{"id":"35594f4a-7dc9-4a5f-8d1c-14557b59c85f","arxiv_id":"2412.02323","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A Tibetan syllable-level black-box attack using syllable embeddings and a probability-based scoring mechanism successfully fools fine-tuned CINO models, with attack success rates up to 76%.","lead":"The paper presents TSAttacker, a black-box adversarial attack that substitutes Tibetan syllables to fool NLP models into wrong predictions. It evaluates the attack on fine-tuned CINO models for Tibetan news and sentiment tasks, showing they can be misled with only a few syllable edits.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported ASR likely measures all prediction changes, not correct-to-incorrect success; the headline ASR 0.7605 exceeds pre-attack accuracy 0.6731, so it cannot be the success rate implied by the text.","rationale":"The most load-bearing concern is the inconsistency in the primary effectiveness metric, ASR. The paper's own definition promises correct-to-incorrect success, but the numbers force a different interpretation. This is not a subjective quality judgment; it is a verifiable quantitative contradiction that directly affects the abstract's headline result. The reader's weakest_assumption (cosine distance as a proxy for imperceptibility) is also important for the 'high-quality' claim, but it is secondary: even if the adversarial text is imperfect, the attack still reduces accuracy considerably, so the robustness warning survives. The ASR issue instead undermines the stated magnitude of the attack's success. The reader did flag the ASR definition as ambiguous, so there is partial agreement, but the reader did not identify it as the central weakness. A correction of the ASR definition or a recomputation would likely lower the reported success rates substantially, making the paper's claims more modest; however, the ADV values still demonstrate model vulnerability, so a conditional verdict remains appropriate.","tokens_in":11381,"tokens_out":12242,"duration_ms":139761,"concrete_test":"Recompute ASR from the released code using the standard definition: among test samples correctly classified before the attack, count the proportion whose prediction becomes incorrect after TSAttacker. Compare these values with the ASR column in Table 4. If the recomputed values are close to ADV / pre-attack accuracy (e.g., about 0.54 for cino-base-v2+TNCC-title) rather than the reported 0.76, the reported ASR is a prediction-flip rate and the effectiveness claim needs to be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.2 defines ASR as 'the percentage of the attack that successfully fool the victim model,' which in adversarial-attack literature means turning a correct prediction into an incorrect one. The reported numbers contradict this definition. For cino-base-v2+TNCC-title(tsheg), pre-attack accuracy is 0.6731 and post-attack accuracy is 0.3085, so ADV = 0.3646. If ASR were the fraction of all test samples that go from correct to incorrect, ASR could not exceed 0.6731; but it is 0.7605. If ASR were the proportion of originally correct samples that flip, then even with no wrong-to-correct flips the accuracy drop would be ASR*0.6731 = 0.5120, far above the observed 0.3646. The only way to reconcile the numbers is that 0.7605 is the raw fraction of samples whose predicted label changes, including flips between two incorrect classes, while 14.7% of all samples would have to flip from incorrect to correct despite the attack explicitly decreasing P(y_true), which is implausible. The more likely standard success rate, correct-to-incorrect flips among originally correct samples, is approximately ADV/pre-attack accuracy = 0.3646/0.6731 ≈ 0.54 for this row, and similarly lower for all six rows. Thus the abstract's headline 'high attack success rates' is overstated and the central effectiveness claim is weakened.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TSAttacker, a syllable-level black-box textual adversarial attack for Tibetan text classification. The attack selects candidate substitution syllables from fastText embeddings within a cosine-distance threshold dmax and orders substitutions by a probability-weighted saliency score. The authors fine-tune two CINO models on three Tibetan datasets and report accuracy drop (ADV), attack success rate (ASR), and Levenshtein distance (LD), claiming high effectiveness and high-quality adversarial samples. The work targets an important and under-explored area: robustness of NLP models for Chinese minority languages.","tokens_in":11652,"tokens_out":6901,"duration_ms":68848,"significance":"If the claims are substantiated, the paper would be a useful first step in adversarial robustness for Tibetan NLP, providing a reusable attack implementation and an evaluation of CINO's Tibetan components. The syllable-level attack design is linguistically appropriate for Tibetan, since the syllable is a natural granularity between character and word. The paper also releases its code and data, which supports reproducibility. However, the current experimental validation does not yet meet the standard needed to support the headline claims: the ASR metric is internally inconsistent with the formal definition, there is no baseline comparison, and sample quality is measured only by edit distance.","major_comments":[{"comment":"The success condition used in the algorithm and the formal definition are inconsistent. Eq. (2) defines a successful attack as F(x') != y_true, but the pseudocode (Algorithm 1, line 22) and the text in Section 3.2.2 use F(x') != F(x), i.e., any change in the predicted label. This directly affects the reported ASR. For cino-base-v2+TNCC-title(tsheg), pre-attack accuracy is 0.6731 and post-attack accuracy is 0.3085, so if ASR were the fraction of all samples that flip from correct to incorrect, it could not exceed 0.6731, yet the reported ASR is 0.7605. If ASR were the fraction of originally correct samples that flip, the implied accuracy drop (ASR * 0.6731 ≈ 0.51) would far exceed the observed ADV of 0.3646. The only way to reconcile the numbers is that ASR counts all prediction changes, including changes between two incorrect labels (and even incorrect-to-correct changes). The authors must align the implementation with Eq. (2), recompute ASR accordingly, or explicitly redefine ASR as a prediction-change rate and revise the claim of a high attack success rate.","section":"Section 3.2.2, Appendix A, Section 4.2, Table 4"},{"comment":"No baseline comparison is provided. The paper reports ADV, ASR, and LD for TSAttacker only, without comparing to random syllable substitution, a greedy synonym attack, or any existing adversarial attack adapted to Tibetan. Without a baseline, the claim in the abstract that TSAttacker is effective is not statistically substantiated; a random perturbation under the same dmax and query budget might achieve comparable results. At minimum, the authors should add a random-substitution baseline and report query counts, so that the contribution of the scoring mechanism and cosine-distance candidate selection can be isolated.","section":"Section 4.2"},{"comment":"The quality of adversarial samples is judged solely by Levenshtein distance. LD measures edit distance, not perceptual, phonetic, or semantic similarity; two substitutions at the same LD can be visually or semantically very different. For TNCC-document, the average LD is 39.18 and 41.97, which is non-trivial even relative to the average length of 689 syllables. The paper provides no human evaluation, fluency scores, or meaning-preservation metrics, so the claim that TSAttacker generates high-quality adversarial samples is not adequately supported. The authors should add human judgments or at least a semantic similarity metric (e.g., BERTScore or embedding similarity) alongside LD.","section":"Section 4.2, Appendix B"},{"comment":"Table 3 contains duplicated rows: cino-large-v2+TNCC-document(space) and cino-large-v2+TNCC-document(no space) have exactly the same accuracy, macro-F1, and other metrics as the corresponding cino-base-v2 rows (0.7380/0.6985/... and 0.7435/0.6967/...). This is almost certainly a copy-paste error and makes the evaluation of cino-large-v2 on TNCC-document incomplete. The authors must correct the table and, if the large-model fine-tuning was actually performed, report the correct numbers.","section":"Table 3"},{"comment":"The default value of dmax (0.2929) is chosen without a principled justification, and the ablation in Section 4.3 only examines three values (0.1340, 0.2929, 0.5) without a clear criterion for the default. Since dmax controls the candidate pool and, through it, the trade-off between attack success and sample quality, the authors should justify the chosen default (e.g., via a validation set) and report the sensitivity of the main results to this parameter, ideally with error bars over multiple runs.","section":"Section 4.2, Section 4.3"}],"minor_comments":[{"comment":"The x-axis labels in Figure 1 appear as '0.1 340', '0.2 929', and '0.5' instead of the intended '0.1340', '0.2929', and '0.5'.","section":"Figure 1"},{"comment":"The sentence 'ASR refers to the percentage of the attack that successfully fool the victim model' is ambiguous; after addressing the metric inconsistency, this definition should be restated precisely.","section":"Section 4.2"},{"comment":"In Algorithm 1, line 12 reuses the notation ΔP_i inside the inner loop, overwriting the value; the pseudocode should use ΔP_{ij} to match Equation (6).","section":"Appendix A"},{"comment":"The adversarial samples in Appendix B are shown with placeholders in the provided text; ensure the actual Tibetan script is rendered and that the bold/red marking of substituted syllables is visible in the final PDF.","section":"Appendix B"},{"comment":"The related work on English textual attacks is somewhat dated; adding recent methods such as BERT-Attack or genetic-algorithm-based attacks would improve the survey, though this is not critical.","section":"Section 2"},{"comment":"The hyperparameter table does not report the number of training steps or the early-stopping criterion; adding these would improve reproducibility.","section":"Section 4.1.2"}],"recommendation":"major_revision","confidential_remarks":"The ASR inconsistency is the most serious issue: the reported ASR values are not compatible with the formal definition in Eq. (2), and the pseudocode reveals why. This is likely to be a definitional misunderstanding rather than fraud, but the authors must recompute the metric and resubmit. The duplicated rows in Table 3 are hard to explain as anything other than a copy-paste error; please ask the authors to verify all Table 3 entries. The absence of baselines is a severe weakness for a paper whose central contribution is an attack method; the revision should include at least a random-substitution baseline. Overall, the paper addresses an interesting and underserved problem, and there is a plausible core contribution, so a major revision is appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe useful thing here is that this is the first textual adversarial attack aimed at Tibetan, at syllable level, and it evaluates the CINO multilingual PLM for Tibetan. The attack itself is a straight adaptation of established components: fastText nearest-neighbor substitution (TextFooler-style) with probability-weighted saliency ordering (PWWS). That doesn't make it worthless — the adaptation to Tibetan syllable boundaries is real work, and the open-source intent (though verify the repo actually has a commit) plus the dmax ablation are good practice.\n\nThe problems are in the evaluation. The headline ASR numbers don't parse. For cino-base-v2+TNCC-title, pre-attack accuracy is 0.6731 and post-attack accuracy is 0.3085, so ADV = 0.3646. They report ASR = 0.7605. If ASR meant what the text says — the percentage of attacks that 'successfully fool the victim model' — it would be the fraction of originally correct samples flipped to wrong. That number can't exceed pre-attack accuracy, and moreover ADV = ASR * pre_acc in the no-back-flip case. Here 0.7605 * 0.6731 = 0.5120, far above the observed 0.3646. So the reported ASR is almost certainly the raw fraction of test samples whose prediction changed at all, including wrong-to-wrong and even wrong-to-correct flips. The standard correct-to-incorrect success rate is roughly ADV / pre-accuracy ≈ 0.54 for that row. Still a meaningful attack, but not the 'high attack success rate' claimed. This needs to be fixed with a clear definition and recomputed numbers.\n\nAlso soft: no baseline (e.g., random syllable substitution) to show the saliency and cosine selection add value. Table 3 has identical rows for the (space) and (no space) conditions across the two CINO sizes — looks like a copy-paste error. Quality is judged only by Levenshtein distance; no human rating or semantic checks for 'high quality.' The ablation on dmax shows the expected monotonic trend, which is fine but doesn't resolve the similarity-quality question.\n\nThe math of the attack itself is sound — the saliency and ΔP computations are standard and correctly executed. The citation pattern to TextFooler, PWWS, CINO, and fastText is appropriate; they aren't hiding their sources.\n\nBottom line: this is a genuine first step for Tibetan robustness. It deserves peer review, but the revision needs to fix the ASR definition, add a baseline, and clean up Table 3. I'd send it to a workshop or an NLP robustness venue rather than a flagship, but it's a legitimate submission. If you're working on low-resource or minority-language robustness, it's worth a quick look; otherwise, it's not going to change how you think about attacks.","headline":"First Tibetan syllable-level attack, but headline ASR is miscalculated; core attack still works but needs metric fixes and baselines.","tokens_in":12183,"tokens_out":3105,"would_cite":false,"duration_ms":32725,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Syllable swaps cut Tibetan model accuracy by up to 38.6 points","keywords":["Tibetan NLP","textual adversarial attack","syllable-level attack","black-box attack","CINO","robustness evaluation","cosine distance","minority languages"],"falsifier":"Run a native-speaker evaluation in which Tibetan readers rate the fluency and semantic fidelity of the released adversarial samples; if they consistently identify the substituted syllable or judge the text unnatural, the high-quality claim is refuted. Alternatively, replace the cosine-distance candidate selection with random syllables that match each original's Levenshtein distance; if random substitution achieves comparable attack success rates, then the embedding-based selection is not the cause of the reported vulnerability.","tokens_in":11168,"feed_emoji":"⚔️","tokens_out":8823,"duration_ms":83686,"temperature":0.7,"pith_summary":"TSAttacker is a black-box textual adversarial attack that perturbs Tibetan text one syllable at a time and, the paper argues, fools fine-tuned classifiers reliably. The paper applies it to six models built from CINO, a multilingual pre-trained language model that includes Tibetan, across news-title, news-document, and sentiment tasks, and reports large accuracy drops and high attack success rates in every case. The low average Levenshtein distance of the perturbed texts is offered as evidence that the adversarial samples are high-quality, implying that defenders cannot simply filter them by edit distance. The motivation is that robustness research has concentrated on English and Chinese, leaving Chinese minority languages such as Tibetan without adversarial stress tests. If the attack works as described, it gives the community a concrete way to measure Tibetan NLP robustness and argues that the involved models need strengthening.","feed_headline":"Syllable swaps cut Tibetan model accuracy by up to 38.6 points","feed_subtitle":"A black-box attacker fools six fine-tuned CINO models by swapping a few near-identical Tibetan syllables.","key_machinery":"The load-bearing mechanism is a syllable-substitution loop with two governing quantities. First, the candidate pool is fixed by syllable cosine distance in a pretrained Tibetan syllable embedding space: a candidate $s'$ is admissible only if $d = 1 - \\frac{s \\cdot s'}{|s||s'|} \\le d_{\\max}$, with $d_{\\max} = 0.2929$, so replacements stay near the original in that geometric space. Second, the substitution order is set by a probability-weighted saliency score $H_i = \\mathrm{softmax}(S_i) \\cdot \\Delta P_{i*}$, where $S_i$ is the drop in true-class probability when syllable $i$ is masked and $\\Delta P_{i*}$ is the largest probability drop achievable by any admissible replacement. The procedure queries only the victim model's output probabilities, which is what makes it a black-box attack.","core_discovery":"The paper's central claim is that a syllable-level, query-only attack consistently lowers the accuracy of fine-tuned Tibetan text classifiers while keeping the perturbed syllables close to the original in an embedding space. For each syllable in an input, TSAttacker forms a candidate set from pretrained Tibetan syllable embeddings whose cosine distance to the original is at most $d_{\\max} = 0.2929$ (a 45-degree angle), then selects the replacement that most reduces the probability of the true class, ordering substitutions by a softmax-weighted saliency score. On the TNCC-title test set the procedure drops cino-base-v2 accuracy from 0.6731 to 0.3085 (an accuracy drop value of 0.3646) with an attack success rate of 0.7605, and the other five models show drops of at least 0.2240. The article also reports that models fine-tuned on orthographically standard Tibetan text with tsheg separators perform better than models trained on space- or no-space variants, and it concludes that CINO's Tibetan robustness has considerable room for improvement.","pith_inferences":["The same attack recipe could transfer to other syllable-based Chinese minority languages, such as Mongolian or Uyghur, whenever a syllable embedding table exists; the paper does not test this transfer.","A human judgment study would probably narrow the candidate pool further, because embedding cosine distance is neither phonetic nor visual; adding such a filter could make the attack both stronger and more clearly imperceptible.","Adversarial training on TSAttacker examples, or fine-tuning on tsheg-standard corpora, is a natural defense to test next; the paper evaluates attacks only, so the defender's side remains open.","The observation that larger models are not always more robust suggests that tokenization and training-data quality may matter more than parameter count for minority-language robustness, a hypothesis the paper leaves implicit."],"forward_implications":["The released attack and code give future Tibetan NLP work a standard baseline for robustness evaluation, allowing researchers to compare defenses and model variants against a common adversary.","The accuracy drops on all six fine-tuned CINO models imply that current Tibetan classifiers are not yet safe for high-stakes deployment without adversarial defense.","The attack succeeds on short titles, long documents, and sentiment texts, so the vulnerability appears to be general across Tibetan text classification rather than limited to one task length.","Because average Levenshtein distances are low (about 1.6 syllables for titles and under 3 for sentiment texts), simple edit-distance-based adversarial filters would miss many of these attacks.","The tsheg-standard fine-tuning comparison suggests that following Tibetan orthographic conventions during training improves model performance, a lesson for future dataset construction."],"supporting_citations":[{"why":"Supplies the pretrained Tibetan syllable embeddings whose cosine distances define the candidate substitution set.","marker":"Grave et al. (2018)"},{"why":"Provides CINO, the Chinese minority multilingual pre-trained language model that is fine-tuned to create the six victim models.","marker":"Yang et al. (2022)"},{"why":"Supplies the TNCC-title and TNCC-document news classification datasets on which attack effectiveness is measured.","marker":"Qun et al. (2017)"},{"why":"Supplies the TU_SA Tibetan sentiment dataset, the third downstream task used for evaluation.","marker":"Zhu et al. (2023)"},{"why":"Defines the probability-weighted word saliency scoring formula that sets the syllable substitution order.","marker":"Ren et al. (2019)"},{"why":"Defines word saliency through representation erasure, used here to score each syllable's importance before substitution.","marker":"Li et al. (2016)"},{"why":"Describes the fastText system used to train the Tibetan syllable embeddings that drive candidate selection.","marker":"Joulin et al. (2016)"}],"fun_headline_variants":["Syllable swaps tumble Tibetan model accuracy by 36 points","Black-box Tibetan syllable attack fools six fine-tuned NLP models","Query-only attack exploits Tibetan syllable similarity to cut accuracy","Tibetan minority language models exposed by syllable-level adversarial attack","New black-box attack reveals large robustness gap in Tibetan NLP"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire method leans on the premise that cosine distance in a syllable embedding space captures what a Tibetan reader would accept as a subtle, meaning-preserving substitution; if that premise fails, the generated texts may look wrong to native speakers even though they meet the geometric threshold.","fun_headline_variants_meta":{"raw":{"variants":["Syllable swaps tumble Tibetan model accuracy by 36 points","Black-box Tibetan syllable attack fools six fine-tuned NLP models","Query-only attack exploits Tibetan syllable similarity to cut accuracy","Tibetan minority language models exposed by syllable-level adversarial attack","New black-box attack reveals large robustness gap in Tibetan NLP"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000785,"raw_usage":{"total_tokens":3472,"prompt_tokens":964,"completion_tokens":2508,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":580,"completion_tokens_details":{"reasoning_tokens":2424}},"tokens_in":580,"tokens_out":2508,"duration_ms":21794,"temperature":1.0,"reasoning_tokens":2424,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T23:35:08.596454+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a native-speaker evaluation in which Tibetan readers rate the fluency and semantic fidelity of the released adversarial samples; if they consistently identify the substituted syllable or judge the text unnatural, the high-quality claim is refuted. Alternatively, replace the cosine-distance candidate selection with random syllables that match each original's Levenshtein distance; if random substitution achieves comparable attack success rates, then the embedding-based selection is not the cause of the reported vulnerability.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides CINO, the Chinese minority multilingual pre-trained language model that is fine-tuned to create the six victim models."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the TNCC-title and TNCC-document news classification datasets on which attack effectiveness is measured."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the TU_SA Tibetan sentiment dataset, the third downstream task used for evaluation."}],"review_version":1}