{"id":"443bf2a9-f93d-46be-af4f-80c28950f219","arxiv_id":"2412.13376","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"VIAP generates one targeted adversarial perturbation that deceives a multi-view classifier across rendered viewpoints of 3D objects, with high train-set accuracy and weaker but notable test-set transfer.","lead":"This paper presents VIAP, a method that learns a single image noise pattern which, when added to any rendered view of a 3D object, makes a MobileNetV2 classifier output a chosen wrong label. The authors report strong success on training views and partial transfer to held-out views, but the evaluation is limited by unclear baselines and dataset splitting.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The paper's central 95% top-1 accuracy claim is not supported by the reported metric: Table 2 reports average target-class softmax values, not top-1 accuracy, and the train/test split is not shown to be object-disjoint.","rationale":"The reader correctly identifies the train/test split and generalization to unseen data as a core weakness, and its rationale notes that the abstract overstates results by omitting that the 95% accuracy is train-only. My stress-test sharpens this: the paper does not report top-1 accuracy at all in the targeted-results section—only average softmax values—so even the train-only claim is not directly verifiable from the tables. This is load-bearing because the central quantitative assertion is the 95% figure. It can be settled by recomputing Eq. 7 from the per-image logits. The split question is secondary but related: without an object-disjoint split, the 'unseen data' generalization claim is only about new views of seen objects. Since the reader's verdict is already CONDITIONAL and my concern is a more precise version of the same overstatement, no verdict change is needed; the required repairs remain the same.","tokens_in":8702,"tokens_out":6147,"duration_ms":59549,"concrete_test":"Recompute the targeted attack results from the saved per-image classifier outputs: for every epsilon value in Table 2, compute the actual Top-1 Target Accuracy (Eq. 7) separately for train and test, alongside the average softmax values, and report how the 605/605 split was constructed. If the split is per-image rather than per-object, rerun with an object-disjoint split and recompute. If the held-out top-1 target accuracy never reaches 95%, or if the accuracy differs from the softmax-based numbers by more than a few percentage points, the abstract's headline claim must be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract and conclusion assert that targeted VIAP achieves 'top-1 accuracies exceeding 95% across various epsilon values.' However, the only targeted results reported are Table 2's average softmax predictions of the target label, not the Top-1 Target Accuracy defined in Eq. 7. High average softmax for the target class does not imply that the target class is the argmax prediction; the target could be consistently second-ranked in many examples. For held-out test images, the best average target softmax in Table 2 is 0.76 at epsilon=10, far below 0.95 for most epsilon values, so the 95% figure appears to be either train-only or computed with an unreported metric. Additionally, the split of 1,210 images (121 objects, 10 views each) into 605/605 is not described as object-disjoint; if the same objects appear in both train and test, 'unseen data' means only unseen viewpoints of objects whose other views were used in optimization, not generalization to unseen objects. The claim of view-invariance requires held-out viewpoints, but the claim of universal transfer to unseen data requires an object-disjoint split, and neither is established by the reported evaluation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes View-Invariant Adversarial Perturbations (VIAP), a method for generating a single universal perturbation that, when added to multiple rendered views of 3D objects, misclassifies them toward a chosen target label. The method is an iterative targeted BIM-style update (Eq. 5) in which the optimization variable is the shared perturbation δ rather than an individual image, with a random initialization and clipping. Experiments on 1,210 rendered images (121 objects, 14 classes) compare VIAP with FGSM and BIM on MobileNetV2 using average softmax confidence in the true label (untargeted, Table 1) and in the target label (targeted, Table 2) over a 605/605 train/test split. The authors report strong training-set results and claim in the abstract and conclusion that targeted attacks achieve top-1 accuracies exceeding 95% across epsilon values and that the method generalizes better than FGSM and BIM to unseen data.","tokens_in":8906,"tokens_out":5315,"duration_ms":50273,"significance":"If substantiated, a single perturbation that is both universal across objects and invariant across viewpoints for targeted attacks would be a useful contribution to robustness evaluation of multi-view 3D recognition systems. The core optimization idea is natural and computationally simple, and the treatment of the perturbation as a shared variable over a batch of rendered views is a sensible extension of BIM. The method appears plausible as an optimization procedure, and the reported training-set softmax values are strong. However, the paper's headline claims are not supported by the metrics actually reported: no top-1 target accuracy is given, the train/test split is not shown to be object-disjoint, and the baseline protocol is ambiguous. The paper also ships no formal derivation, code, or reproducibility artifacts, so the evidence for the central claims is currently incomplete.","major_comments":[{"comment":"The abstract and conclusion claim targeted attacks achieve \"top-1 accuracies exceeding 95%,\" but Table 2 reports average softmax predictions of the target label, not the Top-1 Target Accuracy defined in Eq. 7. High average softmax for the target class does not imply that the target class is the argmax prediction; the target could be consistently second-ranked. The maximum test-set average softmax in Table 2 is 0.76 at epsilon=10, and training-set values reach 0.97 only for a narrow epsilon range. No top-1 accuracy values are reported anywhere, so the 95% claim is unsupported. The authors must either report the actual Top-1 Target Accuracy metric or revise the claim to describe average softmax confidence.","section":"Abstract; Targeted Attack Confidence (Table 2); Conclusion"},{"comment":"The train/test split is not specified as object-disjoint. The dataset consists of 121 objects with 10 views each (1,210 images), and the split is described only as 605 training and 605 test images. If the split is at the image level, the same objects appear in both training and testing, so the test set measures transfer to new viewpoints of seen objects, not generalization to unseen objects. The claim of \"view-invariant universal perturbation\" and \"generalization to unseen data\" requires held-out viewpoints, but the claim of universal transfer across objects requires an object-disjoint split. The authors should state the split criterion and, if it is view-based, add an object-disjoint evaluation or soften the generalization claim.","section":"Dataset and Preprocessing; Experimental Setup"},{"comment":"The comparison with FGSM and BIM is ambiguous because FGSM (Eqs. 1-2) and BIM (Eq. 3) are defined for a single image, while VIAP optimizes a single shared perturbation over a batch of training views (Eqs. 4-5). The text says \"All steps are repeated for the BIM and FGSM attacks,\" but it does not state whether these baselines were applied independently to each image or as universal perturbations. If the baselines are per-image attacks, the comparison does not isolate whether VIAP's advantage comes from view-invariance or from optimizing over a batch. The authors should specify the baseline protocol precisely and, ideally, include both per-image and universal-perturbation versions of FGSM and BIM.","section":"Experimental Setup; Equations 1-5"},{"comment":"The t-test results in Table 3 are insufficiently documented. The text reports p-values of 0.0005 (VIAP vs. FGSM) and 0.0095 (VIAP vs. BIM) but omits the sample size, whether the tests are paired or unpaired, which epsilon values were included, whether the comparison is across all images or per-object aggregates, and any correction for multiple comparisons. Moreover, the tests compare average softmax predictions, which does not address the missing top-1 accuracy evidence. The authors should provide full statistical details or remove the significance claim.","section":"Statistical Significance of Targeted VIAP Results; Table 3"},{"comment":"The claimed contribution of a \"mathematical formalization of view-invariance\" is not substantiated: the section restates the objective (arg max over target class) and writes the gradient as an expectation over transformations, but provides no derivation, theorem, or analysis of when the shared perturbation δ is guaranteed to transfer across views. This is a formalization of the optimization goal, not of the invariance property itself. The authors should either provide a meaningful formal statement with proof or remove this contribution claim.","section":"Mathematical Formalization of View-Invariance"}],"minor_comments":[{"comment":"The notation is inconsistent: Eq. 4 uses X for both the stacked input tensor and the perturbation matrix, while Eq. 5 writes Xadv as the optimization variable; Algorithm 1 instead uses δ. The initialization is also inconsistent: the text after Eq. 4 says Xadv_0 = X + r with r ~ U(-0.01, 0.01), whereas Algorithm 1 initializes δ with random noise δ0 ~ U(-0.01, 0.01). Please unify the notation and initialization description.","section":"Targeted View-Invariant Adversarial Perturbations; Algorithm 1"},{"comment":"Algorithm 1 introduces a step size η in the update rule, but Eq. 5 uses ϵ as the step size and the experimental section reports only ϵ values. It is unclear what value of η was used and how it relates to the clipping bound. Please clarify or remove η.","section":"Algorithm 1"},{"comment":"The text says \"Eight of the objects were rendered from ten distinct viewing angles,\" which conflicts with the earlier statement that all 121 objects were rendered from 10 viewpoints. This appears to be a typo; please correct it and clarify the rendering procedure for the remaining objects.","section":"Dataset and Preprocessing; Experimental Setup"},{"comment":"Table 1's header indicates values are expressed in units of 10^-6, but the surrounding text refers to percentages (e.g., \"average softmax prediction of 8%\"). Please make the units and conversions explicit so the table is readable without cross-referencing the header.","section":"Table 1"},{"comment":"Eqs. 6 and 7 are written in an informal notation (e.g., \"Top-1 True Label Predicts\"). Please rewrite them in standard mathematical notation with clear definitions of the sums and the prediction function.","section":"Evaluation Metrics"}],"recommendation":"major_revision","confidential_remarks":"The paper is an incremental extension of the authors' own universal-perturbation work, and the main novelty is the targeted variant of the same shared-perturbation optimization. The strongest issue is that the headline 95% claim is not backed by the reported metric, and the experimental split may not support the claimed generalization. I would not reject outright because the method is plausible and the missing evidence could be supplied, but the authors need to rerun or re-report the evaluation with top-1 target accuracy and an object-disjoint split, and clarify the baselines. If those points cannot be satisfied, the paper should be downgraded to a more modest claim about train-set softmax confidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe punchline: this is a minor extension of the authors' own untargeted VIAP, and the abstract's central claim of >95% top-1 targeted accuracy is not backed by the numbers actually reported. Table 2 gives average target-class softmax, not Top-1 Target Accuracy, and the best test average is 0.76. The 95% figure appears to be train-only or a confusion of metrics.\n\nWhat is new: the targeted version is literally a sign flip (Eq. 5) on their previous update rule, with the gradient computed w.r.t. the shared perturbation instead of the image. The universal gradient-averaging trick already appears in Moosavi-Dezfooli et al. 2017 and in their own prior work. The 'mathematical formalization' is a restatement of the objective, not a theorem. That said, the paper does a decent job of systematically varying epsilon and reporting both train/test softmax values. The method is simple enough to replicate from the description.\n\nSoft spots: (1) The metric mismatch is the biggest issue. Equation 7 defines Top-1 Target Accuracy but it is never reported; instead we get average softmax. A target class can average 0.76 softmax and still never be the argmax. The abstract overstates to >95% without disclosing the change in metric or that the result is train-only. (2) The train/test split is described only as images split; it is not stated that the 121 objects are partitioned. If the same objects appear in both sets, 'unseen data' means unseen views of seen objects, not generalization to new objects. (3) The FGSM/BIM baselines are ambiguous: it appears they were also run as universal methods (one perturbation over all training images), but the details are not spelled out. (4) The t-test section gives p-values without sample sizes, whether the test was paired, or which images were compared. (5) Novelty is low: a sign flip is not a new attack family.\n\nOn balance, the method is plausible and the training performance is strong, but the evaluation as written does not support the headline claims. With a corrected metric, a proper object-disjoint split, and a clearer baseline protocol, this could be a legitimate incremental contribution. As is, it needs major revision.\n\nWho it's for: someone working on multi-view adversarial robustness might find it a useful baseline. It is not going to change the field.\n\nRecommendation: worth sending to peer review rather than desk-rejecting, because the method is reproducible and the flaws are fixable, but a serious referee should demand the metric fix and split clarification. If those don't come, reject.","headline":"A small sign-flip extension of the authors' own untargeted method, undermined by a metric mismatch: the 95% top-1 accuracy claim is not supported by the reported average-softmax numbers.","tokens_in":9499,"tokens_out":3011,"would_cite":false,"duration_ms":26685,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single image-sized noise, optimized over rendered views, can make a 3D recognition model label objects as a chosen target with top-1 success above 95%.","keywords":["adversarial perturbations","view-invariant attack","3D object recognition","targeted attack","universal perturbation","multi-view robustness","MobileNetV2","Objaverse"],"falsifier":"Run the same VIAP procedure with an object-disjoint split: train the perturbation on some objects' views and test it only on views of objects never seen during training. If targeted top-1 accuracy on those unseen objects falls to chance levels, the claimed view-invariance is actually per-object memorization rather than a general 3D transfer property.","tokens_in":8468,"feed_emoji":"🎯","tokens_out":5819,"duration_ms":51628,"temperature":0.7,"pith_summary":"VIAP is an attack method for 3D object recognition: instead of crafting a separate noise for each camera angle, it produces one universal, image-shaped perturbation that can be added to every rendered view of an object. The paper claims that this single noise makes a pretrained convolutional classifier, MobileNetV2, misclassify the object across different viewpoints, and in the targeted setting can push the model toward a specific label chosen in advance. On a dataset of 1,210 rendered views of 121 objects, the targeted attack reaches top-1 target accuracy above 95% for most epsilon values on training views, and it transfers to held-out views better than FGSM or BIM. The reason to care is that, if the claim holds, multi-view recognition systems are vulnerable to a cheap, viewpoint-agnostic attack that can be prepared entirely in the image domain without manipulating 3D geometry.","feed_headline":"One perturbation flips 3D object labels across views","feed_subtitle":"Targeted VIAP attacks reach over 95% top-1 accuracy with a single noise, beating FGSM and BIM on unseen views","key_machinery":"The central object is $\\delta$, a perturbation tensor with the same width, height, and color channels as a single input image, optimized jointly over a 4-D stack of multi-view renders. The update rule is a BIM-style iterative sign-gradient step, with the crucial change that the gradient is computed with respect to $\\delta$ rather than the input image; this decouples the number of images from the shape of the noise. For targeted attacks, the update subtracts the sign of the gradient of the cross-entropy loss against the chosen target label, so each iteration reduces the loss and pushes every view toward the same target class. This object carries the argument because the entire claim about 'view-invariance' reduces to whether one $\\delta$ trained on roughly five views per object keeps its effect on unseen views and unseen objects.","core_discovery":"The central discovery is that view-invariance can be obtained by optimizing the perturbation itself over a batch of views, rather than by solving for each view separately. Given rendered views $X_i^{(\\theta,\\phi)}$ of object $i$, the attacker seeks a perturbation $\\delta$ such that for every viewpoint $(\\theta,\\phi)$ in a chosen range, $\\arg\\max_c f(X_i^{(\\theta,\\phi)} + \\delta) = y_{\\text{target}}$. The optimization repeats $\\delta \\leftarrow \\text{Clip}_\\epsilon(\\delta - \\eta\\,\\text{sign}(\\nabla_\\delta J(f(X+\\delta), y_{\\text{target}})))$, using the cross-entropy loss against the target label; for untargeted attacks the sign is flipped. Because the gradient is taken with respect to $\\delta$ and the views are stacked as a 4-D tensor, a single noise tensor emerges that drives the true-label softmax score to near zero on training views and, at epsilon values around 10, lifts the target-label softmax to as high as 0.76 on held-out views. The paper takes this as evidence that a targeted universal perturbation can be viewpoint-invariant and that the approach beats FGSM and BIM on transfer to unseen images.","pith_inferences":["Read strictly, the reported 'generalization to unseen data' is evidence about new viewpoints of objects whose other views appeared in training; the stronger claim of transfer to never-seen objects is not established by the paper's described split.","Because target labels were sampled uniformly from the 1,000 ImageNet classes, most targets are semantically distant from the source object; attacking semantically close classes would likely be harder than the reported average.","The attack requires white-box access to the classifier's gradients, so a natural untested extension is whether the same perturbation transfers to a different architecture or to a model with randomized viewpoint preprocessing.","An immediate defensive corollary is that camera-angle randomization or small geometric jitter at inference time could break the fixed-view optimization, since VIAP's robustness is measured only on the specific rendered angles used in training and testing."],"forward_implications":["A multi-view recognition pipeline becomes a single-point failure: one shared noise defeats all camera angles if the attacker knows the classifier gradients.","Because the perturbation is image-shaped rather than view-specific, it can be prepared offline for rendered objects and deployed in settings where the camera angle is not known in advance.","Targeted VIAP transfers to held-out views with mean target softmax up to 0.76 at moderate epsilon, meaning the method does not require per-view optimization at attack time.","The attack operates exclusively on 2D images, so it avoids costly 3D mesh manipulation and can be applied to any classifier that consumes rendered views."],"supporting_citations":[{"why":"Defines the fast gradient sign method that VIAP adapts for step size and clipping.","marker":"(Goodfellow, Shlens, and Szegedy 2015)"},{"why":"Supplies the basic iterative method, the baseline and backbone whose gradient-with-respect-to-noise variant VIAP extends.","marker":"(Kurakin, Goodfellow, and Bengio 2017)"},{"why":"Introduces the preceding untargeted universal multi-view perturbation whose gradient and clipping scheme VIAP modifies for targeted attacks.","marker":"(Ergezer et al. 2024)"},{"why":"Provides MobileNetV2, the classifier used for every attack and evaluation.","marker":"(Sandler et al. 2019)"},{"why":"Supplies the Objaverse 3D models that make up most of the 121-object dataset.","marker":"(Deitke et al. 2023)"},{"why":"Establishes the universal perturbation concept that VIAP extends from image distributions to multi-view renderings.","marker":"(Moosavi-Dezfooli et al. 2017)"}],"fun_headline_variants":["Single noise fools 3D classifiers from every angle","View-invariant attack: one tweak, any pose, 95% success","Universal 3D adversarial noise hits targeted labels across views","Optimized over views: one perturbation defeats 3D object recognition"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a perturbation tuned to about five rendered views per object carries over to other viewpoints and possibly other objects, with no theoretical guarantee, and the paper does not state that its train/test split is object-disjoint.","fun_headline_variants_meta":{"raw":{"variants":["Single noise fools 3D classifiers from every angle","View-invariant attack: one tweak, any pose, 95% success","Universal 3D adversarial noise hits targeted labels across views","Optimized over views: one perturbation defeats 3D object recognition"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000788,"raw_usage":{"total_tokens":3506,"prompt_tokens":1008,"completion_tokens":2498,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":624,"completion_tokens_details":{"reasoning_tokens":2425}},"tokens_in":624,"tokens_out":2498,"duration_ms":13857,"temperature":1.0,"reasoning_tokens":2425,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:11:24.657130+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same VIAP procedure with an object-disjoint split: train the perturbation on some objects' views and test it only on views of objects never seen during training. If targeted top-1 accuracy on those unseen objects falls to chance levels, the claimed view-invariance is actually per-object memorization rather than a general 3D transfer property.","supporting_citations":[{"cited_title":"One Noise to Rule Them All: Multi-View Adversarial Attacks with Universal Perturbation","cited_arxiv_id":"2404.02287","evidence_quote":"Introduces the preceding untargeted universal multi-view perturbation whose gradient and clipping scheme VIAP modifies for targeted attacks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes the universal perturbation concept that VIAP extends from image distributions to multi-view renderings."}],"review_version":1}