{"id":"3a8c6c01-85ff-4e4f-80c7-8aa4c727409d","arxiv_id":"2501.01106","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Adding a guiding image through a semantic injection module substantially improves transferable targeted adversarial attacks.","lead":"A semantic injection module feeds a guiding image into an adversarial generator, letting the generated perturbation carry target-class semantics. On ImageNet benchmarks, the guided attacks transfer to unseen models far better than prior generative attacks, especially for targeted attacks on vision transformers.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Omission of the TTAA baseline leaves 'consistently surpasses all alternatives' unestablished; the central targeted-claim requires a head-to-head comparison.","rationale":"I read the central claim as empirical: AIM surpasses all previous methods on targeted cross-architecture transfer, including ViT. For that claim, the comparison set is the evidence. The Related Work explicitly identifies TTAA as a strong generative targeted attack, yet the experiments omit it. If TTAA outperforms AIM, the sentence 'consistently surpasses all alternative approaches across every model' is unsupported. The untargeted Eq (6) issue is real and should be corrected because Lusi as printed has no dependence on x_adv and thus cannot train the generator, but the paper's primary targeted contribution does not rely on that equation. The guiding-image generalization assumption is tested in the reported protocol, since different test-time guiding images are used; this weakens the reader's weakest_assumption as the key risk. The 'first on ViT' phrasing is inconsistent with the nonzero TTP and GAP numbers in Table 1, but that is a wording problem secondary to the missing TTAA baseline. My proposed check is feasible because TTAA is public and the paper states it follows the same evaluation protocol as Wang et al. The reader's conditional verdict already accommodates this concern; if the check refutes superiority, the claim should be scaled back, but until then the conditional verdict remains appropriate.","tokens_in":12453,"tokens_out":5720,"duration_ms":57249,"concrete_test":"Reproduce the targeted cross-architecture experiment of Table 1 with TTAA (Wang et al., 2023) included under identical conditions: same three target classes (Great Grey Owl, Goose, French Bulldog), same surrogate models (ResNet-152 and DenseNet-169), same epsilon=16/255, same ten evaluation models, and same training data. Compute Avg/Conv, Avg/ViT, and Avg/All exactly as in the paper. If TTAA's Avg/ViT or Avg/All meets or exceeds AIM's entries (e.g., 24.39% and 61.23% for DenseNet-169), then the central claim of surpassing all alternatives is refuted; if AIM still wins, the omission is a reporting gap rather than a correctness error. Also check whether TTAA's published ViT results already exceed the 5.90% threshold the paper attributes to TTP, which would invalidate the 'first on ViT' phrasing.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is empirical: AIM surpasses all alternative approaches on targeted cross-architecture transfer, including ViT models. The Related Work section explicitly identifies TTAA (Wang et al., CVPR 2023) as a dual-discriminator generative targeted attack, yet Table 1 omits TTAA from the baseline set, listing only PGD, DI-FGSM, DR, CDA, GAP, TTP, and BIA. Without the strongest recently published targeted generative attack, the sentence 'our methodology consistently surpasses all alternative approaches across every model' is not supported by the evidence presented. The same omission affects the 'first to successfully conduct attacks on the ViT architecture' assertion: if TTAA already reports nontrivial ViT transfer success, or exceeds AIM's 24.39% average, the headline claim is false. This is a correctness risk in the empirical argument, not a dispute about SIM's internal mechanics; the loss formulations and ablations may be coherent, but the comparison set is incomplete for the claimed universality. The reader's weakest_assumption about random guiding images is actually partially tested in the reported protocol, since test-time guiding images are stated to differ from training ones, making the missing baseline the more decisive gap.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AIM, a generative attack framework that injects semantic information from an additional guiding image into an adversarial generator via a Semantic Injection Module (SIM). The module uses affine transformations on generator feature maps, conditioned on the guiding image, and the paper introduces new training losses for both targeted and untargeted transferable attacks. Experiments on ImageNet with ResNet-152 and DenseNet-169 surrogates evaluate transfer to ten target architectures, including ViT and Swin, reporting large gains in targeted cross-architecture attack success (e.g., 24.39% average success on ViT models versus 5.90% for TTP) and improvements in untargeted cross-domain and cross-architecture settings. The paper includes ablations on loss objectives, guiding-image selection strategies, and computational overhead, and it releases code.","tokens_in":12689,"tokens_out":5801,"duration_ms":54693,"significance":"If the results hold, the proposed SIM provides a simple, plug-and-play way to improve targeted transferability of generative adversarial attacks, especially to ViT-style architectures that are typically hard to attack. The paper's strengths include the clear architecture design, the use of held-out target models, and the ablation of guiding-image selection, which partly addresses the concern that random guiding images may not generalize (the test-time guiding images are stated to differ from training-time ones). However, the significance is currently undercut by two issues: the untargeted semantic injection loss as printed has no dependence on the generator output, and the comparison set for targeted attacks omits the closely related TTAA baseline that the paper itself identifies as a recent generative targeted attack. These issues must be addressed before the claimed superiority over 'all alternative approaches' can be accepted.","major_comments":[{"comment":"The untargeted semantic injection loss Lusi is printed as L(1/N) sum of Lcos(f^l(x_guide^i), f^l(x)), which depends only on the guiding images and the clean image; it does not involve the generator output x_adv. As written, this term has zero gradient with respect to the generator parameters, so it cannot train the generator. The surrounding text states that the loss 'forces the generated adversarial examples close to the semantics of a randomly chosen untarget,' which requires a term like Lcos(f^l(x_adv), f^l(x_guide)) or a contrastive expression involving x_adv. This appears to be a typo, but until corrected and the untargeted experiments are re-verified with the intended loss, the untargeted results in Tables 2 and 3 are not supported by the equations.","section":"Methodology, Untargeted Attack, Eq. (6)"},{"comment":"The Related Work section explicitly describes TTAA (Wang et al., CVPR 2023) as a dual-discriminator generative targeted attack, yet Table 1 lists only PGD, DI-FGSM, CDA, GAP, TTP, and BIA, omitting TTAA. The claim that 'our methodology consistently surpasses all alternative approaches across every model' and the assertion of being 'the first to successfully conduct attacks on the ViT architecture' cannot be established without a head-to-head comparison against TTAA under identical settings (same surrogate models, target models, epsilon, and evaluation protocol). If TTAA already reports nontrivial ViT transfer success or exceeds the reported 24.39% average, the headline claims would be incorrect. The authors should add TTAA to the baseline set or provide a clear justification for its exclusion.","section":"Experiments, Targeted Cross-architecture Transferability, Table 1"},{"comment":"The caption of Table 4 states that in the targeted scenario 'lower values are preferable' and in the untargeted scenario 'higher values are desirable.' This is the reverse of the conventions used in Tables 1-3, where higher top-1 accuracy is better for targeted attacks and lower top-1 accuracy is better for untargeted attacks. The caption introduces confusion about how to interpret the ablation numbers, even though the row ordering (both losses together giving the best result) is still discernible. Please correct the caption to align with the evaluation metrics used elsewhere in the paper.","section":"Experiments, Ablation Study, Table 4"}],"minor_comments":[{"comment":"Please clarify the optimization direction for Lufs: the text says the loss 'enforce[s] the adversarial features to be far away from the clean features,' but since cosine similarity is bounded, the reader needs to know whether the loss is minimized (driving cosine similarity down) or maximized. State the sign convention explicitly for reproducibility.","section":"Methodology, Untargeted Attack, Eq. (5)"},{"comment":"The paper does not report the number of test images used to compute the average top-1 accuracy in Tables 1-3, nor does it report standard deviations across multiple runs or random guiding image selections. Please specify these details so the magnitude of the reported gains can be assessed.","section":"Experiments, Experimental Setup"},{"comment":"The text refers to Figure 2 for Grad-CAM visualizations, but the figure content appears to be missing from the provided manuscript. Please ensure the figure is included and properly captioned.","section":"Visualization of Targeted Attacks, Figure 2"},{"comment":"In the paragraph describing the ablation results, the text says 'the integration of the semantic injection loss Lufs relatively enhances performance,' but Lufs is the base feature-disruption loss, not the semantic injection loss; the semantic injection loss is Lusi. Please correct this labeling error.","section":"Ablation Study, Table 4 discussion"},{"comment":"Please clarify the units in Table 6 (e.g., whether FLOPs are in GFLOPs and whether the average time is per image or per batch) and specify the hardware used for the timing measurements, so the reported overhead can be interpreted.","section":"Computational Analysis, Table 6"}],"recommendation":"major_revision","confidential_remarks":"The technical error in Eq. (6) and the missing TTAA baseline are the two main obstacles to acceptance. The targeted method itself appears coherent, and the reported gains, if verified with a complete baseline set, would be a solid contribution. The ablation-table caption errors are easily fixable but suggest the manuscript would benefit from a careful proofreading pass before resubmission."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know before you read this one. The core idea is simple and looks effective: inject semantics from an extra guiding image into an adversarial generator via SPADE-like affine layers, and train with a contrastive logit loss plus a feature-similarity loss. Targeted transfer results, especially on ViTs, are genuinely striking—24% average success on ViT models versus single digits for prior methods. If that holds up, it matters for evaluating deployed vision systems.\n\nThe paper does several things well. The SIM module is lightweight, plug-and-play, and the ablations show both losses contribute. The computational cost table is honest. The untargeted cross-domain and cross-architecture tables also show strong performance, with the method beating the included baselines clearly.\n\nNow the soft spots, and they are not minor. Equation (6), the untargeted semantic injection loss, as printed depends only on x_guide and x—not on the generator output x_adv. It is a constant with respect to the generator parameters, so it cannot train anything. The text says it 'forces the generated adversarial examples' to move toward the semantics of the guiding class, but the math does not. Since the untargeted ablation shows L_usi has a large effect, the authors clearly implemented something else. The paper cannot be reproduced from Eq. (6), and the gap between the prose and the equation is a serious editorial flaw, not a nitpick.\n\nThe other big gap is baselines. The Related Work explicitly discusses TTAA (Wang et al., CVPR 2023), a dual-discriminator generative targeted attack, but TTAA is absent from Table 1. The paper claims 'consistently surpasses all alternative approaches across every model' and 'first to successfully conduct attacks on the ViT architecture.' Without a head-to-head against TTAA, those claims are unsupported. Maybe AIM really is better, but the reader cannot verify it. This is a simple omission to fix, but it is load-bearing for the universality claims.\n\nA smaller issue: the targeted ablation table caption says 'lower values are preferable' when attack success should be higher-is-better. It looks like a copy-paste error, but it makes the table confusing.\n\nThe random-guiding-image concern from the reader is actually less serious than it looks, because the paper explicitly says test-time guiding images are different from training ones, so the protocol partially tests generalization.\n\nBottom line: the method is worth taking seriously, the targeted numbers are good enough to demand a proper comparison, and the SIM idea is a reasonable contribution to the transferable-attack literature. But the paper needs a corrected Eq. (6) and a TTAA comparison before I'd trust the conclusions. I'd send it to a serious referee; the flaws are fixable and the core is promising.","headline":"Useful generative attack paper with a strong targeted result, but a broken untargeted loss (Eq. 6) and a missing TTAA baseline undercut the paper's headline claims.","tokens_in":13199,"tokens_out":5358,"would_cite":true,"duration_ms":48519,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that injecting a guiding image of the target class into a generative adversarial attack via a Semantic Injection Module yields targeted adversarial examples that transfer to unseen architectures, including vision…","keywords":["adversarial examples","transferable attacks","targeted attacks","generative attacks","semantic injection module","vision transformers","cross-architecture transfer","ImageNet"],"falsifier":"Retrain the generator with one set of random guiding images per class, then evaluate on a disjoint set of guiding images and on held-out architectures; if targeted top-1 accuracy collapses to the level of the no-SIM ablation when the guiding image is changed, the semantic-injection claim is falsified. A second test: use a target-class guiding image with unusual composition or background and check whether transferability drops.","tokens_in":12255,"feed_emoji":"🎯","tokens_out":7436,"duration_ms":59611,"temperature":0.7,"pith_summary":"The paper argues that targeted adversarial attacks fail to transfer because the generator is trained without explicit target-class semantics, and proposes a Semantic Injection Module (SIM) that injects a guiding image of the target class into the generator's feature maps. With new contrastive logit and feature-similarity losses, the trained generator produces adversarial examples that transfer to unseen architectures, including vision transformers where prior methods scored near zero. The paper reports that this approach outperforms all compared generative and iterative baselines on every tested architecture, achieving an average targeted attack success of 24.39% across ViT models when trained on DenseNet-169. If correct, targeted black-box attacks become substantially more practical because an attacker only needs a single image of the target class as a guide.","feed_headline":"One guiding image lifts ViT attack success to 24.39%","feed_subtitle":"SIM turns a single target image into transferable perturbations, beating all prior attacks on every tested model.","key_machinery":"The Semantic Injection Module (SIM) is a plug-and-play component that computes per-channel scale $\\alpha$ and shift $\\beta$ from a resized guiding image via convolutions and applies $f^i_{\\mathrm{SIM}} = (1 + \\alpha^i) f^i + \\beta^i$ to the generator's feature maps. For targeted attacks it is trained with a logit contrastive loss that pulls $f(x_{\\mathrm{adv}})$ toward $f(x_{\\mathrm{guide}})$ and a cosine-similarity loss on mid-layer features that does the same while separating from $f(x)$. These losses allow a single forward pass of the generator to produce an adversarial example conditioned on both the source image and the guide.","core_discovery":"The central claim is that injecting the semantics of a target-class guiding image into an adversarial generator, through the Semantic Injection Module, yields adversarial examples that are both targeted and transferable to unseen architectures. The module applies an affine transformation to intermediate feature maps using scale and shift parameters computed from the guiding image, and the training objectives pull the generated adversarial example toward the guiding image in both logit space and mid-layer feature space while pushing it away from the source image. In the reported experiments, this configuration achieves higher average top-1 accuracy than all baselines across ten architectures, and is described as the first generative method to produce nontrivial targeted attacks on ViT models.","pith_inferences":["If random guiding images generalize as reported, any publicly available image of the target category could serve as the guide, making the attack easy to deploy with images gathered from the web (an implication the paper states but does not test against corrupted or adversarial guides).","The CLIP-score ablation suggests that scalar alignment with the target label is a poor proxy for guide quality; a selection strategy based on feature-space diversity or semantic purity might outperform both random and CLIP-based selection.","The untargeted version iterates over guiding images from one incorrect class; sweeping all incorrect classes would likely strengthen the attack further, at a training cost the paper explicitly leaves untested.","The method's reliance on a surrogate mid-layer feature space suggests it could be combined with existing input-diversity or frequency-domain augmentations to push transferability even higher."],"forward_implications":["Targeted transfer attacks become usable against transformer-based models, where prior generative methods achieved near-zero success.","Because SIM is plug-and-play, existing adversarial generators can be upgraded by adding the module rather than retraining from scratch.","An adversary needs only one image of the target class, not a dataset, to guide the attack, lowering the practical cost of targeted black-box attacks.","Training with random guiding images and testing with different random guiding images indicates the generator relies on class-level semantics rather than memorizing specific images.","Untargeted attacks also improve: guiding with an incorrect-class image reduces overfitting and yields better cross-domain transfer on fine-grained datasets."],"supporting_citations":[{"why":"Defines the TTAA targeted generative baseline and the evaluation protocol of three target classes that this paper follows.","marker":"Wang et al. 2023"},{"why":"Provides the BIA generator and mid-layer feature selection that the proposed framework builds on.","marker":"Zhang et al. 2022"},{"why":"CDA baseline for cross-domain generative attacks and the comparison that motivates adding semantic guidance.","marker":"Naseer et al. 2019"},{"why":"TTP baseline for targeted transferable perturbations; the paper compares against it on all architectures.","marker":"Naseer et al. 2021"},{"why":"PGD iterative baseline and the perturbation-budget constraint used in evaluation.","marker":"Madry et al. 2017"},{"why":"CLIP model used in the guiding-image selection ablation study.","marker":"Radford et al. 2021"}],"fun_headline_variants":["One guiding image boosts adversarial attack transfer","Semantic Injection Module makes attacks transferable","Inject target semantics to transfer attacks to ViTs","Guiding image enables cross-model targeted attacks","AIM: additional image for transferable attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method depends on a single randomly chosen guiding image of the target class carrying enough class-level semantics for the attack to transfer to unseen models, and on the trained generator continuing to work when the adversary uses different guiding images at test time.","fun_headline_variants_meta":{"raw":{"variants":["One guiding image boosts adversarial attack transfer","Semantic Injection Module makes attacks transferable","Inject target semantics to transfer attacks to ViTs","Guiding image enables cross-model targeted attacks","AIM: additional image for transferable attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000386,"raw_usage":{"total_tokens":2003,"prompt_tokens":870,"completion_tokens":1133,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":486,"completion_tokens_details":{"reasoning_tokens":1066}},"tokens_in":486,"tokens_out":1133,"duration_ms":10321,"temperature":1.0,"reasoning_tokens":1066,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:34:38.102042+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Retrain the generator with one set of random guiding images per class, then evaluate on a disjoint set of guiding images and on held-out architectures; if targeted top-1 accuracy collapses to the level of the no-SIM ablation when the guiding image is changed, the semantic-injection claim is falsified. A second test: use a target-class guiding image with unusual composition or background and check whether transferability drops.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the TTAA targeted generative baseline and the evaluation protocol of three target classes that this paper follows."},{"cited_title":"Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains","cited_arxiv_id":"2201.11528","evidence_quote":"Provides the BIA generator and mid-layer feature selection that the proposed framework builds on."},{"cited_title":"M.; Khan, S","cited_arxiv_id":null,"evidence_quote":"CDA baseline for cross-domain generative attacks and the comparison that motivates adding semantic guidance."},{"cited_title":"S.; and Porikli, F","cited_arxiv_id":null,"evidence_quote":"TTP baseline for targeted transferable perturbations; the paper compares against it on all architectures."}],"review_version":1}