{"id":"3c2c17d5-4c70-4351-b4aa-786ea2b7ea6e","arxiv_id":"2412.11168","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A classic PGD attack with a dynamic step-size schedule and an adaptive early stop attains 100% success with l2 distance 0.89 and l_infinity=1/255 on ImageNet classifiers, outperforming specialized imperceptible attacks.","lead":"This paper shows that a simple version of the classic PGD attack, using a gradually increasing step size and stopping as soon as the attack succeeds, can create adversarial images with very small, nearly invisible changes. The authors claim this makes complex perceptual modules unnecessary and beats specialized imperceptible-attack methods in image quality and speed.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported imperceptibility metrics are mutually inconsistent with the algorithm's own 8-bit rounding, so the headline SOTA numbers cannot be taken at face value.","rationale":"The reader's weakest assumption identifies the early-stop heuristic as an unproven optimization-landscape claim. That is a fair secondary concern, but the more load-bearing issue is internal inconsistency in the reported metrics. The algorithm explicitly rounds to 8-bit images and stops when the l∞ distance first reaches 1 gray level. With that constraint, standard l2, l∞, and PSNR values are tightly coupled: a nonzero integer perturbation has l2 at least 1 in raw units, and PSNR is determined by the sum of squared differences. The reported combination l2=0.89, l∞=1/255, PSNR=52.93, and 100% ASR is mathematically impossible under standard definitions for 224×224 images. This is not a disagreement with the community's consensus; it is a correctness check that fails from the paper's own description. If the metrics are computed in a non-standard way, every quantitative comparison in Tables I and II is called into question, including the central claim of state-of-the-art imperceptibility. The test I propose would settle the issue by recomputing the metrics from the algorithm's returned images. My verdict adjustment to REJECT reflects that the current evidence is internally inconsistent; the paper could potentially be revised with corrected metrics and code, but as written the headline empirical claim is not verifiable. I agree partially with the reader because their concern about the early-stop heuristic is real and related, but the metric inconsistency is more fundamental and should be resolved first.","tokens_in":9339,"tokens_out":8419,"duration_ms":73317,"concrete_test":"Reimplement Algorithm 1 exactly on the NIPS 2017 1000-image set with ResNet-50 (or run the authors' code if released), and for each returned xadv compute l∞ = max|xadv−x|/255, l2 = sqrt(Σ(xadv−x)^2), and PSNR = 10·log10(255²/MSE). Then verify: (1) every successful xadv has at least one nonzero pixel difference, so l2 ≥ 1 (raw) and l∞ ≥ 1/255; (2) whether the reported means l2 = 0.89, PSNR = 52.93, and l∞ = 0.004 can be reproduced simultaneously under these definitions; (3) record the actual iteration count and perturbation at the stop point. If the reported means do not reproduce, the headline metrics are artifacts and the SOTA claim is unsupported as stated.","verdict_should_be":"REJECT","load_bearing_attack":"Algorithm 1 returns xadv = round(xt+1) as soon as ||xnow−x||∞ ≥ 1 and the model is fooled (lines 9–14). Since x and xnow are 8-bit images, every changed pixel differs by an integer number of gray levels. Under the standard l2 and PSNR definitions used in the comparisons, a perturbation with l∞ = 1/255 has at least one pixel changed by ±1, giving l2 ≥ 1 in raw [0,255] units (or ≥ 1/255 in normalized units) and PSNR near 95 dB for a single-pixel change. The paper reports l2 = 0.89 and PSNR = 52.93 with 100% ASR for the same attack. These cannot hold simultaneously: l2 = 0.89 implies sum of squared differences ≈ 0.79, which would give PSNR ≈ 96 dB, while PSNR = 52.93 implies MSE ≈ 0.331 in 8-bit units, which would give l2 ≈ 128.9 on 224×224 images. Thus the reported metrics are not computed on the returned 8-bit adversarial images under standard definitions, or they use a non-standard scaling that invalidates comparisons with AdvDrop, PerC-AL, and SSAH. The l∞ = 1/255 with 100% ASR claim is also extraordinary: it requires all 1000 ImageNet images to misclassify at the first iteration at which a single gray level changes, which is not plausible for standard classifiers. The central SOTA claim therefore rests on an unresolved metric/evaluation inconsistency, not merely on an unproven optimization heuristic.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PGD-Imp, a modification of the classic PGD attack for imperceptible adversarial examples. It replaces the fixed step size with a dynamic, schedule-based step size that sums to the l-infinity budget, and it adds an adaptive early-stop criterion that checks the model prediction on the rounded 8-bit image, halting as soon as the attack succeeds. The authors argue that external perceptual modules are unnecessary and report state-of-the-art ASR, l2, l-infinity, PSNR, SSIM, FID, and LPIPS results on the NIPS 2017 ImageNet-compatible dataset for untargeted and targeted attacks against ResNet-50, VGG-19, MobileNet-V2, and WideResNet-50.","tokens_in":9715,"tokens_out":18830,"duration_ms":166017,"significance":"If the reported results hold, the paper is a useful conceptual simplification: a carefully scheduled PGD with early stopping can match or beat perception-oriented attacks while being substantially faster. The ablations in Tables III and IV are informative and support the contribution of each proposed component. I also verified that the reported l2 = 0.89 and PSNR = 52.93 are internally consistent under the standard [0,1] normalization (MSE approximately 5.3e-6, PSNR approximately 52.8 dB), so the apparent 8-bit-unit inconsistency does not actually arise. However, the central 'state-of-the-art minimal-cost' claim is not yet fully supported because the paper does not compare against DeepFool and the Carlini-Wagner l2 attack, which are the standard minimal-distance baselines.","major_comments":[{"comment":"The claim that PGD-Imp achieves state-of-the-art minimal-cost perturbations is not fully supported because the comparison omits DeepFool and the Carlini-Wagner l2 attack, which are the standard minimal-distance baselines. Please add these baselines on the same 1000 images and report l2, l-infinity, PSNR, ASR, and runtime. If C&W or DeepFool achieve lower l2 on the same benchmark, the 'minimal cost toward the decision boundary' claim would need to be qualified.","section":"Section III-B, Tables I and II"},{"comment":"Algorithm 1 cannot be executed as written. Line 10 checks 'if ||xnow - x||_inf >= 1', which is never true for normalized [0,1] images with the reported l-infinity = 1/255; the condition should be '>= 1/255' unless the algorithm explicitly states that x and xnow are in 8-bit integer units. In addition, lines 15-16 ('xadv = xnow; return xadv') appear inside the for loop, which would make the function return the unperturbed image after the first iteration. Please correct the threshold, move the return outside the loop, and specify the rounding mode and clipping at image boundaries.","section":"Algorithm 1, lines 10-16"},{"comment":"The reported l-infinity = 1/255 with 100% ASR is an unusually strong empirical result. Because the scheduled step sizes can produce many iterations in which the rounded image is unchanged, the reader needs more than the average of 34.2 iterations to verify that the early-stop mechanism is behaving as described. Please report the distribution of stop iterations and final l-infinity per image, or release the code, and confirm explicitly that all metrics are computed on the returned 8-bit rounded images.","section":"Section III-B, Table I"}],"minor_comments":[{"comment":"Please define the linear schedule explicitly, for example eta_t = t/T for t = 1..T, and clarify whether epsilon is 8/255 in normalized units or 8 in 8-bit units, since this changes the interpretation of Eq. (3) and the step-size values.","section":"Section II-B, Eq. (3)"},{"comment":"Table II reports l-infinity = 0.01 for targeted PGD-Imp, but for 8-bit rounded outputs the per-image l-infinity must be a discrete multiple of 1/255; please report the mean and distribution (or the exact values) rather than a rounded aggregate that obscures this discreteness.","section":"Table II"},{"comment":"There are citation inconsistencies in the text: 'AdvDrop [4]' and 'Perc-AL [4]' in Section III-A do not match the reference list, where [4] is Madry et al.; please renumber or correct the citations.","section":"Section III-A"},{"comment":"Please add axis labels to Figure 3 and state which metric is plotted; the caption 'Step T and epsilon' is ambiguous without axis information.","section":"Fig. 3"},{"comment":"Given that the evaluation uses only 1000 images, please report standard deviations or confidence intervals for the main metrics, especially the 100% ASR and l-infinity = 1/255 claims.","section":"Tables I-III"}],"recommendation":"major_revision","confidential_remarks":"I believe the method is promising and the high-level idea is sound, but I would request a reproducibility package or a detailed stop-iteration analysis before accepting a journal version. The l-infinity = 1/255 with 100% ASR result is surprising, and the current pseudocode prevents independent verification. Please also ensure that the requested C&W/DeepFool comparison uses the same metric normalization as the proposed method."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The combination of a dynamic step-size schedule and an adaptive early stop for PGD is new in this specific form, and the paper argues cleanly that external perceptual modules are unnecessary. I buy that argument as a hypothesis, and the ablations support it: DSS alone drops l2 from 2.44 to 1.75, AES alone to 1.60, and both together to 0.86. The schedule comparison is also informative—linear increasing works best because it aligns with the early-stop mechanism.\n\nOne thing to note right away: the stress-test note about metric inconsistency is wrong. The l2, PSNR, and l∞ values are mutually consistent if computed on [0,1]-normalized images, which is the standard for these comparisons. l2=0.89 with l∞=1/255 just means roughly 34% of pixels are changed by ±1 gray level, not a contradiction. The early stop fires when the rounded image misclassifies, which after ~34 iterations of small steps can plausibly involve many pixels.\n\nThat said, the soft spots are real. The comparison omits DeepFool and Carlini-Wagner, which are the natural minimal-distance baselines for an attack that claims to find the decision boundary at minimal cost. Without them, the state-of-the-art claim is under-supported. The paper also provides no code and only reports mean l2/l∞, not per-image distributions, which makes the 100% ASR at l∞=1/255 harder to evaluate. A histogram over the 1000 images would settle it.\n\nThe working mechanism is heuristic rather than proven, but that is typical for attack papers and not a fatal flaw. The hyperparameters are chosen by ablation on the same benchmark, a mild selection bias, but the reported metrics are emergent from the optimization, not fitted to a target.\n\nOverall, this is a solid, incremental contribution for adversarial-robustness researchers. It deserves peer review, with the expectation that the authors add DeepFool/CW baselines, provide code or detailed per-image statistics, and clarify the metric normalization in the text. I would not cite it without seeing those additions, but I would bring it to a reading group now.","headline":"Simple PGD variant with dynamic step size and early stopping gives surprisingly strong imperceptibility results, but the SOTA claim needs stronger baseline comparisons and code.","tokens_in":10183,"tokens_out":3421,"would_cite":false,"duration_ms":30031,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Classic PGD with two scheduling tricks reaches state-of-the-art imperceptible adversarial attacks, no perceptual modules needed.","keywords":["adversarial attacks","imperceptible perturbations","projected gradient descent","PGD-Imp","decision boundary","dynamic step size","adaptive early stop","image classification"],"falsifier":"Take a set of images and compute PGD-Imp's output, then compute a much closer approximation to the true minimum-$\\ell_2$ adversarial example (for instance by a fine-grained boundary search). If any image shows a large gap between PGD-Imp's $\\ell_2$ cost and the near-minimal cost, while the early-stopped point is not near the boundary, the central heuristic is refuted for that case. A second check: the reported $\\ell_\\infty = 1/255$ with 100% ASR implies every pixel change is at most 1; rerunning on a larger or more diverse sample and counting images where success requires a $\\pm 2$ or larger change would falsify that specific claim.","tokens_in":1669,"feed_emoji":"🎯","tokens_out":4331,"duration_ms":75758,"temperature":0.7,"pith_summary":"The paper sets out to show that imperceptible adversarial attacks do not need perceptual modules, auxiliary losses, or frequency-domain constraints. Its thesis is that an attack is imperceptible precisely when it pushes the image across the model's decision boundary with the smallest possible perturbation, and that the classic PGD algorithm can already do this if two optimization details are fixed. The first fix, Dynamic Step Size, distributes the total perturbation budget across iterations with a gradually increasing schedule; the second, Adaptive Early Stop, halts the attack the moment a rounded 8-bit candidate misclassifies the model. On a standard 1,000-image benchmark the resulting PGD-Imp attack reports 100% success on ResNet-50 with an average $\\ell_2$ distance of 0.89, PSNR of 52.93, and a maximum per-pixel change of $1/255$, while running in 57 seconds. If the claim holds, the whole apparatus of perceptually motivated attack components becomes optional rather than essential.","feed_headline":"Two tweaks to classic PGD beat complex imperceptible attacks","feed_subtitle":"Dynamic step size plus early stop achieves 100% success with one-pixel changes at a fraction of the runtime.","key_machinery":"The load-bearing mechanism is the pair of scheduling rules applied to PGD's sign-gradient descent. The Dynamic Step Size rule enforces $\\sum_{t=1}^T \\alpha_t = \\epsilon$ with $\\alpha_t = \\eta_t \\beta$ and a linear, increasing $\\eta_t$, which allocates a larger share of the budget to later iterations so early updates explore near the clean image. The Adaptive Early Stop rule evaluates the rounded 8-bit image at each step and breaks as soon as the classifier's decision changes, with the condition $\\|x_{\\mathrm{now}} - x\\|_\\infty \\ge 1$ ensuring the perturbation survives quantization. Together they convert PGD from a fixed-budget attacker into a boundary-approaching attacker that stops at the first successful adversarial example along its path.","core_discovery":"PGD-Imp's central claim is that a minimal-cost crossing of the decision boundary is the essence of imperceptibility, and that two scheduling choices turn plain PGD into a solver for that objective. Dynamic Step Size replaces the fixed step with $\\alpha_t = \\eta_t \\beta$, where $\\eta_t$ follows a linear schedule from 0 to 1 and $\\beta = \\epsilon / \\sum \\eta_t$, so the accumulated signed-gradient updates exactly meet the $\\ell_\\infty$ budget $\\epsilon$. Adaptive Early Stop then rounds the current iterate to an 8-bit image and, once the rounded image already fools the classifier (or hits the target class), stops immediately, leaving the example just past the boundary. The paper reports that this combination achieves state-of-the-art untargeted imperceptible attacks on four classifiers and improves targeted attacks as well, reducing $\\ell_\\infty$ to $1/255$ and halving the $\\ell_2$ cost of the best prior targeted method.","pith_inferences":["Because the attack stops at the first successful rounded point, its output is a cheap empirical estimate of decision-boundary distance; one could reuse it to measure robustness or to probe where a classifier's boundary sits relative to human perception.","The method's success on LPIPS and FID does not by itself establish subjective invisibility; a natural extension is a human study comparing PGD-Imp outputs with perceptual-module outputs at matched ASR.","Since PGD-Imp is built from plain PGD, it could be dropped into adversarial training pipelines as a stronger, cheaper attack for generating training adversaries, though the paper does not test this.","The 1/255 infinity-norm result depends on 8-bit rounding; re-running at higher bit depth or in non-image domains would test whether the minimal-cost boundary claim survives outside the current quantization regime."],"forward_implications":["External perceptual components become optional: if minimal-cost boundary crossing is sufficient, imperceptible attacks can be built and tuned with just a schedule and a stopping rule.","Attack cost drops sharply: the reported 57-second untargeted attack on ResNet-50 is orders of magnitude faster than the perceptual-module baselines it compares against.","Imperceptibility and efficiency align: the same mechanism that lowers L2 distance and raises PSNR also shortens runtime, because early stopping removes redundant iterations.","Hyperparameter sensitivity shrinks: across most settings of epsilon and T the method holds PSNR >= 53 and ASR >= 99%, with degradation only at very small T.","Targeted attacks inherit the same gains, reaching 100% ASR with roughly half the L2 cost of the prior targeted approach."],"supporting_citations":[{"why":"Supplies the base PGD algorithm that the two proposed strategies modify.","marker":"[4]"},{"why":"Baseline perceptual color-distance attack that PGD-Imp must beat in comparisons.","marker":"[11]"},{"why":"Baseline frequency-domain AdvDrop attack used in the experimental comparisons.","marker":"[13]"},{"why":"Baseline frequency-driven SSAH attack used in the experimental comparisons.","marker":"[15]"},{"why":"Baseline targeted AdvINN attack that supplies the targeted benchmark setup and comparison.","marker":"[16]"},{"why":"Supplies the standard 1,000-image dataset on which the untargeted attacks are evaluated.","marker":"[30]"}],"fun_headline_variants":["PGD-Imp: 100% ASR, 1/255 eps, 7x faster than prior","Classic PGD, two new tricks: 100% ASR, tiny distortions","Dynamic step and early stop unleash PGD for imperceptible attacks","Minimal boundary crossing makes PGD attacks imperceptible and fast"],"cache_read_input_tokens":12288,"weakest_assumption_plain":"The method assumes that the first rounded point along its scheduled sign-gradient path that misclassifies the model lies at or very near the minimum-cost adversarial example, so that stopping there gives near-minimal perturbation.","fun_headline_variants_meta":{"raw":{"variants":["PGD-Imp: 100% ASR, 1/255 eps, 7x faster than prior","Classic PGD, two new tricks: 100% ASR, tiny distortions","Dynamic step and early stop unleash PGD for imperceptible attacks","Minimal boundary crossing makes PGD attacks imperceptible and fast"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001333,"raw_usage":{"total_tokens":5444,"prompt_tokens":987,"completion_tokens":4457,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":4368}},"tokens_in":603,"tokens_out":4457,"duration_ms":27676,"temperature":1.0,"reasoning_tokens":4368,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T15:15:00.432156+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a set of images and compute PGD-Imp's output, then compute a much closer approximation to the true minimum-$\\ell_2$ adversarial example (for instance by a fine-grained boundary search). If any image shows a large gap between PGD-Imp's $\\ell_2$ cost and the near-minimal cost, while the early-stopped point is not near the boundary, the central heuristic is refuted for that case. A second check: the reported $\\ell_\\infty = 1/255$ with 100% ASR implies every pixel change is at most 1; rerunning on a larger or more diverse sample and counting images where success requires a $\\pm 2$ or larger change would falsify that specific claim.","supporting_citations":[{"cited_title":"Towards deep learning models resistant to adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the base PGD algorithm that the two proposed strategies modify."},{"cited_title":"Towards large yet imperceptible adversarial image perturbations with perceptual color distance,","cited_arxiv_id":null,"evidence_quote":"Baseline perceptual color-distance attack that PGD-Imp must beat in comparisons."},{"cited_title":"Advdrop: Adversarial attack to dnns by dropping information,","cited_arxiv_id":null,"evidence_quote":"Baseline frequency-domain AdvDrop attack used in the experimental comparisons."},{"cited_title":"Frequency-driven imperceptible adversarial attack on semantic similarity,","cited_arxiv_id":null,"evidence_quote":"Baseline frequency-driven SSAH attack used in the experimental comparisons."},{"cited_title":"Impercep- tible adversarial attack via invertible neural networks,","cited_arxiv_id":null,"evidence_quote":"Baseline targeted AdvINN attack that supplies the targeted benchmark setup and comparison."},{"cited_title":"Adversarial attacks and defences competition,","cited_arxiv_id":null,"evidence_quote":"Supplies the standard 1,000-image dataset on which the untargeted attacks are evaluated."}],"review_version":1}