{"id":"032df827-61d5-4c94-9327-37d13534793c","arxiv_id":"2505.17807","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":9,"one_line_summary":"A background mixup plus temporal gradient consistency attack raises adversarial transferability on video and image models, but its evaluation protocol uses target model predictions inside the attack generation, weakening the stated black-box claim.","lead":"This paper proposes an adversarial attack against video action recognition models that mixes clean frames with background frames from other categories and adds a temporal gradient consistency loss. The reported transferability gains rely on using the target models' own predictions to select the background frame, so the black-box transfer claim is not established.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The transfer reward in Eq. (4)-(6) consumes predictions from the same models later used as evaluation targets, so the reported gain may be query-based adaptation rather than transfer; an ablation removing R_transfer is required.","rationale":"The reader's weakest assumption is correct and is the load-bearing issue. The method explicitly includes target-model rewards in the selection of background frames, and those target models are exactly the evaluation victims. This makes the advertised 'transferability' a mixture of genuine transfer and query-based/ensemble effects. The proposed ablation of R_transfer is the minimal experiment that would settle the concern. I agree with the reader's emphasis; the protocol contamination alone is sufficient to reject the central claim as currently presented. Additional weaknesses, such as the single-video-per-class evaluation without variance estimates and several internally inconsistent table entries (e.g., Table 16 NL-101 row for TPN targets reports 9.60 and 2.57, far below corresponding TT values), make the quantitative evidence unreliable even after the contamination is resolved. Because this concern reinforces rather than changes the reader's conclusion, the verdict remains unchanged at REJECT.","tokens_in":24748,"tokens_out":3634,"duration_ms":39636,"concrete_test":"Re-run the UCF101 protocol from Table 1 with α1 set to 0, removing R_transfer from Eq. (6) while keeping all other hyperparameters fixed, and report ASR on the same six black-box victim models. If the Ours row drops toward the level of the α1=0 ablation in Table 12 (roughly 62-67%) or closer to the TT baseline, the headline gain is attributable to querying target models rather than to transfer. To further confirm the mechanism, sweep α1 over {0, 0.1, 0.3, 0.5} and show whether ASR rises monotonically with α1; a monotone increase is direct evidence that target-model outputs drive the result.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.2 defines R_total = R_attack + α1*R_transfer + α2*R_tbc, with R_transfer = (1/K) Σ_m R^m_attack averaged over M target models. Section 4.2 sets M=3 for video and M=4 for image, and the same NL/SF/TPN and ResNet18/ResNet101/ResNeXt50/DenseNet121 models appear as the victims in Tables 1-3 and 6. Thus, during attack construction, the background frame selection is rewarded for fooling the very models against which ASR is later measured. This is a query-based or ensemble-style attack, not the surrogate-only transfer-based black-box attack promised in the abstract and in the problem definition (Sec. 3.1). The baselines (PGD, TT, etc.) receive no such target-model signal, so the comparison is not apples-to-apples. The α1=0.3 weight is material: R_transfer changes which background frames are selected, and Tables 12 shows performance varies with α1. Consequently, the central claim that BMTC 'significantly boosts transferability' is not established by Tables 1-6; the contribution of R_transfer must be isolated before the claim can be accepted. Secondary issues, including one correctly classified video per category without error bars, apparent normalization slips such as 1/K in Eq. (4), and inconsistent entries in Table 16, reinforce the need for a cleaner protocol but are not the primary blocker.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes BMTC (Background Mixup-induced Temporal Consistency), an adversarial attack method for action recognition models. The method has two components: a Background Adversarial Mixup (BAM) module that selects background frames from other categories via a reward-based selection mechanism, and a Background-induced Temporal Gradient enhancement (BTG) module that adds a background attack loss and a temporal gradient consistency loss. The authors report experiments on UCF101, Kinetics-400, and ImageNet, claiming large gains in attack success rate over prior transfer-based attacks such as Temporal Translation, including on transformer-based video models. The central claim is that BMTC significantly boosts the black-box transferability of adversarial examples across action and image recognition models.","tokens_in":25113,"tokens_out":5872,"duration_ms":64958,"significance":"If the reported transferability gains were obtained under a standard surrogate-only black-box protocol, the paper would make a useful contribution to adversarial video attacks, particularly for transformer-based recognizers. The manuscript also provides a code repository and evaluates on multiple datasets and architectures. However, the reported gains are compromised by a protocol issue: the transfer reward in Eq. (4)-(6) consumes predictions from the very models that later appear as evaluation victims in Tables 1-3 and 6. This makes the comparison with baselines not apples-to-apples and means the central transferability claim is not established by the current evidence. The paper also contains several equation-level inconsistencies that hinder reproducibility.","major_comments":[{"comment":"The transfer reward R_transfer is computed using predictions from M target models, and Section 4.2 sets M to the same NL, SlowFast, and TPN models (or the four image models) that are later used as evaluation targets in Tables 1-3 and 6. This violates the black-box transfer setting defined in Section 3.1, where the attacker has no access to the target model. During attack construction, the background-frame selection is rewarded for fooling the very models against which ASR is later measured, so part of the reported transferability is attributable to query or ensemble access to the victims. The baselines (PGD, TT, etc.) receive no such signal. Table 12 shows that varying α1 changes results materially (e.g., 62.38 to 71.28 for NL-101→SF-101), confirming the effect is not negligible. An ablation removing R_transfer, or an evaluation against held-out models not used in the reward, is required before the claim of improved transferability can be assessed; without it, the tables do not support the abstract's assertion.","section":"§3.2, Eq. (4)-(6); §4.2"},{"comment":"Eq. (7) does not match the prose. The text says the loss 'maximize[s] the cross-entropy loss of other categories and minimize[s] that of the background category', but the equation as written is L_back = -∑_{j≠k'-K} y_j log ŷ_j + y_{k'-K} log ŷ_{k'-K}. If y is the one-hot true label, the first term is the negative cross-entropy of the true class (when the true class is not the background class), not the cross-entropy of other categories. Combined with the PGD update in Eq. (11), the effect of the equation as written is ambiguous and at odds with the described attack direction. This makes the central loss definition unreproducible and needs to be corrected and clarified.","section":"§3.3, Eq. (7)"},{"comment":"The transfer reward is defined as R_transfer = (1/K) ∑_{m=1}^{M} R^m_attack, but the average should be over the M target models. Since K is the number of action categories (101 or 400) and M is 3 or 4, the normalization is off by a factor of roughly 33. This changes the effective contribution of α1 in Eq. (6), so the reported hyper-parameter ablation in Table 12 and the relative importance of R_transfer are not interpretable as stated.","section":"§3.2, Eq. (4)"},{"comment":"Table 16 contains entries that are inconsistent with the corresponding results in Table 1. For example, with NL-101 as the surrogate, the Ours row reports attack success rates of 9.60 and 2.57 on TPN-101 and TPN-50, while Table 1 reports 82.17 and 73.27 for the same pairs. Either the table is mis-formatted or the experiment protocol differs from the main tables; this needs clarification because it affects the validity of the defense-evaluation claims.","section":"Appendix B.7, Table 16"}],"minor_comments":[{"comment":"The evaluation uses one randomly selected video per category with no standard deviation or repeated trials; the claim of 'significantly boosts' would be stronger with multiple seeds and variance reporting.","section":"§4.1"},{"comment":"The mechanism of computing three rewards and selecting the top-scoring background frame is described as 'reinforcement learning', but no policy update, value function, or RL training procedure is specified; it is a greedy reward-based selection.","section":"§3.2"},{"comment":"The appendix contains corrupted text fragments (e.g., '/uni00000031/uni0000002f/...') that should be removed before publication.","section":"Appendix B.6"},{"comment":"The weight decay is written as '1e4', which presumably should be '1e-4'.","section":"§4.2"},{"comment":"In the first block of Table 12, the α1 column is missing an entry for the value 0 (the header shows '0 0.1 0.3 * 0.5' but the first row starts at 0.1); please verify the formatting.","section":"Appendix B.3, Table 12"}],"recommendation":"reject","confidential_remarks":"The core problem is not a missing minor ablation but a leakage of evaluation targets into the attack generation procedure. The transfer reward consumes predictions from the exact models listed as victims in the main tables, so the reported gains are not evidence of transfer-based black-box attack ability. This is a load-bearing issue that would require repositioning the method as an ensemble or query-based attack and redoing the evaluation protocol, which is beyond a standard revision. The equation inconsistencies and table errors strengthen the case for rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper has a genuinely new mechanism—mixing frames with category-level background frames chosen by an RL reward, plus a temporal gradient consistency loss—but the main empirical claim is undercut by the evaluation protocol. The transfer reward in Eq. (4) consumes predictions from the same models later used as attack victims (NL, SF, TPN in Tables 1-3), so the reported boost could be target-informed selection, not pure transfer. The baselines get no such signal. That is a load-bearing flaw.\n\nWhat's new and good: the background adversarial mixup (BAM) with zero-shot video object segmentation to construct category backgrounds, the reward function with attack/transfer/temporal-consistency terms, and the Background-induced Temporal Gradient (BTG) module. This combination is absent in the cited literature (AdMix is image-only; Temporal Translation doesn't do mixup). The paper is clearly organized, has extensive ablations, and ships code.\n\nSoft spots, in order of importance:\n\n1. Circularity. R_transfer is defined as the average attack reward over M target models, and M equals the same models evaluated later. Table 12 shows alpha1 matters, so the target-model signal affects background selection and hence the final perturbation. Without an ablation removing R_transfer, the paper cannot claim standard transfer-based black-box attack. This is not a minor issue; it's the core of the paper.\n\n2. Minor: Eq. (4) divides by K instead of M. Fix the typo.\n\n3. Eq. (7) is confusing but I don't think it's wrong: read as an objective to maximize, it increases non-background class error and increases background-class probability, matching the prose. A footnote would help.\n\n4. Tables 4-5 compare against image-to-video baselines while the proposed method uses video surrogates. That's a protocol mismatch; either use the same surrogate type or say the comparison is illustrative.\n\n5. One video per category, no error bars. Common in the area, but it weakens the strength of the numbers.\n\nWho this is for: researchers in adversarial ML for video, especially those working on input-transformation attacks. The method idea is worth discussing, but the results as present don't back the transferability claim.\n\nRecommendation: Send to peer review with a request for major revision. The required addition is an ablation without R_transfer, plus a corrected evaluation protocol. If the authors can show the gain persists without target-model reward, this could be a solid paper.\n\nReading group: yes. Would cite: not in current form. Serious thinker: yes—the design is coherent and the literature engagement is genuine.","headline":"Background-mixup idea is fresh, but the transfer reward leaks target-model info into attack generation, so the headline transferability numbers don't support the claim as-is.","tokens_in":25596,"tokens_out":7353,"would_cite":false,"duration_ms":54593,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that mixing video frames with category backgrounds selected by reinforcement learning, plus a temporal gradient consistency loss, substantially improves adversarial example transferability across action recognition models.","keywords":["adversarial attack","transferability","action recognition","background mixup","temporal consistency","reinforcement learning","black-box attack","video adversarial examples"],"falsifier":"Remove the transfer reward $R_{\\text{transfer}}$ from the background selection, or hold the M target models out of the reward computation entirely, and rerun the UCF101 and Kinetics-400 evaluations; if the attack success rates against those held-out models fall to the Temporal Translation baseline, the claimed black-box transfer depends on target-model queries during attack generation.","tokens_in":24519,"feed_emoji":"🎬","tokens_out":7318,"duration_ms":61346,"temperature":0.7,"pith_summary":"Adversarial examples for action recognition models typically fail to transfer when the surrogate model's decision boundary differs from the target model's. This paper proposes a transferable attack, BMTC, that instead transforms the input by mixing each clean frame with a background frame from another action category, where a reinforcement-learned Mixer chooses the background with the strongest attack reward, transfer reward, and temporal consistency. It also stabilizes the attack direction across frames with a background attack loss and a temporal gradient consistency loss. The authors report that on UCF101, Kinetics-400, and ImageNet, BMTC raises attack success rates substantially over prior methods, including against transformer-based video models. If the claim holds, an attacker with one white-box surrogate could craft video perturbations that generalize to many black-box action recognizers.","feed_headline":"Background mixup makes video attacks transfer far better","feed_subtitle":"Background mixup plus temporal gradient consistency lifts cross-model attack success on video models.","key_machinery":"Two modules carry the argument. The Background Adversarial Mixup (BAM) module builds an admixed sample $\\tilde{X} = (1-\\gamma) X + \\gamma X_{\\text{back}}$ by blending each clean frame with a background video from another category picked by a Mixer (ResNet50 feature extractor plus classification head) trained with the total reward $R_{\\text{total}} = R_{\\text{attack}} + \\alpha_1 R_{\\text{transfer}} + \\alpha_2 R_{\\text{tbc}}$. The Background-induced Temporal Gradient enhancement (BTG) module adds the loss $L_{\\text{total}} = L_{\\text{back}} + \\beta L_{\\text{tgc}}$, where $L_{\\text{back}}$ maximizes the surrogate's confidence in the selected background category and $L_{\\text{tgc}}$ is the cosine distance between gradients of neighboring adversarial frames; PGD then updates the perturbation. The admixed sample serves as the initialization, so the semantic shift toward another category's background does the attacking work, while the temporal losses keep the attack direction coherent across frames.","core_discovery":"The paper's central claim is that adversarial transferability across video models can be improved without relying on similar decision boundaries, by attacking semantics rather than just gradients. The method first fine-tunes the surrogate model to also classify backgrounds, then, for each video, an adversarial Mixer selects one background frame from each category using reinforcement learning, with rewards for attack success, cross-model transfer, and temporal background consistency; the selected backgrounds are blended into nearby frames. Adversarial example generation then maximizes a background attack loss that pushes predictions toward the chosen background category while a temporal gradient consistency loss keeps gradients of adjacent frames aligned. On UCF101, using a SlowFast-101 surrogate, the attack success rate against a TPN-50 target rises from 38.61% with Temporal Translation to 66.34% with BMTC, and similar gains are reported on Kinetics-400 and against Vision Transformer models.","pith_inferences":["A natural stress test is to replace the target-model transfer reward with a surrogate-only proxy, such as an ensemble of augmentation views or feature-statistics diversity, and check whether the transfer gains survive without any target-model access.","The background mixup mechanism could be inverted for defense: training action recognizers to be invariant to background category swaps might reduce the attack surface this method exploits.","The reinforcement-learned background selector effectively ranks which category contexts most confuse a surrogate, a side signal that could be reused for interpretability or for targeted attacks toward specific background categories.","Combining the temporal gradient consistency loss with other input-transformation attacks, such as translation invariance or scale invariance, may stack gains since the two mechanisms regularize different failure modes."],"forward_implications":["Adversarial examples generated with BMTC transfer across architectures with different inductive biases, including CNN-based models and Vision Transformers such as VideoSwin and TimeSformer.","The cross-modal experiments show an attacker can use image surrogates to produce video adversarial examples, so no video surrogate is required for the method to work.","With only around one-tenth the FLOPs of Temporal Translation and a higher attack success rate, the method offers a practical cost-performance tradeoff for generating transferable video perturbations.","The attack success rate grows with the perturbation budget and iteration count until saturation, so users can adjust $\\epsilon$ and $N_{\\text{iter}}$ to balance imperceptibility against transferability."],"supporting_citations":[{"why":"Temporal Translation baseline that BMTC compares against and claims to outperform on UCF101 and Kinetics-400.","marker":"[Wei et al., 2022a]"},{"why":"Adversarial Mixup, the input-transformation strategy that BMTC adapts by mixing clean frames with background frames from other categories.","marker":"[Wang et al., 2021a]"},{"why":"Projected Gradient Descent, the optimization algorithm used to update the adversarial perturbation.","marker":"[Madry et al., 2018]"},{"why":"Provides the zero-shot video object segmentation that separates background frames from foreground action content.","marker":"[Yuan et al., 2023]"},{"why":"I2V-MF cross-modal attack baseline that defines the clip sampling protocol and serves as an evaluation comparison.","marker":"[Wei et al., 2024]"},{"why":"GCEC cross-modal baseline that motivates the temporal consistency design by illustrating the failure of diverse but unstable attack directions.","marker":"[Wang et al., 2023a]"}],"fun_headline_variants":["Background mixup boosts video attack transfer","BMTC attack: background mixup lifts transferability","Video attacks transfer better with background mixup","Temporal consistency plus mixup improves attack transfer","New attack method enhances video adversarial transfer"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes the attacker can query the target models' predictions to select which background frames to mix, so the reported transferability advantage depends on that access rather than purely on model-agnostic input transformation.","fun_headline_variants_meta":{"raw":{"variants":["Background mixup boosts video attack transfer","BMTC attack: background mixup lifts transferability","Video attacks transfer better with background mixup","Temporal consistency plus mixup improves attack transfer","New attack method enhances video adversarial transfer"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000119,"raw_usage":{"total_tokens":1107,"prompt_tokens":991,"completion_tokens":116,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":607,"completion_tokens_details":{"reasoning_tokens":49}},"tokens_in":607,"tokens_out":116,"duration_ms":1548,"temperature":1.0,"reasoning_tokens":49,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:40:07.338470+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Remove the transfer reward $R_{\\text{transfer}}$ from the background selection, or hold the M target models out of the reward computation entirely, and rerun the UCF101 and Kinetics-400 evaluations; if the attack success rates against those held-out models fall to the Temporal Translation baseline, the claimed black-box transfer depends on target-model queries during attack generation.","supporting_citations":[{"cited_title":"Towards deep learning models resistant to adversarial attacks","cited_arxiv_id":null,"evidence_quote":"Projected Gradient Descent, the optimization algorithm used to update the adversarial perturbation."},{"cited_title":"Isomer: Isomerous transformer for zero-shot video object segmentation","cited_arxiv_id":null,"evidence_quote":"Provides the zero-shot video object segmentation that separates background frames from foreground action content."},{"cited_title":"Adaptive cross-modal transferable adversarial at- tacks from images to videos.IEEE Transactions on Pattern Anal- ysis and MachineIntelligence (TPAMI), 46(5):3772–3783,","cited_arxiv_id":null,"evidence_quote":"I2V-MF cross-modal attack baseline that defines the clip sampling protocol and serves as an evaluation comparison."}],"review_version":1}