{"id":"f1eaff9e-7215-450e-a4d5-92beb8d6d35d","arxiv_id":"2506.07804","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"An adversarial attack and defense that respectively enlarge and shrink conformal prediction sets, with experiments on CIFAR-10, CIFAR-100 and mini-ImageNet.","lead":"Researchers propose OPSA, an adversarial attack that inflates the prediction-set size of conformal classifiers, and OPSA-AT, a defense trained against that attack. They report smaller prediction sets and maintained coverage on image benchmarks, but the paper's training loss is written with the wrong sign and the claimed guarantee is just standard conformal prediction.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (8) and Algorithm 2 minimize Lclass, which drives the true class below the threshold and wrong classes above it—the opposite of the stated defense—so the reported OPSA-AT results cannot be reproduced from the algorithm as written.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the training loss in Eq. (8) has the wrong sign for the stated defense objective. This is not a matter of community consensus or a missing baseline; it is an internal inconsistency in the algorithm that the empirical results are supposed to instantiate. If the implemented code follows Eq. (8), the model is trained to maximize uncertainty, so the reported small set sizes are inexplicable. If the code uses the corrected sign, then the paper as written is not a faithful specification of the method, and the claimed reproducibility is undermined. A quick repository check and a small run of the literal algorithm would settle the question. The 'theoretical guarantees' contribution also lacks any theorem, but the sign error is the more fundamental blocker because it invalidates the described training procedure regardless of experimental numbers. In good faith, this may be a typo that the authors can fix; however, for the submitted manuscript, the central claim is not supported as stated. The verdict therefore remains REJECT, matching the reader's assessment.","tokens_in":22375,"tokens_out":4412,"duration_ms":56906,"concrete_test":"Run Algorithm 2 exactly as printed, with Ltotal = Lclass + lambda * MT2 and the same CIFAR-10 hyperparameters, and measure mean prediction-set size and coverage under OPSA. If the resulting sets are small and robust, the sign concern is refuted. Also inspect the public repository's training step: if the implemented loss is -Lclass + lambda * MT2, then the paper contains an undocumented sign correction, and the central empirical claim depends on an objective that is not the one written in Eq. (8).","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that OPSA-AT trains a classifier that keeps conformal prediction sets small at fixed coverage. Section 3.4 defines Lclass = sigma((fy - tau)/T2) - sum_{k != y} sigma((fk - tau)/T2) and states that maximizing this loss, or minimizing its negative, encourages inclusion of the true label and exclusion of wrong labels. Equation (8) then defines Ltotal = Lclass + lambda * MT2, and Algorithm 2 updates theta by minimizing this total. Minimizing Lclass is exactly the wrong direction: the derivative with respect to fy is positive, so minimization lowers the true-class logit relative to tau, while the derivatives with respect to fk for k != y are negative, so minimization raises the wrong-class logits. This enlarges the soft prediction set and excludes the true label, which is the adversary's objective rather than a defense. The empirical tables can only be consistent with the claimed defense if the implementation actually optimizes -Lclass or an equivalent sign-inverted objective, which the paper never states. As printed, the training algorithm is internally inconsistent, so the main experimental claim cannot be mapped onto the described method. The contribution bullet about theoretical guarantees is also unsupported by any theorem in the text, but the sign inconsistency alone is sufficient to block the central claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes OPSA (OPtimal Size Attack), an adversarial attack designed to enlarge the soft conformal prediction set size, and OPSA-AT (OPSA Adversarial Training), a defense that trains a classifier to keep conformal prediction sets small at fixed coverage. The authors evaluate both methods on CIFAR-10, CIFAR-100, and mini-ImageNet, reporting that OPSA increases uncertainty relative to baseline attacks and that OPSA-AT yields smaller prediction sets than baseline defenses under multiple attacks.","tokens_in":22620,"tokens_out":7038,"duration_ms":81762,"significance":"If established, the framework would address a useful gap: attacks that specifically target conformal prediction efficiency, and a training-time defense against such attacks. The paper includes code, multi-dataset experiments, and comparisons with standard attacks and defenses, which are commendable. However, the central training objective as written has a sign inconsistency that reverses the defense, the advertised theoretical guarantees are not present, and parts of the attack evaluation are circular or selectively reported. These issues prevent the current manuscript from supporting its main claims.","major_comments":[{"comment":"Equation (8) defines Ltotal = Lclass + λ·MT2, and Algorithm 2 minimizes this total loss. Section 3.4 states that maximizing Lclass encourages inclusion of the true label and exclusion of wrong labels. Since minimizing Ltotal minimizes Lclass, the training update as written lowers the true-class logit relative to τ and raises wrong-class logits, which enlarges the prediction set—the opposite of the claimed defense. The reported OPSA-AT results can only be consistent with a different objective, such as minimizing −Lclass + λ·MT2, but the paper never states this. The algorithm as printed is internally inconsistent and does not specify a coherent defense.","section":"Section 3.4, Eq. (8), Algorithm 2"},{"comment":"The contribution list advertises a 'CP defense model leveraging adversarial attacks with theoretical guarantees,' and the abstract promises 'guaranteed model reliability.' No theorem, proposition, or formal guarantee for OPSA-AT appears anywhere in the manuscript. Section 3.5 only restates the standard exchangeability-based marginal coverage property of conformal prediction, which applies to any classifier and is not specific to this method. The claimed theoretical support is therefore absent.","section":"Section 1 contribution bullet and Section 3.5"},{"comment":"The attack comparison is partially circular and selectively reported. OPSA-AT and OPSA-ST are themselves trained with OPSA perturbations, so the finding that OPSA-AT is robust to OPSA is at least partly by construction. Additionally, the claim that OPSA 'consistently achieves the largest size' is made only after excluding OPSA-trained defenses and BETA-AT; in Table 1's BETA-AT column, OPSA10 produces size 7.34 while Auto and APGD100 produce 7.71 and 7.66, so the consistency does not hold in the full reported table. The paper should either report full comparisons or substantiate the claim without selective exclusion.","section":"Section 4, Tables 1 and 2"},{"comment":"The pseudocode contains unexplained negative operations that conflict with the surrounding text. For example, Algorithm 1 line 6 updates ϵ ← −ϵ + η∇ϵMT1(...), line 7 sets ϵ ← −Π..., and Algorithm 2 line 9 writes ϵ∗ ← −OPSA(...) and line 12 writes τ ← −as the ... largest ...; these operations are not consistent with the described gradient-ascent or quantile computations. The algorithms as printed cannot be followed to reproduce the reported results.","section":"Algorithms 1 and 2"}],"minor_comments":[{"comment":"There is a typo: 'experimentatal' should be 'experimental.'","section":"Section 4"},{"comment":"Figure 2 caption labels a panel as (c) OPSA-ST but the accompanying text refers to BETA-ST; Figure 3 similarly uses BETA-ST, while Tables 1, 2, and 6 list BETA-AT. The labels should be made consistent.","section":"Figures 2 and 3"},{"comment":"The notation in the illustrative example is confusing: the true label y is a scalar class index, yet expressions such as 'f1(x+ϵ)−y' and the table headings mix the label y with logit values. The example would be clearer if f_y(x+ϵ) were written explicitly.","section":"Appendix A"}],"recommendation":"reject","confidential_remarks":"The sign inconsistency in Eq. (8) is the clearest load-bearing error, but it is compounded by the absence of the advertised theoretical guarantees and by evaluation choices that obscure the attack comparison. The authors may be able to repair the sign and rerun experiments, but as submitted the manuscript does not provide a reproducible defense method or support for its main claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the attack idea is a reasonable incremental variant: OPSA maximizes a sigmoid-smoothed soft set size with the internal threshold set to the perturbed true-class logit, which is close to BETA but self-referential in a way that removes the need to know alpha. Second, the paper has a sign error in the main training loss that, taken literally, makes the defense train in the wrong direction. Section 3.4 says Lclass should be maximized, but Eq. (8) defines Ltotal = Lclass + lambda*MT2 and Algorithm 2 minimizes Ltotal. That minimizes Lclass, which pushes the true class below the threshold and wrong classes above it—the adversary's objective, not a defense. The empirical tables only cohere if the implementation actually minimizes -Lclass, which the paper never says. The pseudocode also has stray negative signs (Algorithm 1's epsilon update and loop counter), so the algorithms as printed cannot be run.\n\nWhat is genuinely good: the experiments are extensive—CIFAR-10/100 and mini-ImageNet, multiple attacks and defenses, coverage, size, SSCV, accuracy, and runtime. The batch-level split into train/cal is a clean way to calibrate during adversarial training, and the OPSA-ST comparison is a useful control. The 'theoretical guarantees' contribution bullet, though, is unsupported: no theorem appears anywhere, and the only guarantee invoked is standard CP coverage.\n\nOther soft spots: the attack comparison excludes OPSA-trained defenses and BETA-AT when claiming OPSA 'consistently' produces the largest set sizes, which is partly circular, though the full tables let a reader judge. The closest prior defense, AT-UR, is cited but never compared. None of these are as serious as the sign error.\n\nWho this is for: someone working on conformal training or adversarial robustness who wants a cautionary example of how a sign mistake can invalidate a submission, or who wants to track the BETA/Stutz lineage. As printed, I would not cite it. I would send it to peer review only with the expectation of mandatory revision—the idea is plausible and the experiments are substantial, but the paper must first fix the sign and state explicitly whether the code optimizes -Lclass. It is not reproducible in its current form.","headline":"The central training loss in Eq. (8) is minimized, but the paper says Lclass should be maximized, so the defense as written would enlarge prediction sets rather than shrink them.","tokens_in":23205,"tokens_out":3531,"would_cite":false,"duration_ms":38451,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes the OPSA attack, which inflates conformal prediction set sizes without knowing the significance level, and the OPSA-AT defense, which keeps those sets small while preserving coverage.","keywords":["conformal prediction","adversarial attack","adversarial training","prediction set size","uncertainty quantification","OPSA","robustness","coverage guarantee"],"falsifier":"Re-run OPSA-AT training with the loss exactly as written in Eq. (8) and check whether prediction-set size under the OPSA attack increases or decreases from the pre-trained model; the paper's central defense claim predicts a decrease, while the literal equation predicts an increase.","tokens_in":22156,"feed_emoji":"🛡️","tokens_out":8782,"duration_ms":83572,"temperature":0.7,"pith_summary":"Conformal prediction offers distribution-free coverage guarantees, but adversarial perturbations can bloat its prediction sets until they are useless. This paper claims to fix both ends: an attack, OPSA, that maximizes the temperature-softened number of classes in the prediction set without needing the defender's significance level, and a defense, OPSA-AT, that trains so prediction sets stay small at the same coverage. On CIFAR-10, CIFAR-100, and mini-ImageNet, the authors report that OPSA produces larger prediction sets than baseline attacks across several defenses, and OPSA-AT produces smaller sets than baseline defenses at roughly 90% coverage. If correct, this would make calibrated uncertainty more reliable under imperceptible perturbations and give practitioners a concrete training recipe for robust, informative prediction sets.","feed_headline":"OPSA attack inflates conformal prediction sets","feed_subtitle":"The matching OPSA-AT defense keeps prediction sets small while coverage stays near 90% on three benchmarks.","key_machinery":"The machinery is a sigmoid-smoothed indicator of set membership: the soft set size $M_T(x; f, \\tau) = \\sum_{k} \\sigma\\big((f_k(x)-\\tau)/T\\big)$, whose low-temperature limit recovers the hard prediction-set size $|\\Gamma(x; f, \\tau)|$. The OPSA attack sets $\\tau$ internally to the perturbed true-class logit $f_y(x+\\epsilon)$, making the attack independent of any significance level, and performs projected gradient ascent with that surrogate; OPSA-AT minimizes a weighted sum of a classification loss (rewarding true-class inclusion and penalizing wrong-class inclusion) and the soft size loss, with thresholds computed from a calibration split of each batch. This soft-surrogate plus bi-objective split is what carries the argument from a non-differentiable set cardinality to an optimizable training signal.","core_discovery":"The paper's central claim is that an adversary can attack conformal prediction at the level of uncertainty rather than accuracy by maximizing a differentiable surrogate of the prediction-set size, and that a defender can train against exactly this attack to produce smaller, still-valid prediction sets. The attack objective uses the perturbed true-class logit as an internal threshold, so it requires no knowledge of the defender's coverage level α or operational threshold τ; the defense splits each training mini-batch into a training subset (where OPSA perturbations are generated and the conformal loss is minimized) and a calibration subset (from which the quantile threshold is recomputed). The authors report that OPSA attains the largest prediction-set sizes among compared attacks on all examined defenses except its own, and that OPSA-AT attains the smallest sizes among compared defenses at coverage fluctuating near the 1−α level. The paper claims the framework provides theoretical guarantees for the conformal coverage property while improving robustness against multiple attack types.","pith_inferences":["The paper's internal-threshold idea—using the true-class score as a stand-in for the unknown calibration threshold—is a general recipe: the same soft-set-size surrogate could attack or defend any differentiable nonconformity score, and the authors note the framework is not limited to the THR score.","A direct extension the paper does not pursue is conformal regression, where the attack would maximize prediction-interval width rather than set cardinality, using the same temperature-scaled surrogate.","The reported gains at a 10% significance level leave open whether the attack's uncertainty inflation and the defense's efficiency hold at other $\\alpha$ values, which are straightforward to test with the released code."],"forward_implications":["An attacker who can perturb inputs by $\\epsilon = 8/255$ under the $\\ell_\\infty$ norm can, without knowing the deployed confidence level, push conformal prediction sets to be markedly larger, undermining the informativeness of calibrated uncertainty in high-stakes settings.","A defender who trains with OPSA-AT can expect smaller average prediction sets than with FGSM, PGD, TRADES, MART, or BETA adversarial training, at coverage near the $1-\\alpha$ target, across CIFAR-10, CIFAR-100, and mini-ImageNet.","Because the attack is formulated through logit differences rather than a fixed threshold, the same attack recipe transfers to any differentiable nonconformity score, not just the THR score used in the paper.","The bi-objective split of each batch into training and calibration subsets preserves exchangeability between the calibration and test stages, so the finite-sample coverage guarantee survives the adversarial training procedure.","OPSA-AT shows lower prediction-set sizes also under other attack families (FGSM, PGD, AutoAttack, Square, APGD, BETA), indicating the defense is not overfit to the attack used in training."],"supporting_citations":[{"why":"Foundational conformal prediction; supplies the distribution-free coverage guarantee the framework builds on.","marker":"Vovk et al., 2005"},{"why":"THR method; provides the quantile-based threshold procedure and the score $s=1-f_k$ used throughout.","marker":"Sadinle et al., 2019"},{"why":"Defines the min-max adversarial training formulation (Eq. 3) that OPSA-AT modifies; also supplies PGD as a baseline attack.","marker":"Madry et al., 2017"},{"why":"Introduces the temperature-scaled soft set-size surrogate and conformal training approach from which OPSA and OPSA-AT borrow their machinery.","marker":"Stutz et al., 2021"},{"why":"Non-zero-sum adversarial training (BETA) whose logit-difference formulation the OPSA objective conceptually extends; BETA-AT is a comparison defense.","marker":"Robey et al., 2024"},{"why":"Adversarially robust conformal prediction (ARCP); represents the class of coverage-focused robust CP methods the paper contrasts with its size-efficiency goal.","marker":"Gendler et al., 2021"}],"fun_headline_variants":["OPSA attack inflates conformal sets, OPSA-AT shrinks them","Conformal prediction attack OPSA widens sets, defense tightens","OPSA: Adversarial attack on uncertainty, defense restores size","New attack enlarges conformal sets, defense maintains coverage","OPSA-AT defense counters set-inflating attack with robust size"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The classification-loss term in the published total loss, $L_{\\text{total}} = L_{\\text{class}} + \\lambda M_{T_2}$, is written with a plus sign, so minimizing it pushes the true label below the threshold and wrong labels above it, the reverse of the defense goal; the reported results hold only if the released implementation actually minimizes $-L_{\\text{class}}$ or the equation contains a sign typo.","fun_headline_variants_meta":{"raw":{"variants":["OPSA attack inflates conformal sets, OPSA-AT shrinks them","Conformal prediction attack OPSA widens sets, defense tightens","OPSA: Adversarial attack on uncertainty, defense restores size","New attack enlarges conformal sets, defense maintains coverage","OPSA-AT defense counters set-inflating attack with robust size"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000175,"raw_usage":{"total_tokens":1289,"prompt_tokens":949,"completion_tokens":340,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":565,"completion_tokens_details":{"reasoning_tokens":241}},"tokens_in":565,"tokens_out":340,"duration_ms":4328,"temperature":1.0,"reasoning_tokens":241,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:25:27.327267+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run OPSA-AT training with the loss exactly as written in Eq. (8) and check whether prediction-set size under the OPSA attack increases or decreases from the pre-trained model; the paper's central defense claim predicts a decrease, while the literal equation predicts an increase.","supporting_citations":[{"cited_title":"Algorithmic learning in a random world, volume 29","cited_arxiv_id":null,"evidence_quote":"Foundational conformal prediction; supplies the distribution-free coverage guarantee the framework builds on."},{"cited_title":"Towards deep learning models resistant to adversarial attacks","cited_arxiv_id":null,"evidence_quote":"Defines the min-max adversarial training formulation (Eq. 3) that OPSA-AT modifies; also supplies PGD as a baseline attack."},{"cited_title":"J., Hassani, H., and Cevher, V","cited_arxiv_id":null,"evidence_quote":"Non-zero-sum adversarial training (BETA) whose logit-difference formulation the OPSA objective conceptually extends; BETA-AT is a comparison defense."},{"cited_title":"Adversarially robust conformal prediction","cited_arxiv_id":null,"evidence_quote":"Adversarially robust conformal prediction (ARCP); represents the class of coverage-focused robust CP methods the paper contrasts with its size-efficiency goal."}],"review_version":1}