{"id":"cc48c807-a537-4aab-aa11-df5f19542a4f","arxiv_id":"2504.13551","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Q-faker generates adversarial examples for NLU classifiers using surrogate-model gradients and controlled generation, requiring zero queries to the target.","lead":"This paper presents Q-faker, an attack that produces misleading text for spam, toxicity, and other classification models without sending a single query to the target model. It uses a separately trained surrogate model to steer a language model into generating sentences that flip the target's prediction.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Ablation Fig. 2 suggests λ (surrogate-gradient strength) only slightly affects ASR; without a λ=0 no-gradient control, the central surrogate-transfer mechanism is not established.","rationale":"Reader's weakest assumption was cross-dataset transferability of surrogate gradients. My concern is adjacent but more fundamental: the paper's own ablation suggests the gradient strength (λ) has only a small effect on ASR. This makes it possible that truncating the sentence at r=0.5 and generating the second half with unmodified GPT-2 is what flips the classifier, with the surrogate contributing little. That would preserve the empirical 'query-free attack works' claim but invalidate the proposed mechanism and the novelty claim of surrogate-guided controlled generation. The concrete test directly separates these hypotheses: compare λ=0 (no gradient) with λ=0.97, and a random-head surrogate with the trained surrogate. This is cheap and decisive. I therefore keep the reader's CONDITIONAL verdict (UNCHANGED) but with the additional condition that the no-gradient control must be reported before the central mechanism is accepted.","tokens_in":16507,"tokens_out":11342,"duration_ms":109526,"concrete_test":"Reproduce the Jigsaw (and preferably all eight datasets) attack with r=0.5 and λ=0, λ=0.5, and λ=0.97, sampling with multiple seeds; also add a control where the surrogate classification head is randomly initialized (untrained) at λ=0.97. Report ASR and USE for each setting. If λ=0 or random-head ASR is within a few points of λ=0.97 ASR, the surrogate gradient is not the load-bearing component and the central mechanism is not supported. If instead λ=0 ASR drops dramatically, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that gradients from a cross-dataset surrogate make generated continuations transferable to BERT-family targets. The paper's own ablation (Section 5.5, Fig. 2) says that 'increasing λ slightly improves ASR', where λ in Eq. 7 interpolates between the unmodified GPT-2 distribution (λ=0) and the surrogate-updated distribution (λ→1). If the λ sweep includes λ=0, then a large share of the attack success is already achieved by a purely natural continuation with no adversarial gradient. The reported statement that λ is 'not highly sensitive' is therefore evidence against the proposed mechanism unless the λ=0 ASR is explicitly reported and is substantially below the λ=0.97 ASR. No such no-gradient control, nor a randomly-initialized surrogate-head control, is presented. If a generic GPT-2 completion of the retained prefix flips the target at comparable rates, the method's success is not driven by surrogate transfer at all; the cross-dataset surrogate and the gradient updates in Eq. 3-6 would be incidental, and the central claim as stated (surrogate-driven transferable attack) would be unsupported. The exact surrogate input interface (Eq. 3-4) is also underspecified, but the missing λ=0 control is the decisive gap.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Q-faker, a query-free hard black-box attack against text classifiers. The method trains a lightweight surrogate classification head on top of a frozen GPT-2 generator, using a dataset for the same target task but different from the target's training data. At inference, it keeps the first half of an input sentence and generates the second half by performing PPLM-style gradient ascent on the hidden states to maximize the surrogate's loss, then fusing the updated distribution with the unmodified GPT-2 distribution. The authors claim this yields adversarial examples that transfer to unseen BERT-family targets with zero queries, outperforming query-based baselines and the hard black-box CT-GAT baseline across eight tasks, while preserving fluency and semantics. The paper includes ablations, transferability analysis, quality evaluations, and detector-evasion experiments.","tokens_in":16719,"tokens_out":4752,"duration_ms":42633,"significance":"If the central mechanism is confirmed, the contribution is significant: Q-faker is the first hard black-box attack that requires no target queries and only a single forward pass, making it practical in restrictive real-world scenarios. The training cost is remarkably low (a single classification head with roughly 1K parameters on a frozen GPT-2), and the cross-dataset surrogate setup is a genuine attempt to respect the hard black-box assumption. The paper also provides a useful comparison with existing black-box and hard black-box baselines, and the quality evaluations (including human and LLM-based) are a strength. However, the significance hinges on whether the adversarial gradient update is actually responsible for the attack's success; if a natural GPT-2 continuation already flips targets at comparable rates, the contribution reduces to a simple generation-based attack without the claimed controlled-generation mechanism.","major_comments":[{"comment":"The ablation study on λ (post-norm fusion weight in Eq. 7) is not reported with numerical values, and the ASR at λ=0 is not given. Since λ=0 corresponds to the unmodified GPT-2 distribution, a high ASR at λ=0 would indicate that natural continuations of the retained prefix already attack the target successfully, making the surrogate gradient update in Eqs. 5-6 incidental. The paper's statement that 'increasing λ slightly improves ASR' is therefore weak evidence for the central mechanism. Please report the full λ sweep including λ=0 and compare ASR at λ=0 vs λ=0.97, and ideally include a control with a randomly initialized surrogate head to show that the gradient direction, not just the loss value, is what transfers.","section":"§5.5, Figure 2"},{"comment":"The surrogate input interface is underspecified. Eq. (3) defines p(xt) as the probability of the current token (a scalar), yet Eq. (4) computes the gradient of the surrogate loss with respect to the hidden state ht via ∂Lsur/∂p(xt)·∂p(xt)/∂ht, which implies the surrogate loss is a function of this scalar token probability. This is unusual for a classification head; typically the head would take the full hidden state or the full next-token distribution. Please clarify exactly what the single-layer head consumes, and show how the chain rule in Eq. (4) is computed. Without this, the correctness of the gradient update cannot be assessed.","section":"§4.2, Eqs. (3)-(4)"},{"comment":"The main experimental results are reported without any measure of variance (standard deviation, confidence intervals) or significance tests. Several ASR differences in Table 2 are modest (e.g., HSOL: Q-faker 53.1 vs CT-GAT 55.8; CGFake: 13.4 vs 12.4), and the transferability heatmap in Figure 4 lacks any indication of statistical spread. Since the paper claims 'higher and more consistent ASR across target models,' the consistency claim needs quantitative support. Please provide mean and standard deviation over at least three random seeds, or bootstrap confidence intervals, and state the number of runs.","section":"§5.5, Tables 2-3 and Figure 4"},{"comment":"The wording in §4.1 ('the surrogate model is trained on same target task dataset') is inconsistent with the cross-dataset setting described in §5.4, which is central to the hard black-box claim. This should be corrected to avoid confusion. More substantively, the paper does not discuss how the attacker obtains the 'different dataset for the same task' in a real hard black-box scenario, nor does it analyze the sensitivity of the method to the choice of surrogate training data. A brief discussion of the availability and selection of surrogate datasets would strengthen the practical-application argument.","section":"§4.1 and §5.4"}],"minor_comments":[{"comment":"The phrase 'prove its practical' is ungrammatical; it should be 'prove its practicality'.","section":"Abstract"},{"comment":"There is a typo: 'Since the our experimental setting' should be 'Since our experimental setting'.","section":"Problem Statement"},{"comment":"The sentence 'and and has proven effective' contains a duplicated 'and'.","section":"Conclusion"},{"comment":"The baseline name is misspelled as 'TextFlooler' in the table header; it should be 'TextFooler'.","section":"Table 8"},{"comment":"The sentence 'This demonstrates the superiority of our method in real-world scenarios with limited queries' appears twice (in §6.1 and Appendix B.1); one occurrence should be removed.","section":"§5.5"},{"comment":"The notation ∥∇ht Lsur∥γ is undefined. If γ is an exponent in the denominator, specify that the norm is (∥·∥2)^γ; if γ=1.0, state explicitly that this is L2 normalization.","section":"§4.2, Eq. (5)"}],"recommendation":"major_revision","confidential_remarks":"The manuscript addresses a timely and practically important problem, and the proposed method is attractively simple. However, the missing λ=0 control is a load-bearing gap: the paper's own ablation suggests λ has only a slight effect, which could mean the surrogate gradient is not the driver of the attack. I would like to see the authors directly report ASR at λ=0 and a random-head control. The underspecified gradient interface in Eqs. (3)-(4) also needs clarification. If these are resolved, the paper could be acceptable; the current evidence does not fully establish the central mechanism."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper proposes Q-faker, a hard black-box text attack that needs zero queries to the target model. The twist is to train a tiny surrogate classifier on a different dataset for the same task, then use its gradients to steer GPT-2's hidden states during generation, PPLM-style. That's a neat idea, and as far as I can tell it's new in this combination. The paper also does more than the bare minimum: eight datasets, multiple BERT-family targets, quality metrics, human and LLM evaluation, and even some zero-shot LLM tests. The writing is honest about the scope (needs to know the task, no infinite-query scenario).\n\nThe results are plausible but the central mechanism is under-supported. The key claim is that gradients from a cross-dataset surrogate make the generated continuations transferable to unseen BERT-family classifiers. The ablation in Figure 2 supposedly varies lambda, the fusion weight between the original and adversarially updated distributions. The text says 'increasing lambda slightly improves ASR'. That phrasing suggests the gradient update adds only a small edge. If the lambda sweep includes lambda=0, a plain GPT-2 completion with no surrogate gradient, and that already gives a comparable ASR, then the surrogate is mostly decorative. Given they replace roughly half the sentence with generated text, a natural continuation could plausibly flip the label often all by itself. That's not necessarily fatal for the attack, but it would undercut the paper's main mechanistic claim, and the paper does need to report that control explicitly. So the ablation is the first thing I'd ask for.\n\nThere are also smaller gaps: no code, no error bars, and the surrogate's input interface is underspecified (they feed p(xt) into the classification head? That's not standard). One hyperparameter r is tuned on the test set, and the comparison to query-based baselines is inherently favorable because those baselines are capped at 10 queries, though that's arguably the point of the hard black-box setting.\n\nOn balance, this is a serious submission from a capable group. It deserves peer review, but the reviewers should demand the lambda=0 control, code, and a clearer description of the surrogate interface. If the gradient isn't actually driving the success, the paper can still stand as an interesting observation about generation-based attacks, but it needs the honesty to say so.\n\nWho's this for? Anyone working on adversarial robustness, transferability, or controlled text generation. I'd cite it if the ablation holds up. My recommendation: send it to review, but treat the control as a necessary condition.","headline":"A zero-query black-box attack with a clever controlled-generation core, but the ablation doesn't show the surrogate gradient is actually doing the work.","tokens_in":17337,"tokens_out":4522,"would_cite":false,"duration_ms":39213,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single generated sentence flips a text classifier with zero queries.","keywords":["hard black-box attack","query-free adversarial attack","controlled text generation","transferability","text classification","surrogate model","adversarial example"],"falsifier":"Train a target classifier on one dataset with normal labels and a surrogate on a second dataset with the label convention reversed; if Q-faker still flips the target at high rates, the attack is not driven by label-directed gradients, and if it collapses to chance, transfer is confirmed. A cleaner check: replace the trained surrogate head with a randomly initialized one; high attack success with a random head would falsify the claimed mechanism.","tokens_in":16229,"feed_emoji":"🎯","tokens_out":7404,"duration_ms":64287,"temperature":0.7,"pith_summary":"Q-faker sets out to show that a text classifier can be fooled in the hardest realistic setting: no access to the target model's output, parameters, or training data, and no budget for queries. It does this by training a single-layer classification head on a surrogate language model using a different dataset from the same task, then using that head's gradients to steer the frozen generator's output distribution. The result is one generated adversarial sentence per input, produced in roughly $O(n/2)$ time with zero queries to the victim. In experiments across eight datasets for spam, disinformation, toxicity, and sensitive-information detection, the paper reports attack success rates that beat black-box baselines allowed up to twenty queries. If true, this would make closed text-classification APIs attackable with a single crafted input and at very low preparation cost.","feed_headline":"Zero-query attack flips text classifiers with one generated sentence","feed_subtitle":"No queries, no target outputs: a surrogate-trained generator beats baselines allowed ten attempts.","key_machinery":"The load-bearing machinery is the adversarially updated output distribution of a frozen generative language model, obtained through the controlled-generation update $\\tilde{h}_t \\leftarrow h_t + \\alpha \\nabla_{h_t}\\mathcal{L}_{\\mathrm{sur}}$ with the update repeated ten times, followed by post-norm fusion $\\tilde{p}_{\\mathrm{fusion}}(x_{t+1}) = p_{\\mathrm{orig}}(x_{t+1})^{1-\\lambda}\\,\\tilde{p}(x_{t+1})^\\lambda$. The single-layer surrogate head is what produces $\\mathcal{L}_{\\mathrm{sur}}$; without it there is no adversarial signal. The fixed context of the first half of the sentence ($r=0.5$) anchors the meaning, and $\\lambda=0.97$ keeps the output close to the fluent original LM while still biased toward misclassification. This machinery replaces token-by-token query search with a single forward pass through a surrogate-coupled generator.","core_discovery":"The central claim is that a hard black-box attack on an encoder-based text classifier can be run with a single one-shot generation, using only the gradient signal of a surrogate model trained on a different dataset for the same task. The paper builds the surrogate as a frozen pretrained GPT-2 with a single-layer classification head of roughly 1K trainable parameters, and it trains only that head. At attack time, adversarial gradients of the surrogate's loss are propagated into the generator's hidden states, and the next token is sampled from a post-norm fusion of the original and the adversarially updated distributions. Keeping half the original sentence as fixed context preserves meaning, and the fusion coefficient $\\lambda = 0.97$ keeps the text fluent. The paper reports that this zero-query procedure outperforms query-based baselines on seven of eight victim models, and that its success is more consistent across six target architectures.","pith_inferences":["If the mechanism is shared pretraining rather than task transfer, then swapping the surrogate's language model to one with a different pretraining corpus should sharply reduce attack success; the paper does not test this.","The same gradient-steering loop could be applied to non-classification surfaces such as adversarial prompts for generative models, because the controlled generation step does not depend on the target being an encoder.","The requirement that the attacker know the target task could be relaxed with a multi-task surrogate head; that extension is not in the paper.","Since the first half of the sentence is preserved, the attack is effectively a continuation attack; a testable extension would be to let the model rewrite earlier tokens while keeping a semantic anchor, which might raise success on short inputs."],"forward_implications":["Closed target APIs become attackable with a single submitted input, since no query feedback loop is needed to craft it.","Training cost falls to roughly one thousand trainable parameters, so an attacker can prepare surrogate heads for many tasks cheaply.","The generated examples are low-perplexity and grammatical by construction, so perplexity-based filters are unlikely to catch them.","The same adversarial sentence transfers across several encoder architectures, meaning one crafted input can be reused against a family of victim models.","The method's success rate does not degrade as the query budget shrinks, since its performance is independent of query count."],"supporting_citations":[{"why":"Supplies the controlled-generation technique used to steer the frozen LM's hidden states toward a desired classification outcome.","marker":"Dathathri et al., 2020"},{"why":"Supplies post-norm fusion, used to blend the original and adversarially updated token distributions to preserve fluency.","marker":"Stahlberg et al., 2018"},{"why":"The main hard black-box baseline whose training cost, query behavior, and attack success rates Q-faker is compared against.","marker":"Lv et al., 2023"},{"why":"Provides the Advbench benchmark datasets covering the four detection tasks used in all experiments.","marker":"Chen et al., 2022b"},{"why":"Defines BERT, the primary victim architecture and the reference model for transferability comparisons.","marker":"Devlin et al., 2019"},{"why":"Supplies the adversarial example detector used to measure how well Q-faker's examples evade defense systems.","marker":"Mosca et al., 2022"}],"fun_headline_variants":["Zero-query attack: one generated sentence flips text classifier","Hard black-box attack without queries: surrogate-driven generation","Surrogate-trained generator: query-free text attack with one shot","No target access needed: one-shot attack fools text models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method stands or falls on whether gradients from a surrogate trained on a different dataset for the same task transfer to the target model despite architecture differences, and the paper supports that transfer only with empirical results rather than error bars.","fun_headline_variants_meta":{"raw":{"variants":["Zero-query attack: one generated sentence flips text classifier","Hard black-box attack without queries: surrogate-driven generation","Surrogate-trained generator: query-free text attack with one shot","No target access needed: one-shot attack fools text models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000588,"raw_usage":{"total_tokens":2734,"prompt_tokens":893,"completion_tokens":1841,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":509,"completion_tokens_details":{"reasoning_tokens":1773}},"tokens_in":509,"tokens_out":1841,"duration_ms":14253,"temperature":1.0,"reasoning_tokens":1773,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:05:48.567781+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a target classifier on one dataset with normal labels and a surrogate on a second dataset with the label convention reversed; if Q-faker still flips the target at high rates, the attack is not driven by label-directed gradients, and if it collapses to chance, transfer is confirmed. A cleaner check: replace the trained surrogate head with a randomly initialized one; high attack success with a random head would falsify the claimed mechanism.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the controlled-generation technique used to steer the frozen LM's hidden states toward a desired classification outcome."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies post-norm fusion, used to blend the original and adversarially updated token distributions to preserve fluency."}],"review_version":1}