{"id":"3baa3224-77bc-4a64-889f-527e28cc48bf","arxiv_id":"2412.01495","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Hyperbolic versions of FGM and PGD attacks are proposed, and experiments show that Euclidean and hyperbolic ResNets have different, geometry-specific adversarial vulnerabilities.","lead":"This paper adapts two standard adversarial attack methods to hyperbolic geometry, where models live on a curved space instead of flat Euclidean space. It finds that Euclidean and hyperbolic image classifiers are vulnerable in different ways, and that simply attacking in the model's own geometry does not erase those differences.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Causal attribution to geometry is unsupported: the comparison confounds geometry with optimizer, implementation, and curvature, with no seeds or variance reporting.","rationale":"The reader's weakest assumption correctly identified the lack of control for optimizer, implementation, initialization, and the absence of seeds or error bars. My stress-test agrees that this is the load-bearing gap for the central causal claim. The paper's contributions—a clear hyperbolic FGM/PGD formulation and a first empirical map of robustness differences—are real and worth preserving. The confound does not invalidate the proposed attacks, but it does invalidate the strong causal conclusion that geometry alone drives the observed differences. Since the reader already returned CONDITIONAL, my independent review does not move the verdict; it reinforces the need for the authors to provide multi-seed results and an implementation-matched control (e.g., a curvature-zero limit). The typo in Equation 24 is an additional manifestation of the same rigor problem: a key piece of evidence (Figure 5) is not reproducible as printed, and without code the reader cannot tell whether the figure is computed correctly. If the authors can supply the control experiment and correct the equation, the causal claim would become plausible; until then, CONDITIONAL is the appropriate verdict.","tokens_in":13312,"tokens_out":5368,"duration_ms":49063,"concrete_test":"Train the Euclidean ResNet-32, the Poincaré ResNet-32, and a 'Euclidean-limit' control—the same Poincaré ResNet implementation with curvature c set to 0—each with at least 5 random seeds, using the exact same optimizer settings (Riemannian Adam for all three, which reduces to Adam in the Euclidean limit). Plot mean ± standard deviation of FGSM/PGD robustness curves and misclassification matrices. If the Euclidean-limit control matches the standard Euclidean ResNet, the observed differences are not attributable to geometry per se; if it matches the Poincaré model, the differences trace to implementation or optimizer rather than geometry.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central causal claim is that different geometries cause models to learn distinct vulnerability patterns. The evidence is a single unseeded comparison between a standard Euclidean ResNet trained with Adam and a Poincaré ResNet trained with Riemannian Adam, using separate implementations (Section 6.1). Beyond geometry, these models differ in optimizer dynamics, layer parameterization, normalization, and the curvature hyperparameter c=0.1; any of these, or plain training stochasticity, could explain the accuracy gaps in Table 1 (about 1–2 points) and the misclassification differences in Figure 5. The paper calls the models 'identically trained' while explicitly using different optimizers, and no code or seed variation is provided. Section 6.3's hyperbolic attack is reported to behave nearly identically to the Euclidean attack at small perturbations, so that negative result cannot discriminate geometry from other factors. The printed Equation 24 also defines M^E with the Poincaré model ϕP in both numerator and denominator, making M_comp identically zero; as written, Figure 5 contradicts its own definition. The data support the weaker statement that these particular trained models have different vulnerabilities, but not the causal conclusion about geometry.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Riemannian generalizations of the FGM and PGD adversarial attacks for hyperbolic (Poincaré ball) networks, and uses them to study adversarial robustness of fully hyperbolic versus Euclidean ResNets. On a synthetic disk classification task, the authors compare hyperbolic and Euclidean FGM under several objective functions. On CIFAR-10/100, they train Poincaré and Euclidean ResNets, compare their robustness under FGM, and use a comparative misclassification matrix to argue that the two model families exhibit different class-confusion patterns. They further show that applying their hyperbolic FGM to the Poincaré ResNet does not remove these differences, and conclude that the different geometries cause the models to learn distinct vulnerability patterns.","tokens_in":13570,"tokens_out":2841,"duration_ms":27246,"significance":"The paper addresses a genuinely open problem: adversarial attacks for non-Euclidean networks, where standard Euclidean attacks may be inappropriate. The proposed hyperbolic FGM/PGD are natural and clearly derived as Riemannian gradient steps, and the synthetic experiments provide a useful interpretable demonstration that attack geometry matters. The CIFAR experiments also point to an interesting empirical phenomenon: Euclidean and Poincaré ResNets exhibit different misclassification patterns under the same attack. If the causal conclusion about geometry were established, this would be a notable contribution to geometric deep learning. However, the paper's central causal claim is currently stronger than its evidence: the model comparison confounds geometry with optimizer choice, architecture implementation details, curvature hyperparameters, and training stochasticity, and no error bars or multiple seeds are reported. The paper also contains a definitional error in Eq. (24) that, as written, forces the comparative misclassification matrix to be identically zero. The contribution is promising and likely repairable, but the main conclusion needs substantially more support.","major_comments":[{"comment":"Equation (24) defines M^E_ij using the Poincaré model ϕP in both the numerator and the denominator, rather than the Euclidean model ϕE. Since the denominator is the count of misclassified images and the numerator counts images with y_k = i and ϕP(x_k) = j, this makes M^E = M^P by definition, so M_comp = M^P - M^E is identically zero. This directly contradicts Figure 5, which shows many nonzero entries. This is not a cosmetic typo: the comparative misclassification analysis is central to the paper's empirical claim. Please correct Eq. (24) to use ϕE and rerun/verify the corresponding figures.","section":"§6.2, Eq. (24)"},{"comment":"The statement that 'the shifts in adversarial robustness are due to the models learning distinct patterns resulting from their different geometries' is not supported by the experimental design. In Section 6.1, the Poincaré ResNets are trained with Riemannian Adam while the Euclidean ResNets are trained with Adam; the two model families also differ in layer parameterization, implementation, and the curvature hyperparameter c = 0.1, and no multiple seeds or variance estimates are reported. Table 1 shows clean accuracy differences of 1–2 points, and Figure 5 is qualitative. Any of these confounds, or plain training stochasticity, could explain the observed differences. The data support the weaker statement that these particular trained models exhibit different vulnerability patterns; they do not establish geometry as the cause. Please either add controlled comparisons (e.g., matching optimizers/implementations where possible, multiple seeds with error bars, or an analysis that isolates the geometric component) or weaken the causal claim throughout the paper.","section":"§6.1–§6.3, abstract and conclusion"},{"comment":"The paper proposes hyperbolic PGD in Section 4.2 but never evaluates it on the real network experiments. Section 6.2 only states that Euclidean PGD gives 'nearly identical results as FGM' and therefore only FGM results are shown, and Section 6.3 only applies hyperbolic FGM to the Poincaré ResNets. Since PGD is the standard iterative attack used for robustness evaluation, omitting both Euclidean PGD results and hyperbolic PGD results leaves the central comparison incomplete. At minimum, report the PGD curves (or explicitly quantify the claimed near-identity with FGM) and include hyperbolic PGD in the Section 6.3 comparison.","section":"§6.2–§6.3"},{"comment":"The synthetic results are presented as evidence about the relative potency of hyperbolic and Euclidean attacks, but no error bars or repeated runs are provided, and the text acknowledges that the results are 'highly sensitive to the configuration of the dataset and the model parameters' (Section 5.4). Since only a single synthetic model is trained, the reader cannot tell whether the observed ordering of objective functions and attacks is robust or an artifact of one seed and one hyperparameter choice. Please add variance over multiple synthetic data draws and model initializations, or clearly frame Figure 3 as illustrative rather than as a quantitative comparison.","section":"§5.4 and Figure 3"}],"minor_comments":[{"comment":"The introduction states that the paper investigates 'identically trained Euclidean and hyperbolic ResNets,' but Section 6.1 reports that the Poincaré ResNets are trained with Riemannian Adam and the Euclidean ResNets with Adam. Please use consistent wording, e.g., 'comparably trained' rather than 'identically trained,' or justify why the optimizer difference is immaterial.","section":"§1 and §6.1"},{"comment":"There are typos: 'Futhermore' should be 'Furthermore' and 'oberserve' should be 'observe'.","section":"§5.4"},{"comment":"The phrase 'misclasification matrices' in the text before Eq. (22) should be 'misclassification matrices.'","section":"§6.2"},{"comment":"The step-size matching in Eq. (25) constrains the Euclidean norm in image space, not the hyperbolic distance on the preprocessed input. This is a reasonable choice, but the paper should state explicitly that the two attacks are being compared under a Euclidean perturbation budget in the original image space, and that this is not the same as a hyperbolic-distance budget on the manifold.","section":"§6.3, Eq. (25)"}],"recommendation":"major_revision","confidential_remarks":"The paper is a reasonable candidate for a geometric deep learning venue if the authors can fix the Eq. (24) error and substantially strengthen or appropriately soften the causal conclusion. The lack of seeds/error bars and the omission of PGD results are the main technical barriers. I would not recommend rejection if the authors are willing to reframe the central claim as an observed phenomenon plus a hypothesis, or to run the additional controlled experiments needed to support the causal statement."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper gives a clean, well-explained Riemannian FGM/PGD formulation and an honest comparative study of Euclidean and fully hyperbolic ResNets. The central causal claim—that geometry itself produces different vulnerability patterns—is plausible but not established by the evidence as presented, and there's a typo in Eq. 24 that invalidates Figure 5 as printed.\n\nWhat's new: the hyperbolic FGM/PGD variants are standard Riemannian gradient ascent steps (the math is known from optimization, e.g. Bonnabel), but applying them in this setting with the shortest-path projection and step-size calibration is a sensible and clearly written contribution. The synthetic experiment in Section 5 is a nice didactic demonstration showing when the hyperbolic attack helps and when it doesn't. The comparative misclassification matrix idea is genuinely useful for visualizing class-level vulnerability differences.\n\nWhat it does well: the writing is straightforward and doesn't oversell. The authors run the hyperbolic attack and report that it barely changes the picture because small perturbations are approximately Euclidean—that's an honest null result. Using the Poincaré ResNet from their own prior work as the testbed is appropriate.\n\nSoft spots, in order of severity. First, Eq. 24 as printed defines M^E using the Poincaré model φ^P in both numerator and denominator, which makes M_comp identically zero—contradicting Figure 5. That's clearly a typo (should be φ^E), but as printed the figure is unsupported; needs fixing and ideally re-verification. Second, the causal conclusion about geometry: the comparison in Section 6.1 confounds geometry with optimizer (Riemannian Adam vs Adam), implementation details, and the curvature hyperparameter c=0.1, and there are no seeds or error bars. Calling the models 'identically trained' while using different optimizers overstates the control. The weaker claim—that these particular trained models have different vulnerability patterns—is supported. Third, PGD results are mentioned but not shown; given the paper's title includes PGD, that's a minor omission. No code or data is provided, which makes the Eq. 24 issue harder to verify.\n\nWho this is for: researchers in geometric deep learning who want a first toolset for attacking hyperbolic networks and a cautionary note about evaluation. It deserves a serious referee; with the typo fixed and the causal language scaled back, it would be a solid workshop/short-conference paper. My recommendation: send to peer review, ask for major revision, require error bars or seeds, fix Eq. 24, and either release code or show PGD curves.","headline":"Useful, clearly-written extension of FGM/PGD to hyperbolic space with an honest empirical comparison, but the causal claim about geometry outruns the evidence and Eq. 24 has a typo that undermines Figure 5 as printed.","tokens_in":14042,"tokens_out":2616,"would_cite":false,"duration_ms":21662,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hyperbolic networks fail in different ways than Euclidean networks, and geometry-aware attacks cannot close the gap.","keywords":["hyperbolic deep learning","adversarial attacks","Riemannian geometry","Poincaré ball","adversarial robustness","FGM","PGD","geometric deep learning"],"falsifier":"Train both a Euclidean and a Poincaré ResNet with the same optimizer, learning rate schedule, and ten different random initializations, then compute the comparative misclassification matrix on the same attack; if the cross-model differences in label confusions shrink to within-seed variance, the claim that geometry drives the distinct vulnerabilities is refuted.","tokens_in":13128,"feed_emoji":"🌀","tokens_out":4546,"duration_ms":35495,"temperature":0.7,"pith_summary":"Hyperbolic deep learning promises better representation of hierarchical data, but its security properties are unknown. This paper proposes Riemannian generalizations of the FGM and PGD adversarial attacks, which move the input along geodesics of the Poincaré ball instead of along Euclidean straight lines. Using these attacks, the authors compare fully hyperbolic (Poincaré) ResNets with Euclidean ResNets on CIFAR-10 and CIFAR-100, and find the two model families are vulnerable in different ways: they are easily tricked into different specific misclassifications. Notably, attacking the hyperbolic models with the geometry-aware attacks does not remove these differences, leading the authors to conclude that the adversarial robustness gap comes from the geometry of the learned representations themselves, not from a mismatch of attack geometry.","feed_headline":"Geometry reshapes AI's adversarial blind spots","feed_subtitle":"Hyperbolic attacks don't erase the gap—the models simply learned different patterns.","key_machinery":"The carrying object is the Poincaré ball model of hyperbolic space, with Möbius addition, exponential and logarithmic maps, and parallel transport. The paper defines Riemannian FGM as $\\tilde{x} = \\exp_x(\\alpha \\nabla_x J(\\theta, x, y))$ and Riemannian PGD as a multi-step version with projection onto the constraint set $\\mathcal{S}$ using the shortest path in the hyperbolic distance. These reduce to standard FGM and PGD when the manifold is Euclidean space. The comparative misclassification matrix $M^{\\mathrm{comp}} = M^P - M^E$ is used to visualize which label confusions each geometry is prone to, averaged over models and perturbation sizes.","core_discovery":"On its own terms, the paper's central discovery is that Euclidean and fully hyperbolic networks do not differ merely in degree of adversarial robustness; they differ in kind. A comparative misclassification matrix shows that, for the same attack, a Poincaré ResNet is relatively easily fooled into confusing, say, dogs with cats, while a Euclidean ResNet is relatively easily fooled into confusing trucks with ships. The proposed hyperbolic versions of FGM and PGD behave almost identically to their Euclidean counterparts when the perturbation is small, because the Poincaré ball is locally approximately Euclidean, and they do not close the vulnerability gap even at larger perturbation sizes. The authors conclude that the different geometries cause the models to learn distinct decision patterns, each with its own weaknesses.","pith_inferences":["A natural next experiment is to train both model families with the identical optimizer and multiple random seeds; if the vulnerability patterns collapse to noise, the geometry-causal conclusion would need to be weakened to a training-dynamics effect.","The synthetic toy experiment suggests the relative power of hyperbolic versus Euclidean attacks depends on whether the gradient points toward or away from the origin; a hybrid attack that switches geometry depending on gradient direction could be stronger than either alone.","If geometry is a first-order determinant of failure modes, then robustness certification and adversarial training will likely need to be re-derived for hyperbolic models rather than transferred from Euclidean practice."],"forward_implications":["The proposed hyperbolic FGM and PGD are genuine generalizations: on Euclidean space they reduce to the standard attacks, so they can serve as geometry-agnostic attack baselines for any manifold with a computable exponential map.","Because geometry-aware attacks do not remove the robustness difference, adversarial robustness of hyperbolic models cannot be attributed to the attacks being 'wrong geometry'—the difference is in the learned decision boundary.","The specific label confusions revealed by the misclassification matrix give an interpretable diagnostic for where each geometry fails, potentially guiding defense design for each model family.","Hyperbolic networks show a small robustness advantage under Euclidean attacks, but the size of the advantage depends on depth, so depth and curvature interact with the geometric effect."],"supporting_citations":[{"why":"Defines the Poincaré ResNet architecture under attack and the prior claim of increased adversarial robustness that this paper tests.","marker":"[64]"},{"why":"Supplies the exponential and logarithmic maps and gyrovector structure used to define hyperbolic networks and the proposed attacks.","marker":"[26]"},{"why":"Provides the parallel transport operation on the Poincaré ball needed to move gradients between tangent spaces.","marker":"[63]"},{"why":"Defines the FGM attack that the paper generalizes to Riemannian manifolds.","marker":"[30]"},{"why":"Defines the PGD attack and its projection formulation that the paper generalizes to hyperbolic space.","marker":"[52]"},{"why":"Motivates the exponential-map gradient update used in Riemannian FGM and PGD.","marker":"[6]"},{"why":"Provides the wrapped normal distribution used to generate the synthetic dataset on the Poincaré disk.","marker":"[56]"},{"why":"Defines the ResNet architecture used as the Euclidean baseline.","marker":"[32]"}],"fun_headline_variants":["Hyperbolic attacks can't close geometry's vulnerability gap","Different geometry, different AI blind spots: attacks fail to transfer","Poincaré nets learn distinct flaws that Euclidean attacks miss","Why hyperbolic AI has its own unique weak spots","Geometry dictates AI weaknesses, attacks can't erase the divide"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The causal conclusion assumes that the Euclidean and Poincaré ResNets are comparable except for geometry: the paper trains them with different optimizers (Adam vs. Riemannian Adam), does not report seeds or error bars, and only checks that accuracies are similar, leaving open that the vulnerability differences come from training variation rather than from the geometry itself.","fun_headline_variants_meta":{"raw":{"variants":["Hyperbolic attacks can't close geometry's vulnerability gap","Different geometry, different AI blind spots: attacks fail to transfer","Poincaré nets learn distinct flaws that Euclidean attacks miss","Why hyperbolic AI has its own unique weak spots","Geometry dictates AI weaknesses, attacks can't erase the divide"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000648,"raw_usage":{"total_tokens":2893,"prompt_tokens":781,"completion_tokens":2112,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":397,"completion_tokens_details":{"reasoning_tokens":2033}},"tokens_in":397,"tokens_out":2112,"duration_ms":13771,"temperature":1.0,"reasoning_tokens":2033,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T04:17:19.134745+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train both a Euclidean and a Poincaré ResNet with the same optimizer, learning rate schedule, and ten different random initializations, then compute the comparative misclassification matrix on the same attack; if the cross-model differences in label confusions shrink to within-seed variance, the claim that geometry drives the distinct vulnerabilities is refuted.","supporting_citations":[{"cited_title":"In: Proceedings of the IEEE/CVF International Conference on Computer Vision","cited_arxiv_id":null,"evidence_quote":"Defines the Poincaré ResNet architecture under attack and the prior claim of increased adversarial robustness that this paper tests."},{"cited_title":"Advances in neural information processing systems31 (2018)","cited_arxiv_id":null,"evidence_quote":"Supplies the exponential and logarithmic maps and gyrovector structure used to define hyperbolic networks and the proposed attacks."},{"cited_title":"IEEE Trans- actions on Automatic Control58(9), 2217–2229 (2013)","cited_arxiv_id":null,"evidence_quote":"Motivates the exponential-map gradient update used in Riemannian FGM and PGD."},{"cited_title":"In: International Conference on Machine Learning","cited_arxiv_id":null,"evidence_quote":"Provides the wrapped normal distribution used to generate the synthetic dataset on the Poincaré disk."}],"review_version":1}