p_c\\} \\cup \\{v^a_1, v^a_{j_1}, \\dots, v^a_c\\}$. HMA then treats each checkpoint model as a base and adds $\\omega \\leftarrow \\omega + \\eta \\,\\mathrm{sign}(\\nabla_\\omega \\tilde{L}_{t-1})$ on feature maps $\\omega \\in \\Omega$, where $\\tilde{L}$ is the averaged embedding distance to the target image; this converts normal surrogates into hard surrogates during the attack update. The key idea is that the set of models, not any single model, carries the transferability, and the random-init branch covers parameter regions that pretrained-only augmentation cannot reach.","core_discovery":"The paper's central claim is that the transferability of adversarial face examples is limited by the narrowness of the surrogate model set, and that diversifying the surrogate parameters, rather than only transforming inputs or feature maps, makes the crafted perturbations generalize to unseen face recognition models. Concretely, DPA first applies Diverse Parameters Optimization (DPO): it initializes one branch of surrogate models with pretrained backbone weights and a randomly initialized head, and another branch entirely from random weights, trains both with an additive angular margin loss, and saves checkpoints at intervals across 35 epochs. It then applies Hard Model Aggregation (HMA): for each saved surrogate, it adds beneficial perturbations to selected convolutional feature maps so that the model behaves as a hard model during attack optimization, and averages the resulting losses to update the adversarial image. The paper reports that on LFW with MobileFace as the surrogate, black-box ASR reaches 67.7% on IR152, 98.2% on IRSE50, and 90.8% on FaceNet, with average ASR 59.0% on adversarially robust models; ablations attribute the gain to both the diverse initialization and the hard-model aggregation.","pith_inferences":["Inference: the DPO recipe should generalize to other recognition tasks where the classifier head is proprietary, such as person re-identification, speaker verification, or OCR, by training a small random-init head on a public proxy dataset and ensembling checkpoints.","Inference: the random-init branch may act as a weak ensemble over the loss landscape; a direct test would replace random-init training with multiple pretrained checkpoints from different public models and compare transferability, separating 'diversity of parameters' from 'randomness of initialization'.","Inference: a natural defense to test is adversarial training that includes random-init surrogate ensembles in the inner loop; if the attack's power comes from the diversity of the surrogate set, such training should be more robust than training against any single surrogate."],"forward_implications":["With MobileFace as the only available surrogate, black-box ASR on IR152, IRSE50, and FaceNet reaches 67.7%, 98.2%, and 90.8%, versus the strongest baseline in the same table at 18.4%, 97.3%, and 32.9%.","Average ASR on adversarially robust FR models rises from 7.2% with the LGV baseline to 59.0% with DPA, so the attack transfers to models explicitly trained to resist adversarial perturbations.","JPEG compression at varied quality levels leaves DPA's advantage over the baseline intact on both LFW and CelebA-HQ.","Using intermediate-epoch checkpoints from the DPO training trajectory beats using only final-epoch checkpoints in every reported victim setting, confirming that the diversity of the parameter set is doing the work.","Ablations show each stage contributes: DPO alone lifts ASR above the vanilla surrogate, and adding HMA lifts it further."],"supporting_citations":[{"why":"Supplies the parameter-based augmentation baseline (LGV), whose static pretrained initialization the paper argues limits diversity and which Table 2 compares against.","marker":"[12]"},{"why":"Provides the beneficial-perturbation feature augmentation and hard-model formulation that HMA builds on, and serves as a primary baseline.","marker":"[74]"},{"why":"Defines the beneficial perturbations used to turn normal surrogates into hard models during feature-map augmentation.","marker":"[59]"},{"why":"Supplies the additive angular margin loss and the pretrained-backbone/random-head training formulation used in the DPO stage.","marker":"[8]"},{"why":"Input-diversity augmentation baseline that is among the strongest comparators in Table 1 and is a standard transferability method.","marker":"[62]"},{"why":"Structure-invariant transformation baseline used in the black-box comparisons on LFW and CelebA-HQ.","marker":"[55]"},{"why":"Block shuffle and rotation augmentation baseline used as a comparison and as a representative input-based transfer attack.","marker":"[46]"}],"fun_headline_variants":["Diverse parameters boost face-attack transfer","Diverse surrogate models fool unseen face recognizers","Parameter diversity key to stronger face attacks","Diverse checkpoints improve adversarial face transfer"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a face-recognition surrogate trained from random weights for only 35 epochs on a balanced face dataset, with a randomly initialized head, produces feature geometry aligned enough with victim face models that gradients through the random-init branch still point usefully at the victim's decision boundary; if those checkpoints are too weak or misaligned, the DPO ensemble just adds noise and the reported transferability gain disappears.","fun_headline_variants_meta":{"raw":{"variants":["Diverse parameters boost face-attack transfer","Diverse surrogate models fool unseen face recognizers","Parameter diversity key to stronger face attacks","Diverse checkpoints improve adversarial face transfer"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000912,"raw_usage":{"total_tokens":3947,"prompt_tokens":1000,"completion_tokens":2947,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":616,"completion_tokens_details":{"reasoning_tokens":2892}},"tokens_in":616,"tokens_out":2947,"duration_ms":18460,"temperature":1.0,"reasoning_tokens":2892,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:09:37.057759+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the embedding alignment between the random-init surrogate checkpoints and the victim models on LFW pairs, for example the cosine similarity of normalized embeddings of the same images. If the random-init branch's embeddings are nearly uncorrelated with the victims' while the pretrained branch is strongly correlated, then the reported ASR gain cannot be attributed to parameter diversity; a gradient-alignment check should also show the DPO ensemble's update direction diverging from the direction that fools the victim.","supporting_citations":[{"cited_title":"Lgv: Boosting adversarial example transferability from large geometric vicinity","cited_arxiv_id":null,"evidence_quote":"Supplies the parameter-based augmentation baseline (LGV), whose static pretrained initialization the paper argues limits diversity and which Table 2 compares against."},{"cited_title":"Improving the transferability of adver- sarial attacks on face recognition with beneficial perturbation feature augmentation","cited_arxiv_id":null,"evidence_quote":"Provides the beneficial-perturbation feature augmentation and hard-model formulation that HMA builds on, and serves as a primary baseline."},{"cited_title":"Beneficial Perturbations Network for Defending Adversarial Examples","cited_arxiv_id":"2009.12724","evidence_quote":"Defines the beneficial perturbations used to turn normal surrogates into hard models during feature-map augmentation."},{"cited_title":"Arcface: Additive angular margin loss for deep face recognition","cited_arxiv_id":null,"evidence_quote":"Supplies the additive angular margin loss and the pretrained-backbone/random-head training formulation used in the DPO stage."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Input-diversity augmentation baseline that is among the strongest comparators in Table 1 and is a standard transferability method."},{"cited_title":"Structure invariant transformation for better adversarial transferability","cited_arxiv_id":null,"evidence_quote":"Structure-invariant transformation baseline used in the black-box comparisons on LFW and CelebA-HQ."},{"cited_title":"Boosting Adversarial Transferability by Block Shuffle and Rotation","cited_arxiv_id":null,"evidence_quote":"Block shuffle and rotation augmentation baseline used as a comparison and as a representative input-based transfer attack."}],"review_version":1}