{"id":"24b40207-3c1a-4bba-88a2-2edb14a502f5","arxiv_id":"2412.16958","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"RFCoA crafts stealthy physical-world adversarial examples by extracting target-class robust features and fusing them into clean images with a spatial mask.","lead":"This paper proposes RFCoA, a perturbation-based method for physical-world adversarial examples that injects robust features of a target class into clean images. It reports higher transferability, robustness, and stealthiness than prior attacks, with experiments on ImageNet and vision-language models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The optimization in Eq. (3) is never validated against the robust-feature definition of Eq. (2); the extracted pattern may overfit to the surrogate ensemble and the training noise level, so the claimed transferability and robustness are not yet established.","rationale":"The reader's weakest_assumption and my concern coincide: the paper does not bridge Eq. (3) to Eq. (2). I see this as the single most load-bearing point because both headline improvements (transferability and physical robustness) are attributed to Deceptive RF Injection; if the extracted ft is not genuinely robust or model-consistent, the method's advantage would be a narrow ensemble-driven effect rather than a fundamental advance. The paper does provide independent support in the form of a wide model evaluation (12 models, including a transformer) and physical tests at multiple distances and angles; those results are encouraging and the method does outperform baselines on nearly every row. However, the physical test uses only 100 printed AEs, no error bars, and a single camera and lighting setup, so the physical robustness evidence is too thin to justify the 'Breaking Barriers' claim. My proposed test directly validates the robust-feature property and checks the contribution of the ensemble; both are inexpensive and would settle whether the concern lands. I did not find internal inconsistencies in the optimization equations, and the method is clearly described. The verdict remains CONDITIONAL: accept after the feature-validation and statistical-rigor issues are addressed.","tokens_in":13706,"tokens_out":9370,"duration_ms":91074,"concrete_test":"Take the optimized ft from a trained RFCoA run. Decode it to D(ft) and measure the target-class prediction accuracy of (i) the three surrogate models and (ii) held-out models such as ViT-b32, GoogleNet, and an adversarially trained ResNet-50, under perturbations δ' that were not used in Eq. (3): e.g., Gaussian noise with σ ∈ {0.01, 0.05, 0.1}, brightness and contrast shifts, and physical transforms such as 10° rotation and blur. If accuracy degrades sharply for held-out perturbations or held-out models relative to the training-time δ, the features are overfit rather than robust. Additionally, run an ablation that replaces the three-model ensemble in Eq. (3) with a single surrogate; if the final Table 2 black-box tASR drops significantly (e.g., by more than 0.1), the reported transferability is largely an ensemble effect rather than evidence of model-consistent robust features.","verdict_should_be":"UNCHANGED","load_bearing_attack":"RFCoA's core mechanism rests on Eq. (3), which minimizes the average cross-entropy of decoded latent codes under a fixed bounded noise δ over three surrogate CNNs. This is not equivalent to the robust-feature definition in Eq. (2): that definition requires features E(x+δ) to remain predictive for all δ in a perturbation set and for models beyond the training ensemble. The paper does not report any direct validation that the optimized ft satisfies Eq. (2), e.g., by measuring target-class accuracy under held-out perturbation types or magnitudes, or on held-out architectures. The tASR results themselves hint at architectural overfitting: on the ViT-b32 black-box model, RFCoA's digital tASR is only 0.18, versus 0.99 on the DenseNet-121 surrogate, a much larger gap than a model-consistent robust feature would be expected to show. If ft is merely an adversarial pattern in the autoencoder latent space that exploits the three surrogate CNNs, then the high transferability on the other nine models and the physical robustness (tested only at 10–20 cm distances and 15–45° angles) may not generalize to truly unseen models or broader environmental conditions. The central claim of 'superior transferability, robustness, and stealthiness' therefore rests on an unvalidated assumption about the nature of the extracted features.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes RFCoA, a two-stage perturbation-based physical-world adversarial attack. Stage 1 ('Robust Feature Disentanglement', Eq. 3) optimizes a latent code in a pretrained autoencoder by minimizing cross-entropy over an ensemble of three surrogate classifiers under bounded noise, aiming to extract target-class 'robust features' in the sense of Eq. (2). Stage 2 ('Adversarial Feature Fusion', Eqs. 4-10) fuses these features into a clean image using a gradient-derived spatial attention map, while jointly optimizing a pattern mask and transparency to preserve stealthiness. The authors evaluate targeted attack success on ImageNet with 12 models (three white-box surrogates, nine black-box), compare against TPA, Copy/Paste, RFLA, and CleanSheet, and report results for physical prints at different distances/angles, under PGD-AT and DiffPure defenses, and on LVLMs (MiniGPT-4, LLaVA). They claim superior transferability, robustness, and stealthiness relative to existing state-of-the-art PAE methods.","tokens_in":14030,"tokens_out":3931,"duration_ms":39590,"significance":"If the central claims hold, RFCoA would be a meaningful advance: a perturbation-based physical attack that transfers to unseen black-box models, survives physical transformations, and remains stealthier than patch/optical alternatives. The paper has concrete strengths: the code is released; the digital evaluation spans a broad model zoo (ResNet, WRN, VGG, DenseNet, ShuffleNet, ViT, GoogleNet) with three surrogate architectures; both digital and physical results are reported; and the method is checked against two defenses and two LVLMs. However, the key explanatory mechanism—that the optimized latent code actually instantiates the robust-feature definition of Eq. (2)—is not directly validated. The results show large tASR gaps between surrogate and some black-box architectures (e.g., ViT-b32), which is consistent with partial overfitting to the surrogate ensemble. The physical experiment is small (100 images, one print/capture session, no error bars), and LVLM results lack a comparison against the same baseline attacks. These weaknesses do not refute the empirical gains but they do limit the strength of the 'robust feature' and 'physical robustness' generalizations.","major_comments":[{"comment":"The optimization in Eq. (3) is never validated against the robust-feature definition in Eq. (2). Eq. (2) requires the features to remain predictive for all perturbations in a set and to be consistent across models, but Eq. (3) only minimizes cross-entropy on three surrogate models with a single fixed noise bound. The paper does not report any held-out check of the extracted features, such as target-class accuracy under larger or different perturbation types, or on architectures outside the training ensemble. Table 2 actually suggests limited cross-architecture consistency: RFCoA's digital tASR on the DenseNet-121 surrogate is 0.99 while on ViT-b32 it is 0.18 and on GoogleNet 0.30. That is a much larger gap than a model-consistent robust feature would be expected to show. The transferability results are still positive relative to baselines, but the paper's central explanatory claim—that the method works because it attacks robust features—is not yet supported. Please add an explicit validation of Eq. (2), e.g., measuring the predictive power of D(f_t) under held-out perturbations and on held-out architectures, or at least a thorough analysis of per-model feature activation consistency.","section":"Sec. 3.4, Eq. (3) and Table 2"},{"comment":"The physical-world evaluation is too small to support the robustness claims as stated. The paper uses 100 printed AEs, a single print job, a single capture session with one phone, and reports only point estimates without error bars, confidence intervals, or a breakdown across repeated trials. Table 3 shows large drops in tASR from digital to physical (e.g., 0.65 to 0.60 for WRN-50, and 0.18 to 0.14 for ViT-b32), and the physical robustness conclusions depend on these numbers. Since physical attacks are subject to printer color variability, lighting, lens distortion, and random placement, the claimed robustness over 'various distances and angles' requires multiple independent print/capture sessions and some variance reporting. Please report means and standard deviations over at least several sessions, or justify why a single session is representative.","section":"Sec. 4.2 and Sec. 4.3"},{"comment":"The method depends on a large number of hand-selected hyperparameters (w1-w5, tau, epsilon, N, plus the autoencoder architecture), but the paper defers all settings and ablations to a supplementary that is not provided in the submission. This makes the main results non-reproducible from the text alone and leaves open the question of how sensitive the reported gains are to these choices. The main text should at least give the exact parameter values used for Tables 2-4, and ideally include a sensitivity analysis or ablation for the most critical weights (w1/w2 and tau). Without this, the load-bearing 'superior transferability/stealthiness' numbers cannot be independently verified.","section":"Sec. 4.1 and Eqs. (7), (9), (10)"},{"comment":"The LVLM experiments report tASR numbers for RFCoA only, with no comparison to the baseline attacks (TPA, C/P-A, RFLA, CleanSheet) under the same VQA/description setting. The abstract claims the method's effectiveness 'can extend to LVLMs', which requires at least a baseline to show that the effect is not simply a trivial consequence of image corruption. Please add the same baselines to Table 5, or explicitly reframe the LVLM section as a qualitative feasibility study rather than a comparative result.","section":"Sec. 4.4, Table 5"}],"minor_comments":[{"comment":"The notation is inconsistent: Eq. (2) uses 'E' as the robust feature extractor, while Eq. (3) optimizes a parameter 'f' initialized from E(x), and the symbol f is also used for the victim classifier in Eq. (1). Please use distinct symbols for the classifier, the feature extractor, and the optimized latent code.","section":"Sec. 3.4, Eq. (3)"},{"comment":"The physical sampling description states that images are photographed from a 10 cm distance, while Table 3 evaluates 10, 15, and 20 cm distances. Please clarify whether the 100 printed AEs used for the main transferability table were all captured at 10 cm, and whether the distance/angle variations in Table 3 reuse the same prints.","section":"Sec. 4.2"},{"comment":"There are no error bars or confidence intervals anywhere in the tables. Given that some differences between methods are small (e.g., Ours vs. CleanSheet on several models), the absence of variance information makes it hard to judge whether the improvements are statistically meaningful. The authors should add standard deviations across images or bootstrap confidence intervals.","section":"Table 2 and Table 3"},{"comment":"The cognitive loss includes SSIM as a maximization term, but SSIM is not a convex penalty and its gradient can be unstable; please specify the implementation details (e.g., which SSIM variant, kernel size, and whether it is differentiable in the chosen framework).","section":"Sec. 3.5, Eq. (9)"},{"comment":"There are formatting errors in the reference list: 'NerIPS' should be 'NeurIPS' in several entries, and 'InProceedings' appears as a single word in the PB-UAP entry. Please proofread the bibliography.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is a solid empirical contribution with a clear baseline comparison and a reasonable threat model, but the main intellectual claim (robust-feature extraction) is under-validated and the physical evaluation is thin. I do not see a circularity problem, as the authors correctly note that black-box transferability and physical robustness are genuine predictions. The major revisions I request are additive (direct validation of Eq. 2, more physical trials, full hyperparameters and ablations), not changes to the core method. If the authors can supply those, the paper would be a good fit for the journal. One additional concern for the editor: the authors state that details are in a supplementary, but no supplementary file is included; please check that a complete supplement is submitted with any revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hi [Name],\n\nQuick take on arXiv:2412.16958 (RFCoA). The paper proposes a perturbation-based physical-world adversarial attack that extracts 'robust features' from a target class via an autoencoder, then fuses them onto clean images using an attention mask and a sparsity mask to maintain stealth. The headline results are good: on 12 ImageNet classifiers with three surrogates, RFCoA beats C/P-A, TPA, RFLA, and CleanSheet on most black-box models, and the printed-photo evaluation at 10-20 cm and 15-45 degrees shows better robustness than the baselines. The SSIM/LPIPS numbers also indicate it's stealthier.\n\nWhat's actually new is the specific pipeline, not the core idea. Leveraging robust features for transferable attacks goes back to Ilyas et al. and especially Springer et al. 2021b, which the paper cites but doesn't compare against directly. That's a gap. The autoencoder-based disentanglement and the attention fusion with a pattern mask is a reasonable engineering contribution, and the physical-world evaluation, though small, is more than many papers do.\n\nThe main soft spot is that the optimization in Eq (3) is never validated against the robust-feature definition in Eq (2). The authors minimize cross-entropy over an ensemble and call the result 'robust features,' but they don't show that the extracted features stay predictive under held-out perturbations or on held-out architectures. The ViT-b32 numbers hint at surrogate overfitting: tASR drops from 0.99 on DenseNet-121 (a surrogate) to 0.18 on ViT-b32 (black-box). That's a red flag. The physical test is also thin: 100 images, one session, no error bars, and only a narrow range of distances and angles. The LVLM evaluation is weaker still—appending the target class name to the prompt and then counting a hit is circular.\n\nNone of this kills the paper. The attack does work better than the baselines on the evaluated settings, and the empirical protocol is mostly sound. But the central mechanism is under-supported, and the claims of 'superior transferability and robustness' go beyond what the evidence shows. A serious referee should ask for (1) direct validation of feature robustness, (2) a comparison with Springer et al.'s robust-feature attack, (3) a larger physical test with error bars, and (4) a cleaner LVLM evaluation.\n\nI'd send this to peer review—it deserves referee time—but I'd expect major revision. I probably wouldn't cite it in its current form, but if the authors address the validation gap, it could become a useful reference for physical-world transfer attacks.\n\nBest,\n[Your name]","headline":"Plausible physical-world attack with strong numbers, but the robust-feature assumption needs direct validation before I'd trust the transferability claims.","tokens_in":14555,"tokens_out":2542,"would_cite":false,"duration_ms":22720,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that physical-world adversarial examples can be made transferable and robust by injecting target-class robust features, and that its RFCoA method achieves this while keeping perturbations nearly invisible.","keywords":["physical-world adversarial examples","robust features","transferability","stealthiness","targeted attack","feature fusion","adversarial perturbations","large vision-language models"],"falsifier":"Feed an RFCoA adversarial image to a black-box model whose architecture and training are far from the surrogate set, such as a CLIP zero-shot classifier, and measure target attack success rate; if it is near zero even in the digital world, the extracted features are not genuinely model-consistent. Alternatively, re-photograph the printed adversarial examples at angles beyond 45 degrees or under night lighting and check whether tASR drops sharply, which would reveal that the reported physical robustness only holds in the narrow tested range.","tokens_in":13527,"feed_emoji":"🎯","tokens_out":7118,"duration_ms":59574,"temperature":0.7,"pith_summary":"The paper is trying to establish that the long-standing trade-off in physical-world adversarial examples—between attack strength and stealth, and between white-box success and black-box transfer—can be overcome by attacking through robust features rather than the fragile non-robust features that ordinary adversarial perturbations exploit. It proposes RFCoA, a two-stage perturbation-based attack that first disentangles target-class robust features in the latent space of an autoencoder and then fuses them onto clean images using attention weights and a sparse pattern mask. Experiments claim that RFCoA beats current state-of-the-art PAE methods on transferability, robustness to distance and angle, and visual stealthiness, and that it also fools large vision-language models. A sympathetic reader would care because if the claim holds, printed adversarial objects could be both nearly invisible and effective against unknown black-box systems, including multimodal ones.","feed_headline":"Robust features make physical attacks transferable and nearly invisible","feed_subtitle":"New attack injects target-class semantic patterns into clean photos, beating prior methods on transferability, robustness, and stealth.","key_machinery":"The central object is the robust feature (RF), defined as features whose predictive power persists under worst-case perturbations within a set $\\Delta(x)$ (Eq. 2). The machinery is two coupled optimizations: Eq. (3) extracts target-class RFs by minimizing the ensemble cross-entropy of decoded, noise-perturbed features, and Eq. (10) fuses them into clean images by jointly optimizing attention weights $\\alpha$ and a pattern mask $m$ under an adversarial loss $L_{\\mathrm{adv}}$ and a cognitive loss $L_{\\mathrm{cog}}$ that enforces sparsity, smoothness, and SSIM similarity. A gradient-based spatial attention map (Eq. 4) locates the clean image's predictive features to weaken, and the pattern mask strips away non-essential perturbations, making the final adversarial example visually close to the original.","core_discovery":"The paper's central claim is that RFCoA, a perturbation-based physical-world adversarial attack, achieves simultaneously high transferability to unseen black-box models, robustness to physical distortions such as distance and angle, and stealthiness, outperforming state-of-the-art patch-, optical-, and perturbation-based methods. It argues that this is possible because the attack injects robust features of the target class—image patterns that are semantically predictive, survive noise, and are perceived similarly across different models—into the clean image, instead of manipulating the brittle non-robust features that ordinary adversarial examples exploit. In the first stage, Robust Feature Disentanglement extracts these features by optimizing a feature vector through an autoencoder so that an ensemble of surrogate models classifies the decoded, noised image as the target class. In the second stage, Adversarial Feature Fusion uses a gradient-based spatial attention map to weaken the clean image's own predictive features, overlays the target-class features with learned per-position weights, and optimizes a sparse pattern mask so that only the essential adversarial pattern remains. The paper reports that this yields tASR gains of roughly 10 to 50 points over baselines across black-box models, maintains tASR above 0.22 on black-box models even at 45 degrees angle and 20 cm distance, and achieves SSIM 0.89 and LPIPS 0.14.","pith_inferences":["We infer that the optimization in Eq. (3) does not literally enforce the infimum over all perturbations in the definition of Eq. (2); it samples random noise and averages loss, so the extracted features may be only weakly robust and could overfit the surrogate ensemble.","If the robust-feature story is right, then a testable prediction follows: the same RFCoA procedure should transfer to any model trained on similar visual semantics, including CLIP-style zero-shot classifiers, with little or no adaptation.","The success on LVLMs suggests that robust features may act as semantic bridges that shift multimodal alignment; this could be used as a probe to study what image-text models actually ground on.","The attention-plus-mask fusion recipe is general enough that other perturbation-based PAE methods could adopt it, potentially improving the transferability and stealth trade-off without redesigning the attack from scratch."],"forward_implications":["If RFCoA is correct, printed adversarial objects can transfer to black-box models never used in crafting the attack, including transformer-based classifiers.","Physical robustness holds over a range of re-photography distances (10 to 20 cm) and angles (15 to 45 degrees), with black-box tASR staying near or above 0.22 even in the hardest tested condition.","Adversarial examples can be both effective and nearly invisible: SSIM 0.89 and LPIPS 0.14 place the perturbations below what prior patch-based and most optical attacks achieve.","The attack retains high success against PGD adversarial training and DiffPure purification, because robust features survive both defenses.","The same adversarial example generation procedure extends to large vision-language models, suggesting a path toward attacks on visual question answering and image captioning systems."],"supporting_citations":[{"why":"Supplies the robust and non-robust feature dichotomy and the claim that ordinary adversarial examples exploit non-robust features, which motivates the entire RF-injection approach.","marker":"Ilyas et al. 2019"},{"why":"Demonstrates that robust features can be leveraged for targeted transfer attacks, serving as the direct precedent for the transfer mechanism.","marker":"Springer, Mitchell, and Kenyon 2021b"},{"why":"Argues that adversarial perturbations are entangled with both robust and non-robust features, supporting the paper's feature classification.","marker":"Springer, Mitchell, and Kenyon 2021a"},{"why":"Provides a non-robust feature perspective on batch normalization and adversarial transferability, used to justify the model consistency of robust features.","marker":"Benz, Zhang, and Kweon 2021"},{"why":"Supplies the minimal cognitive pattern approach that the paper adapts to minimize adversarial perturbations and keep only essential semantic patterns.","marker":"Huang et al. 2023b"},{"why":"Grad-CAM is used to compute the spatial attention map that locates predictive features in clean images during feature fusion.","marker":"Selvaraju et al. 2017"},{"why":"CleanSheet is the perturbation-based physical adversarial example baseline whose transferability and robustness the paper aims to surpass.","marker":"Ge et al. 2024"}],"fun_headline_variants":["RFCoA injects robust features: physical attacks transfer and stay stealthy","Semantic pattern injection makes adversarial examples transferable and invisible","Robust feature coverage attack beats prior methods on transfer and stealth","Adversarial examples that survive distance, angle, and black-box models","Robust features make physical attacks transferable and nearly invisible"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that the features extracted by optimizing over a few surrogate models are the target class's truly robust, model-consistent features; if they only fit the surrogates, transferability and physical robustness collapse outside the evaluation set.","fun_headline_variants_meta":{"raw":{"variants":["RFCoA injects robust features: physical attacks transfer and stay stealthy","Semantic pattern injection makes adversarial examples transferable and invisible","Robust feature coverage attack beats prior methods on transfer and stealth","Adversarial examples that survive distance, angle, and black-box models","Robust features make physical attacks transferable and nearly invisible"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000339,"raw_usage":{"total_tokens":1961,"prompt_tokens":1123,"completion_tokens":838,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":739,"completion_tokens_details":{"reasoning_tokens":749}},"tokens_in":739,"tokens_out":838,"duration_ms":7220,"temperature":1.0,"reasoning_tokens":749,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T05:56:11.136178+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Feed an RFCoA adversarial image to a black-box model whose architecture and training are far from the surrogate set, such as a CLIP zero-shot classifier, and measure target attack success rate; if it is near zero even in the digital world, the extracted features are not genuinely model-consistent. Alternatively, re-photograph the printed adversarial examples at angles beyond 45 degrees or under night lighting and check whether tASR drops sharply, which would reveal that the reported physical robustness only holds in the narrow tested range.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the robust and non-robust feature dichotomy and the claim that ordinary adversarial examples exploit non-robust features, which motivates the entire RF-injection approach."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides a non-robust feature perspective on batch normalization and adversarial transferability, used to justify the model consistency of robust features."},{"cited_title":"R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D","cited_arxiv_id":null,"evidence_quote":"Grad-CAM is used to compute the spatial attention map that locates predictive features in clean images during feature fusion."}],"review_version":1}