{"id":"7127ea17-9bde-4f4f-a52d-a7bd0fbb889f","arxiv_id":"2608.04441","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Season separates low- and high-frequency gradient components, redirects texture noise to background regions, and projects the branches orthogonally, lifting average transfer success by 6.6 percentage points.","lead":"This paper presents Season, a plug-and-play wrapper that improves how adversarial examples transfer from one image-classification model to another by separating texture and shape signals in the gradient. The method could make black-box security evaluations of real-world machine-learning systems more effective, because attackers often cannot access the target model directly.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Universal-boost claim rests on untested default hyperparameters; Table II's own robustness study shows negative deltas, so the 6.6pp average may be a fit rather than a prediction.","rationale":"The paper proposes a plausible mechanism, and the ablations in Table III provide some internal support that the dual-branch and masking components help. However, the central empirical claim is a universal boost across attacks and targets, and that claim depends on the generalization of three hand-set hyperparameters plus a kernel size. The reader's weakest_assumption identifies the same gap. Table II strengthens the concern: it is presented as a robustness study, yet it contains negative deltas for DI-FGSM under two surrogate/budget settings. Those negative entries are internal evidence that the method does not consistently improve even the baseline attacks it claims to wrap. Without a sensitivity analysis, a held-out parameter-selection protocol, or error bars, the headline 6.6pp average cannot be distinguished from an in-sample fit. This does not force rejection because the average gain may still be real, but it does mean the evidence as shipped supports only a conditional acceptance. The recommended verdict therefore remains CONDITIONAL, matching the reader's assessment.","tokens_in":9449,"tokens_out":5104,"duration_ms":48766,"concrete_test":"Run a sensitivity sweep on a held-out subset: fix the base attacks (MI-FGSM, DI-FGSM, TI-FGSM) and targets (all eight), then grid over rho in {0.05, 0.15, 0.25}, lambda in {0.5, 0.7, 0.9}, sigma in {0.5, 1.0, 2.0}, and kernel sizes {3, 5, 7}, reporting mean TSR and per-cell deltas for each configuration. Additionally, hold out half of the 5,000 images for parameter selection and half for evaluation. If no configuration achieves a positive average delta on the held-out images, or if the default configuration's gain is not near the top of the grid, then the 6.6pp headline is a fit, not a prediction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that Season 'consistently boosts' eight attacks and improves transfer success by 6.6pp on average. The only evidence for this is Table I, run with a single surrogate (ResNet-50), one budget (16/255), and one hand-set configuration (rho=0.15, lambda=0.7, sigma=1.0, kernel size 5, Sec. IV-A). No sensitivity analysis is reported, so nothing rules out that these defaults were selected using the same evaluation set as Table I. More importantly, the paper's own robustness study, Table II, already contradicts 'consistently': with a DN-121 surrogate at 16/255, DI-FGSM drops from 78.4 to 78.1 (-0.3pp), and with GoogLeNet at 16/255 it drops from 71.1 to 70.5 (-0.6pp). These are not external edge cases; they appear in the paper's robustness section. If the default parameters are not robust across surrogates and budgets, then the +6.6pp average is an artifact of the chosen configuration rather than a property of the method, and the advertised universal-wrapper claim is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Season, a training-free plug-and-play wrapper for transfer-based L-infinity adversarial attacks. Season takes the surrogate gradient produced by a base attack, splits it by a Gaussian low-pass filter into low- and high-frequency branches, multiplies the high-frequency branch by a precomputed low-saliency mask (bottom 15% saliency percentile), maintains separate momentum buffers and accumulated perturbations for the two branches, projects the high-frequency perturbation onto the orthogonal complement of the low-frequency perturbation, and then clips and rescales the combined perturbation to respect the epsilon-ball. Experiments are reported on ImageNet with a ResNet-50 surrogate, eight base attacks, and eight CNN/ViT/MLP target models under a unified TPAMI protocol; the main table reports an average TSR gain of 6.6 percentage points. A robustness study across five CNN surrogates and two L-infinity budgets (Table II) and a component-wise ablation on 1,024 images (Table III) are also provided.","tokens_in":9742,"tokens_out":7066,"duration_ms":60522,"significance":"If the reported average gains are stable, Season would be a useful contribution: it is simple, adds small overhead, requires no training, and is compatible with a range of existing gradient-stabilization and input-enhancement attacks, with clear gains on ViT and MLP targets. The paper's strengths are the unified evaluation protocol, the breadth of target architectures, the clean ablation, and the fact that the gains are measured against external baselines. However, the universal-boost claim is currently under-supported: the paper provides no code, no error bars, no sensitivity analysis of the hand-set hyperparameters, and Table II itself contains negative deltas. These issues are addressable in a revision.","major_comments":[{"comment":"The paper's central claim that Season 'consistently boosts' eight attacks is not supported by the paper's own robustness study. With the default configuration (rho=0.15, lambda=0.7, sigma=1.0, kernel size 5), Table II reports negative deltas for DI-FGSM at 16/255 when the surrogate is DN-121 (78.4 to 78.1, -0.3pp) and GoogLeNet (71.1 to 70.5, -0.6pp). Because these are the paper's own results and no sensitivity analysis over rho, lambda, sigma, or kernel size is provided, it remains possible that the average +6.6pp gain in Table I is tied to the hand-set configuration rather than to the method. Please add a sensitivity analysis over reasonable ranges of these hyperparameters and clarify whether the default values were selected before or after inspection of the evaluation set.","section":"Section IV-A and Table II"},{"comment":"The geometric core of the method is the orthogonality constraint, but after taking signed updates (sign(m_L), sign(m_H)), clipping, and shared rescaling, the projected high-frequency perturbation no longer satisfies ⟨δ_H, δ_L⟩=0. The paper acknowledges that orthogonality is only 'approximately preserved,' but it never quantifies the approximation. Please report the empirical distribution of the cosine similarity between δ_L and δ_H (before and after the clipping/rebudgeting step) on a sample of images, or provide an argument that the residual coupling is negligible. Without this, the claimed mechanism is not verifiable from the paper's data.","section":"Section III-C, Eqs. (9)-(12)"},{"comment":"No error bars, confidence intervals, or repeated runs are reported for any TSR number. The differences in Table II are as small as 0.2-0.3pp on a fixed 1,024-image subset, which is within the range of sampling noise; the claim that Season is a 'consistent' booster should be supported by variance estimates or a matched-pair test, or the claim should be weakened to an average improvement.","section":"Sections IV-A and IV-B"}],"minor_comments":[{"comment":"In the Season+VT row, the entries '55.84', '67.27', and '61.81' are concatenated as '55.8467.2761.81'; please fix the formatting.","section":"Table I"},{"comment":"Table I uses 5,000 images, while Table II and Table III use a fixed 1,024-image subset; the relationship between these subsets should be explicitly stated, and the difference in subset sizes should be acknowledged when comparing numbers across tables.","section":"Section IV-A"},{"comment":"With the stated default lambda=0.7, high-saliency pixels receive weight 0.7 and low-saliency pixels receive weight 1.0, so the mask attenuates high-saliency updates by only 30%; the text's phrase 'redirects high-frequency perturbations to background regions' overstates the effect. Please clarify whether a stronger attenuation was considered.","section":"Eq. (5)"},{"comment":"The precomputed low-saliency mask is computed on the clean image and kept fixed, but for base attacks that use random input transformations (DIM, Admix, VT), the gradient is computed with respect to a transformed input; the paper should clarify how the fixed spatial mask is aligned with the transformed gradient, since the stated motivation of avoiding misalignment is not self-evident.","section":"Section III-B"}],"recommendation":"major_revision","confidential_remarks":"The paper is within scope and the core idea is interesting, but the authors' own robustness table undercuts the 'consistently boosts' claim. I would encourage the editor to request sensitivity analysis, error bars, and a code release as part of the revision; the absence of code is a reproducibility concern for an empirical transferability paper. The author-overlapping citation [18] is peripheral and does not appear to drive the main claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: Season is a genuinely new wrapper that decomposes the gradient into low- and high-frequency branches, pushes high-frequency energy toward low-saliency background using a fixed mask, and projects the high-frequency perturbation orthogonal to the structural direction. It wraps eight transfer attacks and reports an average +6.6pp gain under the unified TPAMI protocol. The idea is clear, the ablation actually tests each component, and the gain is plausible.\n\nWhat it does well: the mechanism is well-motivated, the ablation isolates dual-frequency decomposition, mask, and orthogonality, and the wrapper design means it can be bolted onto existing attacks without changing their cores. Table I results are broadly consistent across many targets and the unified protocol makes comparison easier. The self-citation to FastJSMA is peripheral, so no circularity concern.\n\nSoft spots: the universal-boost claim is not supported. The paper's own Table II shows negative deltas: DI-FGSM with DN-121 and GoogLeNet surrogates at 16/255 gives -0.3 and -0.6 pp. Those are in-paper cases, not external edge cases. That contradicts \"consistently boosts.\" Also, the defaults rho=0.15, lambda=0.7, sigma=1.0, kernel size 5 are stated without sensitivity analysis. Could be tuned on the evaluation set. No code, no error bars, no per-case variance. The orthogonality projection is approximate and the masking is static; that's acceptable, but the geometric interpretation needs more evidence than the current ablation provides. The spectral-bias ratio (1.75 vs 0.88) is nice descriptive support, but it is not shown to be the causal mechanism behind the gains.\n\nIn sum: the central idea is worth publishing, the average gain likely real, but the paper overclaims. A serious referee should ask for code, sensitivity analysis over rho/lambda/sigma and budgets, and either confidence intervals or a softening of \"consistently.\" I would accept for peer review with that expectation.","headline":"Season's frequency-decomposition wrapper is a credible incremental advance, but the 'consistently boosts' claim is contradicted by its own robustness table and untested defaults.","tokens_in":10214,"tokens_out":1407,"would_cite":false,"duration_ms":13619,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Season, a training-free wrapper, improves transfer success of eight adversarial attacks by 6.6 percentage points on average and up to 16.0 points across CNN, ViT, and MLP targets.","keywords":["adversarial attacks","transferability","spectral decomposition","orthogonal projection","Vision Transformers","low-saliency mask","L-infinity perturbation","black-box attack"],"falsifier":"Re-run the main ImageNet evaluation after replacing the low-saliency mask with a random mask of the same 15% density, keeping all other Season components fixed; if the average transfer-success gain over the eight baselines does not drop by several points, then the saliency guidance is not what carries the claimed boost, and the 'background texture' explanation is wrong.","tokens_in":9244,"feed_emoji":"🎯","tokens_out":9094,"duration_ms":67712,"temperature":0.7,"pith_summary":"Season is a training-free wrapper that aims to fix a specific failure mode of transfer-based adversarial attacks: a CNN surrogate's gradient is dominated by local texture, so attacks tuned on it corrupt the global shape cues that Vision Transformers rely on. The paper claims that splitting each update into a low-frequency structural stream and a high-frequency textural stream, steering the textural stream toward low-saliency background pixels, and forcing the two streams orthogonal in perturbation space lets a single attack transfer much better to heterogeneous targets. On ImageNet, Season adds 6.6 percentage points on average and up to 16.0 points to eight existing attacks across eight CNN, ViT, and MLP target models, with no retraining and only a small per-image overhead. If this holds, it gives black-box attackers a cheap universal upgrade and sharpens explanations of why cross-architecture transfer fails.","feed_headline":"Split gradients boost adversarial attacks by up to 16 points","feed_subtitle":"A wrapper separates shape and texture updates, making black-box attacks transfer across CNN, ViT, and MLP targets.","key_machinery":"The carrying mechanism is a spectral–spatial–geometric pipeline applied to each raw surrogate gradient. (1) Dual-frequency decomposition: a Gaussian convolution $K_\\sigma$ splits $g_t$ into low-frequency structure $g_t^L$ and high-frequency texture $g_t^H$; (2) low-saliency guidance: a one-time saliency map from a clean-image backward pass selects the bottom-15% least salient pixels, and the static weight $W = \\lambda 1 + (1-\\lambda)M$ with $\\lambda=0.7$ attenuates high-frequency updates on foreground objects while letting them accumulate in backgrounds; (3) orthogonal projection: the accumulated high-frequency perturbation is projected to the null space of the structural perturbation, and the combined perturbation is clipped and rescaled to stay in the $\\ell_\\infty$ ball. The paper treats the low-frequency branch as the cross-architecture \"anchor\" and uses the orthogonal constraint to prevent textural noise from corrupting it.","core_discovery":"The central claim is that the cross-architecture transfer gap is caused by coupled gradients: standard attacks accumulate one momentum stream that mixes texture-dominated high-frequency signals with shape-dominated low-frequency signals, and the texture bias of CNN surrogates overwhelms the structural signal. Season decouples the gradient $g_t$ into a low-frequency branch $g_t^L = K_\\sigma * g_t$ and a high-frequency residual $g_t^H = g_t - g_t^L$, re-weights the high-frequency branch by a static mask $W = \\lambda 1 + (1-\\lambda)M$ that keeps only the bottom-15% low-saliency pixels, and projects the accumulated high-frequency perturbation onto the orthogonal complement of the structural perturbation via $\\hat{\\delta}_t^H = \\delta_t^H - \\frac{\\langle\\delta_t^H,\\delta_t^L\\rangle}{\\|\\delta_t^L\\|^2+\\xi}\\delta_t^L$. With these two branches maintained as separate momenta, Season replaces only the update rule of a base attack, leaving its transformation schedule and hyperparameters untouched. The paper reports that this boosts average transfer success rate by 6.6 percentage points (up to 16.0) across eight attacks and eight unseen CNN, ViT, and MLP targets, with the largest single gain on TI-FGSM (+15.5 points), and that the gains persist across five CNN surrogates and two $\\ell_\\infty$ budgets, albeit with small negative deltas in two of the sixteen robustness configurations.","pith_inferences":["A testable extension: the same spectral split and orthogonal constraint could be applied to targeted attacks, where the structural anchor may need to be the target-class gradient rather than the source-class one.","If the spectral-bias story is the true cause, then the optimal saliency fraction $\\rho$ and suppression $\\lambda$ should vary with the surrogate's measured high/low frequency ratio (1.75 for ResNet-50 vs 0.88 for ViT-B/16); Season's fixed defaults predict that a ViT surrogate needs less masking and weaker suppression, which the paper does not test.","Because the projection is applied in perturbation space on accumulated updates rather than per-step gradients, the method implicitly assumes that $L^2$-orthogonality of cumulative updates preserves the structure; a cheaper version projecting per-step momenta might behave differently."],"forward_implications":["If Season's boost is real, any existing gradient-stabilization or input-enhancement attack can be upgraded without retraining and without changing its transformations, so the transfer attack state of the art moves up uniformly.","The largest gain on TI-FGSM suggests that smoothing-based attacks are not losing texture information because smoothing is harmful, but because the smoothed gradient still mixes frequencies; this predicts that other smoothing methods can recover the same high-frequency capability when paired with decoupling.","Since the mask is computed once on the clean image, the added cost is one backward pass plus a Gaussian filter and a projection per iteration, so the wrapper is practical at ImageNet scale.","The robustness table implies the gain depends on surrogate choice and budget: two of sixteen configurations lose about 0.3–0.6 points, so the universal-boost claim is bounded rather than absolute."],"supporting_citations":[{"why":"Supplies MI-FGSM, the first baseline whose momentum update Season wraps and refines.","marker":"[3]"},{"why":"Supplies DIM, the input-diversity baseline; Season preserves its random resizing and padding.","marker":"[4]"},{"why":"Supplies the unified evaluation protocol and the eight CNN/ViT/MLP target models.","marker":"[5]"},{"why":"Establishes that ImageNet-trained CNNs are texture-biased, the premise for the high-frequency branch.","marker":"[6]"},{"why":"Introduces ViT-B/16 and motivates the claim that self-attention models rely on global shapes.","marker":"[7]"},{"why":"Supplies NI-FGSM and SI-FGSM baselines; Season follows their look-ahead and scale-averaging gradients.","marker":"[9]"},{"why":"Supplies PI-FGSM baseline, whose patch-wise gradient amplification Season feeds into dual-branch refinement.","marker":"[10]"},{"why":"Supplies Variance Tuning (VT) baseline; Season+VT reports the best average transfer success rate.","marker":"[11]"},{"why":"Supplies TI-FGSM baseline; smoothing suppresses high frequencies, the setting where Season shows its largest gain.","marker":"[12]"},{"why":"Supplies Admix baseline; input mixing is combined with Season's spectral refinement.","marker":"[13]"}],"fun_headline_variants":["Spectrum-split gradients boost black-box attack transfer by 6.6 pts","Orthogonal gradient refinement lifts adversarial transfer up to 16 points","Season: shape-texture gradient split boosts black-box attack transfer","Training-free wrapper separates gradients, gains 16 points on black-box attacks","Low-freq/high-freq gradient refinement boosts adversarial transfer by 6.6 pts"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that the hand-set default hyperparameters (saliency percentile 0.15, suppression 0.7, Gaussian scale 1.0, kernel size 5) transfer across attacks, targets, and perturbation budgets, since no sensitivity analysis is reported and two configurations in the robustness study show small negative gains.","fun_headline_variants_meta":{"raw":{"variants":["Spectrum-split gradients boost black-box attack transfer by 6.6 pts","Orthogonal gradient refinement lifts adversarial transfer up to 16 points","Season: shape-texture gradient split boosts black-box attack transfer","Training-free wrapper separates gradients, gains 16 points on black-box attacks","Low-freq/high-freq gradient refinement boosts adversarial transfer by 6.6 pts"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000596,"raw_usage":{"total_tokens":2837,"prompt_tokens":1039,"completion_tokens":1798,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":655,"completion_tokens_details":{"reasoning_tokens":1700}},"tokens_in":655,"tokens_out":1798,"duration_ms":11038,"temperature":1.0,"reasoning_tokens":1700,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:39:46.526926+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the main ImageNet evaluation after replacing the low-saliency mask with a random mask of the same 15% density, keeping all other Season components fixed; if the average transfer-success gain over the eight baselines does not drop by several points, then the saliency guidance is not what carries the claimed boost, and the 'background texture' explanation is wrong.","supporting_citations":[{"cited_title":"Boosting adversarial attacks with momentum,","cited_arxiv_id":null,"evidence_quote":"Supplies MI-FGSM, the first baseline whose momentum update Season wraps and refines."},{"cited_title":"Improving transferability of adversarial examples with input diversity,","cited_arxiv_id":null,"evidence_quote":"Supplies DIM, the input-diversity baseline; Season preserves its random resizing and padding."},{"cited_title":"Re- visiting transferable adversarial images: Systemization, evaluation, and new insights,","cited_arxiv_id":null,"evidence_quote":"Supplies the unified evaluation protocol and the eight CNN/ViT/MLP target models."},{"cited_title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness,","cited_arxiv_id":null,"evidence_quote":"Establishes that ImageNet-trained CNNs are texture-biased, the premise for the high-frequency branch."},{"cited_title":"Nesterov accelerated gradient and scale invariance for adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies NI-FGSM and SI-FGSM baselines; Season follows their look-ahead and scale-averaging gradients."},{"cited_title":"Patch-wise attack for fooling deep neural network,","cited_arxiv_id":null,"evidence_quote":"Supplies PI-FGSM baseline, whose patch-wise gradient amplification Season feeds into dual-branch refinement."},{"cited_title":"Enhancing the transferability of adversarial attacks through variance tuning,","cited_arxiv_id":null,"evidence_quote":"Supplies Variance Tuning (VT) baseline; Season+VT reports the best average transfer success rate."},{"cited_title":"Evading defenses to transferable adversarial examples by translation-invariant attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies TI-FGSM baseline; smoothing suppresses high frequencies, the setting where Season shows its largest gain."},{"cited_title":"Admix: Enhancing the transferability of adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies Admix baseline; input mixing is combined with Season's spectral refinement."}],"review_version":2}