{"id":"d99f5a9b-24b5-499a-921f-086a2dea1331","arxiv_id":"2412.11384","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A review with small ART-based experiments showing adversarial attacks fool an object detector and a bone-fracture classifier, and that preprocessing defenses largely fail while defensive distillation appears stronger.","lead":"This paper reviews known methods for tricking machine learning models with small, hidden changes to their input, and runs a small benchmark showing that both an object detector and a bone-fracture image classifier can be fooled. A generalist might read it as a catalog of attack techniques and as evidence that simple image preprocessing defenses are weak while defensive distillation works better on small data.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Defensive-distillation success rate is not an out-of-sample estimate: student and adversarial test images share the same 100 training samples, so the 71% claim cannot rule out memorization.","rationale":"Strictly, the paper's contribution is a survey plus a small benchmark. The survey portion is derivative and the reference list is unreliable, but the review's value could still stand if the benchmark supported a concrete conclusion. The only concrete conclusion that goes beyond the cited literature is the defensive-distillation result, so that claim is load-bearing. The weakest point is exactly the one the reader flags: the student is trained on the same 100 originals used to build the adversarial test set, with no held-out split described. Under that protocol, high defense success can be explained by memorization or locally constant behavior around training points rather than by distillation's supposed mechanism of smoother gradients. Averaging widely varying per-attack success rates into a single 71% number, without error bars, compounds the problem. Since the paper's own Limitations section acknowledges 'limited dataset size' but not the train/test overlap, the reader's rejection is well-founded. A held-out re-run is the minimal experiment that would separate a genuine distillation effect from an artifact; until that is done, the central positive claim should not be accepted. Reader's verdict (REJECT) remains appropriate.","tokens_in":14497,"tokens_out":3832,"duration_ms":36753,"concrete_test":"Conduct a strict held-out evaluation: randomly split the 100 bone-fracture images into 50 training and 50 test images before any attack generation. Train the student model only on the 50 training originals using the same ART defensive-distillation procedure; generate all adversarial examples from the 50 held-out test originals; recompute per-attack defense success rates and a 95% CI for the overall rate. If the held-out success rate is materially below 71% (or close to the preprocessing-defense rates), the original claim is an artifact of training/evaluation overlap.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that defensive distillation is effective rests on a 71% average success rate across six attacks. The evaluation protocol in the 'Defensive Distillation' section trains the student on the same 100 original bone-fracture images that anchor all adversarial test inputs. Because the adversarial images are perturbations of the student's training set, a student that simply memorizes those 100 samples and their labels can appear robust even when it has no ability to classify new images. The per-attack rates (94% Simba, 90% C&W, 79% BIM, 62% Pixel, 57% FGSM, 46% DeepFool) are also reported without confidence intervals or repeated resampling. The paper's Limitations section acknowledges the small sample size but does not acknowledge this train/test overlap. Therefore the 71% figure is not a valid estimate of defense efficacy on unseen images, and the paper's only original positive result—the basis for its conclusion—is not supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript positions itself as a comprehensive review of adversarial attacks on machine learning and complements this with two empirical studies using the Adversarial Robustness Toolbox (ART). The first study applies FGSM, PGD, and BIM to a DETR-ResNet50 object detector on 100 sampled self-driving car images. The second applies BIM, FGSM, Simba, C&W L2, DeepFool, and Pixel attacks to a CNN bone-fracture classifier, then evaluates seven preprocessing defenses and defensive distillation. The paper's central positive claim is that defensive distillation achieves a 71% success rate in restoring correct predictions on adversarial bone-fracture images, while preprocessing defenses are largely ineffective.","tokens_in":14668,"tokens_out":4550,"duration_ms":40882,"significance":"If the defensive distillation claim were supported by a valid out-of-sample evaluation, it would be a practically relevant result for medical-image classifiers. The paper is transparent about ART attack parameters and explicitly acknowledges the small sample size in its Limitations section, which is a strength. However, the central empirical contribution is currently not supported: the distillation evaluation is circular because the student model is trained on the same 100 images that seed the adversarial test set, attack and defense success rates are reported without confidence intervals or repeated resampling, object-detection 'success' is not crisply defined, and the review's reference list contains several incorrect citations. The reported defense rankings therefore cannot be accepted as out-of-sample evidence.","major_comments":[{"comment":"The 71% defensive distillation success rate is not an out-of-sample estimate. The section states 'we trained a model using the ART library on a limited dataset of 100 original samples,' and the adversarial images evaluated against the student model are perturbations of those same 100 samples. A student model could memorize the training labels and appear robust on perturbations of its own training images without generalizing to new bone-fracture images. No held-out split, cross-validation, or repeated resampling is described. This circularity directly undermines the central positive claim of the paper.","section":"Defensive Distillation"},{"comment":"All attack and defense success rates (e.g., 95%, 99%, 47%, 71%) are reported as point estimates without confidence intervals, standard deviations, or repeated resampling over the 100-image sample. Given n=100, binomial confidence intervals are wide; for example, the 71% defense success rate has an approximate 95% confidence interval of roughly 61-80%. Consequntly, the rankings of defenses (e.g., median filtering at 35.7% vs. Gaussian blur at 30.3%) and the relative effectiveness of attacks are not statistically supported as stated.","section":"Evaluation Metrics and attack/defense tables"},{"comment":"Object-detection attack success is loosely defined. In the FGSM example, a successful attack is described as 'either no object detection or incorrect identifications,' which conflates missing an object with misclassifying a detected object and does not specify the detection confidence threshold or matching procedure. No mAP, precision/recall, or per-class metrics are reported, so the 99-100% success rates for FGSM, PGD, and BIM on the object detector are ambiguous and not comparable with standard object-detection evaluations.","section":"Attacks on Object Detection Use Case"},{"comment":"The blanket statement that 'preprocessing techniques proved ineffective in mitigating these attacks' is contradicted by the paper's own defense tables. For example, median filtering and spatial smoothing each report 98% success on Pixel-attack images, TV denoising reports 83% on Carlini-Wagner L2 images, and Gaussian blur reports 97% on Pixel-attack images. The aggregated preprocessing rates are below 50%, but the per-attack results show that several preprocessing defenses are highly effective against specific attacks, so the conclusion is not supported without qualification.","section":"Conclusion"},{"comment":"The literature review is undermined by multiple incorrect citations. Reference [9] is cited for 'certified robustness (Wong et al., 2018)' but points to a 3D segmentation paper; Reference [10] is cited for 'adversarial detection (Ma et al., 2019)' but points to a bias-variance trade-off paper; References [6] and [14] duplicate the same 'Making an Invisibility Cloak' paper with different arXiv identifiers. These errors affect the credibility of the review aspect of the manuscript and need correction.","section":"References"}],"minor_comments":[{"comment":"There are frequent typos and formatting inconsistencies, such as 'FSGM' instead of 'FGSM' and duplicated equation text in the FGSM definition (e.g., 'ψ(x,y)=−e⋅sign(∇xL(x,y))ψ(x,y)=−e⋅sign(∇xL(x,y))'). A careful proofread is needed.","section":"Throughout"},{"comment":"Figures are referenced in text but are not numbered, and many figure captions are missing or too terse to interpret (e.g., the before/after prediction labels are only in the body text). Figure numbering and captions should be added.","section":"Figures"},{"comment":"The random selection of 100 representative samples is not described with a random seed or selection protocol, so the experiments cannot be reproduced exactly.","section":"Experimental Setup"},{"comment":"No training hyperparameters for the student model are provided: temperature, student architecture, optimizer, number of epochs, and loss function are all omitted. This makes the distillation experiment not reproducible even if a held-out split were added.","section":"Defensive Distillation"},{"comment":"Reference [11] is given as a Hugging Face URL but is also cited as the source for several standard attacks, and Reference [12] is a bare Kaggle URL with no title or access date. These should be clarified and completed.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is more of an experimental report than a comprehensive review, and the survey portion contains citation errors that will need correction. The central experimental claim is salvageable in principle, but only through a redesigned evaluation with a held-out split and uncertainty quantification. This is a substantial but feasible revision, so I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a tutorial-level survey with some illustrative ART experiments, not a research contribution. The one headline result—defensive distillation at 71%—does not survive contact with the evaluation protocol.\n\nThe paper does a reasonable job of organizing attack families (FGSM, PGD, BIM, C&W, DeepFool, SimBA, pixel) and seven preprocessing defenses, with parameter tables and sample images. That is useful for a practitioner who wants a hands-on introduction to the Adversarial Robustness Toolbox. Applying attacks to a DETR object detector on a driving dataset is also a nice demo, even if it is only 100 images.\n\nThe soft spots are serious. n=100 is small, but the bigger issue is that defensive distillation is trained on the same 100 original bone-fracture images that anchor the adversarial test set. The student sees the clean versions of the very images that are later perturbed and fed back as 'unseen' adversarial inputs. The 71% success rate is therefore not an out-of-sample estimate; it is at least partially a memorization artifact. The Limitations section mentions the small dataset but does not acknowledge this overlap.\n\nBeyond that, attack success rates are reported without error bars or confidence intervals, and the manual parameter tuning is not described with any criterion. Successful object detection is loosely defined as either no detection or a wrong detection, which conflates different failure modes. The reference list also has mismatches: [9] cites a 3D segmentation paper rather than Wong et al.'s certified robustness work, and [10] cites a bias-variance trade-off paper instead of Ma et al. Those are the kinds of errors that make a survey unreliable as an entry point.\n\nCredit where it is due: the preprocessing-defense comparisons are consistent with the existing literature—most of them barely restore correct predictions—and the authors are explicit that object-detection defenses were not attempted due to cost. The writing is readable and the structure is clear.\n\nWho gets value? A student wanting a quick map of ART attacks and defenses might find this handy. Anyone doing serious robustness research will not learn anything new, and the defensive-distillation claim would mislead them. I would not send this to full peer review as a research paper; it belongs in a workshop/tutorial track at best, with the distillation evaluation redone on a held-out split. As it stands, a desk reject is defensible.","headline":"Competent tutorial survey; the only new result (defensive distillation at 71%) is invalid due to train/test overlap, and the rest is a rehash of known attacks and defenses.","tokens_in":15198,"tokens_out":2851,"would_cite":false,"duration_ms":24973,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that defensive distillation restores correct predictions for 71% of adversarial bone-fracture images, outperforming all seven preprocessing defenses it tested.","keywords":["adversarial attacks","defensive distillation","adversarial robustness","image classification","object detection","preprocessing defenses","medical imaging","autonomous vehicles"],"falsifier":"Train the defensive-distillation student on a set of bone-fracture images disjoint from the ones used to generate adversarial test examples, then measure the restored-prediction rate; if it falls to the same 15-45% range as the preprocessing defenses, the paper's central claim that distillation is an effective defense would be undercut.","tokens_in":14338,"feed_emoji":"🛡️","tokens_out":5858,"duration_ms":49464,"temperature":0.7,"pith_summary":"This paper tries to establish that machine learning models used in safety-critical settings are easily fooled by small adversarial perturbations, and that one defense—defensive distillation—is markedly more effective than simple input preprocessing. On a bone-fracture classification CNN, seven preprocessing defenses (median filtering, total variation denoising, bilateral filtering, spatial smoothing, feature squeezing, Gaussian smoothing, and Gaussian blur) restored correct predictions for only 14% to 43% of adversarial images, while a student network trained on soft teacher labels recovered the original class for 71%. On an object-detection model for self-driving scenes, preprocessing defenses were nearly useless, restoring correct predictions for under 1% of adversarial images after attacks such as FGSM, PGD, and BIM achieved 99% to 100% attack success. The paper's practical message is that adversarial robustness requires more than cleaning up input pixels.","feed_headline":"Defensive distillation beats adversarial attacks 71% of the time","feed_subtitle":"A student network trained on soft labels restores correct fracture predictions where seven preprocessing defenses fail.","key_machinery":"The load-bearing mechanism is defensive distillation: a student network trained on the teacher model's soft class probabilities rather than hard labels, which smooths the loss landscape and reduces the gradient signal an attacker can exploit. In the paper, the student is trained through the Adversarial Robustness Toolbox on 100 original bone-fracture samples, and the same toolbox is used to generate adversarial examples from FGSM, PGD, BIM, SIMBA, Carlini-Wagner L2, DeepFool, and Pixel attacks. The student's restored-prediction rate across those attacks is the paper's main evidence for distillation's effectiveness.","core_discovery":"On its own terms, the central discovery is that adversarial attacks generated with the Adversarial Robustness Toolbox reliably mislead both a DETR-ResNet50 object detector and a roughly 99%-accurate CNN for bone-fracture classification, and that defensive distillation—training a student network to mimic the teacher's soft probability outputs—restores the original prediction on 71% of adversarial bone-fracture images across SIMBA, BIM, DeepFool, FGSM, Carlini-Wagner L2, and Pixel attacks. The same evaluation shows that preprocessing defenses are largely ineffective: total variation denoising tops out at a 42.7% success rate, and feature squeezing at 14%. For object detection, none of the preprocessing defenses reached 1% restoration, which the authors take as evidence that detection models need defense strategies beyond simple input preprocessing.","pith_inferences":["Because the student was trained on the same 100 images later used to create the adversarial test examples, the 71% figure is likely an upper bound; a held-out evaluation could show a substantially lower restoration rate.","The paper's attack-success results (100% for PGD and BIM on the object detector) are consistent with the broader pattern that gradient-based attacks transfer across architectures, so the specific model choice may matter less than the perturbation budget.","A natural next experiment the paper does not run is to combine defensive distillation with adversarial training; the two mechanisms may compound and push restoration rates higher.","The claim that preprocessing defenses are insufficient should be read as specific to these attacks and hyperparameters; techniques like feature squeezing are often more effective when paired with adversarial detection rather than simple correction."],"forward_implications":["Practitioners evaluating input-preprocessing defenses for medical image classifiers should expect limited restoration (at most roughly 43% in these experiments) and should consider distillation-based training instead.","The 71% defensive-distillation restoration rate suggests that retraining a student on soft labels can absorb much of the perturbation noise that defeats preprocessing.","Object detection models, at least in this setup, remain almost entirely unprotected by preprocessing, so defenses for detection need a different design.","The reported mean perturbation values provide a rough ranking of attack stealthiness, with the Pixel attack being the most imperceptible on the bone-fracture model."],"supporting_citations":[{"why":"Supplies the library used to generate every adversarial example and to train the defensive-distillation student network.","marker":"[1]"},{"why":"Documents the toolbox's v1.0.0 attack and defense implementations that the experiments call directly.","marker":"[13]"},{"why":"Defines the fast gradient sign method, one of the attacks the distillation defense is evaluated against.","marker":"[3]"},{"why":"Defines the Carlini-Wagner optimization attack, another attack in the distillation evaluation set.","marker":"[4]"}],"fun_headline_variants":["Defensive distillation restores 71% of adversarial attacks","Distillation beats seven preprocessing defenses in attack test","Student network recovers 71% of adversarial fracture images","Adversarial toolbox: distillation outperforms preprocessing 5x"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The student model in defensive distillation was trained on the same 100 original images used to create the adversarial test samples, so the 71% success rate could be inflated by overfitting to those specific images rather than reflecting performance on new inputs.","fun_headline_variants_meta":{"raw":{"variants":["Defensive distillation restores 71% of adversarial attacks","Distillation beats seven preprocessing defenses in attack test","Student network recovers 71% of adversarial fracture images","Adversarial toolbox: distillation outperforms preprocessing 5x"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000138,"raw_usage":{"total_tokens":1084,"prompt_tokens":808,"completion_tokens":276,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":424,"completion_tokens_details":{"reasoning_tokens":210}},"tokens_in":424,"tokens_out":276,"duration_ms":3437,"temperature":1.0,"reasoning_tokens":210,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:58:45.472585+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the defensive-distillation student on a set of bone-fracture images disjoint from the ones used to generate adversarial test examples, then measure the restored-prediction rate; if it falls to the same 15-45% range as the preprocessing defenses, the paper's central claim that distillation is an effective defense would be undercut.","supporting_citations":[{"cited_title":"Adversarial Robustness Toolbox (ART),","cited_arxiv_id":null,"evidence_quote":"Supplies the library used to generate every adversarial example and to train the defensive-distillation student network."},{"cited_title":"Adversarial Robustness Toolbox v1.0.0,","cited_arxiv_id":null,"evidence_quote":"Documents the toolbox's v1.0.0 attack and defense implementations that the experiments call directly."}],"review_version":1}