{"id":"051bf706-dcdc-4ab1-a860-7e8cc868e39d","arxiv_id":"2508.10039","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"CEMA converts multi-task black-box text attacks into attacks on a binary classifier trained on cluster pseudo-labels, achieving high attack success with 100 queries.","lead":"The authors propose CEMA, a black-box attack that tricks multi-task text models by clustering unlabeled texts into pseudo-labels, training a small substitute classifier, and transferring adversarial examples to the real model. It claims strong attack success on translation, classification, summarization, and image generation with only 100 queries.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Assumption 4.1 is untested: no ablation shows that deep-level cluster labels, rather than random labels or generic perturbation, drive CEMA's transfer; a random-label control is needed.","rationale":"The reader's weakest_assumption already identifies Assumption 4.1 as the soft spot; my stress-test sharpens it into a falsifiable control. This is the single most load-bearing concern because every subsequent component — plug-and-play substitute, 100-query budget, multi-task transfer — inherits its validity from the untested hypothesis. The paper does provide some independent evidence (main results across victim models, low-quality auxiliary data in Appendix K, defense experiments), so I do not claim the results are impossible; but the absence of a null model means the reported numbers cannot be attributed to 'deep-level' labels rather than to generic perturbation or overfitting. Consequently I keep the reader's CONDITIONAL verdict: the condition should be the random-label / input-only ablation and, ideally, release of code. No ad hominem; the issue is an experimental gap.","tokens_in":26571,"tokens_out":7781,"duration_ms":87860,"concrete_test":"Re-run the full CEMA pipeline (same 100 auxiliary texts, mT5 vectorization, spectral clustering, Hotflip+FD+TextBugger, ensemble selection, thresholds) on Victim Models A and B for SST5 and Emotion, but permute the cluster labels y_i^c before training f_s, preserving the class balance. If Table 2's ASR/BLEU are reproduced within a few points, the deep-level labels are not load-bearing and Assumption 4.1 is unsupported. If performance collapses, run a second control: cluster only {Ex_i} (drop victim-output vectors); if that also reproduces CEMA, then the victim queries and outputs are unnecessary, so the 'deep-level' story still fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central result — CEMA's >59% ASR and BLEU <0.16 with 100 queries — depends entirely on Assumption 4.1 (Section 4.1, Eq. 1): adversarial examples generated against a substitute trained on binary cluster labels of concatenated input+output vectors transfer across tasks. Section 4.2.2 creates these labels by spectral clustering E_i = Concat(Ex_i, Ey_i^1, ..., Ey_i^N) on 100 auxiliary texts. Nothing in the paper establishes that a two-cluster partition of these vectors encodes a 'deep-level' property shared by classification, translation, summarization, and text-to-image tasks. The ablations in Section 5.3 vary cluster number, clustering algorithm, and vectorization, but never test whether the labels themselves matter: there is no random-label control, no input-only-label control, and no comparison to a substitute trained on one task's true labels. Because CEMA's candidates are produced by generic text-classification attacks (Hotflip, FD, TextBugger) and filtered by an ensemble of substitutes trained on 80% subsamples of the same 100 points, the observed transfer could be explained by (i) generic character/word corruption degrading any NLP model — the sole LLM baseline is Random-Del — or (ii) overfitting to the auxiliary input-output pairs, rather than by a deep shared structure. If random binary labels yield similar ASR/BLEU, Eq. (1) is not the mechanism and the central claim collapses to 'perturbing text hurts multi-task models.'","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CEMA, a black-box multi-task textual adversarial attack. It uses 100 auxiliary texts, queries the victim model to obtain outputs, concatenates input/output embeddings, applies binary spectral clustering to create 'deep-level labels', and trains a substitute binary classifier. It then generates candidate adversarial examples with Hotflip, FD, and TextBugger, and selects the candidate that fools the largest number of ensemble substitute models. Experiments on M3TL models, commercial APIs, LLMs, and six-task setups report ASR above 59% for classification and BLEU below 0.16 for translation with 100 total queries, plus extensions to summarization and text-to-image. The central load-bearing assertion is Assumption 4.1 (the deep-level attack hypothesis), which is stated as an assumption rather than derived or directly validated.","tokens_in":27039,"tokens_out":7383,"duration_ms":69485,"significance":"The framework is simple, query-efficient, and potentially general: converting a multi-task attack into a classification attack with a plug-and-play substitute model. The breadth of evaluation—two, three, and six tasks, commercial APIs, LLMs, and image generation—is a strength, and the reported few-shot performance is impressive if the mechanism holds. However, the central mechanism is asserted as an assumption and is not isolated by control experiments; the evaluation lacks error bars and uses a weak LLM baseline. If the deep-level hypothesis is validated, this is a significant result; as it stands, the evidence is suggestive but incomplete. The paper does not appear to ship code, which limits reproducibility.","major_comments":[{"comment":"The central claim rests on Assumption 4.1, which is asserted via a bird/cat analogy rather than derived or directly tested. The contribution list (Sec. 1) says the hypothesis is 'demonstrated', but the paper only shows that CEMA as a whole works; no experiment isolates whether the cluster labels carry task-relevant 'deep-level' structure. The ablations in Sec. 5.3 vary cluster number, clustering algorithm, vectorization, and attack-method count, but never compare against a random-label substitute trained on the same inputs with arbitrary binary labels, nor against input-only labels (without victim outputs). If a random-label control yields similar ASR/BLEU, Eq. (1) is not the operative mechanism and the results reduce to generic text corruption. This control is essential before the transfer claim can be accepted.","section":"Sec. 4.1, Assumption 4.1 / Eq. (1); Sec. 5.3"},{"comment":"The query-budget comparison is ambiguous. CEMA's Total-Qry=100 appears to be a global budget for querying the victim on 100 auxiliary texts, after which all test-set attacks are performed via transfer with zero additional victim queries. Baseline Total-Qry entries (e.g., 47360 for BAE) are totals over the full test set, while the text says baselines are 'limited to 55 queries per victim text'. These are incompatible units. In addition, the main setup says only 'we select 100 unlabeled victim texts' without stating whether these auxiliary texts are disjoint from the test set; if they are test-set instances or sampled from the same distribution without exclusion, the comparison is not a clean few-shot evaluation. The low-quality auxiliary experiment (Sec. K) uses cross-dataset data, but the main tables need an explicit statement of auxiliary/test overlap.","section":"Sec. 5.1 and Tables 2-3"},{"comment":"All reported numbers are single runs with no error bars or significance tests. CEMA involves random 80% subsampling of auxiliary pairs, w random substitute initializations, and stochastic search in the candidate attacks, so run-to-run variance is expected. For example, Table 2 reports ASR 73.57% for CEMA vs 46.11% for HQA; without variance it is impossible to know whether the gap is meaningful. Further, the only LLM baseline in Table 1 is Random-Del (random character deletion), which is not a standard adversarial baseline; claiming 'state-of-the-art' performance against such a baseline is unsupported. Please report means and standard deviations over at least 5 seeds and compare against established black-box text attacks (e.g., TextFooler, BERT-ATTACK, or HLGA) where applicable.","section":"Sec. 5.2, Tables 1-3"}],"minor_comments":[{"comment":"The proof of Theorem 4.2 for dependent events is invalid: from P(A_u) ≤ Π(1-p_i) and P(A_{u+1}) ≤ Π(1-p_i) one cannot conclude P(A_{u+1}) ≥ P(A_u). The theorem itself is trivially true because A_u ⊆ A_{u+1} for any events, so the proof should be replaced by this simple argument. The stress-test concern about dependence therefore does not undermine the conclusion, but the formal proof needs correction.","section":"Appendix H"},{"comment":"Heading contains a typo: 'Mutil-task Adversarial Attack' should be 'Multi-task Adversarial Attack'.","section":"Sec. 2.3"},{"comment":"The claim that two clusters capture the 'most fundamental deep-level label' because three- or four-cluster labels 'would ultimately merge into two' is unclear and needs a concrete justification.","section":"Sec. 4.2.2"},{"comment":"The figures are low resolution; equations embedded in Figure 1 are not legible and should be typeset separately or enlarged.","section":"Figures 1 and 3"},{"comment":"Header typos: 'dis-emoton' should be 'dis-emotion' and 'opumt' should be 'opus-mt'.","section":"Table 12"},{"comment":"No code or data release statement is provided. Given the number of hyperparameters (ϵ, number of clusters, w, l, subsampling ratio), a release or at least a detailed pseudocode would improve reproducibility.","section":"Reproducibility"}],"recommendation":"major_revision","confidential_remarks":"The paper's contribution is potentially interesting, but the central mechanism (Assumption 4.1) is under-validated. The lack of a random-label control and the ambiguous query-budget comparison are serious enough to require major revision. The 'first plug-and-play' novelty claim should also be checked against prior substitute-model transfer works with pseudo-labels. I would not recommend rejection if the authors can supply the missing controls and clarify the evaluation setup, as the idea has merit and the empirical scope is broad."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague — quick take on arXiv:2508.10039. The paper does something genuinely new: CEMA is the first text multi-task black-box attack, and the recipe — cluster concatenated input/output embeddings into binary pseudo-labels, train a substitute classifier, generate candidates with Hotflip/FD/TextBugger, then pick the candidate that fools the most re-trained substitutes — is clever and easy to reuse. The empirical footprint is broad: 2/3/6-task setups, classification plus translation, commercial APIs, LLMs, summarization, text-to-image, and a low-quality auxiliary data test. If the numbers are reproducible, it's a useful result.\n\nThe soft spot is exactly where the reader put it. Assumption 4.1 is the load-bearing claim: adversarials from a substitute trained on \"deep-level labels\" transfer across tasks. But those labels are just a two-cluster partition of the concatenated vectors. The ablations vary cluster count, clustering algorithm, vectorization, and number of attack methods, but never test whether the labels matter. A random-label control and an input-only-label control would settle whether the transfer comes from the deep-level structure or from generic perturbation degrading any NLP model. Given the LLM baseline is only random character deletion, the generic-perturbation explanation is not ruled out. The paper overstates in the abstract when it says it \"demonstrates\" the hypothesis; it demonstrates the attack, not the hypothesis.\n\nOther issues are smaller. The proof of Theorem 4.2 for dependent events uses a questionable inequality direction, though the theorem itself is just monotonicity of unions and is fine. No error bars and no discussion of seeds, which matters because clustering and subsampling inject variance. The main setup uses \"unlabeled victim texts\" as auxiliary data, which may or may not overlap the test set; the low-quality-data section explicitly uses the validation set, which is better. The LLM comparison to random deletion is too weak to call the results SOTA on LLMs.\n\nNone of this sinks the paper. The method is new, the experiments are substantial, and the commercial API results are independent evidence that something transfers in 100 queries. But the central mechanism is unfalsified, so the paper should not be accepted as-is. A serious referee should ask for the random-label ablation, a stronger LLM baseline (e.g., a standard word-level attack), and error bars over multiple runs. With that, it could be a solid venue paper. I would engage with it in review; it's the kind of paper that benefits from one round of substantive revision. Bring it to reading group if you want to discuss how much mechanism a security paper needs.","headline":"Plausible, useful black-box multi-task attack with a weakly supported central mechanism; the random-label ablation is the thing to demand in review.","tokens_in":27396,"tokens_out":3656,"would_cite":true,"duration_ms":35289,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"CEMA claims that a substitute classifier trained on binary cluster labels of concatenated input-output vectors can craft adversarial texts that transfer across unrelated tasks in a black-box multi-task model, using as few as 100 queries.","keywords":["adversarial text attack","multi-task learning","black-box attack","transferability","few-shot queries","substitute model","binary clustering","LLM security"],"falsifier":"Run CEMA's full pipeline with the same auxiliary texts, victim outputs, embeddings, and attack methods, but replace the spectral-cluster labels with random binary labels. If attack success rates and BLEU scores stay close to the reported values, the 'deep-level' labels carry no causal information and the hypothesis is refuted. A complementary check is whether cluster assignments align with any interpretable semantic partition of the victim outputs; if they do not, the transfer is better explained by input-space artifacts.","tokens_in":1680,"feed_emoji":"🎯","tokens_out":1680,"duration_ms":77518,"temperature":0.7,"pith_summary":"This paper proposes CEMA (Cluster and Ensemble Multi-task Text Adversarial Attack), an attack that turns a black-box multi-task text model into a single classification problem. CEMA takes a small set of auxiliary texts, queries the victim once per text, embeds each text together with all its task outputs, concatenates those embeddings, and runs binary clustering to create pseudo-labels. A substitute classifier trained on those pseudo-labels is then attacked with standard text-classification methods, and the candidate perturbation that fools the largest number of independently retrained substitutes is chosen as the final adversarial text. The paper's central claim is that this 'deep-level' substitute transfers adversarial examples to unrelated downstream tasks: with 100 black-box queries, CEMA reports classification attack success above 59% (up to 80.80%) and translation BLEU scores as low as 0.14. If the claim holds, multi-task attacks no longer need shared internal features, task-specific labels, or large query budgets.","feed_headline":"A cluster-trained substitute attacks six text tasks in 100 queries","feed_subtitle":"A binary-cluster substitute transfers attacks across translation, summarization, and image generation.","key_machinery":"The central mechanism is the deep-level substitute model: a binary text classifier trained on cluster labels obtained by spectral clustering of concatenated input-output embeddings. It converts a multi-task black-box attack into a white-box classification attack and supplies the transferability channel. The second mechanism is the transferability-oriented selection rule: among candidates generated by Hotflip, FD, and TextBugger, the one that flips the most independently retrained substitutes wins, with output-probability shift as the tie-breaker.","core_discovery":"CEMA's load-bearing discovery is the deep-level attack hypothesis (Assumption 4.1): if a substitute model $f_s$ trained on deep-level labels misclassifies an adversarial example, the victim multi-task model $f_v$ will also change its output, i.e. $f_s(x^*)\\neq f_s(\\tilde{x})$ implies $f_v(x^*)\\neq f_v(\\tilde{x})$ for downstream tasks. The deep-level labels are obtained without task supervision: auxiliary inputs and their victim outputs are embedded with a pre-trained model, concatenated, and split into two clusters by spectral clustering. Those binary cluster labels replace the unknown task labels, and a binary classifier is trained as the substitute. CEMA then generates candidate adversaria","pith_inferences":["If the deep-level hypothesis is right, the same concatenate-and-cluster recipe may extend to multimodal multi-task systems by clustering embeddings of inputs concatenated with their outputs; this is a direct extension CEMA itself does not claim.","A random-label control would test whether the cluster labels themselves carry information: if replacing spectral-cluster labels with random binary labels preserves attack success, transfer is driven by input-space geometry rather than by any 'deep' semantic property.","The reported invariance of performance across clustering and vectorization methods (spectral/K-means/BIRCH, mT5/XLM-R/one-hot) suggests the mechanism is robust to embedding choice, which in turn points toward a defensive strategy: disrupt the input-output concatenation structure rather than attempt to remove task information.","If cluster labels merely reflect formatting or distributional artifacts of the outputs, the attack should fail on tasks whose output distributions differ sharply from the auxiliary data; testing on out-of-distribution auxiliary texts would reveal this boundary."],"forward_implications":["With 100 black-box queries, CEMA reports classification ASR above 59% (up to 80.80%) and translation BLEU scores as low as 0.14 across the reported victim models and datasets.","With only 10 queries, average ASR is around 43% and average BLEU around 0.22, so query budgets far smaller than prior multi-task attacks suffice.","The attack transfers across task types: six-task setups mixing four classification and two translation tasks, plus summarization and text-to-image settings, all show degradation.","Commercial closed APIs (Baidu Translate, Ali Translate) and large language models (ChatGPT-4o, Claude 3.5) are reported as vulnerable using 100 auxiliary texts and black-box outputs.","Increasing the number of candidate-generating attack methods improves attack success, while increasing the number of clusters above two reduces reported performance."],"supporting_citations":[{"why":"Supplies the substitute-model transfer-attack paradigm that CEMA extends by replacing task labels with cluster pseudo-labels.","marker":"(Papernot et al., 2017)"},{"why":"Spectral clustering is the algorithm that produces the binary deep-level labels from concatenated input-output vectors.","marker":"(Ng et al., 2001)"},{"why":"mT5 is the pre-trained encoder used to vectorize texts and outputs and to compute the cosine similarity for candidate filtering.","marker":"(Xue, 2020)"},{"why":"Hotflip is one of the three text-classification attack methods used to generate candidate adversarial examples.","marker":"(Ebrahimi et al., 2018b)"},{"why":"The FD gradient-based attack is the second candidate-generating method used in CEMA.","marker":"(Papernot et al., 2016)"},{"why":"TextBugger, as cited in the paper, is the third candidate-generating attack method used in the ensemble.","marker":"(Ren et al., 2019)"},{"why":"MTA is the prior multi-task adversarial attack that requires shared internal features, the baseline CEMA positions itself against.","marker":"(Guo et al., 2020)"},{"why":"Prior multi-task adversarial text work that needs extensive queries and focuses on same-type tasks, the scenario CEMA claims to replace.","marker":"(Liu et al., 2017)"}],"fun_headline_variants":["100-query attack hits six tasks via cluster substitute","Cluster substitute enables few-shot multi-task attack","Deep-label substitute transfers attacks across six tasks","Black-box attack on six tasks in 100 queries","CEMA: 100-query attack on APIs, LLMs, and image models"],"cache_read_input_tokens":29312,"weakest_assumption_plain":"The load-bearing premise is that binary cluster labels over concatenated input-output embeddings encode a deep shared property of all downstream tasks, so that a substitute trained on those labels produces adversarial examples that transfer to tasks whose labels and objectives were never seen.","fun_headline_variants_meta":{"raw":{"variants":["100-query attack hits six tasks via cluster substitute","Cluster substitute enables few-shot multi-task attack","Deep-label substitute transfers attacks across six tasks","Black-box attack on six tasks in 100 queries","CEMA: 100-query attack on APIs, LLMs, and image models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000833,"raw_usage":{"total_tokens":3501,"prompt_tokens":803,"completion_tokens":2698,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":547,"completion_tokens_details":{"reasoning_tokens":2619}},"tokens_in":547,"tokens_out":2698,"duration_ms":19357,"temperature":1.0,"reasoning_tokens":2619,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T22:11:27.155423+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run CEMA's full pipeline with the same auxiliary texts, victim outputs, embeddings, and attack methods, but replace the spectral-cluster labels with random binary labels. If attack success rates and BLEU scores stay close to the reported values, the 'deep-level' labels carry no causal information and the hypothesis is refuted. A complementary check is whether cluster assignments align with any interpretable semantic partition of the victim outputs; if they do not, the transfer is better explained by input-space artifacts.","supporting_citations":[],"review_version":1}