{"id":"a0a39171-0828-4848-af19-484e9a6d5fc2","arxiv_id":"2505.23313","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"ASL-PAR creates universal adversarial noise using label and semantic perturbation, dropping PromptPAR's mean accuracy by up to 40 points on standard PAR benchmarks, while a filter-and-prompt defense restores most of the drop.","lead":"This paper presents an adversarial attack and defense method for pedestrian attribute recognition, which predicts attributes like gender and clothing from surveillance images. It shows that a universal, barely visible noise pattern can sharply reduce the accuracy of a CLIP-based model, and that a learned input filter plus prompt tuning can recover most of the lost accuracy.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Cross-model evidence (Table VII) shows ASL-PAR barely affects VTB or MambaPAR; the general 'PAR vulnerability' claim rests on PromptPAR being representative, which the paper does not demonstrate.","rationale":"The reader's conditional verdict is well-supported. I do not see an internal inconsistency in the digital attack experiments; the drop from 88.76 to 48.25 mA on PETA is reported with a clear protocol and the authors include an honest limitation section. The load-bearing issue is scope: the abstract and conclusion generalize from a single model to PAR as a field, while the paper's own transfer evidence (Table VII) shows the trained perturbation barely affects VTB and MambaPAR. Since the semantic loss is the same GL objective used to train PromptPAR, and the defense operates by prompt-tuning in PromptPAR's space, the attack/defense loop is closed around one architecture. This does not make the paper worthless, but it means the first-paragraph claims of pioneering PAR security and of highlighting PAR vulnerability need to be conditioned on PromptPAR (or on CLIP-prompt architectures) rather than stated as a general finding. My proposed check would settle whether even the label-based part transfers to other architectures.","tokens_in":18250,"tokens_out":11748,"duration_ms":135063,"concrete_test":"Using the official VTB and MambaPAR checkpoints on MSP60K/PETA, run the ASL-PAR training procedure with the semantic perturbation term disabled (alpha=0), optimizing the same universal noise white-box against each model with the same 10/255 budget. If neither model shows more than a ~3 mA drop, ASL-PAR is not a general PAR attack and the general vulnerability claim should be rescoped to PromptPAR. Complementarily, retrain PromptPAR without the GL loss and repeat; if the drop collapses, the semantic component is exploiting PromptPAR's own training objective.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central generalization claim rests on PromptPAR being a representative PAR model, but the evidence against this is in the paper itself. The attack is built on PromptPAR's prompt-based CLIP architecture and uses the GL loss (Eq. 10), the same auxiliary loss PromptPAR was trained with, as the semantic objective; the defense is likewise prompt-tuning in that same space. Table VII shows on MSP60K that the PromptPAR-trained noise drops mA by 12.46 on PromptPAR, but only 1.34 on VTB and 0.72 on MambaPAR. These are not small transfer losses; they are near-zero attack effects. The honest limitation in Section IV-H concedes that the ultimate goal of crossing datasets and models was not achieved, yet the abstract and conclusion still present the method as the first PAR attack/defense framework and as evidence of PAR model vulnerability. Without an independent CLIP-based PAR model or a white-box ASL-PAR run on non-PromptPAR architectures, the 'vulnerability of PAR models' conclusion is not established beyond a single, co-authored model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes ASL-PAR, a universal adversarial perturbation for pedestrian attribute recognition. Noise is optimized on a frozen PromptPAR model using two losses: a label-perturbation term that shifts attribute labels within body-part groups, and a semantic term that uses PromptPAR's GL image-text similarity loss. A defense is then proposed, consisting of an input convolution filter and learnable text prompts. Experiments report large mA drops on PromptPAR over PETA, PA100K and RAPv2, smaller drops on MSP60K, and additional cross-dataset, physical-world, and ablation studies. The paper claims to be the first adversarial attack and defense framework for pedestrian attribute recognition.","tokens_in":18485,"tokens_out":6843,"duration_ms":77956,"significance":"If the results were general, the proposed universal noise would be an inexpensive way to probe PAR security, and the defense would be a useful first response. The paper's most positive features are the universal single-noise attack design (no per-sample gradient optimization at test time), the evaluation on four public benchmarks, and the planned source-code release. However, the evaluation is centered on a model and a loss from the authors' own prior work, cross-model transfer is essentially absent (Table VII), and the physical experiment is uncontrolled. The significance therefore depends on revisions that either demonstrate transfer of the attack to an independent PAR model or clearly restrict all claims to PromptPAR.","major_comments":[{"comment":"The paper's central claim that PAR models are vulnerable is not supported beyond PromptPAR. On MSP60K, the trained noise reduces PromptPAR mA from 63.24 to 50.78 (a 12.46-point drop), but VTB drops only from 58.59 to 57.25 and MambaPAR from 56.75 to 56.03. The limitation paragraph in §IV-H admits that cross-model transfer was not achieved, yet the abstract and conclusion state a general vulnerability of pedestrian attribute recognition and claim a first attack/defense framework. Please either add a white-box ASL-PAR attack on an independent CLIP-based PAR model or restrict all claims to PromptPAR and revise the title, abstract, and conclusion accordingly.","section":"§IV-H, Table VII"},{"comment":"The attack and defense are both anchored in PromptPAR to a degree that makes the general conclusion unsupported. The semantic perturbation optimizes the GL loss of Eq. (10), the same auxiliary loss used to train PromptPAR [12], and the defense restores alignment by tuning prompts in the same CLIP/PromptPAR space. The mA measurements are external, so the attack effect on PromptPAR is real, but this setup does not provide independent evidence that PAR architectures in general share the same failure mode. I ask for an explicit statement of this limitation in §IV-H and, if feasible, an experiment with a different CLIP-based PAR model to test the semantic component.","section":"§III-C, §III-E, §IV-H"},{"comment":"The physical-world experiment does not validate the attack as reported. The custom set contains 12 clean images and 127 attacked images captured under different conditions, with no matched clean/attacked pairs and no comparison against an alternative patch attack. Given the authors themselves note a large domain gap from the training data, the mA change from 48.06 to 45.58 across different image sets is not interpretable as attack effectiveness. Please collect paired clean/attacked shots with the same subjects and viewpoints, or remove the physical validation claim from the abstract and conclusion.","section":"§IV-G, Table VI"},{"comment":"The defense evaluation is limited to the authors' own attack on PETA. This does not support the conclusion that the defense is highly effective at restoring model performance: no other attack (FGSM, PGD, GRA, NCS, ANDA) is tested under the defense, no other dataset is used, and no adaptive attack is considered. I ask either to add those baselines or to state explicitly that the defense is designed and evaluated only against ASL-PAR and that its general robustness is untested.","section":"§IV-E, Table V"},{"comment":"The claim of being 'the first adversarial attack and defense framework for pedestrian attribute recognition' is asserted without a systematic literature check. Section II reviews only generic adversarial attack and defense methods and does not survey prior adversarial work on PAR or related attribute-recognition tasks, despite the authors citing their own PAR survey and paper list. This novelty claim should be verified against that list and, if necessary, softened to 'to the best of our knowledge' or removed.","section":"Abstract; §V"},{"comment":"The update rule in Algorithm 1, lines 10–13, is not reproducible as printed. It defines R_cse = ∇L_cse and R_GL = ∇L_GL and then writes η^{e+1} ← Clip(|η^e − (R_cse + α·R_GL)| < ε), which is not a standard adversarial update: there is no sign convention, no learning rate, and the clipping notation is ambiguous. Please rewrite the pseudocode with an explicit sign (ascent or descent), step size, and projection onto the L∞ ball.","section":"Algorithm 1"}],"minor_comments":[{"comment":"In Eq. (4), the multi-modal Transformer is written as MM-Former(F_img, F_img); from the surrounding text and Eq. (2)–(3), the second argument should be F_text.","section":"§III-A, Eq. (4)"},{"comment":"The summation index is written as 'j−1' in both equations; this should be 'j=1'.","section":"Eq. (9), Eq. (10)"},{"comment":"The notation for the perturbation bound is inconsistent: the text uses L10, l10, and 'L∞ norm of the noise is at most 10/255'. Please standardize to a single notation, e.g., L∞ with value 10/255.","section":"§IV-B, §IV-C"},{"comment":"The implementation details contain a typo: 'weight decays to le-4' should read '1e-4'.","section":"§IV-B"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper does something new but narrower than its abstract claims. ASL-PAR is a universal, generator-free perturbation for CLIP-based PAR, using body-part label shifting plus the GL semantic alignment loss from PromptPAR. On PromptPAR itself the digital attack is convincingly strong: on PETA mA drops from 88.76 to 48.25, and the ablations show both terms matter. That is a legitimate contribution to the small PAR-security literature, and the cross-dataset experiments are a reasonable attempt to show the noise transfers between datasets. The code release promise helps, though I note no code or data is actually shipped with this version.\n\nWhere it gets soft is the central framing. The paper calls itself the first PAR attack/defense framework and says it exposes the vulnerability of PAR models. The evidence doesn't support that breadth. Table VII shows the same noise drops PromptPAR's MSP60K mA from 63.24 to 50.78, but VTB only from 58.59 to 57.25, and MambaPAR from 56.75 to 56.03. That is near-zero transfer. The attack is built from PromptPAR's own GL loss and is trained on a frozen PromptPAR; the defense is prompt-tuning in that same space. So what's demonstrated is a vulnerability of PromptPAR, not of PAR models generally. To their credit, Section IV-H concedes the cross-model goal is not achieved, but the abstract and conclusion do not carry that caveat. The 'first' claim is also shaky without a systematic literature check; they compare against generic attacks but don't show they searched for prior PAR-specific ones.\n\nThe physical experiment is too thin to count for much: 139 images, no standard baselines, no variance, and the numbers show only a modest mA drop. The digital experiments also lack error bars. The defense is tested only against this attack, so 'defense' is more 'cleanup of a known perturbation' than a robustness method.\n\nWho is this for? Someone working on PAR security or on CLIP-based attacks might get a useful starting point and a cautionary example. It deserves a serious referee, but I'd send it back for major revision: reframe as an attack effective on a specific CLIP-PAR architecture, add at least one independent CLIP-based PAR model to the white-box evaluation, report variance or significance, and fix the physical section. If those changes are made, it could be a solid applied-security paper. I would not desk-reject it.","headline":"A solid digital attack on the authors' own PromptPAR model, with a general-vulnerability claim that the paper's own Table VII contradicts.","tokens_in":18984,"tokens_out":3311,"would_cite":false,"duration_ms":34494,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that pedestrian attribute recognition models built on CLIP-based vision-language fusion are vulnerable to a single shared adversarial noise pattern, and that a filter-plus-prompt defense largely restores performance.","keywords":["pedestrian attribute recognition","adversarial attack","adversarial defense","universal adversarial perturbation","CLIP vision-language model","prompt tuning","semantic perturbation","multi-label classification"],"falsifier":"Train the ASL-PAR noise on PromptPAR and evaluate it against several independently built CLIP-based PAR models that use different prompt templates, different fusion heads, and no GL loss in training; if mean accuracy drops by only a few points on all of them, the claim of a general PAR vulnerability would be refuted in favor of a PromptPAR-specific effect. A simpler observation also suffices: if re-running the same experiments with noise trained on a non-PromptPAR CLIP-based baseline does not produce a comparable drop, the method's reach depends on the target model's own training loss.","tokens_in":18074,"feed_emoji":"🎯","tokens_out":12904,"duration_ms":120490,"temperature":0.7,"pith_summary":"This paper sets out to establish that pedestrian attribute recognition (PAR), a vision-language task used in surveillance and person retrieval, is vulnerable to adversarial interference, and that a practical defense exists. It introduces ASL-PAR, a generator-free attack that trains a single universal noise pattern per dataset against a frozen CLIP-based PAR model, combining a label-perturbation loss that shifts attribute labels inside body-part groups with a semantic-perturbation loss that misaligns image and text features in CLIP space. On PETA, mean accuracy drops from 88.76 to 48.25, and on PA100K from 87.47 to 50.85, with smaller but clear drops on MSP60K and RAPv2; a printable patch version degrades recognition in physical tests. The paper also proposes a defense, an input filter paired with learnable text prompts, and reports that it restores most of the lost accuracy. The authors claim this is the first adversarial attack and defense framework for PAR.","feed_headline":"One invisible noise nearly halves pedestrian attribute accuracy","feed_subtitle":"One pattern, printed or digital, works on any image; the paper's defense restores most of the damage.","key_machinery":"The load-bearing object is the universal adversarial perturbation itself: one trainable noise tensor $\\eta$ of the same size as the input image, shared by every sample in a dataset and optimized by gradient inversion against a fully frozen PromptPAR model. Its training loss is the sum of a weighted cross-entropy term on part-shifted pseudo-labels and the GL loss (Equation 10), which measures global-local image-text similarity and is reused from PromptPAR's own training objective. A perturbation procedure groups attributes by body part (gender, head, upper body, lower body, feet, hands) and shifts positive labels to other attributes in the same group, so the target mistakes are semantically plausible. For the defense, the central mechanisms are a learnable convolutional filter placed before the vision encoder and a learnable text prompt that re-aligns the CLIP semantic space; both are trained on noisy data.","core_discovery":"The central claim is that a state-of-the-art CLIP-prompting PAR model can be broken by a perturbation that is shared across all test images rather than crafted per image, and that the breakage is driven by two complementary mechanisms. Perturbing the labels inside each body-part group makes the model converge toward plausible but wrong attribute predictions, while perturbing the global-local image-text similarity used by the semantic loss pushes the CLIP feature space itself out of alignment. At a fixed $\\ell^\\infty$ budget of $10/255$, the combined noise nearly halves PETA mA and transfers across datasets, sometimes outperforming attacks trained directly on the target dataset. The defense, a convolutional filter on the image side plus prompt tuning on the text side, is reported to bring performance back close to the un-attacked model, from 48.25 to roughly 85.82 mA on PETA. The paper frames the contribution as opening a security research direction for PAR.","pith_inferences":["An implication not drawn by the paper: because the semantic perturbation reuses the exact GL loss that PromptPAR was trained with, the measured drop may be inflated by the attack having direct access to the model's own training objective; testing against CLIP-based PAR models trained with a different or absent GL loss would separate a general CLIP weakness from a PromptPAR-specific one.","The near-zero transfer to MambaPAR suggests that feature-space geometry, not just architecture, is the deciding factor in PAR security; a natural follow-up is to optimise the perturbation against an ensemble of fused feature spaces rather than a single frozen model.","The part-shifting label procedure could be reused constructively: training a PAR model with adversarially shifted body-part labels as a form of label smoothing could improve its tolerance of partial occlusions, which are common in real surveillance imagery.","A cheap testable defense suggested by the paper's own design is prompt diversity: if the attack has to misalign several independently tuned text prompts simultaneously, its semantic-loss component should weaken, which could be verified by running the same attack against models with different prompt templates."],"forward_implications":["A deployed CLIP-based PAR system can be attacked with one precomputed noise pattern applied to every frame, with no per-image gradient computation at test time.","A printable patch version of the noise degrades recognition when physically carried by a person, so the threat is not confined to digital images.","Because the semantic component attacks the shared image-text alignment, other CLIP-based PAR models with similarity-based fusion are plausible targets even if their prompts or heads differ.","The defense works only when both an input filter and learnable text prompts are used, which means restoring a vision-language model's alignment is part of the cure.","Noise trained on one dataset transfers to other benchmarks, sometimes beating attacks trained on the target dataset, so public data in one domain can be used to attack deployments in another."],"supporting_citations":[{"why":"PromptPAR is the target model whose frozen weights define the attack surface and whose GL loss is reused for the semantic perturbation term.","marker":"[12]"},{"why":"CLIP supplies the pre-trained ViT-L/14 image encoder and text encoder whose shared semantic space the attack misaligns and the defense re-aligns.","marker":"[8]"},{"why":"The global-local similarity aggregator from this work produces the image-text similarity scores used in the GL loss of the attack.","marker":"[56]"},{"why":"FGSM is the single-step gradient baseline whose attack performance the proposed method is compared against on every dataset.","marker":"[23]"},{"why":"ANDA is the strongest recent transferable-attack baseline in the comparison, used as the reference for state-of-the-art attack effectiveness.","marker":"[17]"},{"why":"The PETA dataset is the primary benchmark for the headline attack and defense numbers and for the cross-dataset transfer experiments.","marker":"[19]"},{"why":"VTB is the other Transformer-based PAR model used in Table VII to show the attack transfers moderately across models.","marker":"[7]"},{"why":"MambaPAR is the state-space model whose near-zero attack transfer defines the boundary of the paper's claimed PAR vulnerability.","marker":"[61]"}],"fun_headline_variants":["One universal noise nearly halves pedestrian attribute accuracy","Single perturbation breaks CLIP pedestrian attribute recognition","One noise, many failures: universal attack on pedestrian attributes","Universal perturbation nearly halves pedestrian attribute accuracy","CLIP-based pedestrian attribute model crippled by one shared noise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that PromptPAR stands in for pedestrian attribute recognition systems as a class, even though the attack is trained on PromptPAR's own weights and its own semantic loss, and the paper's transfer table shows the same noise leaves a Mamba-based PAR model almost untouched.","fun_headline_variants_meta":{"raw":{"variants":["One universal noise nearly halves pedestrian attribute accuracy","Single perturbation breaks CLIP pedestrian attribute recognition","One noise, many failures: universal attack on pedestrian attributes","Universal perturbation nearly halves pedestrian attribute accuracy","CLIP-based pedestrian attribute model crippled by one shared noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000932,"raw_usage":{"total_tokens":4011,"prompt_tokens":991,"completion_tokens":3020,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":607,"completion_tokens_details":{"reasoning_tokens":2948}},"tokens_in":607,"tokens_out":3020,"duration_ms":20927,"temperature":1.0,"reasoning_tokens":2948,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:47:23.372630+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the ASL-PAR noise on PromptPAR and evaluate it against several independently built CLIP-based PAR models that use different prompt templates, different fusion heads, and no GL loss in training; if mean accuracy drops by only a few points on all of them, the claim of a general PAR vulnerability would be refuted in favor of a PromptPAR-specific effect. A simpler observation also suffices: if re-running the same experiments with noise trained on a non-PromptPAR CLIP-based baseline does not produce a comparable drop, the method's reach depends on the target model's own training loss.","supporting_citations":[{"cited_title":"Pedestrian attribute recognition via clip based prompt vision-language fusion,","cited_arxiv_id":null,"evidence_quote":"PromptPAR is the target model whose frozen weights define the attack surface and whose GL loss is reused for the semantic perturbation term."},{"cited_title":"Learning transferable visual models from natural language supervision,","cited_arxiv_id":null,"evidence_quote":"CLIP supplies the pre-trained ViT-L/14 image encoder and text encoder whose shared semantic space the attack misaligns and the defense re-aligns."},{"cited_title":"Cdul: Clip- driven unsupervised learning for multi-label image classification,","cited_arxiv_id":null,"evidence_quote":"The global-local similarity aggregator from this work produces the image-text similarity scores used in the GL loss of the attack."},{"cited_title":"Strong transferable adversar- ial attacks via ensembled asymptotically normal distribution learning,","cited_arxiv_id":null,"evidence_quote":"ANDA is the strongest recent transferable-attack baseline in the comparison, used as the reference for state-of-the-art attack effectiveness."},{"cited_title":"Pedestrian attribute recog- nition at far distance,","cited_arxiv_id":null,"evidence_quote":"The PETA dataset is the primary benchmark for the headline attack and defense numbers and for the cross-dataset transfer experiments."},{"cited_title":"A simple visual-textual baseline for pedestrian attribute recognition,","cited_arxiv_id":null,"evidence_quote":"VTB is the other Transformer-based PAR model used in Table VII to show the attack transfers moderately across models."},{"cited_title":"An empirical study of mamba-based pedestrian attribute recognition,","cited_arxiv_id":null,"evidence_quote":"MambaPAR is the state-space model whose near-zero attack transfer defines the boundary of the paper's claimed PAR vulnerability."}],"review_version":1}