{"id":"7d59c6de-4ed0-4d0b-a62e-a535865f775f","arxiv_id":"2412.20807","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Averaging adversarial examples over the fine-tuning trajectory, called AaF, improves targeted adversarial transferability across CNN and transformer victim models compared with endpoint-only fine-tuning.","lead":"This paper proposes averaging adversarial examples along the fine-tuning trajectory, instead of keeping only the final example, to make targeted attacks transfer better across different AI models. In ImageNet benchmark tests, the averaging method raises targeted transfer success by several percentage points over the previous fine-tuning endpoint method.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"AaF vs FFT comparison may be confounded by total fine-tuning iterations: warm-up N_wu=5 is omitted from Algorithm 1, while the supplementary γ-ablation implies Nft=15, not the stated Nft=10.","rationale":"The reader's weakest-assumption concerned the qualitative mechanism (warm-up quality and centrality). I find a more concrete, falsifiable threat: the iteration budget is not clearly matched between AaF and FFT. The main text fixes Nft=10 and N_wu=5, yet Algorithm 1—which should define the method—contains no warm-up and averages from the initial AE. The supplementary ablation then says γ=0 corresponds to FFT with Nft=15, suggesting that in practice 15 fine-tuning steps are used. If warm-up is extra, AaF simply has a longer optimization budget; averaging would be unnecessary for the reported gains. This would not make the method useless, but it would invalidate the paper's central comparison and the attribution of the improvement to averaging. The proposed test settles it by matching total iterations across methods. Until that is done, the current conditional accept remains appropriate, so I keep the reader's verdict unchanged.","tokens_in":14109,"tokens_out":6498,"duration_ms":62739,"concrete_test":"Run a matched-compute ablation on the Dense121→VGG16 CE transfer setting from Table I: (a) FFT with Nft=15, (b) AaF with Nft=10 and no warm-up, and (c) AaF with 5 warm-up iterations plus Nft=10 while FFT uses Nft=15. If condition (a) or (c) reaches the reported CE+AaF success rate (about 50.3%), the claimed advantage of averaging is not established. Report mean and standard deviation over at least 5 independent runs.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that AaF improves over FFT requires an apples-to-apples comparison. The main text sets Nft=10 (Sec. IV-A) and N_wu=5 warm-up iterations (Sec. III-B), but Algorithm 1 contains no warm-up step: it starts from the baseline AE and averages over Nft fine-tuned snapshots. The supplementary ablation (Fig. 1) states that γ=0 'reduces to the vanilla FFT method with Nft=15', implying the ablation uses 15 fine-tuning iterations, not 10. If the AaF results in Tables I/II effectively use 15 total fine-tuning iterations (5 warm-up + 10 averaged) while the FFT baseline uses only 10, then the reported gains—e.g., CE+AaF 50.3% vs CE+FFT 34.8% on Dense121→VGG16—may be attributable to extra optimization steps rather than trajectory averaging. This is a concrete confound: the positive results would hold even if averaging contributes nothing, as long as more fine-tuning iterations help. The paper does not report the total fine-tuning iteration budget per method, nor does it specify how N_wu enters Algorithm 1.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AaF (Averaging along Fine-Tuning), a fine-tuning strategy for targeted adversarial attacks that averages the adversarial example (AE) over the fine-tuning trajectory rather than using only the endpoint as in FFT. The method is integrated with five baseline attacks (CE, Logit, Margin, SH, SU) and evaluated on CNN and transformer victim models, reporting consistent improvements over ILA and FFT and competitive performance with generative attacks such as TTP and C-GSP. The authors attribute the improvement to the averaged AE being located in a 'more centered region' of the loss surface, supported by 2D logit contour plots. The code is released.","tokens_in":14381,"tokens_out":4860,"duration_ms":50004,"significance":"If the reported gains are valid, AaF is a simple, low-overhead method that could improve targeted transferability across a broad range of attacks and architectures, with a plausible connection to flatness/centrality of the loss landscape. The paper includes a wide empirical comparison: five baselines, four surrogate architectures, multiple CNN and transformer victims, and a robust-surrogate setting. However, two load-bearing issues currently undermine the central comparison: an inconsistency in the fine-tuning iteration budget between AaF and FFT, and an unenforced L-infinity constraint on the averaged AE. These issues must be resolved before the empirical claims can be accepted.","major_comments":[{"comment":"The fine-tuning iteration budget is inconsistent between AaF and the FFT baseline, potentially confounding the central comparison. Main text (Sec. IV-A) sets Nft=10 and states N_wu=5 warm-up iterations, but Algorithm 1 in the supplementary has no warm-up loop. The supplementary ablation (Sec. B) says that γ=0 'reduces to the vanilla FFT method with Nft=15', implying the ablation uses 15 fine-tuning iterations, not 10. If the AaF results in Tables I and II effectively use 5 warm-up + 10 averaged = 15 total fine-tuning iterations while the FFT baseline uses only 10, then the reported gains (e.g., CE+AaF 50.3% vs CE+FFT 34.8% for Dense121→VGG16) may be attributable to extra optimization steps rather than trajectory averaging. Please clarify exactly how many fine-tuning iterations each method uses, and provide a matched-budget comparison (e.g., FFT with 15 iterations, or AaF with only 10 total iterations).","section":"Sec. IV-A, Algorithm 1, Supplementary Sec. B"},{"comment":"The proposed AaF average does not appear to be projected back into the L-infinity ball, violating the stated threat model. The weights in Eq. (5) sum to (1 - γ^{Nft})/(1 - γ), which for Nft=10 and γ=0.8 is approximately 4.6. If each snapshot I'_ft,i lies within the allowed ε-ball, the weighted sum can be several times larger than ε. Algorithm 1's recurrence (line 7) has no clipping or projection step, and the paper does not state that the final output is clipped. If the constraint is not enforced, AaF may produce perturbations that exceed the reported budget, giving it an unfair advantage over FFT and ILA. Please add an explicit projection step (or normalize the weights so the sum equals 1) and confirm that the reported experiments respect ||I'_aaf - I||_∞ ≤ ε.","section":"Eq. (5), Algorithm 1"},{"comment":"The mechanistic claim that AaF locates AEs in a 'more centered region' is supported only by qualitative 2D logit contour plots. The paper does not provide any quantitative measure of centrality, flatness, or the claimed trajectory behavior. To substantiate the explanation, please report quantitative metrics averaged over the test set, such as the trace of the Hessian of the logit loss, the variance of the logits in a local neighborhood, or the distance to the decision boundary, comparing FFT and AaF.","section":"Fig. 3, Supplementary Sec. C"},{"comment":"The decaying factor γ is selected using the same victim models that appear in the main evaluation. The supplementary ablation computes transferability averaged over 'three hold-out models' and Swin, but Table I and the transformer results use those same victim models. This constitutes tuning on the evaluation set and can inflate the reported performance. Please perform the γ selection on a separate validation set of victim models, or show that the chosen γ=0.8 performs well across a range of unseen models without being selected on them.","section":"Sec. IV-A, Supplementary Fig. 1"}],"minor_comments":[{"comment":"In Algorithm 1, line 6 says 'Fine-tune I_aaf,t-1 with the optimization objective defined in (4) and obtain I'_ft,t', but the notation I'_ft,t is not explicitly defined in the loop. It would be clearer to state that I'_ft,t is the snapshot produced by one step of the fine-tuning optimization, and to specify whether it is clipped to the ε-ball.","section":"Eq. (5) and Algorithm 1"},{"comment":"The sentence 'the baseline iteration number N=160 (N=200 when fine-tuning is disabled)' is ambiguous: it is not clear whether N refers to the total number of attack iterations including fine-tuning, or only to the baseline attack. Please state the total number of optimization steps for each configuration.","section":"Sec. IV-A"},{"comment":"The supplementary tables do not state which fine-tuning hyperparameters (Nft, N_wu, γ) were used for the transformer and most-difficult-target experiments. Please include these settings or refer to the main-text parameters.","section":"Supplementary Tables 1 and 2"},{"comment":"The contour plots would benefit from a color scale or numeric labels on the logit contours, and from marking the original image and the target-class direction, so that the 'central region' claim is visually verifiable.","section":"Fig. 3 and Supplementary Fig. 2"}],"recommendation":"major_revision","confidential_remarks":"The two main issues—iteration-budget mismatch and the unenforced L∞ constraint—are potentially fixable with controlled experiments, but they strike at the core comparison that supports the paper's headline claim. If the violation of the perturbation budget is confirmed, the quantitative results may change substantially. The authors should also address the test-set tuning of γ and the lack of error bars. I would not recommend acceptance in the current form, but a careful revision with matched compute and proper constraint enforcement could make the contribution publishable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This paper applies weight averaging to adversarial fine-tuning: instead of using only the endpoint of FFT, it averages snapshots along the trajectory with an exponential decay. That is a simple, previously unreported combination and it makes sense as an analogue of stochastic weight averaging. The evaluation is genuinely broad: five baseline attacks, four CNN surrogates, transformer victims, a robust surrogate, and a comparison with generative attacks. Across the board AaF improves over FFT, often by several points, and the overhead is negligible. For anyone working on targeted transfer attacks, this is a useful practical add-on. The main issue is the iteration budget. The method section says they use N_wu=5 warm-up iterations, but Algorithm 1 has no warm-up. The gamma ablation in the supplement says gamma=0 reduces to FFT with Nft=15, while the main text sets Nft=10. That is confusing. If AaF actually uses 5 warm-up plus 10 averaged steps while FFT uses 10 steps, then part of the reported gain could be extra fine-tuning compute. The stress-test note is right to flag this. That said, the gamma ablation itself includes a same-compute control: at Nft=15, gamma=0 (FFT) versus gamma=0.8 (AaF) shows AaF winning, which supports the averaging effect rather than pure extra compute. So the concern is not that the result is fake, but that the main tables' settings are under-specified and the comparison may not be apples-to-apples. The authors need to clarify the exact schedule and add a compute-matched ablation, e.g., FFT with Nft=15 versus AaF with Nft=10 plus warm-up=5, and AaF with Nft=15 without warm-up. Other soft spots: all numbers are single-run success rates with no error bars or significance tests, so a difference of one or two points may be noise. Gamma is selected from an ablation that uses the same evaluation victims, which is a mild selection bias. The 'centered region' explanation rests only on 2D contour plots, which is okay as intuition but not as evidence. All of these are fixable in revision. Who is this for? Researchers on transferable targeted attacks who want a cheap boost on top of existing baselines. It is not a conceptual breakthrough. A serious referee should engage with it, mainly to force the authors to fix the iteration accounting and add variance estimates. I would accept it for peer review and recommend conditional acceptance after that cleanup.","headline":"A plausible and broadly evaluated incremental attack that needs a cleaner iteration-accounting before the headline gains are fully trustworthy.","tokens_in":732,"tokens_out":1669,"would_cite":true,"duration_ms":54826,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Targeted adversarial attacks transfer better when the final image is an average of the fine-tuning trajectory, not just its endpoint.","keywords":["targeted adversarial attack","transferability","fine-tuning trajectory","trajectory averaging","feature space fine-tuning","adversarial example","loss surface flatness"],"falsifier":"Compute a quantitative flatness or centrality measure — for example, the average loss increase under random pixel perturbations, or the curvature of the logit surface — for the FFT endpoint and the AaF endpoint across many images and source models. If AaF endpoints are not systematically flatter or more central than FFT endpoints on that measure, the proposed mechanism is not supported even if transferability numbers improve.","tokens_in":13909,"feed_emoji":"🎯","tokens_out":4926,"duration_ms":42864,"temperature":0.7,"pith_summary":"This paper is about making targeted adversarial attacks work against models the attacker did not see. Fine-tuning an existing attack image in feature space helps, but current schemes keep only the last image. The paper proposes to keep a weighted average of the whole fine-tuning path, with recent snapshots weighted by a decay factor of 0.8. Across five baseline attacks and several source/victim model pairs, the resulting images are consistently more transferable, with the weakest baseline (cross-entropy) gaining the most. The claimed reason is that averaging pulls the attack image into a flatter, more central region of the loss surface.","feed_headline":"Averaging fine-tuning snapshots boosts targeted attack transfer","feed_subtitle":"A simple running average along the attack's fine-tuning path lifts success rates, most for the weakest baselines.","key_machinery":"The load-bearing object is the exponential-decay trajectory average, Eq. (5), implemented online as $I'_{aaf,i} = \\gamma I'_{aaf,i-1} + I'_{ft,i}$, after only $N_{wu}=5$ warm-up iterations. Averaging is applied to the same feature-space fine-tuning loop as FFT: an aggregate gradient combines target-class feature importance (with random patch masking and Gaussian smoothing) and source-class suppression, and each fine-tuning step maximizes the dot product between this combined gradient and the feature map. The mechanism proposed to explain the gain is that vanilla fine-tuning oscillates around the periphery of a flat region of the loss surface, while the weighted average of snapshots lands closer to the center of that region, which is more transferable.","core_discovery":"The paper's central claim is that the exponential moving average of adversarial images collected along the fine-tuning trajectory, computed as $I'_{aaf} = \\gamma^{N_{ft}-1} I'_{ft,0} + \\gamma^{N_{ft}-2} I'_{ft,1} + \\cdots + I'_{ft,N_{ft}-1}$ with $\\gamma=0.8$, yields an adversarial image located in a more centered region of the loss surface than the endpoint-only fine-tuning of FFT. In this centered region the image exhibits stronger transferability to held-out models. The claim is supported by consistent improvements in targeted success rate over five baseline attacks (CE, Logit, Margin, SupHigh, SU) when AaF is applied, with the largest gains on the weakest baselines; for example, transferring CE-based attacks from Dense121 to VGG16 rises from 11.3% to 50.3%.","pith_inferences":["Trajectory averaging here plays a role analogous to stochastic weight averaging in model training; the same trick could plausibly be applied to the fine-tuning stage of other intermediate-level attacks, such as ILA, to see whether centrality gains generalize.","The flatness/centrality explanation is currently supported only by contour plots; a quantitative test would be to compare Hessian-based curvature or the loss increase under random perturbations for AaF versus FFT endpoints.","A natural testable extension is to replace the fixed decay factor with an adaptive schedule based on validation transferability, or to use geometric averaging in the perturbation space rather than the image space."],"forward_implications":["Any iterative targeted attack (CE, Logit, Margin, SupHigh, SU) can be upgraded to AaF by keeping a running average of fine-tuned snapshots, adding negligible computation.","The weaker the baseline attack, the larger the transferability gain from AaF; the hardest transfer scenarios benefit most.","Fine-tuned iterative attacks with AaF match or beat generative methods like TTP and C-GSP at low perturbation budgets ($\\epsilon=8$).","AaF also improves transferability when the surrogate is an adversarially trained model.","The improvement holds across CNN architectures and extends to transformer-based victim models, though overall success rates remain low."],"supporting_citations":[{"why":"Provides the base feature-space fine-tuning method (FFT) that AaF extends, including the combined aggregate gradient and fine-tuning objective.","marker":"[11]"},{"why":"Supplies the inspiration that averaging high-quality snapshots along a training trajectory leads to wider optima and better generalization.","marker":"[12]"},{"why":"Defines the intermediate-level attack (ILA) used as a competing fine-tuning scheme in the experiments.","marker":"[9]"},{"why":"Provides the Logit baseline attack and the experimental settings (surrogates, parameters) that the paper follows.","marker":"[20]"},{"why":"Provides the transferable targeted perturbation (TTP) generative attack compared in Table III.","marker":"[15]"},{"why":"Provides the conditional generative attack (C-GSP) compared in Table III.","marker":"[16]"},{"why":"Supplies the patch-wise random mask used in computing the aggregate feature-importance gradients.","marker":"[28]"}],"fun_headline_variants":["Averaged fine-tune path yields stronger transfer attacks","EMA of fine-tune path centers adversarial image","Average fine-tune snapshots to center attack for transfer","Averaged trajectory beats endpoint for attack transfer"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that after only five warm-up fine-tuning iterations, every snapshot is a high-quality adversarial image, and that a fixed decay factor of 0.8 over their average reliably shifts the attack to a flatter, more central region of the loss surface; the only direct evidence offered is a handful of two-dimensional contour plots.","fun_headline_variants_meta":{"raw":{"variants":["Averaged fine-tune path yields stronger transfer attacks","EMA of fine-tune path centers adversarial image","Average fine-tune snapshots to center attack for transfer","Averaged trajectory beats endpoint for attack transfer"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000434,"raw_usage":{"total_tokens":2181,"prompt_tokens":883,"completion_tokens":1298,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":499,"completion_tokens_details":{"reasoning_tokens":1244}},"tokens_in":499,"tokens_out":1298,"duration_ms":10273,"temperature":1.0,"reasoning_tokens":1244,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T23:09:55.362510+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute a quantitative flatness or centrality measure — for example, the average loss increase under random pixel perturbations, or the curvature of the logit surface — for the FFT endpoint and the AaF endpoint across many images and source models. If AaF endpoints are not systematically flatter or more central than FFT endpoints on that measure, the proposed mechanism is not supported even if transferability numbers improve.","supporting_citations":[{"cited_title":"Enhancing targeted transferability via feature spa ce fine -tuning,","cited_arxiv_id":null,"evidence_quote":"Provides the base feature-space fine-tuning method (FFT) that AaF extends, including the combined aggregate gradient and fine-tuning objective."},{"cited_title":"Enhancing adversarial example transferability with an intermediate level attack,","cited_arxiv_id":null,"evidence_quote":"Defines the intermediate-level attack (ILA) used as a competing fine-tuning scheme in the experiments."},{"cited_title":"On success and simplicity: a second look at transferable targeted attacks,","cited_arxiv_id":null,"evidence_quote":"Provides the Logit baseline attack and the experimental settings (surrogates, parameters) that the paper follows."},{"cited_title":"On generating transferable targeted perturbations,","cited_arxiv_id":null,"evidence_quote":"Provides the transferable targeted perturbation (TTP) generative attack compared in Table III."},{"cited_title":"Boosting transferability of targeted adversarial examples via hierarchical generative network,","cited_arxiv_id":null,"evidence_quote":"Provides the conditional generative attack (C-GSP) compared in Table III."},{"cited_title":"Enhancing the transferability of adversarial examples with random patch,","cited_arxiv_id":null,"evidence_quote":"Supplies the patch-wise random mask used in computing the aggregate feature-importance gradients."}],"review_version":1}