{"id":"b660445a-3579-4cb2-a7f6-8d69fb766e7a","arxiv_id":"2412.03539","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"Replacing the AdvGAN generator with a Neural ODE and tuning the training perturbation budget raises attack success, perceptual similarity, and black-box transferability on FMNIST and CIFAR-10.","lead":"This paper makes adversarial examples, tiny image changes that fool AI classifiers, using a neural-network version of differential equations instead of the usual step-by-step attacker. The authors report higher attack success and better image quality than standard methods, plus a trick for making attacks transfer from one model to another.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attribution to continuous-time NODE dynamics is untested: with Euler integration and N=5, the generator is a shared-weight residual CNN, and no matched-capacity non-ODE generator is ablated; reported gains could stem from capacity, architecture, or epsilon_train selection.","rationale":"The reader's weakest assumption identifies exactly the load-bearing gap: the paper claims that modeling adversarial generation as a continuous process with a NODE improves attack success, perceptual similarity, and transferability, but it never compares against a non-ODE generator of matched capacity. This matters because the implementation uses Euler integration with only five steps, making the generator mathematically a shared-weight residual network. Without a matched CNN baseline, the reported gains are not attributable to the continuous-time formulation; they could come from increased capacity, the dilated-convolution receptive field, or the careful loss and epsilon_train tuning. The paper does provide useful evidence: a released code repository, systematic sweeps over alpha, beta, N, and epsilon_train, and a consistent comparison to AdvGAN under the same training pipeline. The internal consistency of the tables and the fact that NODE-AdvGAN outperforms AdvGAN at N>=3 suggest the method works empirically, but the scientific claim about dynamics is not yet established. This is an addressable experimental omission rather than a mathematical contradiction, so a conditional verdict is appropriate. No change to the reader's verdict is needed.","tokens_in":18466,"tokens_out":6189,"duration_ms":63590,"concrete_test":"Implement a matched-capacity non-ODE generator: replace the N=5 shared-weight Euler loop with five independent residual blocks using the same 3x3 dilated-conv block architecture, reducing per-block width so the total parameter count matches NODE-AdvGAN's CIFAR-10 generator (about 1.13e5 parameters). Train it with identical losses, hyperparameters (alpha=beta=0.01, c=0.1), clipping at epsilon_train=epsilon=15/255, same epochs, optimizer, and data augmentation. Compare white-box ASR/SSIM/PSNR on VGG16, ResNet34, and DenseNet121 and transfer ASR on VGG19, ResNet18, and DenseNet169, over at least 3 seeds. If the non-shared residual CNN matches NODE-AdvGAN within seed variance, the NODE-specific attribution fails; if it is substantially worse, the ODE formulation is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.2 implements Eq. (3) using Euler integration with N=5 steps and T=0.05. Under Euler's method the generator is exactly a five-step residual map with shared weights: x_{n+1} = x_n + (T/N)F(x_n, t_n). The 'continuous-time' model is therefore a particular parameterization of a discrete residual CNN, not a fundamentally different function class. The only generator comparison is against the original AdvGAN generator, which differs in architecture, depth, and parameter count; no ablation holds capacity or architecture constant. Thus the observed ASR, PSNR, and SSIM improvements could be due to the larger or more expressive generator, the loss tuning, or the epsilon_train scheduling, with no evidence that the shared-weight ODE structure itself is responsible. The NODE-AdvGAN-T transfer gains are additionally confounded because Section 4.2 selects epsilon_train = 10/255 by evaluating transfer ASR on VGG19, ResNet18, and DenseNet169, and the main transfer tables reuse those architectures. Single-run results without error bars further weaken the comparison. The central claim therefore rests on an untested attribution to NODE dynamics.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes NODE-AdvGAN, a GAN-based adversarial example generator whose generator is a Neural Ordinary Differential Equation (NODE) with an Euler integrator, and NODE-AdvGAN-T, a variant that tunes the training-time perturbation clip epsilon_train to improve transferability. The generator models the perturbation process as v_dot(t) = F(t, v, y, Theta_NODE) with v(0)=x and v(T)=x_adv. The method is evaluated on Fashion-MNIST and CIFAR-10 against FGSM, I-FGSM, MI-FGSM, NI-FGSM, and the original AdvGAN, reporting attack success rate (ASR), PSNR, and SSIM for white-box, transfer, untargeted, and targeted attacks. The central empirical claims are that NODE-AdvGAN matches or exceeds AdvGAN in ASR and perceptual similarity, and that NODE-AdvGAN-T substantially improves transfer ASR.","tokens_in":18776,"tokens_out":3104,"duration_ms":32456,"significance":"If the central claims hold, the paper would offer a useful empirical contribution: a generative adversarial attack with strong transferability and better perceptual metrics, with public code and a clearly described architecture in Appendix B. The loss-weight ablation (Figure 3), the N-step ablation (Figure 4), and the epsilon_train ablation (Figure 5) are valuable and the paper gives a concrete, reproducible experiment setup. The large transfer-ASR gains of NODE-AdvGAN-T over NODE-AdvGAN, e.g., 32.46% to 45.56% on FMNIST for VGG16-trained attacks in Table 3, are substantial if they are robust. However, the paper's conceptual claim that the gains come from continuous-time NODE dynamics is not established, because with Euler integration and N=5 the generator is mathematically a five-step shared-weight residual network and no matched-capacity non-ODE generator is compared. The transferability gains are also partly confounded by selecting epsilon_train on the same target architectures used in the final transfer tables.","major_comments":[{"comment":"The paper attributes the improved performance to the continuous-time NODE formulation, but with Euler integration, N=5 steps, and T=0.05, the generator is exactly a five-step shared-weight residual map: x_{n+1} = x_n + (T/N)F(x_n, t_n). Section 4.2 compares only to the original AdvGAN generator, which differs in architecture, depth, and parameter count. No ablation holds capacity or architecture constant. To support the central 'dynamic-system' claim, the authors should add a matched-capacity conventional CNN generator (e.g., a five-block residual CNN with the same channels and parameter count, trained with identical losses and epsilon_train) and show that NODE-AdvGAN outperforms it. Without such an ablation, the observed gains could come simply from a larger or differently structured generator rather than from the ODE structure.","section":"§3.2, Eq. (3)"},{"comment":"The transfer-ASR improvements of NODE-AdvGAN-T are partly a fitted hyperparameter: epsilon_train = 10/255 is selected by measuring transfer ASR on VGG19, ResNet18, and DenseNet169 in Figure 5, and the main transfer tables (Tables 3, 5, and 8) evaluate on those same architectures. The manuscript even notes that VGG19 transfer behavior resembles a white-box attack because of architectural similarity. To make the transferability claim predictive rather than circular, the authors should either select epsilon_train on VGG16 only and evaluate on architectures not used during selection, or report results for a genuinely held-out set of target models and datasets. A statement of how much of the transfer gain remains when epsilon_train is fixed without access to the target architectures would directly address this concern.","section":"§4.2, Fig. 5 and Tables 3, 5, 8"},{"comment":"All reported ASR, PSNR, and SSIM values are single runs with no standard deviations, confidence intervals, or multiple seeds. This is problematic because several comparative claims rest on small margins; for example, in Table 2 the FMNIST white-box ASR for NODE-AdvGAN vs AdvGAN is 99.10% vs 98.66%, and in Table 4 the CIFAR-10 white-box ASR for NODE-AdvGAN vs AdvGAN on VGG16 is 97.54% vs 97.06%. GAN training is stochastic and the ablation plots in Figures 3–5 show sensitivity to hyperparameters. The authors should repeat the main experiments with at least three seeds and report mean ± standard deviation (or an equivalent measure), and should avoid claims of 'consistently' best performance without such evidence.","section":"§4.3, Tables 2–5 and 7–8"}],"minor_comments":[{"comment":"The sentence 'Since our approach differs from the original AdvGAN only in the generator component' is not accurate: the two methods also differ in loss weights, epsilon_train clipping, training schedule, and generator depth. Please qualify this statement.","section":"§4.1"},{"comment":"The name 'Ni-FGSM' appears in several tables and in the text, while the standard name NI-FGSM is used elsewhere; please make the abbreviation consistent.","section":"Throughout"},{"comment":"Reference [43] cites the piqa package but describes it as 'Physical interaction: Question answering'; this description is incorrect. Please cite the actual Python image-quality-assessment package with its correct name and version.","section":"Reference [43]"},{"comment":"Figure 4 reports ASR and PSNR versus N but does not show any measure of variability; please add error bars or at least note that the values are from a single run.","section":"Figure 4"},{"comment":"Algorithm 1 uses the classifier f in training but there is no explicit loss term referencing f in the pseudocode; please clarify that the CW loss inside LCW(G) uses the classifier logits, or add the loss formula to the algorithm block.","section":"§3.3, Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":"The paper is a reasonable empirical study with code availability, but the conceptual novelty — the NODE-based generator — is not isolated from simpler explanations such as increased generator capacity and hyperparameter fitting. The epsilon_train selection procedure in Section 4.2 is a particular concern because the transfer tables reuse exactly the architectures used to choose epsilon_train. If the authors add a matched-capacity non-ODE baseline, report multi-seed statistics, and evaluate NODE-AdvGAN-T on architectures not used for hyperparameter selection, the contribution would be much stronger and could become acceptable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Xinheng, two things you should know about this paper. First, the empirical direction is sound: swapping the AdvGAN generator for a NODE and tuning the training perturbation budget does produce higher ASR and better or similar PSNR/SSIM in most reported settings. Second, the central attribution—that continuous-time dynamics drive the improvement—is not actually tested, and the headline transfer gains partly come from selecting epsilon_train on the same target models used in the final tables.\n\nThe combination is new in the cited literature: a NODE-parameterized generator inside the AdvGAN objective, plus the epsilon_train tuning. The authors also show the tuning trick helps the original AdvGAN, which is a useful sanity check. The experiments are fairly broad: two datasets, six classification models, targeted and untargeted, white-box and transfer, and they released code.\n\nThe soft spots are real but not fatal. With Euler integration and N=5, the NODE is exactly a five-step shared-weight residual CNN. The only generator baseline is the original AdvGAN generator, which differs in architecture and capacity. Without a matched-capacity non-ODE generator, the \"dynamic-system\" explanation is just an analogy; the gains could come from a bigger or differently shaped generator. Second, NODE-AdvGAN-T's transfer numbers are inflated by the selection procedure: Figure 5 sweeps epsilon_train and evaluates transfer ASR on VGG19, ResNet18, and DenseNet169, and the main transfer tables reuse those same architectures. That is fitting a hyperparameter to the test set. Third, all results are single-run, no error bars, which is a minor issue for a paper whose quantitative claims are the whole story.\n\nFor an adversarial-ML reader this is a decent incremental contribution and worth one serious referee pass. The revision should add a matched-capacity non-ODE ablation, report multiple seeds, and either retune epsilon_train on a held-out model or clearly label the reported numbers as selected. I would not desk-reject it; I would send it out with a request for those experiments.","headline":"Competent empirical extension of AdvGAN with a NODE generator and train-time epsilon tuning; the improvement direction is plausible, but the NODE-specific claim is untested and the transfer gains are partly fitted to the test architectures.","tokens_in":19253,"tokens_out":2172,"would_cite":false,"duration_ms":21451,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that replacing the AdvGAN generator with a Neural ODE and tuning training-time noise yields adversarial images that are stronger and less visible.","keywords":["adversarial examples","neural ordinary differential equations","generative adversarial networks","attack transferability","perceptual similarity","white-box attacks","black-box attacks","perturbation budget tuning"],"falsifier":"Train a conventional CNN generator (for example, a ResNet-style or plain convolutional generator) with the same parameter count and loss as NODE-AdvGAN on CIFAR-10 with $\\epsilon = 15/255$, and compare white-box and transfer attack success plus PSNR and SSIM against NODE-AdvGAN and NODE-AdvGAN-T; if the CNN matches or exceeds those numbers, the dynamic-system explanation is not needed.","tokens_in":18241,"feed_emoji":"🎯","tokens_out":9192,"duration_ms":84740,"temperature":0.7,"pith_summary":"The paper tries to establish that an adversarial image is best understood as the endpoint of a continuous evolution, not a one-shot perturbation or a hand-crafted iterative loop. It substitutes a Neural Ordinary Differential Equation (NODE) for the generator of AdvGAN, learning a vector field that gradually turns a clean image into an adversarial one. On FMNIST and CIFAR-10, this NODE-AdvGAN is reported to achieve higher attack success rates than four gradient-based methods and the original AdvGAN while maintaining better or comparable image quality measured by PSNR and SSIM. The companion training strategy, NODE-AdvGAN-T, tunes the perturbation budget used during training (about 10/255) separately from the fixed test budget (15/255), which the paper reports raises transfer attack success substantially on unseen architectures. The stated motivation is that stronger, less visible adversarial examples could be used to train more robust classifiers.","feed_headline":"Neural-ODE generator lifts attack success, preserves image quality","feed_subtitle":"A dynamic-system generator beats gradient attacks and AdvGAN while keeping perturbations imperceptible.","key_machinery":"The central object is a NODE generator: a learnable vector field $F$ that maps the current image state and time to a perturbation direction, integrated by Euler steps to produce $x_{\\mathrm{adv}}$. The image dimensions stay fixed throughout, and the vector field uses dilated 3x3 convolutions with a receptive field of 29 on 32x32 inputs. The second mechanism is budget separation: during training, the generator output is clipped to $[-\\epsilon_{\\mathrm{train}}, \\epsilon_{\\mathrm{train}}]$, while at test time it is clipped to the fixed budget $[-\\epsilon, \\epsilon]$, and $\\epsilon_{\\mathrm{train}}$ is selected by transfer attack success on a surrogate (VGG16) rather than set equal to $\\epsilon$. With Euler integration and $N=5$, the generator is mathematically a five-step shared-weight residual network; the paper argues that the continuous-time interpretation supplies smoothness, learned update rules, and trajectory-based generalization.","core_discovery":"The paper claims that modelling adversarial example generation as a continuous-time dynamical system makes the trade-off between attack strength and imperceptibility come out better than either hand-crafted gradient updates or a static GAN generator. In NODE-AdvGAN the perturbation is produced by a Neural Ordinary Differential Equation, $\\dot{v}(t) = F(t, v, y, \\Theta_{\\text{NODE}})$ with $v(0)=x$ and $v(T)=x_{\\text{adv}}$, where the vector field $F$ is a six-layer dilated convolutional network trained with the AdvGAN losses (Carlini-Wagner attack loss, least-squares GAN loss, and an $L_2$ hinge penalty). Integrated with the Euler method at $T=0.05$ and $N=5$ steps, this generator is reported to beat FGSM, I-FGSM, MI-FGSM, NI-FGSM, and the original AdvGAN in white-box attack success on FMNIST and CIFAR-10 while giving higher PSNR and SSIM. In NODE-AdvGAN-T, the clipping budget used in training, $\\epsilon_{\\text{train}}$, is tuned separately from the fixed test budget $\\epsilon$; choosing $\\epsilon_{\\text{train}} \\approx 10/255$ with $\\epsilon = 15/255$ yields transfer-attack gains of 9.43--29.89 percentage points over NODE-AdvGAN on FMNIST and similar improvements on CIFAR-10, and the same tuning also improves the original AdvGAN.","pith_inferences":["The continuous-time explanation is not yet isolated: with Euler integration and $N=5$, the generator is a five-step shared-weight residual network, so the comparison that would settle the mechanism is a conventional CNN generator with matched parameter count, depth, and loss trained under identical budgets.","The $\\epsilon_{\\mathrm{train}}$ tuning rule resembles a curriculum on perturbation size; an untested implication is that annealing $\\epsilon_{\\mathrm{train}}$ during training, or sampling it per batch, could improve transferability further or remove the need for a separate tuning run.","If trajectory smoothness is the active transferability driver, then randomizing integration time $T$ or step count $N$ at training time may act as a data augmentation over perturbation trajectories and could be tested directly against the fixed $T=0.05$, $N=5$ setting.","The paper's use of a single surrogate (VGG16) to select $\\epsilon_{\\mathrm{train}}$ suggests a cheaper protocol: use one small model to tune the budget, then apply the same budget across diverse target models; an obvious extension is to test whether the chosen $\\epsilon_{\\mathrm{train}}$ transfers across datasets and image resolutions."],"forward_implications":["White-box attacks can be generated in a single forward pass (about 1.08 seconds for 10,000 CIFAR-10 images) at success rates near or above 99% on FMNIST and above 96% on CIFAR-10, while iterative gradient attacks take far longer and achieve lower success.","Training-time perturbation budget is a usable dial for transferability: setting $\\epsilon_{\\mathrm{train}}$ below the test budget $\\epsilon$ improves black-box attack success on architectures not seen during training, and the same dial also improves the original AdvGAN.","Targeted attacks, which are very hard for gradient methods under the paper's settings (roughly 14--22% success on CIFAR-10), can be produced at about 96--97% success with better PSNR than AdvGAN.","Because adversarial examples can be generated quickly at inference time, they are practical as an augmentation source for adversarial training, which the paper identifies as future work."],"supporting_citations":[{"why":"Supplies the AdvGAN generator-discriminator framework and loss configuration whose generator NODE-AdvGAN replaces.","marker":"[13]"},{"why":"Introduces Neural ODEs, the continuous-depth model used as the generator's dynamical core.","marker":"[21]"},{"why":"Provides the Carlini-Wagner attack loss that drives misclassification in the generator objective.","marker":"[25]"},{"why":"Supplies the least-squares GAN objective used for the discriminator and perceptual constraint.","marker":"[34]"},{"why":"Defines MI-FGSM, a momentum-based transfer attack used as a baseline and motivation for learned update rules.","marker":"[12]"},{"why":"Defines NI-FGSM, the Nesterov-style baseline and motivation for learned update rules.","marker":"[5]"},{"why":"Defines FGSM, the single-step gradient baseline the paper compares against.","marker":"[10]"},{"why":"Defines I-FGSM, the iterative gradient baseline that the paper's dynamic-system view generalizes.","marker":"[40]"},{"why":"Defines the structural similarity metric used to support the perceptual-quality claim.","marker":"[42]"}],"fun_headline_variants":["ODE-driven GAN hits higher attack success and image quality","Neural ODE generator sharpens adversarial trade-off","Dynamic-system GAN beats gradient attacks and classic AdvGAN","Tuned noise boosts ODE-AdvGAN black-box transfer","Adversarial examples from a neural ODE: strong and imperceptible"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the continuous-time ODE formulation itself produces the reported gains; the paper does not compare against an ordinary convolutional generator with the same number of parameters, so if such a generator performs equally well, the central claim loses its support.","fun_headline_variants_meta":{"raw":{"variants":["ODE-driven GAN hits higher attack success and image quality","Neural ODE generator sharpens adversarial trade-off","Dynamic-system GAN beats gradient attacks and classic AdvGAN","Tuned noise boosts ODE-AdvGAN black-box transfer","Adversarial examples from a neural ODE: strong and imperceptible"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001,"raw_usage":{"total_tokens":4269,"prompt_tokens":1019,"completion_tokens":3250,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":635,"completion_tokens_details":{"reasoning_tokens":3165}},"tokens_in":635,"tokens_out":3250,"duration_ms":23521,"temperature":1.0,"reasoning_tokens":3165,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T22:17:19.250016+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a conventional CNN generator (for example, a ResNet-style or plain convolutional generator) with the same parameter count and loss as NODE-AdvGAN on CIFAR-10 with $\\epsilon = 15/255$, and compare white-box and transfer attack success plus PSNR and SSIM against NODE-AdvGAN and NODE-AdvGAN-T; if the CNN matches or exceeds those numbers, the dynamic-system explanation is not needed.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the AdvGAN generator-discriminator framework and loss configuration whose generator NODE-AdvGAN replaces."}],"review_version":1}