{"id":"cadb551a-2e90-4aed-9833-0a7aee061037","arxiv_id":"2412.09795","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Robust accuracy alone is insufficient for comparing deepfake detection models; the proposed robust ratio reveals that models with equal robust accuracy differ in output-probability stability under perturbations.","lead":"The paper proposes a complementary robustness metric, the robust ratio (RR), for deepfake detection models, measuring how much output probabilities change under small input perturbations. It shows that models with similar robust accuracy can differ in this stability measure, which matters when confidence scores guide decisions.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attack-based evaluation does not realize Eq. (2)'s universal quantifier, so the reported RR may not be the defined RR and the central claim is unverified.","rationale":"The reader's weakest assumption identifies the same core issue: the paper defines RR with a universal quantifier over an L2 ball but evaluates it only on a finite set of attack-generated perturbations. My stress-test agrees that this is the single most load-bearing concern. The central claim is empirical: RA is insufficient because two models with similar RA show different RR. If the RR measurement is not faithful to the definition, then the empirical demonstration does not test the proposed metric. This concern is not merely about missing ablations; it concerns the validity of the headline result. The paper does acknowledge in the text that alternative metrics exist and that interaction with them is future work, which is honest but does not repair the definition-measurement gap. A concrete verifier-based test would settle whether the attack-based approximation is adequate. The paper's conceptual idea—that probability-level stability complements label-level accuracy—is reasonable and has independent support in the formal-verification literature, but the execution as presented does not yet establish the claim. Therefore the existing CONDITIONAL verdict is appropriate; no change is needed.","tokens_in":4275,"tokens_out":4554,"duration_ms":55147,"concrete_test":"On a random subset of N=100 FF++ images, compute RR exactly (or with a sound verifier, e.g., auto_LiRPA or a Lipschitz bound) for Meso4, Meso4Inception, and ResNet34 using the same epsilon values as in Fig. 1 and a fixed, explicitly reported b. Compare these verified RR values with the FGSM/PGD/CW-based estimates from Section 3. If the verified RR differs substantially or the model ordering reverses, then the attack-based curves do not support the claim that models have varying RR despite similar RA. If the authors cannot compute a sound upper bound, they should instead report the missing b value and show that the ranking is stable across b and across attack configurations.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that RR reveals differences that RA misses. But Eq. (2) defines phi_rob with a universal quantifier over every delta with ||delta||_2 <= epsilon, and Eq. (3) defines RR as the fraction of samples satisfying that property. Section 3 computes this fraction using only FGSM, PGD, and CW attacks. These attacks produce a sparse set of perturbations and provide no certificate that the property holds for all delta in the L2 ball; they are at best a lower bound/estimate. The plotted RR values in Fig. 1 are therefore not the RR defined in Eq. (3), and the observed 'varying RR' could be an artifact of the particular attacks, their step sizes, or their initialization rather than a property of the models. Moreover, the tolerance settings never specify the value of the output bound b in Eq. (2); the text lists tolerance delta = {0, .01, ..., 0.2}, but Eq. (2) requires both an input-radius epsilon and an output bound b. If b is left unspecified, the condition in Eq. (2) is undefined and the RR values cannot be reproduced or compared across models. Without a sound verification procedure and a complete specification of both tolerance parameters, the paper's headline empirical demonstration is not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that robust accuracy (RA) alone is insufficient to characterize the robustness of deepfake-detection models, and proposes a complementary metric, robust ratio (RR), defined via a formal-verification-style universal condition on the stability of the model's probability output under L2-bounded perturbations. Experiments on image and video data with Meso4, Meso4Inception, and ResNet34 under FGSM, PGD, and CW attacks are reported, and the authors claim that models with similar RA can nevertheless show different RR values as a function of tolerance.","tokens_in":4628,"tokens_out":3042,"duration_ms":34797,"significance":"If the proposed metric were rigorously validated, RR would be a useful addition to the robustness-evaluation toolbox, particularly for high-stakes applications where probability shifts below the misclassification threshold still matter. The link to formal verification (Eq. 2) is conceptually sound and gives the metric a clean definition. The observation that RA can miss output-distribution instability is worth making, and the paper explicitly frames RR as complementary rather than replacement, which is appropriate. However, as presented, the empirical demonstration does not measure the defined quantity, and the missing output-bound parameter prevents reproducibility. The central claim therefore is not yet established, though it is plausibly fixable.","major_comments":[{"comment":"Eq. (2) defines robustness with a universal quantifier over all δ with ‖δ‖₂ ≤ ε, and Eq. (3) defines RR as the fraction of samples satisfying that universal condition. Section 3 computes this fraction only for perturbations produced by FGSM, PGD, and CW. These attacks generate a sparse set of adversarial directions and provide no certificate that the property holds for every δ in the L2 ball, so the plotted RR values are not the RR defined in Eq. (3) unless an explicit approximation statement is added. The manuscript never states that the reported quantity is an attack-based estimate or a lower bound. Please either provide a certified verification (e.g., Lipschitz-based bounds) or explicitly rename the measured quantity to 'attack-based RR' and discuss the gap to Eq. (2).","section":"Section 3, Adversarial Attacks; Eq. (2)-(3)"},{"comment":"Eq. (2) requires two tolerance parameters: the input perturbation radius ε and the output deviation bound b. The Tolerance Settings paragraph lists only δ = {0, .01, .02, ..., 0.2} and describes it as 'tolerance (proportional to the bound)', but the value of b is never specified anywhere in the paper. Without b, the condition |P(Y|x_i+δ,w_i)(ŷ) − P(Y|x_i,w_i)(ŷ)| ≤ b is undefined, and the RR values in Fig. 1 cannot be reproduced, interpreted, or compared across models. Please specify both ε and b for every experiment, or provide the exact mapping from the listed δ values to (ε, b).","section":"Section 3, Tolerance Settings; Eq. (2)"},{"comment":"Eq. (1) defines RA as (1/N) Σ 𝟙(ŷ_i = y_i), which is ordinary accuracy and contains no dependence on adversarial perturbation δ. The surrounding text, however, describes RA as the proportion of predictions that 'remain correct under an adversarial perturbation δ'. As written, Eq. (1) does not measure robustness at all; RA must be defined with respect to perturbed inputs (e.g., ŷ_i = f(x_i + δ)) and the attack/ε used must be stated. This error affects the main comparison framework, since the claim that RA shows similar performance across models is currently a claim about standard accuracy, not adversarial robustness.","section":"Section 2, Eq. (1)"},{"comment":"The video dataset consists of only 5 videos, and no error bars, confidence intervals, or repeated runs are reported for any of the RA or RR results. With n=5, the observed 'more linear relationship' of RR with tolerance for video data (Section 4) and the image-vs-video comparison are not statistically supported. At minimum, add error bars or confidence intervals, and either substantially increase the video sample size or temper the conclusions drawn from the video data.","section":"Section 3, Datasets; Section 4"}],"minor_comments":[{"comment":"The notation δ is used both for the adversarial perturbation in Eq. (2) and for the tolerance level in Section 3; please use distinct symbols (e.g., τ for tolerance) to avoid confusion.","section":"Section 3, Tolerance Settings"},{"comment":"The phrase 'RA, function of only the attack type' is inaccurate: RA also depends on the model, the dataset, and the perturbation bound; please rephrase to reflect the empirical observation that RA is similar across the tested models.","section":"Section 4, first paragraph"},{"comment":"The caption does not explain how RA is aggregated across the three attack methods (FGSM, PGD, CW); please state whether RA is averaged, shown separately, or computed with a specific attack, and describe the curves and markers clearly.","section":"Figure 1"},{"comment":"The attack parameters (e.g., number of PGD iterations, step size, CW confidence, number of restarts) are not reported; without these, the RR computation is not reproducible. Please add the full attack configurations.","section":"Section 3, Adversarial Attacks"},{"comment":"The paper is described as an extended abstract, but it presents a new metric and empirical results; a short 'limitations' paragraph acknowledging the attack-based approximation and the small video dataset would improve clarity and honesty.","section":"Introduction, contributions"}],"recommendation":"major_revision","confidential_remarks":"The central idea is reasonable and the paper's framing of RR as complementary to RA is appropriate, but the empirical gap between the universal definition in Eq. (2) and the attack-based evaluation in Section 3 is load-bearing and must be addressed, as must the missing output bound b and the incorrect RA formula in Eq. (1). These issues are fixable within the scope of the paper, so I recommend major revision rather than rejection. The paper would also benefit from a more careful statistical treatment of the five-video dataset and from explicit attack configurations."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper's basic observation is correct: robust accuracy only records label flips and can miss large probability swings that stay on the same side of the decision boundary. That is worth saying. The proposed robust ratio is a named instance of the standard local robustness property from formal verification, and the authors themselves note that similar metrics exist. So the novelty is modest, but the framing is honest and the definition is standard.\n\nWhat the paper does well: it makes the case that model selection in high-stakes settings might want more than a single accuracy number, and it connects that to an existing formal definition. The empirical comparison, if done properly, would illustrate that point. The authors are also upfront about related metrics like robustness-score and average-confidence-of-class, which is good practice.\n\nWhere it falls short: the experiments do not compute the quantity defined in Eqs. (2)–(3). Eq. (2) is a universal guarantee over all perturbations with ||δ||₂ ≤ ε, but Section 3 evaluates only FGSM, PGD, and CW. Those attacks produce a sparse sample and no certificate, so the reported RR is at best a lower-bound estimate under a handful of attacks, not the universal fraction. Worse, the output bound b is never specified. The 'tolerance δ = {0, .01, ..., 0.2}' suggests input perturbation size, but that leaves b free, and without b the condition in Eq. (2) is undefined and RR cannot be reproduced or compared across models. The video dataset being five clips and the absence of error bars are minor by comparison, but they do not help. The stress-test note is right: the observed variation in RR could be an artifact of the particular attacks or their step sizes.\n\nNet: the conceptual point is reasonable and probably correct, but the empirical demonstration is not established as written. This is fixable—specify b, either use a verifier or clearly state that RR is being estimated with attack-based sampling, and add more data—but as it stands the paper's main claim outruns its evidence.\n\nI would send it to peer review because the concept deserves referee time and the flaws are repairable, but I would expect a major revision before acceptance. I would not cite it in its current form.","headline":"A fair point about robust accuracy's blind spot, but the empirical RR doesn't match the defined RR (attacks vs. universal quantifier, missing b), so the headline claim isn't established.","tokens_in":5024,"tokens_out":2711,"would_cite":false,"duration_ms":28667,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Robust accuracy alone hides how deepfake detectors differ","keywords":["robust accuracy","robust ratio","deepfake detection","adversarial robustness","model evaluation","local robustness","perturbation tolerance","deep learning safety"],"falsifier":"Compute RR exactly for a small set of samples by verifying the local-robustness condition across the full L2 ball (for example through formal verification or dense sampling) and compare it with the attack-based RR. If two models have different attack-based RR but identical verified RR, or vice versa, the empirical core of the paper's claim would be undercut.","tokens_in":4031,"feed_emoji":"🛡️","tokens_out":5471,"duration_ms":52594,"temperature":0.7,"pith_summary":"This paper argues that robust accuracy (RA), the standard metric for adversarial robustness, is insufficient to compare deep-learning models for deepfake detection. The authors introduce robust ratio (RR), which measures the fraction of samples for which an input perturbation with bounded L2 norm leaves the model's probability output within a fixed tolerance. Experiments across three deepfake detectors and three attack types show that models with almost identical RA can have clearly different RR under the same perturbation tolerances. The conclusion is that RA alone hides information about how stably a model's output probability behaves, and RR should be used as a complementary metric in model selection.","feed_headline":"Robust accuracy alone hides how deepfake detectors differ","feed_subtitle":"Complementary metric robust ratio tracks probability shifts under attack, separating models that robust accuracy ties together.","key_machinery":"The robust ratio, defined in Eqs. 2 and 3, is the fraction of test samples satisfying a local-robustness property borrowed from formal verification: the classifier's probability for its predicted class moves by at most b over the entire L2 ball of radius ε around the input. This object carries the argument because it converts robustness into a per-sample stability check on probability outputs rather than a per-sample label check, which is why it can differ between models with the same RA.","core_discovery":"The central claim is that RA measures only whether the predicted label survives a perturbation, while ignoring how much the continuous probability output shifts. RR captures that shift: a sample counts as robust when every perturbation δ with ∥δ∥2 ≤ ε changes the probability of the predicted class by no more than a bound b. Comparing three models (Meso4, Meso4Inception, ResNet34) under FGSM, PGD, and CW attacks on three deepfake datasets, the paper finds RA nearly identical across models while RR varies substantially and depends on the tolerance b. This is presented as evidence that RA is not sufficient and that RR reveals model-specific regions of stable operation.","pith_inferences":["Editorial: The same RA-versus-RR divergence should appear in any classification task where decisions are made from probability outputs, not just deepfake detection, because the mechanism is generic to bounded perturbations of continuous outputs.","Editorial: A natural testable extension is whether models with higher RR also show better output calibration or lower disagreement under noise in deployment; this would connect RR to practical reliability.","Editorial: The paper's attack-based evaluation could be validated or challenged by computing RR exactly on a small subset using formal verification of the L2 ball; if attack-based RR and verified RR diverge, the empirical claims would need to be reinterpreted.","Editorial: The video linearity hypothesis could be isolated by ablating how attacks are applied across frames; confirming it would let RR be predicted from frame-level perturbation schedules."],"forward_implications":["Model selection for deepfake detection should report RR alongside RA to avoid choosing between models that appear equally robust by accuracy only.","RR's dependence on tolerance b gives a way to define an application-specific safe operating region, such as the perturbation level up to which a model's output probability stays trustworthy.","Existing robustness comparisons that rely solely on RA may be incomplete, since they miss probability-level instability that RR detects.","For video inputs, the observed roughly linear RR-versus-tolerance relationship suggests that temporal attack accumulation could be predictable from RR curves."],"supporting_citations":[{"why":"Supplies the formal-verification definition of local robustness that Eq. 2 uses to define RR.","marker":"[13]"},{"why":"Introduces the FGSM attack used to generate adversarial perturbations in the experiments.","marker":"[1]"},{"why":"Introduces the PGD attack used as a second adversarial evaluation method.","marker":"[20]"},{"why":"Introduces the CW attack used as a third adversarial evaluation method.","marker":"[21]"},{"why":"Introduces the Meso4 and Meso4Inception deepfake detection models evaluated in the study.","marker":"[18]"},{"why":"Describes ResNet34, the third model evaluated in the study.","marker":"[19]"},{"why":"Provides the UADFV dataset used to construct image and video test samples.","marker":"[15]"},{"why":"Provides the FaceForensics++ dataset used for image and video samples.","marker":"[16]"},{"why":"Provides the Celeb-DF-v2 dataset used for image and video samples.","marker":"[17]"}],"fun_headline_variants":["Robust accuracy hides key differences in deepfake detectors","Robust ratio separates deepfake models that accuracy ties","Why robust accuracy alone misleads deepfake evaluation","Similar robust accuracy, different robust ratio: what's missing","Robust ratio: complementing accuracy in deepfake robustness checks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Eq. 2 defines RR over all perturbations within an L2 ball, but the experiments evaluate only FGSM, PGD, and CW attacks, so the claim that the measured RR represents the defined RR rests on the unstated assumption that these three attacks stand in for every bounded perturbation.","fun_headline_variants_meta":{"raw":{"variants":["Robust accuracy hides key differences in deepfake detectors","Robust ratio separates deepfake models that accuracy ties","Why robust accuracy alone misleads deepfake evaluation","Similar robust accuracy, different robust ratio: what's missing","Robust ratio: complementing accuracy in deepfake robustness checks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000819,"raw_usage":{"total_tokens":3524,"prompt_tokens":823,"completion_tokens":2701,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":439,"completion_tokens_details":{"reasoning_tokens":2622}},"tokens_in":439,"tokens_out":2701,"duration_ms":21542,"temperature":1.0,"reasoning_tokens":2622,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T16:42:22.509335+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute RR exactly for a small set of samples by verifying the local-robustness condition across the full L2 ball (for example through formal verification or dense sampling) and compare it with the attack-based RR. If two models have different attack-based RR but identical verified RR, or vice versa, the empirical core of the paper's claim would be undercut.","supporting_citations":[{"cited_title":"Celeb-df (v2): a new dataset for deepfake foren- sics [j]","cited_arxiv_id":null,"evidence_quote":"Provides the Celeb-DF-v2 dataset used for image and video samples."},{"cited_title":"Faceforen- sics++: Learning to detect manipulated facial images","cited_arxiv_id":null,"evidence_quote":"Provides the FaceForensics++ dataset used for image and video samples."},{"cited_title":"Bridging formal methods and machine learning with model checking and global optimisation","cited_arxiv_id":null,"evidence_quote":"Supplies the formal-verification definition of local robustness that Eq. 2 uses to define RR."},{"cited_title":"Towards evalu- ating the robustness of neural networks","cited_arxiv_id":null,"evidence_quote":"Introduces the CW attack used as a third adversarial evaluation method."},{"cited_title":"Mesonet: a compact facial video forgery detection network","cited_arxiv_id":null,"evidence_quote":"Introduces the Meso4 and Meso4Inception deepfake detection models evaluated in the study."},{"cited_title":"ResNet 34","cited_arxiv_id":null,"evidence_quote":"Describes ResNet34, the third model evaluated in the study."},{"cited_title":"Exposing deep fakes using inconsistent head poses","cited_arxiv_id":null,"evidence_quote":"Provides the UADFV dataset used to construct image and video test samples."}],"review_version":1}