{"id":"db116dc6-1c99-4144-b26c-f0728d1893fc","arxiv_id":"2505.06860","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"DP-TRAE combines a transferable white-box adversarial initialization with a memory-augmented superpixel query attack and reversible embedding to mislead black-box image classifiers while allowing image recovery.","lead":"This paper proposes DP-TRAE, a two-stage attack that first creates transferable white-box noise, then refines it against a black-box model with query-based superpixel updates, and makes the perturbation recoverable. The authors report very high attack and recovery rates, but the headline numbers are not consistently supported by the paper's own tables.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 100% lossless recovery claim is contradicted by Table V (48.94 dB PSNR, 0.9913 SSIM), and the 99.0% black-box ASR is not the Table III average (81.5%); the central claim is unsupported.","rationale":"The reader's verdict of REJECT is well supported. The abstract's central claim has two quantitative halves, and both are contradicted by data inside the manuscript. The recovery half is the more fundamental: 'reversible' is the defining contribution, so if the original image is not bit-exactly restored, the method is not a reversible adversarial example in the sense claimed. Table V's finite PSNR and SSIM below 1 are direct evidence of nonzero pixel error; identical images would yield infinite PSNR and SSIM 1. The paper asserts 'losslessly' in Section III.E and 'without loss' in Section IV.D, but the LSB embedding description in Section II.B provides no reversibility mechanism, and no capacity or overflow analysis is supplied for Algorithm 3's payload. The attack half is separately contradicted: Table III's black-box average is 81.5%, not 99.0%; 99.0 appears only for the queried model itself or in the ensemble transfer table. Both issues are internal inconsistencies, not disagreements with external consensus, so they directly bear on correctness. The proposed test, an end-to-end run comparing recovered pixels to the original, would settle the recovery question definitively. If recovery is lossy, the central claim fails even if all ASR numbers were correct; if recovery is lossless, the paper would still need to correct the ASR attribution. Thus the reader's REJECT verdict is unchanged.","tokens_in":17784,"tokens_out":9540,"duration_ms":95267,"concrete_test":"Run Algorithm 3 end-to-end on a held-out subset of the 1,000 ImageNet images: embed the Huffman-coded stage matrix into x+delta via the paper's LSB-based RDH, extract and reverse, and compute the maximum absolute pixel difference and PSNR between the recovered image and original x. If max difference > 0 or PSNR is finite, lossless recovery fails and the '100% recovery' / 'reversible' claim is refuted regardless of attack success.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is the abstract's '99.0% attack success rate and 100% recovery rate in black-box scenarios.' The load-bearing assumption for the 'reversible' half is that the RDH pipeline in Section III.E / Algorithm 3 restores the original image exactly. That assumption is contradicted by Table V: 'Recover (DP-TRAE)' is reported at 48.94 dB PSNR and 0.9913 SSIM, which cannot be a bit-exact restoration because identical images give infinite PSNR. Section II.B states 'we employ the LSB method for data embedding,' yet no mechanism (e.g., reversible LSB variants, overflow handling, original-bit storage) is described that would make LSB embedding lossless, and no capacity analysis is given for embedding the Huffman-coded stage matrix into x+delta while preserving exact recovery. The attack half is also unsupported as stated: Table III, the black-box scenario, gives DP-TRAE an average ASR of 81.5%, with the 99.0% value appearing only for the query model DN-121 and, in Table II, for an ensemble/white-box transfer setting. Thus both headline numbers are contradicted by the manuscript's own results; the recovery contradiction is the more fundamental because it invalidates the defining 'reversible' property.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes DP-TRAE, a reversible adversarial example method for image privacy protection. It combines a white-box stepwise adaptive attack (SA-WA) to generate a transferable initial perturbation with a memory-assisted black-box attack (MAE-BA) that queries superpixel blocks and uses historical query results. The perturbation is quantized, Huffman-coded, and embedded via reversible data hiding (RDH), with recovery intended to restore the original image. Experiments report attack success rates across several ImageNet classifiers, robustness against preprocessing defenses, recovery quality metrics, ablations, and a commercial API attack. The central claim, stated in the abstract and introduction, is that the method achieves 99.0% attack success rate and 100% recovery rate in black-box scenarios.","tokens_in":18160,"tokens_out":3576,"duration_ms":38927,"significance":"If the claims were substantiated, DP-TRAE would be a practically relevant advance: it would make reversible adversarial examples viable against black-box and commercial models, combining transferable initialization with query-efficient refinement while preserving lossless recovery. The paper has genuine strengths: it evaluates against multiple black-box baselines, tests robustness defenses, includes ablation studies, and reports a real-world commercial API attack. The algorithms are presented in sufficient detail to be reimplemented. However, the headline numerical claims are contradicted by the manuscript's own tables, and the defining 'reversible' property is not established: the reported recovery quality is finite-PSNR, not lossless, and the RDH mechanism is described only as LSB embedding with no losslessness mechanism or capacity analysis. These are load-bearing issues for the paper's central contribution.","major_comments":[{"comment":"The abstract claims a '99.0% attack success rate and 100% recovery rate in black-box scenarios,' but the black-box results in Table III give DP-TRAE an average ASR of 81.5%, with the 99.0% value appearing only for the query model DN-121. The values near 99.0% in Table II occur in the ensemble/white-box transfer setting, not in the black-box scenario of Table III. The headline ASR claim is therefore unsupported by the reported black-box experiments. In addition, all ASR values are point estimates on 1,000 images with no error bars or significance tests, so the claimed superiority over baselines is not statistically grounded.","section":"Abstract and Tables II-III"},{"comment":"The paper repeatedly states that the RDH step recovers the original image losslessly (Section III.A, Section III.E, Section IV.D), and the abstract claims a 100% recovery rate. Table V, however, reports the recovered image at PSNR 48.94 dB and SSIM 0.9913. An exactly recovered image would have infinite PSNR and SSIM of 1.0. These numbers are inconsistent with lossless recovery and with the claim that the restored images are 'without loss' and 'indistinguishable from the original images.' This contradiction invalidates the central 'reversible' property as currently claimed; the authors must either provide a genuinely lossless recovery pipeline with corresponding evidence or restate the contribution as approximate recovery, which would be a fundamentally different result.","section":"Section III.E and Table V"},{"comment":"The RDH component is described only as 'we employ the LSB method for data embedding' (Section II.B) with no mechanism that would make LSB embedding reversible. Standard LSB substitution overwrites the least significant bits and is not lossless unless the original bits are stored, or histogram shifting/overflow handling is used. The paper provides no such mechanism, no discussion of overflow/underflow at pixel boundaries, and no capacity analysis for embedding the Huffman-coded stage matrix into x+delta while preserving exact recovery. Without these details, Algorithm 3 cannot substantiate the claim that the perturbation information is embedded reversibly.","section":"Section II.B and Section III.E"},{"comment":"In Algorithm 3, line 5 sets Mse[h,w] = xi for every position, while line 6 appends the computed stage value to the Huffman tree. As written, the message matrix does not encode the perturbation stages; if this is a typo for Mse[h,w] = stage, it must be corrected. Either way, the paper never specifies the extraction and recovery algorithm that reverses this embedding, so the reader cannot verify the claimed lossless restoration.","section":"Algorithm 3, line 5"}],"minor_comments":[{"comment":"There is a typo in the abstract: 'Further more' should be 'Furthermore'.","section":"Abstract"},{"comment":"The caption says 'againsting'; this should be 'against'.","section":"Table IV caption"},{"comment":"The caption contains typos: 'RECOVERD' should be 'RECOVERED' and 'CLASSFICATION' should be 'CLASSIFICATION'.","section":"Table V caption"},{"comment":"The subplots in Figure 4 lack axis labels and units; please state what quantity is plotted (presumably average ASR) and over which target models the average is taken.","section":"Figure 4"},{"comment":"The commercial model experiment uses only 50 images and does not specify the query budget or API constraints; please provide these details so the 92% success rate can be interpreted.","section":"Section IV.F"}],"recommendation":"reject","confidential_remarks":"The manuscript is presented as a journal extension of the authors' ACM MM 2024 DP-RAE paper, but the incremental novelty is not clearly delineated. The decisive issue is not the incremental contribution but the contradiction between the headline claims and the reported data: the black-box ASR average is 81.5%, not 99.0%, and the recovery quality is finite-PSNR, contradicting the lossless-recovery claim that defines the method. These are not presentation issues that a revision could fix without changing the paper's core claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the headline: the abstract's two big numbers don't survive contact with the paper's own tables. The 99.0% ASR is not what the black-box table shows (Table III averages 81.5%), and the recovered images are 48.94 dB PSNR, not lossless. So the central claim, as written, is unsupported.\n\nThat said, the paper isn't empty. The dual-phase design—a white-box transferable perturbation followed by a memory-augmented superpixel black-box stage—is a sensible way to cut query counts, and the adaptive white-box step (amplify gradient-sensitive regions early, taper off later) is a plausible trick. Huffman-compressing the perturbation before RDH embedding is a reasonable engineering choice, and the commercial API test (92% on 50 images) is a useful practical data point. The method is described clearly enough to reproduce, and comparing against the authors' own DP-RAE is a legitimate baseline, not circular.\n\nThe soft spots are real. The recovery claim is the most serious: Section II.B says they employ 'the LSB method for data embedding.' Plain LSB substitution is lossy. No reversible LSB variant, no overflow handling, no capacity analysis is given. Table V reports PSNR 48.94 dB and SSIM 0.9913, which cannot be exact recovery. For a paper built around 'reversible' adversarial examples, that's a load-bearing flaw. The attack half is also misstated: Table III's average is 81.5%, with 99.0% only on one model (DN-121) and, in Table II, in the ensemble/white-box setting. There are no error bars anywhere, and the ablation study picks expansion size and enhancement frequency on the test models themselves, which inflates the reported numbers.\n\nI agree with the stress-test note: the contradiction between the abstract and the tables is enough to reject the current version. But the ideas are worth engaging with. A careful reader can extract a plausible method and re-test it with honest reporting.\n\nI'd send this to peer review with the expectation of heavy revision. The first round of referee comments should demand: (1) reconcile the abstract with the actual numbers, (2) provide a lossless RDH construction with capacity analysis, and (3) error bars or per-model breakdowns. As it stands, it should not be accepted. If you're working on reversible adversarial examples, it's worth a skim for the combination of ideas, but not a citation yet.","headline":"The dual-phase attack idea has merit, but the abstract's 99% ASR and 100% recovery claims are contradicted by the paper's own tables.","tokens_in":18634,"tokens_out":3680,"would_cite":false,"duration_ms":32583,"reading_group":"no","serious_thinker":"unclear","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A two-phase reversible adversarial attack achieves 99.0% success against black-box classifiers while restoring original images.","keywords":["reversible adversarial examples","black-box attack","image privacy protection","reversible data hiding","adversarial transferability","query efficiency","Huffman coding","commercial API attack"],"falsifier":"Compare the restored images with the originals pixel by pixel on the paper's 1,000-image test set: lossless recovery requires every pixel to be identical, so any nonzero difference—already implied by the reported 48.94 dB PSNR—would refute the 100% recovery claim. A direct byte-level comparison settles it.","tokens_in":17580,"feed_emoji":"🛡️","tokens_out":8561,"duration_ms":81994,"temperature":0.7,"pith_summary":"This paper proposes DP-TRAE, a method for crafting reversible adversarial examples—images that are perturbed to fool classifiers but can be restored to the original—so that they work against unknown black-box classifiers. The central claim is that splitting the attack into a transferable white-box phase and a query-efficient black-box phase resolves the tension between strong attacks and the strict perturbation limits of reversible data hiding. On a ten-model ImageNet benchmark, the paper reports 99.0% black-box attack success, better transferability than prior reversible attacks, and a 100% recovery rate for restored images. It also reports a 92% success rate against a commercial cloud vision API, presented as the first reversible adversarial attack on a commercial black-box model. If the claim holds, reversible adversarial examples move from white-box demonstrations to a practical privacy tool for unknown and proprietary classifiers.","feed_headline":"Reversible adversarial images fool black-box AI at 99%","feed_subtitle":"A two-phase attack hides photos from unknown classifiers and restores originals from embedded data.","key_machinery":"The load-bearing mechanism is the two-phase perturbation pipeline together with the compression scheme that makes reversibility affordable. SA-WA's stepwise adaptive rule labels the top $(N-i)/2N$ gradient positions for extra perturbation and shrinks that set as iterations grow, which the paper argues boosts transferability while curbing overfitting. MAE-BA's memory list $H$ stores the probability ratios from each queried superpixel block and periodically expands the block that gave the largest ratio, exploiting local coherence of gradients to reduce queries. Equation (8) maps each perturbation to a thresholded magnitude in $\\{0,1,2\\}$ times a stage threshold $\\xi$, and Huffman coding then compresses the resulting message so the side information fits into the reversible data hiding stage; this quantization is what lets the attack use larger, more effective perturbations without exceeding RDH capacity.","core_discovery":"On the paper's own terms, the discovery is that a reversible adversarial example can be made black-box practical by combining two complementary phases. The Stepwise Adaptive White-box Attack (SA-WA) first generates a transferable perturbation from a known surrogate model, amplifying gradient-sensitive regions early and tapering that amplification to avoid overfitting, using momentum, input diversity, and translation-invariant smoothing. The Memory-Assisted Expansion Black-box Attack (MAE-BA) then queries the unknown model on superpixel blocks—groups of neighboring pixels—and keeps a memory of which regions most changed the target probability, periodically revisiting and expanding those regions. The final perturbation is quantized to three magnitudes, compressed with Huffman coding, and embedded with reversible data hiding so the image can be restored. Across ten ImageNet classifiers of varied architecture, the paper reports 99.0% black-box attack success and 100% recovery of correct classifications from restored images.","pith_inferences":["Beyond the paper's claims, the finite PSNR of 48.94 dB for restored images means exact pixel-for-pixel recovery is not demonstrated; the 100% figure appears to measure classification success, not bit-exact identity.","Beyond the paper's claims, the method's transferability is bounded by how well the surrogate models approximate the unknown target, so success on ImageNet-style classifiers may not carry over to very different domains.","Beyond the paper's claims, the 92% commercial-API result on 50 images is a small sample; a larger evaluation with equalized query budgets against other black-box attacks would sharpen the practical estimate."],"forward_implications":["Reversible adversarial examples can be targeted at black-box and proprietary image classifiers, not only at white-box surrogates.","A white-box initialization followed by black-box refinement lowers the query budget compared with starting from random perturbations.","Threshold quantization plus Huffman coding is a workable way to fit strong adversarial perturbations inside the storage limits of reversible data hiding.","The reported robustness under spatial squeezing, randomization, Gaussian blur, JPEG compression, and super-resolution suggests the approach survives common preprocessing defenses."],"supporting_citations":[{"why":"Introduces reversible adversarial examples by combining adversarial attacks with reversible data hiding; DP-TRAE extends the idea to black-box models.","marker":"[37]"},{"why":"Prior work extending reversible adversarial examples to black-box settings through ensemble models, the point of departure DP-TRAE improves on.","marker":"[38]"},{"why":"The authors' earlier DP-RAE method, the direct baseline that DP-TRAE's two-phase design extends.","marker":"[42]"},{"why":"Supplies the reversible image transformation baseline used for comparison in the attack evaluations.","marker":"[43]"},{"why":"Momentum iterative FGSM provides the transferable white-box gradient update that SA-WA builds on.","marker":"[46]"},{"why":"Input diversity augmentation used in SA-WA to reduce overfitting and improve transferability.","marker":"[47]"},{"why":"Translation-invariant gradient smoothing used in SA-WA to widen the perturbation's spatial effect.","marker":"[48]"},{"why":"SimBA supplies the stochastic coordinate perturbation strategy and the black-box query baseline MAE-BA adapts.","marker":"[49]"},{"why":"SurFree is a surrogate-free black-box attack baseline compared against in the black-box experiments.","marker":"[50]"}],"fun_headline_variants":["Two-phase trick fools black-box AI 99% of the time","Reversible attack hits 99% on unseen models","Dual-phase attack wins black-box battles at 99%","Hide photos from AI with 99% success, restore later","99% black-box fooling with reversible images"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that reversible data hiding recovers the original pixels losslessly; if that step is even slightly lossy, the advertised 100% recovery rate fails no matter how strong the attack is.","fun_headline_variants_meta":{"raw":{"variants":["Two-phase trick fools black-box AI 99% of the time","Reversible attack hits 99% on unseen models","Dual-phase attack wins black-box battles at 99%","Hide photos from AI with 99% success, restore later","99% black-box fooling with reversible images"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000415,"raw_usage":{"total_tokens":2132,"prompt_tokens":926,"completion_tokens":1206,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":542,"completion_tokens_details":{"reasoning_tokens":1124}},"tokens_in":542,"tokens_out":1206,"duration_ms":8802,"temperature":1.0,"reasoning_tokens":1124,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:31:21.383918+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compare the restored images with the originals pixel by pixel on the paper's 1,000-image test set: lossless recovery requires every pixel to be identical, so any nonzero difference—already implied by the reported 48.94 dB PSNR—would refute the 100% recovery claim. A direct byte-level comparison settles it.","supporting_citations":[{"cited_title":"Unauthorized ai cannot recognize me: Reversible adversarial example","cited_arxiv_id":null,"evidence_quote":"Introduces reversible adversarial examples by combining adversarial attacks with reversible data hiding; DP-TRAE extends the idea to black-box models."},{"cited_title":"A black-box reversible adversarial example for authorizable recognition to shared images","cited_arxiv_id":null,"evidence_quote":"Prior work extending reversible adversarial examples to black-box settings through ensemble models, the point of departure DP-TRAE improves on."},{"cited_title":"Dp-rae: A dual-phase merging reversible adversarial example for image privacy protection","cited_arxiv_id":null,"evidence_quote":"The authors' earlier DP-RAE method, the direct baseline that DP-TRAE's two-phase design extends."},{"cited_title":"Improving transferability of adversarial exam- ples with input diversity","cited_arxiv_id":null,"evidence_quote":"Input diversity augmentation used in SA-WA to reduce overfitting and improve transferability."},{"cited_title":"Evading defenses to transferable adversarial examples by translation-invariant attacks","cited_arxiv_id":null,"evidence_quote":"Translation-invariant gradient smoothing used in SA-WA to widen the perturbation's spatial effect."},{"cited_title":"Simple black-box adversarial attacks","cited_arxiv_id":null,"evidence_quote":"SimBA supplies the stochastic coordinate perturbation strategy and the black-box query baseline MAE-BA adapts."},{"cited_title":"Surfree: a fast surrogate-free black-box attack","cited_arxiv_id":null,"evidence_quote":"SurFree is a surrogate-free black-box attack baseline compared against in the black-box experiments."}],"review_version":1}