{"id":"58881814-ab14-4d3d-b33c-449373169016","arxiv_id":"2607.18339","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Simple transfer-only attacks expose shared vulnerabilities inside adversarial-training, purification, and robust-LVLM defense families.","lead":"This paper shows that defenses hardened against adversarial attacks can share the same hidden weak spots, so an attack built against one often breaks others in the same family. A deliberately simple attack reached 80.4% average success across eight purification defenses, suggesting that current defenses may be less independent than assumed.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Purifier transfer claim is confounded by the fixed non-robust downstream classifier; the 80.4% may not isolate purifier-family sensitivity.","rationale":"The reader's weakest assumption targets exactly the attribution issue: the purifier experiments fix a non-robust ResNet-50 downstream classifier shared by all surrogate and target systems. This is load-bearing because the headline 80.4% transfer success is the paper's strongest evidence that 'one breach exposes the family.' If the downstream classifier is the actual source of the vulnerability, then the paper's conclusion that purification-based defenses as a family are exposed would be overstated. The paper's own control (Table 14) shows that weak surrogates transfer poorly to diffusion purifiers, which demonstrates an interaction between surrogate strength and target purifier; however, it does not separate the contribution of the shared f. A robust downstream classifier would provide a decisive test. The VQA experiments share the same structural confound (fixed LLaVA-1.5-7B and projector), so even though the current strongest claim is purification, the attribution concern spans all pipeline settings. Because the concern is concrete and addressable with an additional experimental arm, the existing CONDITIONAL verdict is appropriate rather than REJECT; the paper's protocols are otherwise careful and the classifier-only results provide some independent support for robustness-induced transfer. No change to the reader's verdict is needed, but the stated condition should explicitly include the downstream-classifier variation.","tokens_in":23338,"tokens_out":6046,"duration_ms":62989,"concrete_test":"Re-run the purification experiments (Table 11) with the DDIM surrogate and identical attack settings, but replace the fixed downstream ResNet-50 with (i) an adversarially robust ResNet-50 (e.g., a RobustBench model) and (ii) a different non-robust architecture (e.g., ViT-B or ConvNeXt-B), keeping the same purifiers. If the average TASR across the purifier set collapses to near the robust classifier's white-box ASR in (i), the 80.4% is attributable to the shared non-robust downstream model rather than to purifier-family sensitivity. If TASR remains high in both cases, the purifier-family attribution is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central 80.4% claim (Table 11) is measured on pipelines F(x)=f(g(x)) with the same non-robust ResNet-50 f for every surrogate and target (Eq. 3, §2.1; §5.4). PGDTransfer's gradient flows through f as well as through the DDIM surrogate, so the optimized perturbation is jointly tuned to (a) survive g_s and (b) exploit f's specific non-robust decision boundary. Transfer to F_t=f(g_t) then only requires the perturbation to survive g_t; the same f provides the error signal. The undefended 'No Purifier' target already yields 87.6% TASR, showing the attack's output is a strong adversarial example for f itself. Table 14's weak-surrogate contrast (Mean/Gaussian vs DDIM) shows that not every surrogate produces transferable perturbations, but it does not isolate whether the transferable perturbations succeed because the purifiers share aligned sensitivity or because the shared f is easily fooled after any preprocessing that leaves the perturbation intact. If f were adversarially robust, a perturbation that survives g_t might no longer flip the prediction, and the 'purifier family' result could collapse. Thus the paper's inference from varied g to a property of the g-family is not identified from the shared, non-robust f.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that adversarial robustness optimization creates shared vulnerabilities within defense families: once a representative defense is breached, a simple PGD-style attack transfers to other defenses in the same family without target gradients, queries, or adaptation. It introduces stricter transfer-only evaluation protocols (small-budget untargeted, targeted, robustness-mismatch, clean-correct subset), a deliberately simple attack called PGDTransfer, and Adversarial Sensitivity Maps (AdvSMs) as a visualization and quantification tool. Experiments cover adversarially trained classifiers, purification-based defenses, and LVLMs with robust visual encoders. The headline result is an average transfer attack success rate of 80.4% across filtering-, compression-, and diffusion-based purifiers under epsilon=4/255, with a fixed non-robust ResNet-50 downstream classifier. The paper concludes that defense isolation, not just individual robustness, should be a security objective.","tokens_in":23691,"tokens_out":6122,"duration_ms":65962,"significance":"If the findings hold, the paper makes a practically important point: robustness evaluation that treats each defense in isolation may miss family-level transferable vulnerabilities. The protocol design is a genuine contribution: the clean-correct subset, the small-budget primary protocol, the targeted and architecture-mismatch controls, and the attempt to isolate component-level transfer are all reasonable and go beyond common practice. The AdvSM tool, despite the concerns below, is a useful attempt to measure sensitivity alignment beyond differentiable classifiers. The paper also ships code, which supports reproducibility. However, the central attribution claim—that transfer arises from aligned sensitivity within the purifier family—is not yet established because of a shared non-robust downstream classifier confound. The current evidence is consistent with a weaker but still important conclusion: a simple adaptive attack through one surrogate purifier finds perturbations that survive a range of purifiers and then fool the common non-robust classifier. Distinguishing these interpretations requires additional controls.","major_comments":[{"comment":"The headline purifier-transfer result does not isolate the purifier family as the source of transfer. Every surrogate and target in Table 11 is the composition F(x)=f(g(x)) with the same non-robust ResNet-50 f. PGDTransfer's gradient flows through f, and the 'No Purifier' column already reports 87.6% TASR, so the optimized perturbation is a strong adversarial example for f alone. The weak-surrogate contrast in Table 14 shows that some perturbations produced through f are removed by strong purifiers, but it does not test whether the surviving perturbations succeed because of shared purifier sensitivity or because any purifier that incompletely removes a strong f-adversarial perturbation will fail. A decisive control is to fix the purifier set g and vary the downstream classifier f, e.g., using an adversarially robust ResNet-50. If the 80.4% average collapses, the claim should be restated","section":"§5.4, Eq. (3), Table 11"},{"comment":"The AdvSM similarity values for purifiers are not compared with any null or chance baseline. Since the ternary maps contain a large fraction of zeros and are defined on natural images, the observed 'all purifier pairs have positive similarity' may reflect shared map sparsity or common image statistics rather than robustness-aligned sensitivity. I request a permutation baseline (e.g., randomly permuting pixel labels within each map) or a comparison with a non-robust preprocessing pipeline, together with confidence intervals. Without such a baseline, the AdvSM-based causal story in §4.4 and §5.6 is not quantitatively supported.","section":"§4.3, Eq. (25), Figure 4"},{"comment":"The attack's default hyperparameters (EOT=5, DDIM surrogate with 3 denoising steps) and the choice of DDIM as the surrogate are selected using transfer results on the target purifiers. Tables 21 and 22 report ablations on exactly the targets used in Table 11, and Table 14 compares surrogates by their target TASR. This is a form of target-outcome-based adaptation, even though no target gradients or queries are used. Since the paper's contribution is 'natural transferability' from a deliberately simple attack, the protocol should either use a validation set disjoint from the evaluation targets or explicitly acknowledge that the reported 80.4% is the result of selecting among several feasible surrogate/parameter configurations. This does not eliminate the finding, but it materially weakens the 'no adaptation' claim.","section":"§5.1, Appendix C, Table 14"},{"comment":"All transfer numbers are based on 500 clean-correct images with no confidence intervals or multiple runs. For stochastic purifiers, the binomial standard error at the reported TASR levels is roughly 1.8–2.2 percentage points, so several differences between PGDTransfer and prior adaptive attacks in Table 11 are within about two standard errors (e.g., DiffPure: 63.6 vs 60.0; ContrastDiff: 58.0 vs 54.6). The comparative claim that PGDTransfer 'achieves the highest TASR on every purifier' needs error bars or a significance test. The AdvSM similarity values in Figures 3, 4, and 6 are averages over 100 samples with no variance estimates; without them, the strength of the alignment claims is unclear.","section":"§5.1, Tables 11 and 13"}],"minor_comments":[{"comment":"The paragraph on controlled component-level transfer argues that shared downstream modules alone cannot explain the results because weak surrogates transfer poorly. This conflates 'shared f is not sufficient' with 'shared f is not a confound.' Please rephrase to acknowledge that the shared f can still be a necessary contributor to the observed transfer.","section":"§2.1"},{"comment":"The ternary label assignment is hard to parse: '+1' is assigned 'otherwise', which includes mixed-sign and mixed-magnitude cases. Please spell out the exact condition for '+1' in words and explain why that condition corresponds to an adversarially 'sensitive' location.","section":"§4.3, Eq. (25)"},{"comment":"The six panels in (d) are not individually labeled in the caption or text. Please annotate each panel with the corresponding purifier name so the reader can connect the qualitative claim to the specific defense.","section":"Figure 2"},{"comment":"Reference [49] has a typo: 'Devling' should be 'Delving.'","section":"References"},{"comment":"The claim that weak purifiers leave many sensitive regions while strong purifiers suppress more regions is supported only by visual inspection of Figure 2(d). A quantitative summary, e.g., the fraction of non-zero AdvSM entries per purifier, would make the surrogate-selection principle more concrete.","section":"§5.6"}],"recommendation":"major_revision","confidential_remarks":"The paper is potentially impactful, but the purifier claim currently overreaches relative to the evidence. The shared-downstream-classifier confound is real and central to the 'family' attribution. I would encourage the authors to run the robust-downstream control; if the 80.4% result collapses when f is adversarially robust, the paper should be reframed around pipeline-level shared vulnerability rather than purifier-family sensitivity. The protocol controls are strong enough that the manuscript deserves a revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague — this paper is more interesting than its bland title suggests, and it is mostly honest work. The strict protocols (4/255, clean-correct subset, targeted and robustness-mismatch controls) are a real step up from the usual transfer-attack evaluations. PGDTransfer being deliberately simple and still beating specialized adaptive attacks is a nice result, and the AdvSM visualization, even with its quirks, is a useful way to compare non-differentiable defenses. The contrast between weak surrogates (Mean/Gaussian) and DDIM in Table 14 is the strongest evidence that the effect is not just \"any preprocessing yields transfer.\" Credit where due: they ran baselines under a unified protocol and shipped code.\n\nBut the central claim for purifiers — 80.4% average TASR across the family — is not fully identified. Every pipeline in Table 11 is F(x) = f(g(x)) with the same non-robust ResNet-50 f. The attack is optimized through f as well as through the DDIM surrogate, so the perturbation is already tuned to fool f after preprocessing. The undefended target achieves 87.6%, so the attack is a strong adversarial example for f on its own. Transfer to each target may require only that the perturbation survive g_t; the error signal comes from the shared f. The paper's \"controlled component-level transfer\" defense (Section 2.1) anticipates this, but the weak-surrogate comparison does not close it. If the downstream classifier were adversarially robust, the transfer might collapse — and that would invalidate the \"purifier family\" framing, reducing it to \"this particular non-robust pipeline.\" This is testable, and it needs to be tested.\n\nOther soft spots: AdvSM similarity has no random-baseline comparison, so positive values are hard to interpret. 500 clean-correct samples with no error bars is thin for an 80.4% headline. The DDIM surrogate and EOT/denoising choices were selected after looking at target TASR (Appendix C), which is tuning on the evaluation set. These are addressable in revision.\n\nBottom line: the classifier and VQA results are suggestive and cleaner; the purification result is the paper's reason to exist, and right now it is a promising hypothesis with a confound. The paper deserves a serious referee, but the referee should ask for a downstream-classifier control (e.g., robust ResNet/another architecture) and an AdvSM null model. If the 80.4% survives a robust f, this becomes an important result. If not, the narrative should shrink accordingly.","headline":"A careful, honest study whose headline purification-transfer result is confounded by the fixed non-robust downstream classifier; it deserves review but needs a control experiment.","tokens_in":24154,"tokens_out":3138,"would_cite":true,"duration_ms":32456,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that adversarial robustness optimization aligns defenses' remaining weak spots, so breaching one representative defense can expose the whole family without target-side access.","keywords":["adversarial robustness","adversarial transferability","adversarial purification","adversarial training","defense isolation","PGDTransfer","Adversarial Sensitivity Maps","large vision-language models"],"falsifier":"Re-run the purifier transfer experiment with the same DDIM surrogate and 4/255 budget but replace the shared fixed non-robust downstream classifier with a robust classifier, so surrogate and target pipelines share a robust rather than non-robust final stage. If the 80.4% average transfer collapses, the family-level claim is not established; the exposure would be in the common downstream pipeline, not in the purifier family. A second check: find two purifiers with high AdvSM similarity but zero attack transfer; that would break the proposed alignment-to-transfer link.","tokens_in":23242,"feed_emoji":"🛡️","tokens_out":5868,"duration_ms":49751,"temperature":0.7,"pith_summary":"This paper tries to establish a risk that comes from the very success of adversarial robustness: optimizing different defenses toward the same robust behavior can align the directions in which they remain vulnerable. It claims that within a family—adversarially trained classifiers, purification-based defenses, or large vision-language models with robust visual encoders—an adversarial example built on one suitable surrogate transfers to the others with no target gradients, queries, or adaptation. The strongest evidence is a deliberately simple PGD-style attack, PGDTransfer, which reaches an average 80.4% transfer attack success rate across filtering-, compression-, and diffusion-based purifiers at a small 4/255 perturbation budget. To show this is genuine transfer rather than distortion, the paper introduces stricter transfer-only protocols and Adversarial Sensitivity Maps (AdvSMs), a ternary map of where each defense remains sensitive. If the claim is right, individual robustness numbers overstate security: the family, not the single model, is the meaningful unit of defense isolation.","feed_headline":"One simple attack breaches purifier defense families at 80%","feed_subtitle":"Robustness training aligns defenses' weak spots; a surrogate attack on one purifier reaches the others with no queries.","key_machinery":"The central object is the Adversarial Sensitivity Map (AdvSM), a ternary pixel-wise map that labels every location as positively sensitive, negatively sensitive, or insensitive/purified. For differentiable systems it is computed from the sign and magnitude of input gradients; for stochastic or non-differentiable purifiers it is measured from output responses to random sign perturbations. AdvSM cosine similarity across defenses quantifies how much robustness-optimized systems agree on which image regions remain adversarially usable. The paper uses AdvSMs both as explanatory evidence—aligned maps accompany high transfer—and as a surrogate-selection principle: a surrogate with a compact sensiti","core_discovery":"The paper's central claim is that robustness optimization creates shared adversarial sensitivity within a defense family, and that this shared sensitivity is sufficient for transfer even when the attack is simple. Concretely, PGDTransfer—projected gradient descent with expectation over transformation and a lightweight denoising diffusion surrogate—achieves an average transfer success rate of 80.4% across the eight evaluated purifiers under 4/255, outperforming adaptive attacks designed specifically for diffusion purifiers. The paper attributes this to AdvSM alignment: robust classifiers, robust visual encoders, and diverse purifiers (mean, Gaussian, JPEG, diffusion-based) all show positively","pith_inferences":["Editorial inference: the cleanest way to test the attribution is to vary the shared downstream component. If replacing the fixed non-robust classifier behind every purifier with a robust classifier collapses the 80.4% transfer, then the experiment exposes the shared pipeline rather than the purifier family; the paper's indirect argument—weak surrogates transfer poorly to strong purifiers—would nee","Editorial inference: AdvSMs could serve as a pre-deployment auditing tool: measure the cosine similarity between a candidate defense and known public surrogates before deployment, and treat high alignment as a warning that one breach will propagate. The paper does not spell this practical consequence out.","Editorial inference: the same mechanism should appear wherever robustness optimization converges on shared invariant features, not only in vision; audited audio or tabular classifiers trained adversarially may show similar family-level transfer.","Editorial inference: the surrogate-selection principle suggests a concrete defense design: explicitly diversify sensitivity maps across defense instances—for example, adding an AdvSM decorrelation penalty during training—and verify that transfer-only attack success drops."],"forward_implications":["An attacker with white-box access to a public representative defense can compromise private defenses in the same robustness family without target gradients, queries, or adaptation.","Randomly switching among defense modules no longer provides protection when the candidate modules share AdvSM-aligned sensitivity; one surrogate example can remain effective across all of them.","Current purification defenses are already at risk: a simple PGD-style attack reaches 80.4% average transfer success, so reported individual-robustness numbers overstate the protection a deployed purifier provides.","Currently stronger families, such as robust classifiers and robust visual encoders, show the same alignment pattern and may face the same exposure as attacks improve.","Future defense evaluation should measure vulnerability diversity and transfer-only isolation in addition to standalone robustness."],"fun_headline_variants":["One breach, entire purifier family: 80% transfer","80% transfer: one simple attack crosses purifier defenses","Shared weakness: one breach exposes purifier family at 80%","Purifiers share one weak spot: 80% transfer with PGDTransfer","One attack, 80% transfer across purifier defenses"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the shared, non-robust downstream components—the fixed classifier behind every purifier and the fixed language model behind every VQA system—are not themselves the cause of the measured transfer, so the effect can be attributed to alignment among the varied robustness-optimized components.","fun_headline_variants_meta":{"raw":{"variants":["One breach, entire purifier family: 80% transfer","80% transfer: one simple attack crosses purifier defenses","Shared weakness: one breach exposes purifier family at 80%","Purifiers share one weak spot: 80% transfer with PGDTransfer","One attack, 80% transfer across purifier defenses"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001982,"raw_usage":{"total_tokens":7602,"prompt_tokens":793,"completion_tokens":6809,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":537,"completion_tokens_details":{"reasoning_tokens":6721}},"tokens_in":537,"tokens_out":6809,"duration_ms":43144,"temperature":1.0,"reasoning_tokens":6721,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T17:52:40.786570+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the purifier transfer experiment with the same DDIM surrogate and 4/255 budget but replace the shared fixed non-robust downstream classifier with a robust classifier, so surrogate and target pipelines share a robust rather than non-robust final stage. If the 80.4% average transfer collapses, the family-level claim is not established; the exposure would be in the common downstream pipeline, not in the purifier family. A second check: find two purifiers with high AdvSM similarity but zero attack transfer; that would break the proposed alignment-to-transfer link.","supporting_citations":[],"review_version":1}