{"id":"b7527985-053f-4683-953f-5b9617757a3f","arxiv_id":"2507.03427","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A two-stage entropy-maximization then entropy-minimization rectification, guided by a low-entropy prior of adversarial examples, improves test-time defense generalization on several benchmarks.","lead":"Adversarial examples are often misclassified with low entropy, meaning the model is very confident and very wrong. A new plug-in defense, REAL, first maximizes then minimizes prediction entropy to purify such inputs at test time, and it improves several existing rectifiers on some attack families, though gains are uneven.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"REAL's own CIFAR100 results contradict the central claim: as a plug-in it lowers AA accuracy (Table II: 47.13 vs 51.56; Table I: 43.69 vs 45.11) and CW accuracy while dropping natural accuracy, so 'greatly improve' and 'universal robustness' are unsupported on one of four datasets.","rationale":"In good faith, the paper is a clear, well-structured heuristic contribution: it documents limitations, tests adaptive attacks, and shows notable gains on MNIST and CIFAR10. However, the central claim is universal improvement of existing rectifiers and robustness to unseen attacks, and that claim is contradicted by the paper's own tables. CIFAR100 with LC is not an exotic setting; it is one of the four standard datasets, and the degradation on AA (the strongest attack family) and on natural accuracy is substantial. The paper's stated explanation, that clean and CW/DF distributions are mixed on CIFAR100, concedes that the LE prior and detection thresholds fail exactly where the method needs them. This moves the issue from 'future attacks may violate the prior' to 'the prior fails on a dataset included in the paper, and the method's outputs confirm it.' The reader's conditional verdict remains the right level: the method is worth publishing as a heuristic with narrowed claims, code release, and a clear statement that gains are dataset/attack-dependent, but the 'universal' framing must be corrected. I partially agree with the reader's weakest assumption; the deeper problem is the internal inconsistency of the reported results, not only the possibility of future prior failure.","tokens_in":23325,"tokens_out":6963,"duration_ms":75879,"concrete_test":"Independently reproduce the CIFAR100/Label-Consistency rows of Tables I and II using released code or a faithful reimplementation of Algorithm 1 with thresholds aux* and ent* set from clean-sample statistics, and compute per-attack accuracy for SOAP and SOAP+Ours on AA and CW. If the plug-in does not strictly improve those numbers, or if natural accuracy drops materially, the central 'greatly improve/universal robustness' claim is contradicted on this dataset.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the LE prior is common to adversarial samples and that the REAL plug-in 'greatly improve[s] the performance of existing sample rectification models' and yields 'universal robustness against unseen attacks.' The main results contradict this. On CIFAR100 with WideResNet28-10 plus the LC task (Table II), adding REAL to SOAP reduces AutoAttack accuracy from 51.56% to 47.13% and CW from 56.09% to 54.65%, while natural accuracy drops from 61.01% to 56.57%. On ResNet18 (Table I), natural accuracy drops 8.64 points. These are non-marginal, and AA is the strongest evaluated attack. The paper's explanation (Sec. IV.E) is that on CIFAR100 clean and CW/DF distributions mix, so threshold detection misclassifies many adversarial samples as clean. That concession means the LE prior and the detection mechanism fail on an entire dataset, precisely the 'unseen attack' regime the paper claims to handle. The universal-improvement claim is therefore falsified by the paper's own experiments, not by a competing assumption.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims that adversarial examples across many attacks share a low-entropy prior: (1) they are misclassified with low prediction entropy, and (2) stronger attacks produce even lower prediction entropy. On this basis the authors propose REAL, a two-stage test-time rectification method that first maximizes prediction entropy ('reverse rectification') and then minimizes it ('forward rectification'), with an attack-aware weighting scheme, a clean-vs-adversarial detection step, and a heuristic stopping condition. REAL is presented as a training-free plug-in that can be added to existing sample-rectification methods, such as SOAP, and that improves 'universal robustness against unseen attacks.' The experiments cover MNIST, CIFAR-10, CIFAR-100, and TinyImageNet with multiple backbones, auxiliary tasks, attack types, adaptive attacks, and BPDA attacks.","tokens_in":23589,"tokens_out":3277,"duration_ms":41148,"significance":"If the low-entropy prior held broadly and the Max-Min rectification reliably improved existing defense methods, REAL would be a useful training-free plug-in for test-time robustness. The paper has notable strengths: it analyzes entropy statistics over multiple attacks and datasets, provides visual and quantitative ablation results, reports inference-time overhead, and tests adaptive and BPDA attacks. However, the paper's own results undermine the central 'universal robustness' and 'greatly improve' claims: on CIFAR-100, adding REAL to SOAP lowers AutoAttack accuracy in both Table I and Table II and lowers natural accuracy substantially, and the paper's Section IV.L concedes that adversarial patches violate the prior. The contribution is therefore best assessed as a conditional, attack-specific technique rather than a universal plug-in, and the manuscript needs substantial reframing and additional evidence.","major_comments":[{"comment":"The central claim that REAL 'can greatly improve the performance of existing sample rectification models' and provide 'universal robustness against unseen attacks' is contradicted by the paper's own CIFAR-100 results. With the label-consistency auxiliary task, adding REAL to SOAP reduces AutoAttack accuracy from 45.11% to 43.69% on ResNet18 (Table I) and from 51.56% to 47.13% on WideResNet28-10 (Table II), while also dropping natural accuracy from 52.91% to 44.27% and from 61.01% to 56.57%, respectively. The paper's explanation in Section IV.E is that clean and CW/DF adversarial distributions are mixed on CIFAR-100, causing thresholds to misclassify many adversarial samples as clean. That is exactly the unseen-attack regime the paper claims to handle, so the claim of universal improvement cannot stand as stated. I would ask the authors to either restrict the claim to settings where the LE prior provably holds, report performance separately for detected and undetected samples, or provide an attack-agnostic variant that does not rely on threshold statistics.","section":"Sec. IV.E, Tables I and II"},{"comment":"The paper's own limitation subsection shows that adversarial patches do not exhibit low-entropy misclassification and that REAL provides no improvement for large patches: at 50% patch size, SOAP+Ours achieves 16.20% versus SOAP's 17.40% on CIFAR-10 (Table IX). Since the abstract and introduction claim 'universal robustness against unseen attacks,' the existence of a broad attack family that violates the prior is a load-bearing scope limitation. The manuscript should explicitly state in the abstract and conclusion that the method targets perturbation-based attacks satisfying the low-entropy prior, not arbitrary adversarial perturbations.","section":"Sec. IV.L, Fig. 11 and Table IX"},{"comment":"The detection thresholds aux* and ent* are 'determined based on the statistical means of the auxiliary loss and predicted entropy of clean samples,' which presumes access to a representative clean-sample calibration set at test time. The paper does not report the threshold values, the sensitivity of results to their choice, or what happens when clean-sample statistics are unavailable (e.g., under a fully adaptive attack that also contaminates the calibration stream). Since detection underpins the clean-accuracy preservation in Algorithm 1, this assumption needs to be justified and quantified.","section":"Sec. IV.D and Algorithm 1"},{"comment":"The paper states that for data reconstruction tasks on CIFAR-10/100 'we choose not to employ threshold detection,' yet Algorithm 1 presents detection as an unconditional component of the method. It is unclear whether the REC rows in Tables I and II use detection, and if not, how clean accuracy is controlled in those configurations. The algorithm description and the experimental settings should be brought into correspondence.","section":"Sec. IV.D"}],"minor_comments":[{"comment":"There are several typos, including 'Re ctify A dversarial sample based on L oE prior' and 'plugged-played'; these should be corrected.","section":"Abstract and Introduction"},{"comment":"The text says the correlation coefficient rho is shown in Fig. 2 and that the negative correlation is 'significant,' but the exact coefficient values are not reported in the text or figure caption, and no error bars or confidence intervals are given. Reporting the numeric rho values with sample sizes would allow readers to assess the strength of Property 2.","section":"Fig. 2"},{"comment":"The claim that REAL improves CIFAR-10 ResNet18 by 'nearly 10%' is not uniformly supported by Table I: under the REC auxiliary task, DF accuracy is slightly worse with REAL (65.52 vs. 65.97), and the reported near-10% gain appears to refer only to the LC task under CW. The sentence should cite the specific table cells.","section":"Sec. IV.E"},{"comment":"The adaptive weights beta_max and beta_min depend on the hyperparameter alpha, but the ablation study (Fig. 7 and Table IV) only varies the number of rectification rounds R. A sensitivity analysis for alpha, and for the thresholds aux* and ent*, would strengthen the practical guidance for users.","section":"Sec. III.C and Sec. IV.D"},{"comment":"The inference-time table reports a roughly fivefold increase when REAL is added to SOAP, but it does not report the breakdown between the two rectification stages and the repeated rounds, nor does it compare against the cost of the detection stage. A short sentence explaining the dominant cost would help.","section":"Table VII"}],"recommendation":"major_revision","confidential_remarks":"The paper contains an interesting empirical observation and a plausible plug-in mechanism, but its central 'universal robustness' claim is falsified by its own CIFAR-100 AutoAttack results and patch experiments. The authors should be asked to substantially reframe the contribution as an attack-conditional test-time rectifier, add the missing threshold and hyperparameter analysis, and make the limitations section consistent with the abstract and conclusion."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper has a real heuristic: treat adversarial samples as low-entropy misclassifications, break that by maximizing entropy, then re-establish confidence by minimizing entropy, all as a plug-in to self-supervised rectification. The two-stage Max-Min scheme is easy to state, and the paper tests it across four datasets and several attacks, including adaptive BPDA. The best results—e.g., MNIST, CIFAR10 with label consistency, TinyImageNet with LC—are substantial. The authors are also honest about detection-threshold limitations and the reconstruction-task mismatch.\n\nThe soft spot is the central claim. 'Universal robustness against unseen attacks' and 'greatly improve' are contradicted by their own CIFAR100 numbers. On WideResNet28-10 + LC, REAL drops AutoAttack accuracy from 51.56 to 47.13 and CW from 56.09 to 54.65, while natural accuracy falls from 61.01 to 56.57. The paper's explanation—that on CIFAR100 clean and CW/DF distributions mix, so detection fails—means the prior and the detection mechanism fail on an entire dataset, exactly the unseen-attack regime they claim to handle. That is not a minor caveat; it is a boundary on the method.\n\nThe prior itself is not new: confident misclassification of adversarial examples is well documented, and the entropy-based alternation resembles ref [50], which is cited but not differentiated. The empirical section would be stronger with error bars and exact correlation coefficients in Fig. 2, and the detection thresholds aux* and ent* rely on clean-sample statistics that may not be available at test time. No code is released, compounding reproducibility concerns.\n\nStill, the paper is clearly written, the failures are reported rather than hidden, and the plug-in helps in several settings. It is a legitimate heuristic contribution, but the universal framing needs to be narrowed, and the CIFAR100 failure should be handled as a first-class limitation, not a side remark.\n\nI would send it to review: a serious referee can push the authors to re-scope the claims and add the missing calibration analysis. I would not cite it as evidence of universal robustness until the CIFAR100 issue is resolved.","headline":"A useful plug-in rectifier with a too-broad 'universal' claim; the paper's own CIFAR100 results undercut the headline.","tokens_in":24145,"tokens_out":1894,"would_cite":false,"duration_ms":21437,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adversarial images carry a low-entropy signature, and a two-stage Max-Min entropy rectification exploits it to defend against unseen attacks at test time.","keywords":["low entropy prior","test-time defense","adversarial robustness","adversarial rectification","Max-Min entropy optimization","attack-aware weighting","unseen attacks","self-supervised learning"],"falsifier":"A concrete falsifier: build a PGD-style attack that maximizes classification loss minus prediction entropy, producing high-entropy misclassifications, and run the defended model on those samples. If the rectified samples end up less accurate than the raw adversarial inputs, or if the $aux^{*}$ and $ent^{*}$ thresholds flag them as clean, then the low-entropy prior is violated and REAL's first stage has no signal to work with.","tokens_in":23095,"feed_emoji":"🛡️","tokens_out":12129,"duration_ms":117705,"temperature":0.7,"pith_summary":"Adversarial attacks on image classifiers share a statistical tell: their targets are misclassified with high confidence, so the model's prediction entropy is abnormally low, and lower still for stronger attacks. The paper argues that this low-entropy prior holds across many attack families and can be exploited at test time without retraining the classifier. It proposes REAL, a plug-in rectification that first maximizes prediction entropy to strip the sample's adversarial nature and then minimizes entropy to push it back toward a clean, correctly classified image. Applied on top of existing self-supervised or diffusion-based purifyers, REAL raises worst-case accuracy against attacks the defenders were never trained on, including CW, DeepFool, and AutoAttack. The prior is the load-bearing premise: if a future attack misleads with high-entropy predictions, the first rectification stage has nothing to grab onto.","feed_headline":"A low-entropy tell powers test-time defense against unseen attacks","feed_subtitle":"Attackers make models confidently wrong; reversing then restoring entropy raises worst-case accuracy on unseen attacks.","key_machinery":"The low-entropy prior (LE prior) is the central object: the empirical regularity that adversarial samples are misclassified with low predictive entropy and that entropy decreases as attack intensity increases. The machinery that carries the argument is the Max-Min entropy optimization scheme: a reverse rectification step that maximizes prediction entropy, combined with an auxiliary self-supervised loss, to mask the adversarial structure, followed by a forward rectification step that minimizes entropy to restore clean-like confident correct predictions, both under a perturbation budget $\\epsilon_{\\mathrm{pfy}}$. Around this core sit the attack-aware weighting mechanism, which sets $\\beta_{\\max} = \\alpha(1 - V_{\\mathrm{ent}})^2$ and $\\beta_{\\min} = \\alpha V_{\\mathrm{ent}}^2$ from the normalized entropy $V_{\\mathrm{ent}} = L_{\\mathrm{ent}} / \\log_2(N)$, and the heuristic selection strategy with detection thresholds $aux^*$ and $ent^*$ derived from clean-sample statistics. This machinery is designed to be orthogonal to existing sample-rectification models, so it can be plugged into them without retraining.","core_discovery":"The central discovery is that natural and adversarial samples occupy opposite regimes of predictive entropy, not just for one attack but across FGSM, PGD, CW, DeepFool, MIM, STA, and AutoAttack on MNIST, CIFAR10, CIFAR100, and TinyImageNet. Clean samples follow the usual trend—higher entropy correlates with higher error rate—whereas adversarial samples are confidently wrong (low entropy) and their entropy falls as attack loss rises, with correlation coefficients reported in Fig. 2. Exploiting this, the authors build REAL, a two-stage Max-Min entropy optimizer. Stage one (reverse rectification) minimizes the auxiliary self-supervised loss while maximizing classifier entropy, pulling the sample toward the decision boundary and producing a 'mask sample'. Stage two (forward rectification) minimizes both auxiliary loss and entropy to 'enlighten' the mask sample into a purified image that the classifier labels correctly with high confidence. An attack-aware weighting uses normalized entropy to set $\\beta_{\\max}$ and $\\beta_{\\min}$, a detection step thresholds auxiliary loss and entropy using clean-sample statistics, and a heuristic selection strategy repeats rounds until purification criteria are met. The claim is that this recipe substantially improves the clean and worst-case accuracy of existing rectification models and generalizes to unseen attacks.","pith_inferences":["A direct test of the prior's boundary: an attacker who maximizes prediction entropy while crafting perturbations, as in the paper's Eq. 11 with a large entropy weight, should erode REAL's advantage; the paper already observes that in this regime the attack's own gradient directions conflict, so the prediction is that REAL is most fragile against high-entropy misclassification attacks.","The $aux^*$ and $ent^*$ thresholds are calibrated from clean-sample statistics, so a deployment-time distribution shift of legitimate inputs would require recalibration; otherwise the detector will either reject many clean samples or admit adversarial ones.","REAL's inference time is roughly five times that of the base purifier (Table VII), so the natural next step is a lightweight predictor of how many rectification rounds each sample needs, replacing the heuristic termination rule.","The same Max-Min entropy recipe could transfer to other prediction heads, such as segmentation, detection, or face recognition, wherever a confidently-wrong signature appears, but the prior would first need to be re-verified for each task."],"forward_implications":["Plugged into SOAP with label-consistency or reconstruction auxiliary tasks, REAL raises worst-case accuracy: on MNIST with a fully connected network the worst case climbs from 55.62% to 91.63%, and on CIFAR10 with ResNet18 and label consistency it rises from 51.02% to 58.29%.","Integrated into the diffusion-based purifier ADP, REAL lifts worst-case accuracy on CIFAR10 from 76.14% to 92.13% (ResNet18), exceeding the compared DiffPure and Defense Transformer results in the same setting.","The detection strategy, using only clean-sample statistics and the $aux^*$/$ent^*$ thresholds, exceeds 80% detection accuracy across FGSM, PGD, CW, DF, and AA on CIFAR10 with ResNet18 and shows the strongest worst-case detection when compared methods are trained only on FGSM.","Under the BPDA adaptive attack, REAL improves SOAP's accuracy from 3.6% to 18.7% on ResNet18 and from 11.3% to 20.5% on WideResNet28-10, suggesting the Max-Min loop resists white-box tracing better than a single rectification.","Ablations show the top-level components carry the gains: on CIFAR10 with the reconstruction auxiliary task, worst-case accuracy is 17.29% with auxiliary loss alone, 12.58% after adding Max-Min entropy optimization, 31.84% after adding the heuristic selection strategy, and 31.52% with the attack-aware weighting."],"supporting_citations":[{"why":"Supplies the PGD attack whose entropy statistics anchor Property 1 and whose multi-step design inspires the heuristic multi-round rectification.","marker":"[35]"},{"why":"The self-supervised rectification model (SOAP) that REAL is plugged into and the main baseline across reconstruction and label-consistency auxiliary tasks.","marker":"[43]"},{"why":"Provides the joint auxiliary-loss and entropy distribution view that motivates the aux* and ent* detection thresholds.","marker":"[48]"},{"why":"The contrastive-learning rectification method where REAL is inserted, and the source of the shared training parameters.","marker":"[36]"},{"why":"The BPDA adaptive attack used to test REAL under a white-box adversary who knows the purification pipeline.","marker":"[11]"},{"why":"AutoAttack, the ensemble attack that serves as the challenging unseen-attack evaluation.","marker":"[13]"},{"why":"The CW attack, one of the two optimization-based unseen attacks that adversarial training fails to generalize to.","marker":"[7]"},{"why":"The DeepFool attack, the other unseen attack whose low-entropy behavior the LE prior is claimed to capture.","marker":"[39]"},{"why":"ADP, the score-based diffusion purifier that REAL integrates with to show applicability beyond self-supervised rectification.","marker":"[64]"}],"fun_headline_variants":["Low entropy prior flips adversarial samples back to clean","Test-time defense turns confident misclassifications into correct ones","Max-min entropy rectifies adversarial samples at test time","Entropy tells all: purify adversarial samples without retraining","Attack-agnostic defense uses low entropy to purify samples"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The LE prior is assumed to hold for whatever attacks arrive at test time, and the $aux^{*}$ and $ent^{*}$ thresholds are calibrated from clean-sample statistics; the paper itself reports that on CIFAR100 the clean and CW/DF entropy distributions mix (Sec. IV.E) and that adversarial patches lack low-entropy misclassification (Fig. 11), so a high-entropy or mixed-distribution attack would leave the first rectification stage without a signal.","fun_headline_variants_meta":{"raw":{"variants":["Low entropy prior flips adversarial samples back to clean","Test-time defense turns confident misclassifications into correct ones","Max-min entropy rectifies adversarial samples at test time","Entropy tells all: purify adversarial samples without retraining","Attack-agnostic defense uses low entropy to purify samples"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000317,"raw_usage":{"total_tokens":1853,"prompt_tokens":1063,"completion_tokens":790,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":679,"completion_tokens_details":{"reasoning_tokens":711}},"tokens_in":679,"tokens_out":790,"duration_ms":8642,"temperature":1.0,"reasoning_tokens":711,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T20:10:29.165210+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete falsifier: build a PGD-style attack that maximizes classification loss minus prediction entropy, producing high-entropy misclassifications, and run the defended model on those samples. If the rectified samples end up less accurate than the raw adversarial inputs, or if the $aux^{*}$ and $ent^{*}$ thresholds flag them as clean, then the low-entropy prior is violated and REAL's first stage has no signal to work with.","supporting_citations":[{"cited_title":"Online adversarial purification based on self-supervised learning","cited_arxiv_id":null,"evidence_quote":"The self-supervised rectification model (SOAP) that REAL is plugged into and the main baseline across reconstruction and label-consistency auxiliary tasks."},{"cited_title":"Test-time Detection and Repair of Adversarial Samples via Masked Autoencoder","cited_arxiv_id":"2303.12848","evidence_quote":"Provides the joint auxiliary-loss and entropy distribution view that motivates the aux* and ent* detection thresholds."},{"cited_title":"Adversarial attacks are reversible with natural supervision","cited_arxiv_id":null,"evidence_quote":"The contrastive-learning rectification method where REAL is inserted, and the source of the shared training parameters."},{"cited_title":"Evaluating the adversarial robustness of adaptive test-time defenses","cited_arxiv_id":null,"evidence_quote":"The BPDA adaptive attack used to test REAL under a white-box adversary who knows the purification pipeline."},{"cited_title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","cited_arxiv_id":null,"evidence_quote":"AutoAttack, the ensemble attack that serves as the challenging unseen-attack evaluation."},{"cited_title":"Deepfool: a simple and accurate method to fool deep neural networks","cited_arxiv_id":null,"evidence_quote":"The DeepFool attack, the other unseen attack whose low-entropy behavior the LE prior is claimed to capture."},{"cited_title":"Adversarial purification with score-based generative models","cited_arxiv_id":null,"evidence_quote":"ADP, the score-based diffusion purifier that REAL integrates with to show applicability beyond self-supervised rectification."}],"review_version":1}