{"id":"4e59147b-6fd6-46ad-91b9-554907f9cb6d","arxiv_id":"2505.03383","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"AAA aggregates mid-layer gradient attention maps from an MIM adversarial trajectory into a single importance map, and uses it in a feature-level attack to boost transferability of facial adversarial examples.","lead":"This paper introduces a two-stage attack that adds up attention maps collected while crafting an adversarial face image, then uses the sum to guide a stronger transferable attack. It reports consistent gains in black-box face-recognition attack success across 12 models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported AAA gains may be inflated by per-source-model layer/budget selection on the same LFW test set; a held-out validation split is needed before the transferability claim is accepted.","rationale":"The central empirical claim is that AAA beats MIM and LGC on black-box FR attacks. The reader flags the orthogonality/attention-imitation premise as the weakest assumption; I think that is a real gap in the paper's explanation, but the empirical comparison can survive a false rationale if the aggregation is a useful heuristic. The more load-bearing threat to the empirical claim is that AAA's per-source hyperparameters (layer, gamma, and unreported N, beta) appear to be selected using the same 3000 LFW pairs on which all ASR tables are computed. Since MIM and LGC have no equivalent tunable layer, this gives AAA an unfair advantage and makes the comparison non-fair. A validation split or a fixed, architecture-agnostic layer rule (e.g., always attack the penultimate block) would settle the issue. My recommendation is therefore unchanged: conditional acceptance pending the required re-analysis.","tokens_in":17833,"tokens_out":8283,"duration_ms":88648,"concrete_test":"Re-run the comparison with a validation split: hold out a subset (e.g., 500 of the 3000 LFW pairs) and, for each source model, select the attack layer and gamma using only black-box ASR on that subset; then evaluate AAA, MIM, and LGC on the remaining test pairs. Report N and beta explicitly and keep the total iteration/step budget comparable. If the average gain of AAA over LGC/MIM shrinks toward zero or reverses on the test set, the central transferability claim is an artefact of test-set selection; if the gain persists, the concern does not land.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.1 fixes a custom mid-layer for each source model (e.g., layer2.3 for ResNet50, body.19 for ArcFace and IResNet variants, blocks.7 for MobileFace) and sets gamma=8/255. Section 3.3 and Figures 2-3 select these values by measuring attack success rate against the same 3000 LFW pairs that are then used for all reported results in Tables 1-6; no validation split or separate test set is mentioned. MIM and LGC have no comparable per-source tunable layer, so AAA is granted an extra degree of freedom fitted to the evaluation benchmark. The reported advantage over baselines may therefore reflect test-set overfitting rather than the attention-aggregation mechanism. In addition, Algorithm 1's first-stage hyperparameters N and beta are never specified in Section 3.1, so even the fitted configuration cannot be reproduced or checked for an equivalent computational budget. The orthogonality premise in Section 2.2 is a separate concern, but the fairness of the comparison must be established first.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Attention-aggregated Attack (AAA), a transfer-based black-box attack for face recognition. The authors observe that different FR models weight different facial features, and that running MIM on a source model makes its mid-layer gradient 'attention' maps drift smoothly across facial regions. AAA therefore first runs N iterations of MIM with step size beta to create intermediate adversarial images, accumulates the source model's cosine-similarity gradients with respect to a chosen mid-layer feature map into a static importance map I (Eq. 7), and then attacks by minimizing L = sum(I * h_adv) with momentum (Algorithm 1, Eq. 8). The paper reports dodging and impersonation success rates on 3000 LFW pairs, comparing AAA with MIM and LGC, with and without DI/SIM/SG boosters, for single-model and ensemble attacks, across 12 FR models, and includes ablations over the attacked layer and the noise budget gamma. The central claim is that AAA consistently outperforms MIM and LGC on black-box targets because it destroys features that are critical to other FR models.","tokens_in":18023,"tokens_out":7902,"duration_ms":78337,"significance":"If the quantitative claims are reproducible, the paper makes a useful contribution to the adversarial-attack literature for fine-grained recognition: it provides a simple feature-level attack tailored to FR, shows that aggregating attention maps along an adversarial trajectory can improve transferability, and demonstrates compatibility with standard boosters. The experimental coverage is a genuine strength: twelve models spanning different backbones and losses, both dodging and impersonation, multiple perturbation budgets, ensemble attacks, and ablations. I do not see a circularity problem in the headline comparison, because the target models are external and no target-model labels or gradients are used to build the importance map. However, the absence of validation discipline, the unreported first-stage hyperparameters, and the unsupported orthogonality premise are load-bearing issues that must be fixed before the empirical advantage can be accepted as a property of AAA rather than of test-set tuning.","major_comments":[{"comment":"The first-stage iteration count N and step size beta appear in Algorithm 1 as inputs but are never specified in Section 3.1 or in any experimental table. Only epsilon, T, alpha, momentum, gamma, and the attacked layer are given. Consequently, the exact configuration used to produce Tables 1-6 cannot be reproduced, and the comparison may not be at equal computational cost: AAA performs N additional forward/backward passes before the T iterations shared with MIM. Please report N and beta for every experiment and provide a runtime or FLOPs comparison with the baselines.","section":"Section 3.1, Algorithm 1"},{"comment":"The mid-layer attacked for each source model and the noise budget gamma are selected by success-rate measurements on LFW, the same dataset used for all reported results, and no validation split is described. Because MIM and LGC have no per-source-model layer knob, AAA is effectively granted an extra degree of freedom that is fitted to the evaluation benchmark, which can inflate its apparent advantage over the baselines. Please fix the layer choice and gamma on a held-out validation split (or a fixed rule, e.g., the same relative depth for all architectures) and report the final success rates on a disjoint test set, at minimum for Tables 1 and 4.","section":"Section 3.3, Figs. 2-3, Tables 1-4"},{"comment":"The claim that 'facial features are orthogonal to each other in the pixel space' is asserted without evidence or citation, and it is load-bearing: it is used to argue that summing the N attention maps spreads importance across features without destructive cancellation. If the maps are not orthogonal, the aggregate I may over-emphasize source-specific features or wash out, and the stated mechanism would fail even if the empirical results survive. Please supply quantitative evidence, such as pairwise cosine similarities of the N maps, or an ablation comparing the sum with a max-pooled or randomly selected map.","section":"Section 2.2, Eq. (7)"},{"comment":"The premise that the attention maps computed on MIM-perturbed images of one source model 'imitate' the attentions of other FR models on clean images is supported only by visual inspection of three models. This is a central interpretive claim of the paper. Please quantify the similarity (e.g., mean cosine similarity between the aggregated map and target-model attention maps on clean images) or demonstrate that AAA's gain remains when the aggregate is replaced by a non-attention alternative such as a fixed combination of the same N maps.","section":"Section 2.2, Fig. 1"}],"minor_comments":[{"comment":"All ASRs are reported as single percentages without error bars or significance tests; on 3000 test pairs the binomial standard error is on the order of one percentage point, and several reported advantages over the closest baseline are within that range. Please add multiple-run statistics or confidence intervals.","section":"Tables 1-6"},{"comment":"Layer names should be formatted consistently; entries such as 'repeat.2 5', 'conv3 3', and 'stage3.ShuffleUnit Stage3 3' are hard to parse and should be normalized to the notation used in the model implementations.","section":"Section 3.1, Fig. 1"},{"comment":"The notation in the chain-rule expression should be cleaned up: the gradient of D with respect to the feature map should be written with an explicit partial derivative in the denominator, and the text should clarify that the gradient is evaluated at x_adv^k rather than at the feature map itself.","section":"Eq. (9)"}],"recommendation":"major_revision","confidential_remarks":"The main risk is test-set selection of hyperparameters, which is a correctness issue for the quantitative claims rather than a novelty problem. The paper would also be strengthened by code release and exact identification of model checkpoints. I do not regard the central comparison as circular, since the target models are external and no target-model labels or gradients are used."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know about arXiv:2505.03383: it proposes a new feature-level attack for face recognition, called AAA, that collects mid-layer gradient maps along an MIM trajectory and sums them into a fixed importance mask. That specific construction, Eq. (7) and (8), is not in FIA, NAA, or LGC, and it is a reasonable idea: as MIM iterates, the source model's attention drifts, and aggregating those maps is a cheap ensemble-like spread across facial features. The paper deserves credit for that.\n\nThe experiments are extensive and consistent. They cover many source/target FR models, three model groupings, dodging and impersonation, plus DI/SIM/SG combinations and ensemble attacks. AAA beats MIM and LGC by a few points in almost every black-box cell, and the gains grow when combined with input diversity. That pattern is hard to explain away as noise alone.\n\nThe soft spots are real but not all equal. The most serious is selection bias: Section 3.3 chooses the per-source mid-layer and gamma by measuring attack success against the same 3000 LFW pairs that later populate Tables 1-6. There is no validation split. Since MIM and LGC have no comparable per-source tunable layer, AAA effectively gets an extra degree of freedom fitted to the test set. The reported advantage could be partly an artifact of that tuning. Second, Algorithm 1 lists first-stage parameters N and beta, but Section 3.1 never gives their values, so the configuration cannot be reproduced. Third, the orthogonality premise in Section 2.2, that facial features are orthogonal in pixel space, is asserted, not shown; if it fails, the aggregation rationale weakens, though the method could still work empirically. Minor: no error bars, no released code, and the paper is submitted in an unfinished template with corrupted figure captions.\n\nOverall, the central claim is plausible and probably defensible, but the evidence as presented is not clean enough to take the reported numbers at face value. The right fix is a held-out validation split for hyperparameters, full disclosure of N and beta, and code. This deserves a serious referee, not a desk reject, but it needs major revision.","headline":"Genuinely new attack recipe with wide experiments, but test-set-tuned hyperparameters and missing first-stage parameters keep the reported gains from being fully trustworthy.","tokens_in":18579,"tokens_out":2502,"would_cite":true,"duration_ms":25040,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An Attention-aggregated Attack (AAA) sums the shifting attention maps of a surrogate face model across iteratively perturbed images, claiming the sum imitates other models' attention and boosts black-box transferability.","keywords":["adversarial transferability","face recognition","black-box attack","feature-level attack","attention aggregation","momentum iterative attack","facial adversarial examples"],"falsifier":"Compute the pairwise cosine similarities between the N collected attention maps, or their upsampled versions, on a sample of LFW faces; if the average absolute similarity is large and positive, the maps overlap rather than being orthogonal, and the aggregation mechanism is not what the gains come from. A second check is to find faces where the source model's attention on MIM-perturbed images barely overlaps the target model's attention on the clean image; if AAA's transfer advantage disappears on that subset, the imitation claim fails.","tokens_in":17611,"feed_emoji":"👁️","tokens_out":5714,"duration_ms":52443,"temperature":0.7,"pith_summary":"The paper argues that face recognition models are idiosyncratic: each model leans on its own mix of decisive and auxiliary facial features, so an adversarial perturbation tuned to one model overfits and fails to transfer. To counter this, the paper introduces AAA, a feature-level attack that first lets the surrogate model's attention drift by applying a few momentum-iterated steps, then sums the mid-layer gradient maps (visual importance) across those steps to form a static attack weight. The aggregated weight is meant to spread destruction over all potentially critical facial features, imitating an ensemble of unseen models' attentions. If AAA works as claimed, adversarial examples crafted against one face model succeed against other black-box face models at higher rates than MIM or LGC, especially when combined with input diversity.","feed_headline":"Facial attack copies other models' attention to transfer better","feed_subtitle":"New AAA method sums attention maps from perturbed faces, boosting black-box success across face-recognition models.","key_machinery":"The central object is the aggregated attention map I = sum_{k=0}^{N-1} partial D_{f_theta}(x_adv^k, x_r) / partial h_adv^k, where h_adv^k is a chosen mid-layer feature map of the surrogate model and x_adv^k are intermediate images from a momentum attack. The element-wise product I \\odot h_adv inside the loss is the mechanism that steers the final perturbation: instead of following the source model's own dynamic gradient, the attack follows a static weighted sum of attention maps collected at different perturbation stages. The paper justifies the aggregation by asserting that facial features are orthogonal to each other in the pixel space, so summing the drifting attention maps spreads importance over the whole face rather than cancelling. The authors read the drifting attention as imitating the fixed attentions of different face models, giving an ensemble-like effect.","core_discovery":"AAA claims to boost adversarial transferability against face recognition models by destroying the facial features that other models would rely on, without knowing those models. The attack does this by computing attention maps as the gradient of the cosine-similarity loss with respect to a mid-layer feature map, taking those gradients at several intermediate adversarial images produced by momentum iterations, and summing them into the fixed weight I = sum_{k=0}^{N-1} partial D / partial h_adv^k. The attack loss L(x_adv) = sum(I \\odot h_adv) then drives the final perturbation. The authors' comparison of AAA with MIM and LGC across FaceNet, SphereFace, CosFace, ArcFace, MobileFace, MobileNetV2, ShuffleNet-V1, ResNet50, and IResNet50 variants reports higher black-box attack success rates with and without DI/SIM/SG boosters, while white-box success remains near 100%. The paper also reports ablations on which layer to attack and on the noise budget used for the attention-transferring stage.","pith_inferences":["The orthogonality assumption is strong; one could measure the pairwise cosine similarities of the collected attention maps on real face images and check whether the aggregation is truly spreading importance rather than averaging overlapping gradients.","The attention-transferring stage is essentially a MIM trajectory, so one could test whether the order or number of collected steps, N, controls which facial features get covered, independent of the claimed imitation.","The same recipe could apply to other fine-grained, embedding-based recognition tasks such as bird or vehicle re-identification, where model-specific decisive features are also likely to hurt transferability.","The claim that the surrogate model's attention on MIM-perturbed images imitates other models' attention is supported only by visual inspection; a quantitative comparison of source-model attention on perturbed images with target-model attention on clean images would directly test it."],"forward_implications":["If AAA is right, black-box attacks on face recognition need no queries to the target model; only a surrogate model and repeated attention collection are required.","Combining AAA with input diversity strengthens transferability, and adding scale-invariant and smooth-gradient boosters further raises attack success across different architectures and losses.","The ablation results imply that attacking a middle layer is important for the method, so the layer choice is part of the recipe rather than a free parameter.","Crafting AAA on an ensemble of face models improves transferability further, which the paper reads as evidence that its single-model aggregation mimics an ensemble effect."],"supporting_citations":[{"why":"Supplies the LGC baseline and the FR-specific attention-transfer motivation that AAA compares against.","marker":"[10]"},{"why":"Supplies MIM, the momentum iterative attack used both as the baseline and as the attention-transferring stage in Equations (5)-(6).","marker":"[13]"},{"why":"Supplies input diversity (DI-FGSM), the data augmentation booster combined with AAA in the main experiments.","marker":"[6]"},{"why":"Supplies the feature-level attack form with the I element-wise h objective that AAA adapts for face recognition.","marker":"[8]"},{"why":"Supplies the neuron attribution feature-level attack that motivates destroying semantically critical features.","marker":"[9]"},{"why":"Supplies the human cue-saliency ordering (forehead, eyes, mouth, chin, nose) that the paper contrasts with model-specific attention.","marker":"[11]"},{"why":"Supplies evidence that mid-layer features across models are more similar, motivating the choice of attacking a mid-layer feature map.","marker":"[19]"},{"why":"Supplies the LFW face-pair dataset used for the attack experiments.","marker":"[23]"}],"fun_headline_variants":["AAA: mimics other models' attention for transferable face attacks","Facial attack steals attention maps to boost transferability","Attention-aggregated attack: better black-box face hacking","Copy face models' gaze to improve adversarial transfer","AAA boosts facial adversarial transfer via attention imitation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method rests on the assertion that facial features are orthogonal to each other in the pixel space, so summing attention maps spreads importance instead of cancelling.","fun_headline_variants_meta":{"raw":{"variants":["AAA: mimics other models' attention for transferable face attacks","Facial attack steals attention maps to boost transferability","Attention-aggregated attack: better black-box face hacking","Copy face models' gaze to improve adversarial transfer","AAA boosts facial adversarial transfer via attention imitation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000155,"raw_usage":{"total_tokens":1222,"prompt_tokens":958,"completion_tokens":264,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":574,"completion_tokens_details":{"reasoning_tokens":188}},"tokens_in":574,"tokens_out":264,"duration_ms":3433,"temperature":1.0,"reasoning_tokens":188,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:52:28.760242+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the pairwise cosine similarities between the N collected attention maps, or their upsampled versions, on a sample of LFW faces; if the average absolute similarity is large and positive, the maps overlap rather than being orthogonal, and the aggregation mechanism is not what the gains come from. A second check is to find faces where the source model's attention on MIM-perturbed images barely overlaps the target model's attention on the clean image; if AAA's transfer advantage disappears on that subset, the imitation claim fails.","supporting_citations":[{"cited_title":"Labeled faces in the wild: A database forstudying face recognition in unconstrained environments,","cited_arxiv_id":null,"evidence_quote":"Supplies the LFW face-pair dataset used for the attack experiments."},{"cited_title":"Boosting adversarial attacks with momentum,","cited_arxiv_id":null,"evidence_quote":"Supplies MIM, the momentum iterative attack used both as the baseline and as the attention-transferring stage in Equations (5)-(6)."},{"cited_title":"Improving transferability of adversarial examples with input diversity,","cited_arxiv_id":null,"evidence_quote":"Supplies input diversity (DI-FGSM), the data augmentation booster combined with AAA in the main experiments."},{"cited_title":"Feature importance-aware transferable adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the feature-level attack form with the I element-wise h objective that AAA adapts for face recognition."},{"cited_title":"Improving adversarial transferability via neuron attribution-based attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the neuron attribution feature-level attack that motivates destroying semantically critical features."},{"cited_title":"Cue saliency in faces as assessed by the ‘photofit’technique,","cited_arxiv_id":null,"evidence_quote":"Supplies the human cue-saliency ordering (forehead, eyes, mouth, chin, nose) that the paper contrasts with model-specific attention."},{"cited_title":"Learning transferable adversarial perturbations,","cited_arxiv_id":null,"evidence_quote":"Supplies evidence that mid-layer features across models are more similar, motivating the choice of attacking a mid-layer feature map."}],"review_version":1}