{"id":"ab926fdd-2fb1-4804-80f4-95890b2c32eb","arxiv_id":"2508.06127","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"VeSCA generates adversarial examples against SAM's encoder that transfer to downstream models, reporting a 12.7% improvement over state-of-the-art attacks.","lead":"A new attack called VeSCA uses a simplicial complex to target weaknesses in the image encoder of the Segment Anything Model (SAM), producing adversarial images that also fool downstream models. If transferable in practice, it highlights a single point of failure in widely reused AI vision components.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Manuscript mismatch: provided full text is an unrelated LLM serving paper; central claim has no supporting evidence in the reviewed artifact.","rationale":"The reader's verdict is UNVERDICTED with low confidence, based on the mismatch between the abstract and the supplied full text. My review confirms that the full text is indeed an unrelated LLM serving optimization paper, so the central claim cannot be verified from the artifact. The reader's weakest_assumption about the simplicial complex capturing shared vulnerabilities is plausible but secondary: before assessing that methodological premise, the actual manuscript with the method description and experiments must be available. The reader correctly identifies the information-integrity issue, though their stated weakest_assumption focuses on a specific methodological detail rather than the more fundamental absence of the paper. I therefore agree with the UNVERDICTED outcome but only partially agree that the weakest assumption is the specific simplicial-complex premise—the primary concern is the missing evidence. No adjustment to the reader's verdict is needed; it should remain UNVERDICTED until the correct text is supplied.","tokens_in":1782,"tokens_out":1575,"duration_ms":18110,"concrete_test":"Retrieve the actual PDF for arXiv:2508.06127 from arXiv and verify that its full text matches the VeSCA abstract. If it matches, then inspect the methodology sections for (1) a formal definition of the parametric simplicial complex, (2) a description of the iterative vertex refinement and random sampling, and (3) tables/figures reporting the claimed 12.7% improvement across the three downstream model categories and five datasets. If any of these components are missing, the central claim remains unverified. If the retrieved PDF is instead the LLM serving paper, conclude that the artifact is a mismatched submission and the claim cannot be assessed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract for arXiv:2508.06127 describes VeSCA, an adversarial attack on the SAM encoder that uses a parametric simplicial complex to generate transferable adversarial examples and claims a 12.7% improvement over state-of-the-art methods. However, the supplied full text is not the VeSCA paper; it is an entirely unrelated manuscript on LLM serving optimization (arXiv:2508.06133). The reviewed artifact therefore contains no derivation of the simplicial complex construction, no description of the adversarial sampling procedure, no downstream model evaluations, and no quantitative results supporting the 12.7% claim. The central claim depends on a body of evidence that is simply absent from the manuscript under review. This is not a claim about author intent; it is a concrete verification gap. Until the correct full text is supplied and examined, no component of the abstract's central claim—explicit characterization of shared vulnerable regions, iterative vertex refinement, domain re-adaptation, transferability, or performance improvement—can be checked. The reader's UNVERDICTED status is therefore appropriate, and the load-bearing weakness is the absence of the supporting manuscript itself, which supersedes any specific methodological assumption.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The submitted manuscript, as provided to the referee, consists of an abstract for a paper titled \"SAM Encoder Breach by Adversarial Simplicial Complex Triggers Downstream Model Failures\" and a full text that is entirely different. The abstract proposes VeSCA, an adversarial attack on the SAM encoder that uses a parametric simplicial complex to generate transferable adversarial examples and claims a 12.7% improvement over state-of-the-art methods. The appended full text, however, is a paper on LLM serving scheduling (arXiv:2508.06133), with an introduction, theoretical model, and experiments on latency minimization. None of the full text describes VeSCA, simplicial complexes, SAM, adversarial attacks, or downstream model vulnerabilities. Consequently, the manuscript provides no supporting evidence for the abstract's central claims.","tokens_in":2040,"tokens_out":3040,"duration_ms":32981,"significance":"If the VeSCA method worked as claimed, it would be a valuable contribution to robustness of vision foundation models: an attack that uses only the SAM encoder and transfers to downstream models would lend concrete support to the abstract's warning about single-point failures in foundation models. The reported 12.7% improvement across five datasets would be a meaningful empirical result if accompanied by experimental details, baselines, and statistical significance. However, the present manuscript supplies none of the required evidence. The contribution, as submitted, is limited to an unverifiable abstract; this is not a citable scientific result. The significance of the underlying idea cannot be assessed from the reviewed artifact.","major_comments":[{"comment":"The appended full text is an unrelated LLM-serving scheduling paper, not the VeSCA paper. It contains no derivation of the parametric simplicial complex, no description of iterative vertex refinement, no definition of 'shared vulnerable regions,' no adversarial sampling procedure, and no evaluation against SAM or downstream models. The central claim of the abstract is therefore completely unsupported by the body of the manuscript. This is a load-bearing defect: the reviewed manuscript does not contain the work it claims to present.","section":"Full text (1-6)"},{"comment":"The reported 'performance improved by 12.7% compared to state-of-the-art methods across three downstream model categories across five domain-specific datasets' is a bare assertion. No dataset names, evaluation metrics, baselines, error bars, or statistical tests are present. Even if the correct full text were supplied, the current manuscript provides no way to check the magnitude, variability, or significance of the claimed improvement.","section":"Abstract, 'Extensive experiments...'"},{"comment":"The method is not reproducible from the submitted artifact. Key terms in the abstract—'parametric simplicial complex,' 'iterative vertex-wise refinement,' 'lightweight domain re-adaptation,' 'random simplicial complex sampling'—are never defined or formalized. No algorithm, pseudo-code, optimization objective, or threat model is given. An adversarial-attack paper must make its method explicit; here it is absent.","section":"Entire manuscript"}],"minor_comments":[{"comment":"The full text is labeled as arXiv:2508.06133v4, while the abstract corresponds to arXiv:2508.06127. The internal inconsistency between title, abstract, and body underscores that the submitted document is not a coherent manuscript.","section":"Title/header"},{"comment":"The abstract refers to prior adversarial attacks on SAM and to a novel method, but the full text provides no related-work discussion, no citations to SAM or adversarial-attack literature, and no references relevant to the claimed method.","section":"References"}],"recommendation":"reject","confidential_remarks":"The manuscript as submitted cannot be reviewed as a scientific paper because the full text is a different paper. I recommend rejection of the present document. Should a corrected version containing the actual VeSCA paper be submitted, it would require a fresh review; no assessment of the underlying claims is possible from the current artifact."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, the takeaway: this paper cannot be evaluated yet. The abstract describes VeSCA, an adversarial attack on the SAM encoder that builds a vertex-refined simplicial complex to expose shared vulnerabilities between SAM and downstream models. That is a novel and plausible angle, and the claim of a 12.7% relative improvement over state-of-the-art across three model families and five datasets would be worth checking. But the supplied full text is not this paper. It is an unrelated manuscript on LLM serving optimization. So there is no derivation, no experimental setup, no numbers to audit. That is not idle skepticism; the evidence required for the central claim is simply not in the artifact.\n\nWhat the abstract itself does well: it identifies a real risk (encoder-level transferable attacks as a single point of failure), proposes a concrete mechanism (random sampling of simplicial complexes with vertex-wise refinement and a light domain re-adaptation step), and positions against prior SAM attacks that focused on single models. On the face of it, that is a plausible research direction, and the importance-if-true score of 6 seems fair.\n\nWhere things fall apart is in verification. The 12.7% number comes with no error bars or dataset list in the abstract, which is normal for an abstract, but the full text that would carry that detail is absent. So no part of the method is checkable: not the complex construction, not the refinement, not the transferability evaluation. The reader's UNVERDICTED status is the right one. I don't see a reason to call it a load-bearing flaw in the method itself—there simply is no method on the table.\n\nWho is this for? If the real paper matches the abstract, it would be for the adversarial-ml and foundation-model robustness community. As submitted to this review, it is not yet a reviewable document. My recommendation: desk-reject this version and ask the authors to resubmit with the correct full text. Once that happens, the idea deserves a serious referee. I would not cite it until I can see the actual experiments.","headline":"The abstract describes a plausible and potentially novel attack on SAM's encoder, but the supplied full text is a different paper on LLM scheduling, so there is nothing to review yet.","tokens_in":2484,"tokens_out":2483,"would_cite":false,"duration_ms":23888,"reading_group":"no","serious_thinker":"unclear","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"VeSCA claims that a parametric simplicial complex fitted to SAM's encoder can be refined into adversarial perturbations that transfer to downstream models, beating prior transfer attacks by 12.7% on five datasets.","keywords":["SAM","adversarial attack","adversarial transferability","simplicial complex","vertex refinement","domain re-adaptation","foundation model vulnerability","image segmentation"],"falsifier":"Run VeSCA with only the SAM encoder and the stated few reference images against a held-out set of downstream models; if the attack success rate does not significantly exceed same-norm random noise, or if removing the domain re-adaptation data wipes out the reported 12.7% gain, the transferability claim is refuted.","tokens_in":1704,"feed_emoji":"🕸️","tokens_out":6073,"duration_ms":59605,"temperature":0.7,"pith_summary":"This paper is trying to establish that the Segment Anything Model (SAM) encoder has shared vulnerable regions that also belong to downstream models, and that an attacker who can probe only SAM's encoder can find those regions by modeling them as a simplicial complex and refining its vertices. If true, a single attack recipe built from a frozen SAM encoder would compromise many downstream applications without touching their weights, making SAM a single point of failure. The concrete payoff claimed is a 12.7% average improvement in transferability over earlier attack methods across three categories of downstream models and five domain-specific datasets.","feed_headline":"Simplicial-complex SAM attack beats prior attacks by 12.7%","feed_subtitle":"VeSCA uses only SAM's encoder plus a few reference images to craft attacks that transfer to every downstream model.","key_machinery":"The central object is the parametric simplicial complex: a topological construct made of vertices, edges, triangles, and higher-dimensional simplices that serves as an explicit geometric model of the regions where SAM and downstream models share adversarial vulnerability. Iterative vertex refinement locates the complex in high-risk regions of the SAM encoder's loss landscape, and random sampling from the complex generates the perturbation candidates that transfer.","core_discovery":"The central claim is a new attack method, VeSCA, that uses only the SAM encoder to generate adversarial examples that transfer to downstream models. It characterizes the shared vulnerable regions between SAM and those models as a parametric simplicial complex, finds such a complex inside adversarially potent regions through iterative vertex-wise refinement, and uses random sampling on the complex to produce diverse transferable perturbations. A lightweight domain re-adaptation step, using minimal reference data, bridges the domain gap during complex initialization. The paper reports that VeSCA improves adversarial transferability by 12.7% over state-of-the-art methods across three downstream","pith_inferences":["My inference: the same simplicial-complex sampling idea could be tested as a general transfer-attack generator for other frozen foundation-model encoders (vision-language, audio, or multimodal), not just SAM.","My inference: the paper's framing implies that adversarial vulnerability has a topological structure, which suggests that topological data analysis tools could be used to measure the persistence or size of shared vulnerable regions and compare them across foundation models.","Integrity caveat: the supplied full text is an unrelated LLM-serving scheduling paper, so the abstract's experiments and the 12.7% figure cannot be checked in the provided body; the above summary describes the abstract's claims in good faith, not an independently verified result."],"forward_implications":["If VeSCA is right, an attacker with white-box access to SAM's encoder alone can compromise downstream models that were never individually attacked, so SAM's security becomes a shared dependency for the whole application ecosystem.","The 12.7% reported improvement implies that existing transfer attacks underexploit the common geometric structure of vulnerabilities, and that modeling shared regions rather than single points is the productive direction.","The lightweight domain re-adaptation result suggests that very few reference images are enough to bridge domain gaps for transfer attacks, which lowers the cost of auditing foundation models for downstream risk.","Downstream model defenses should not only harden against known adversarial examples but also target the shared simplicial-complex regions that transferability relies on."],"supporting_citations":[],"fun_headline_variants":["Attack SAM encoder to break all downstream models by 12.7%","One encoder attack, all downstream models fail: VeSCA","SAM's hidden weak spot: VeSCA attack transfers 12.7% better","VeSCA: Attack SAM's encoder, fool every downstream model","12.7% better transferable attacks on SAM via simplicial complex"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The load-bearing premise is that a parametric simplicial complex fitted to the SAM encoder's adversarial regions, with only minimal reference data for domain re-adaptation, actually captures regions that downstream models share, so refining vertices on the SAM encoder alone finds transferable attacks.","fun_headline_variants_meta":{"raw":{"variants":["Attack SAM encoder to break all downstream models by 12.7%","One encoder attack, all downstream models fail: VeSCA","SAM's hidden weak spot: VeSCA attack transfers 12.7% better","VeSCA: Attack SAM's encoder, fool every downstream model","12.7% better transferable attacks on SAM via simplicial complex"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000233,"raw_usage":{"total_tokens":1330,"prompt_tokens":746,"completion_tokens":584,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":490,"completion_tokens_details":{"reasoning_tokens":487}},"tokens_in":490,"tokens_out":584,"duration_ms":5700,"temperature":1.0,"reasoning_tokens":487,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T22:53:24.442543+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run VeSCA with only the SAM encoder and the stated few reference images against a held-out set of downstream models; if the attack success rate does not significantly exceed same-norm random noise, or if removing the domain re-adaptation data wipes out the reported 12.7% gain, the transferability claim is refuted.","supporting_citations":[],"review_version":1}