{"id":"a99b5acd-b7f8-4d85-be55-bd92a72563cc","arxiv_id":"2411.17936","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A multi-task adversarial attack that selectively degrades a target task while preserving or improving other tasks, using negative loss weights and automated weight tuning.","lead":"This paper presents an attack method that breaks one chosen task in a multi-task neural network while leaving the other tasks working normally. It does this by adding negative weights for the non-targeted tasks and automatically tuning those weights.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The unproven feasibility guarantee for the negative-weight relaxation (Eq. 2) and Algorithm 1 is the load-bearing step: weighted-sum maximizers need not satisfy the non-target constraints in nonconvex problems, and no convergence proof or hyperparameter analysis is supplied.","rationale":"Reader identified the same weakest assumption; I agree. The core novelty is not the multi-task attack per se but the stealthiness claim, i.e., the guarantee or ability to keep non-target tasks at or above baseline. Eq. (2) is not a relaxation in the standard sense because a penalized maximization does not enforce constraints; Algorithm 1 is a heuristic. If feasibility is not certified, an adversary cannot claim stealthiness, and the entire contribution reduces to a particular hyperparameter schedule on two datasets. I also note the paper's abstract promises adversarially trained models but no such experiments appear, and no code or hyperparameters are released; those strengthen the need for conditional verification rather than changing the central direction. The reported tables show many cells where the constraints are satisfied, so the concern is about the unproven guarantee and the uncovered high-perturbation regime, not about fabricated results. A conditional verdict, pending code, hyperparameters, exact feasibility checks, and the missing rows, remains appropriate.","tokens_in":12892,"tokens_out":11312,"duration_ms":95688,"concrete_test":"Run the paper's setup on NYUv2 (or a released reproduction) with Algorithm 1 for a grid of step sizes lambda and attenuation coefficients alpha (e.g., lambda in {0.01, 0.03, 0.1, 0.3, 1}, alpha in {0.1, 0.5, 0.9}), targeting each task at each perturbation epsilon including the missing epsilon=8/255 target-segment cell, and record the fraction of images where any non-target task violates L_i(x+delta) <= L_i(x) or its reported metric worsens. If the violation rate is non-negligible, or if the omitted cells cannot be reproduced with satisfied constraints, the asserted feasibility guarantee fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Methodology asserts: \"When we solve problem (2), we can guarantee to find a solution that is feasible to problem (1) by adjusting the weighting factors manually or using an automated searching method.\" No proof, counterexample analysis, or convergence result is given for this assertion. For a nonconvex deep-network loss, a maximizer of the weighted sum with negative non-target weights is not necessarily feasible for the constrained problem: the positive target gain can outweigh the penalty on an increased non-target loss, and the feasible set may be empty for some inputs and budgets. Algorithm 1's weight updates are a heuristic dual-ascent-like scheme; without monotonicity or stationarity results it does not certify feasibility. The displayed tables do provide some empirical support because many SMTA rows show non-target metrics at or below baseline, but the central guarantee is far stronger than what is demonstrated, and the omitted epsilon=8/255 target-semantic-segmentation rows and unspecified lambda, alpha values leave the strongest regime untested.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SMTA^2, a framework for selective adversarial attacks on multi-task models. It formulates the objective as a constrained optimization problem (Eq. 1) in which the targeted task loss is maximized while each non-targeted task loss must not exceed its clean value, then relaxes this to a weighted-sum maximization with a positive weight on the targeted task and negative weights on non-targeted tasks (Eq. 2). The authors present a manual weight-tuning procedure and an automated procedure (Algorithm 1), and evaluate the framework on NYUv2 and Cityscapes using PGD L2, PGD L∞, and IFGSM attacks, attacking each task in turn. The central empirical claim is that the targeted task is degraded while non-targeted tasks remain at or above baseline performance, and that the automated weight search is comparable in effectiveness to manual tuning.","tokens_in":13100,"tokens_out":5833,"duration_ms":52716,"significance":"If the central claim holds, the paper makes a useful contribution: it introduces a clean evaluation criterion for selective multi-task attacks and demonstrates that negative-weight relaxation can in practice steer perturbations toward a single task. The experimental scope is broad, covering two datasets, three tasks, three attack variants, and two weight-search strategies, and the tables show a fairly consistent pattern of preserved non-targeted metrics. However, the manuscript's central feasibility guarantee for Eq. (2) is asserted without proof, the abstract and conclusion claim experiments on adversarially trained models that do not appear in the experiments, and all performance numbers are single point estimates with no uncertainty quantification. These gaps prevent full acceptance in the current form, but the contribution is potentially publishable after substantial revision.","major_comments":[{"comment":"The statement \"we can guarantee to find a solution that is feasible to problem (1)\" is unsupported. In nonconvex deep-network losses, a maximizer of the weighted sum with negative non-target weights is not guaranteed to satisfy the constraints Li(x+delta) <= Li(x) for i != it: the positive target term can dominate an increase in a non-targeted loss, and the feasible set may be empty for some inputs and budgets. Algorithm 1's update rule is a heuristic with no convergence analysis or monotonicity result, so it does not certify feasibility either. The same applies to the manual method, which is claimed to guarantee feasibility after finite trials. Please either provide a formal guarantee under explicit conditions or rephrase this as an empirical claim, and supplement it with per-sample feasibility statistics (for example, the fraction of test images on which every non-targeted constraint is satisfied).","section":"Methodology, Eq. (2)"},{"comment":"The abstract states that experiments are performed \"on both undefended and adversarially trained models,\" and the conclusion says the framework is validated \"across various multi-task datasets and attack methods,\" but the experiments section contains no adversarially trained model. All reported results in Tables 1-6 appear to use undefended pretrained models. Please add experiments with adversarially trained models or remove the unsupported claim from the abstract and conclusion.","section":"Abstract and Experiments"},{"comment":"All results in Tables 1-6 are single point estimates with no error bars, confidence intervals, or statistical tests. Because the central claim is that non-targeted task performance is \"strictly equal or better,\" the paper should demonstrate that this inequality is not an artifact of a single evaluation subset or random seed. At minimum, report bootstrap confidence intervals over test images or repeated attack runs, and ideally provide a paired test comparing attacked and clean non-targeted metrics.","section":"Tables 1-6"},{"comment":"The automated weight-search method is said to work \"with a proper step size and attenuation coefficient,\" but the paper never reports the values of lambda, alpha, or the number of attack steps S used in any experiment. These hyperparameters determine whether the non-targeted constraints are satisfied, and no sensitivity analysis is provided. Without this information, the reproducibility of the empirical feasibility result is in question, and the claim that the method is substantially more efficient than manual tuning is not fully supported.","section":"Algorithm 1 hyperparameters"}],"minor_comments":[{"comment":"The tables do not explicitly label which row corresponds to which targeted task; the underlining mentioned in the captions is not visible in the rendered text. Please add row labels such as \"target = semantic segmentation\" to make the mapping unambiguous.","section":"Tables 1-6"},{"comment":"Table 7 is captioned \"Example images\" but contains only numerical results. Please either include the actual example images or retitle the table as a quantitative comparison.","section":"Table 7"},{"comment":"The sum notation in Eq. (2) is corrupted in the rendering (\"mX i=1\"); it should be typeset as a standard summation.","section":"Equation (2)"},{"comment":"The paper claims to be the \"first standard and baseline\" for stealthy multi-task attacks, but it does not compare against existing multi-task attack methods such as MTA under a unified setup. A quantitative comparison with prior multi-task attack baselines would make the state-of-the-art claim credible.","section":"Related Work and Experiments"},{"comment":"The references for PGD and IFGSM are nonstandard: Chen and Wainwright 2015 is not the canonical PGD attack reference. Please cite Madry et al. 2018 for projected gradient descent and the original I-FGSM reference by Kurakin et al. 2016.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper has a useful empirical idea, but the core feasibility guarantee is asserted rather than proven and the adversarially-trained-model claim in the abstract is not backed by any experiment. I think the manuscript can be revised within scope by reframing the guarantee as an empirical property, adding uncertainty quantification and hyperparameter details, and either adding defense experiments or removing the unsupported statement. I do not see grounds for rejection, but the current version is not acceptable as is."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The new thing here is the problem definition: a stealthy, selective multi-task attack that degrades one task while keeping the non-targeted tasks at or above their clean performance. As far as I can tell, prior multi-task attacks degrade all tasks, so this framing is a genuine gap. The paper also makes a nice practical observation: negative weights on the non-targeted losses in a weighted-sum attack do most of the preservation work, and the automated weight search matches manual tuning across the board.\n\nWhat the paper does well is the breadth of the empirical evaluation: NYUv2 and Cityscapes, PGD L2/L∞ and IFGSM, manual and automated weight search, and a comparison against single-task attacks. The tables are internally consistent, and the conclusion that automated tuning is comparable to manual tuning is believable.\n\nThe soft spots are concentrated in the methodology. The claim that solving the relaxed weighted-sum problem guarantees a solution feasible for the constrained problem is asserted without proof. For nonconvex deep-network losses that guarantee has no basis; a weighted-sum maximizer can easily violate the non-target constraints. Algorithm 1 is a heuristic with no convergence analysis, and the key hyperparameters (step size λ, attenuation α) are never reported. Relatedly, the stealthiness is partly enforced by construction: Algorithm 1 explicitly adjusts weights so that Li(x+δ) ≤ Li(x), so the near-baseline non-target metrics in the tables are more a check on the algorithm than evidence of an independent property.\n\nThe abstract says experiments were done on adversarially trained models, but all reported experiments use undefended models. That is a real mismatch and should be fixed. No error bars or statistical tests appear anywhere, and some largest-perturbation rows (epsilon=8/255, segmentation targeted) are missing from the tables. None of these flaws sink the empirical claim, which is that the approach works on the tested settings. But the analytical claim of guaranteed feasibility is much stronger than what is demonstrated.\n\nThis paper is for people working on adversarial attacks in multi-task learning or task-aware robustness. It deserves a serious referee, though the authors should be asked to correct the abstract, replace the feasibility guarantee with a properly hedged statement or a proof, report hyperparameters and ideally code, and add variance estimates. I would take it to the reading group, mostly to discuss whether the negative-weight trick is a genuine advance or just a reweighted-loss artefact.","headline":"A useful problem definition and a plausible empirical trick, but the central feasibility guarantee is asserted rather than proved and the paper overclaims adversarial-training coverage.","tokens_in":13605,"tokens_out":2688,"would_cite":true,"duration_ms":25875,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A multi-task adversarial attack can degrade a single targeted task while every other task keeps or improves its performance, by optimizing a weighted loss with negative weights on the spared tasks.","keywords":["multi-task adversarial attack","stealthy attack","constrained optimization","loss-weight tuning","projected gradient descent","iterative FGSM","multi-task learning","semantic segmentation"],"falsifier":"Run the automated weight search on a multi-task model where two tasks have strongly conflicting gradients (for instance, depth estimation and semantic segmentation on Cityscapes) under a larger perturbation budget, and record every non-targeted task's post-attack loss. If any non-targeted loss exceeds its clean value after Algorithm 1 completes its fixed number of steps, the feasibility guarantee is violated and stealthiness collapses.","tokens_in":12716,"feed_emoji":"🎯","tokens_out":7067,"duration_ms":58654,"temperature":0.7,"pith_summary":"Multi-task neural networks share one backbone across several tasks, so an adversarial perturbation aimed at one task usually degrades all of them. This paper claims that an attacker can instead single out one task for degradation while keeping the others at or above their clean performance, a property it calls stealthy. The proposed formulation relaxes a constrained attack problem into a weighted sum of task losses with a positive weight on the targeted task and negative weights on the rest, and an automated rule adjusts those weights during the attack. Experiments on NYUv2 and Cityscapes with PGD and IFGSM show that the targeted task is degraded about as much as in a non-stealthy attack while non-targeted tasks are preserved or improved. If the claim holds, attackers in safety-critical settings such as autonomous driving could sabotage a high-priority task without triggering defenses that monitor other tasks.","feed_headline":"Stealthy attack sabotages one AI task, spares the rest","feed_subtitle":"A weighted-loss scheme damages a chosen task while non-targeted tasks hold or improve their accuracy.","key_machinery":"The load-bearing object is the relaxed attack objective in Equation (2): maximize $\\sum_{i=1}^{m} w_i L_i(x+\\delta, y_i)$ over perturbations $\\delta$ with $\\|\\delta\\|_p \\le \\epsilon$, where $w_{i_t} > 0$ for the targeted task and $w_i < 0$ for every other task. The negative weights turn the preservation of non-targeted tasks into a penalty inside a single gradient-based attack loop, so a standard PGD or IFGSM step on this objective moves the perturbation in a direction that hurts the target and compensates the others. The automated weight-search procedure (Algorithm 1) updates each negative weight in proportion to how far that task's current loss exceeds its clean value, then shrinks the update step for tasks that already satisfy the constraint. The paper asserts, without proof, that adjusting these weights yields a solution feasible for the original constrained problem (Equation 1).","core_discovery":"The paper's central claim is that a multi-task adversarial attack can be made selective and stealthy: the attacker chooses one targeted task, and the perturbation is required to push that task's loss up while every other task's loss stays at or below its clean value. The authors propose the Stealthy Multi-Task Adversarial Attack ($SMTA^{2}$), which encodes this objective as a constrained optimization problem and relaxes it to maximizing a weighted sum of task losses, with a positive weight on the targeted task and negative weights on all non-targeted tasks. They supply two ways to set those weights: manual tuning and an automated per-step update that increases the magnitude of a negative weight when the corresponding task's loss rises above its clean value and attenuates the update once the constraint is satisfied. The paper reports experiments across two multi-task benchmarks and two gradient-based attack algorithms showing that non-targeted tasks maintain or improve their performance while the targeted task is degraded, and that the automated weight search matches manual tuning in attack strength.","pith_inferences":["The feasibility guarantee for the relaxed problem is asserted but not proven; if a task's gradients conflict too strongly with the targeted task, the negative-weight penalty may not suffice, and the attack would collapse into a non-stealthy attack for that instance. A counterexample with three tasks where two share a strong gradient conflict would test this directly.","The abstract states results on adversarially trained models, but the reported experiments only cover undefended models; measuring whether the negative-weight mechanism survives PGD-based adversarial training would clarify the practical threat window.","The same negative-weight trick could be adapted to other constrained adversarial objectives, such as preserving perceptual similarity (a non-target 'task' being a perceptual quality metric) or satisfying fairness constraints during an attack.","Scaling the approach to multi-task models with more than three tasks may require coupling the weight updates, since each added non-targeted task dilutes the influence of the target's positive weight."],"forward_implications":["An attacker can sabotage a security-critical task in a multi-task perception system while leaving auxiliary tasks (e.g., depth, normal estimation) unchanged, making the attack invisible to task-level monitoring.","The automated weight search removes the need for manual hyperparameter scanning, so stealthy attacks can be adapted per input at runtime.","The framework provides a new evaluation criterion for multi-task attacks: attack strength is only meaningful if non-targeted tasks stay at or above their baseline performance.","Because non-targeted tasks can even improve under attack, defenders cannot rely on overall multi-task loss or per-task monitoring to detect these perturbations."],"supporting_citations":[{"why":"Introduces the multi-task adversarial attack (MTA) that this paper extends; supplies the non-stealthy baseline whose collateral damage the authors measure.","marker":"Guo et al. 2020"},{"why":"Provides the projected gradient descent attack and the robust optimization formulation that motivates both the attack and the adversarial training defense mentioned in the abstract.","marker":"Madry et al. 2018"},{"why":"Supplies the iterative fast gradient sign method (IFGSM) used as one of the attack algorithms in the experiments.","marker":"Kurakin, Goodfellow, and Bengio 2018"},{"why":"Cited for the projected gradient descent method used as the PGD attack algorithm.","marker":"Chen and Wainwright 2015"},{"why":"Analyzes adversarial robustness in multi-task learning and defines the perturbation magnitudes the paper treats as strong adversarial attacks.","marker":"Ghamizi et al. 2022"},{"why":"Provides the benchmark settings and dynamic-task-relationship methodology that the experiments follow.","marker":"Liu et al. 2022"}],"fun_headline_variants":["AI attack targets one task, leaves others unharmed","Multi-task AI attacked on just one front","Stealthy attack picks one task, spares the rest","New attack sabotages single task in multi-task AI","Selective attack: damage one task, keep others safe"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Solving the relaxed weighted-loss objective with negative weights on non-targeted tasks always produces a perturbation under which those non-targeted tasks' losses stay at or below their clean values, and the automated weight-adjustment rule is guaranteed to reach such weights.","fun_headline_variants_meta":{"raw":{"variants":["AI attack targets one task, leaves others unharmed","Multi-task AI attacked on just one front","Stealthy attack picks one task, spares the rest","New attack sabotages single task in multi-task AI","Selective attack: damage one task, keep others safe"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000208,"raw_usage":{"total_tokens":1396,"prompt_tokens":927,"completion_tokens":469,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":543,"completion_tokens_details":{"reasoning_tokens":392}},"tokens_in":543,"tokens_out":469,"duration_ms":4663,"temperature":1.0,"reasoning_tokens":392,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T11:40:55.948827+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the automated weight search on a multi-task model where two tasks have strongly conflicting gradients (for instance, depth estimation and semantic segmentation on Cityscapes) under a larger perturbation budget, and record every non-targeted task's post-attack loss. If any non-targeted loss exceeds its clean value after Algorithm 1 completes its fixed number of steps, the feasibility guarantee is violated and stealthiness collapses.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Analyzes adversarial robustness in multi-task learning and defines the perturbation magnitudes the paper treats as strong adversarial attacks."}],"review_version":1}