{"id":"60cc32e9-1061-41bf-9003-08514cb099a6","arxiv_id":"2608.04680","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A model-agnostic input preprocessing pipeline of random resizing, median filtering, and JPEG compression limits adversarial efficiency-degradation attacks on token-pruning Vision Transformers to within 3.4% of unattacked GFLOPs.","lead":"MOAT is a preprocessing defense that applies random resizing, median filtering, and JPEG compression to images before they reach token-pruning Vision Transformers. It aims to stop adversarial attacks that force these models to keep more tokens and use more computation, restoring efficiency without retraining or modifying the models.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The defense is evaluated only against attacks generated without knowledge of it, while the stated threat model is white-box; adaptive EOT/BPDA attacks are acknowledged but not run, so the central robustness claim is not yet supported.","rationale":"The reader's verdict is CONDITIONAL on the lack of adaptive attack evaluation. My review identifies the same load-bearing weakness, but makes it more concrete: the attack used in evaluation is crafted on the undefended model and simply passed through MOAT, so the reported 7.5%-8.9% ASR and 3.4% GFLOPs bound demonstrate robustness only against a defense-unaware adversary. Section IV.E acknowledges this gap and gives a qualitative argument based on randomness and non-differentiability, but does not test it. This is not an internal inconsistency in the reported numbers; it is a mismatch between the generality of the central claim and the scope of the experiments. I do not see a separate independent flaw that would change the verdict. The paper's contribution is plausible and internally consistent, and the overhead analysis is useful. A conditional acceptance with a required adaptive-attack experiment is the appropriate outcome. I therefore leave the reader's verdict unchanged.","tokens_in":8494,"tokens_out":3093,"duration_ms":36991,"concrete_test":"Run a white-box adaptive attack against the full MOAT pipeline on the same 500 ImageNet validation samples used in Table I: PGD with epsilon=8/255, 500 iterations, and EOT over the random resize distribution (e.g., 50 Monte-Carlo samples per gradient step), with backward pass through median filtering treated as identity and JPEG quantization approximated by a straight-through estimator. Report ASR and GFLOPs for DeiT-Small/ATS with MOAT parameters [0.9,1.1], 3x3 median, q=75. If ASR stays near 7.5% and GFLOPs stay within 3.4% of clean+ATS, the concern is resolved; if ASR rises substantially or GFLOPs degradation exceeds 3.4%, the central claim fails as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that MOAT limits GFLOPs degradation to within 3.4% under adversarial efficiency attacks. But every reported attack result is obtained by crafting a PGD perturbation against the undefended ATS model and then passing the resulting image through MOAT. The adversary in Section III.A is white-box with full knowledge of the victim model and pruning strategy, and Section IV.E explicitly contemplates an adaptive attacker with full knowledge of the defense. For a preprocessing defense, the standard and decisive evaluation is an adaptive attack that optimizes the perturbation through the defense pipeline itself: expectation over transformation (EOT) for the random resizing, and a differentiable surrogate or straight-through estimator for the median filter and JPEG quantization. Without such an attack, the defense's robustness is demonstrated only against a static, defense-unaware adversary. The randomness and non-differentiability arguments in Section IV.E explain why adaptive attacks may be harder, but they are not evidence that the defense withstands them. Therefore, the empirical basis for the headline figure does not yet cover the adversary class in the paper's own threat model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes MOAT, a preprocessing pipeline consisting of random resizing, median filtering, and JPEG compression, intended to defend adaptive token-pruning Vision Transformers against adversarial efficiency-degradation attacks. The defense is model-agnostic in the sense that it operates on the input image and does not alter the model or pruning mechanism. The authors evaluate MOAT against the DeSparsify attack on ATS-based DeiT-Tiny and DeiT-Small models using 500 ImageNet validation images, reporting GFLOPs, accuracy, and attack success rate. They claim that across all evaluated ViT models, MOAT limits GFLOPs degradation under attack to within 3.4% of the unattacked model while introducing negligible overhead. The paper also includes a discussion of adaptive attacks, acknowledging that expectation-over-transformation and gradient approximation would be needed, but such attacks are not implemented.","tokens_in":8678,"tokens_out":3925,"duration_ms":44935,"significance":"If validated, MOAT would be a useful contribution: it is the first preprocessing-based defense specifically for efficiency-degradation attacks on token pruning, it is lightweight and training-free, and the overhead comparison against a diffusion-based defense is informative. The experimental results are internally consistent, and the authors are transparent about the threat model and the need for adaptive evaluation. However, the significance is currently limited by a substantial mismatch between the stated white-box threat model and the non-adaptive attack evaluation, by the small evaluation set (500 images) with no error bars, and by hyperparameters selected post hoc on the same test set. The central robustness claim therefore rests on evidence against a weaker adversary than the one specified in the paper.","major_comments":[{"comment":"The threat model in Section III.A states that the attacker has full knowledge of the victim model and its pruning strategy, and Section IV.E further contemplates an adaptive attacker with full knowledge of the defense. However, every attack evaluation in Section IV.B is generated against the undefended ATS model, with MOAT applied only after the perturbation is crafted. No experiment optimizes the perturbation through the defense pipeline, such as expectation-over-transformation (EOT) for the random resize and a differentiable surrogate (e.g., BPDA or straight-through estimator) for the median filter and JPEG quantization. Consequently, the headline claim that GFLOPs degradation stays within 3.4% of the unattacked model is demonstrated only against a defense-unaware adversary, which is weaker than the adversary specified in the paper's own threat model. This is the primary load-bearing gap, and an adaptive-attack evaluation is needed before the central claim can be accepted.","section":"III.A, IV.B, IV.E"},{"comment":"The defense hyperparameters are selected on the same 500-image evaluation set used to report the final results. Table II compares configurations by clean/adversarial accuracy and ASR, and the 'balanced' configuration is then adopted for Table I. This post hoc selection on the test set can inflate the reported effectiveness and gives no estimate of variability; the small evaluation set makes this concern concrete. Please use a held-out validation split or cross-validation for parameter selection, and report confidence intervals or multiple subsample runs for the headline GFLOPs and ASR figures.","section":"IV.C, Table II"},{"comment":"The evaluation covers only two models (DeiT-Tiny and DeiT-Small) that both use the same ATS pruning mechanism, and only 500 ImageNet validation images. The phrase 'across all evaluated ViT models' in the abstract is technically accurate but the evidence is too narrow to support the model-agnostic generality claim. At minimum, the paper should include a different token-pruning framework (e.g., AdaViT or DynamicViT) and report statistics over multiple subsamples. Additionally, only a single attack family (DeSparsify per-image PGD attack) is considered; the defense's effectiveness against other efficiency-degradation attacks, such as the universal patch attack Slowformer, remains untested.","section":"IV.A, Table I"},{"comment":"The discussion in Section IV.E argues that randomness and non-differentiability make adaptive attacks harder, but the paper stops at argument rather than providing evidence. Non-differentiability of JPEG quantization is not a robustness guarantee: standard practice is to approximate gradients with BPDA or straight-through estimators, and the random resize can be handled with EOT. The authors explicitly acknowledge that EOT would be needed yet do not run it. Please either run these adaptive attacks or substantially weaken the claimed robustness to the white-box adversary in the threat model.","section":"IV.E"}],"minor_comments":[{"comment":"The introduction refers to 'Figure 4 (green box)' and 'Figure 4 (red box)', but the figure showing the efficiency-degradation attack is labeled Figure 1; the figure numbering appears inconsistent and should be corrected.","section":"Introduction, Figure 1"},{"comment":"The abstract uses 'MOdel Agnostic randomized Transformations' while the contributions paragraph uses 'MOdel Agnostic randomized Transformations' with different capitalization than 'Model Agnostic' in the title; please unify the acronym expansion.","section":"Abstract / Contributions"},{"comment":"References [5] and [11] cite the same paper ('An image is worth 16x16 words'); duplicate entries should be merged into a single reference.","section":"References"},{"comment":"There are typos in the text: 'a various optimization' should be 'various optimization' and 'efficiancy' should be 'efficiency'; a careful proofread would improve readability.","section":"II.B"},{"comment":"Table III compares MOAT with a 'DDPM Rectifier' citing DiffPure [20], but DiffPure is a diffusion-based purification/certification method; please clarify what implementation of the 'Rectifier' is used and why it is a representative comparison.","section":"Table III"},{"comment":"In Algorithm 1, the center-crop/pad operation after random resizing does not specify the padding mode or fill value; this detail matters at image boundaries for the subsequent median filter and should be stated.","section":"Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":"This is a promising early exploration of a practical defense for efficiency-degradation attacks, and the authors are honest about the adaptive-attack limitation. However, for a security venue, the gap between the stated white-box threat model and the non-adaptive evaluation is a load-bearing issue. The proposed adaptive-attack experiments and the small-sample/post-hoc-selection concerns are within the manuscript's scope to fix, so I view this as a major-revision rather than a rejection. I would ask the editor to ensure the revised version either contains a genuine adaptive-attack evaluation or restricts the claims to a non-adaptive adversary."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The one thing worth knowing: MOAT is, to my knowledge, the first preprocessing-based defense against efficiency-degradation attacks on token-pruning ViTs. The authors show that a fixed pipeline of random resizing, median filtering, and JPEG compression restores most of the efficiency lost to the DeSparsify attack on ATS, and they do it with almost no inference overhead. The comparison to a diffusion-based defense is stark and legitimate. That is a real, if narrow, contribution. I was also impressed that the paper is honest: it says outright in Section IV.E that adaptive attacks are a concern and gives reasons why they should be hard. That is better than most defense papers.\n\nThe central weakness is exactly what the stress-test note flags, though I would put it slightly less harshly. The reported robustness is against perturbations crafted on the undefended model, not against an adversary that knows about MOAT. The threat model in Section III.A is white-box for the model and pruning strategy; it does not explicitly claim full knowledge of the defense. But the abstract and introduction say the defense \"protects\" against efficiency-degradation attacks, which implies a broader adversary class than the one evaluated. The non-differentiability of JPEG and the randomness of resizing are plausible obstacles, but plausibility is not a result. An EOT attack for the random resize and a straight-through or BPDA surrogate for the median filter and JPEG quantization are the standard next experiments, and the paper does not run them. That is a serious gap, but it is a fixable one, not a conceptual dead end.\n\nOther soft spots: 500 images, no error bars, and the hyperparameters are chosen on the same benchmark used for evaluation. The clean accuracy drop of 6-10 points is not negligible for a defense that is supposed to be efficiency-preserving, though the efficiency itself is preserved. The attack evaluation covers one attack family (DeSparsify, PGD-based single image), not Slowformer or other efficiency attacks. None of these are fatal, but they do mean the empirical picture is thinner than the headline \"within 3.4%\" suggests.\n\nWho is this for? Researchers working on efficiency attacks, edge deployments, or robust inference. As a paper, it is clearly written, the math is simple and correct, and the overhead analysis is useful. It deserves a serious referee. My recommendation: send it to peer review, but with a request for adaptive-attack experiments and ideally a larger evaluation with error bars. If the adaptive attacks break the defense, the conclusion should be revised to a much narrower claim about static adversaries; if MOAT holds up against EOT/BPDA, it becomes a genuinely useful defense.","headline":"A modest but real contribution: a lightweight preprocessing defense against efficiency-degradation attacks on token-pruning ViTs, with clean numbers against the static DeSparsify attack but no adaptive-attack evaluation, so the headline claim is only partially supported.","tokens_in":715,"tokens_out":711,"would_cite":false,"duration_ms":27856,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A preprocessing pipeline of random resizing, median filtering, and JPEG compression, applied to inputs before inference, suppresses adversarial efficiency attacks on token-pruning Vision Transformers and keeps GFLOPs degradation within…","keywords":["Vision Transformers","token pruning","efficiency degradation attacks","preprocessing defense","random resizing","median filtering","JPEG compression","model-agnostic defense"],"falsifier":"Run the same DeSparsify attack on DeiT-Tiny/DeiT-Small with an adaptive variant that computes gradients via expectation over transformation across the random resize and uses a differentiable approximation or straight-through estimator for median filtering and JPEG compression. If the resulting GFLOPs exceeds the unattacked baseline by more than 3.4% (or attack success rate rises substantially above ~9%), the paper's central robustness claim is falsified.","tokens_in":8309,"feed_emoji":"🛡️","tokens_out":7167,"duration_ms":67882,"temperature":0.7,"pith_summary":"This paper claims that a lightweight, model-agnostic preprocessing pipeline can shield token-pruning Vision Transformers from adversarial efficiency-degradation attacks. The pipeline, called MOAT, applies random resizing, median filtering, and JPEG compression to every input image before inference, with no changes to the model or its pruning mechanism. Across the evaluated ViT models (DeiT-Tiny and DeiT-Small with ATS token sampling), it keeps attack-induced GFLOPs growth within 3.4% of the unattacked baseline and cuts attack success rate from roughly 56–60% to under 9%. A careful reader would care because efficiency attacks can silently drain power and latency on edge deployments, and current defenses (token capping, adversarial training) require model modification or retraining.","feed_headline":"Preprocessing blocks ViT efficiency attacks within 3.4% GFLOPs","feed_subtitle":"Lightweight, model-agnostic input transforms restore token pruning cost without retraining or architecture changes.","key_machinery":"The load-bearing mechanism is the ordered pipeline of three input transformations, each aimed at a distinct facet of the adversarial perturbation. Random resizing (scale sampled from $[0.9,1.1]$) shifts pixel coordinates and breaks the alignment between crafted noise and patch embeddings; median filtering with a $3\\times3$ kernel removes localized high-frequency noise while preserving edges; JPEG compression (quality 75) discards DCT high-frequency components and introduces a rounding-based non-differentiable step that obstructs gradient flow. Together they force the token-importance distribution of an adversarially perturbed input to resemble that of the clean image, so the ATS pruning mechanism again removes tokens and computation stays near the unattacked level. The defense's parameters were chosen as a 'balanced' trade-off (as opposed to more aggressive or more accuracy-preserving settings), and the order resize→median→JPEG gave the lowest attack success rate at 7.57%.","core_discovery":"MOAT's central claim is that adversarial efficiency attacks on adaptive ViTs can be neutralized entirely in input space. The attack works by pushing the token-importance distribution $S^{(l)}$ toward uniform, forcing ATS to sample nearly every token and raising inference cost toward the dense ViT. MOAT suppresses this by sequentially random-resizing (scale $s\\sim U(0.9,1.1)$), median-filtering ($3\\times3$ kernel), and JPEG-compressing (quality 75) the input, each step disrupting a different component of the adversarial noise without changing the model. In experiments on DeiT-Tiny and DeiT-Small under the $\\ell_\\infty$-bounded PGD DeSparsify attack ($\\epsilon=8/255$, 500 iterations), GFLOPs savings under attack recover from 12.4% to 28.2% and from 16.9% to 31.4%, respectively, while attack success rate drops to 7.5% and 8.9%, all with the same defense configuration on both models. The defense adds only 0.15–0.57% overhead, in contrast to a diffusion-based defense that multiplies cost by over one hundred times.","pith_inferences":["An obvious next test is an adaptive attacker using expectation over transformation to average gradients through the random resize, combined with a straight-through estimator for JPEG's rounding; the paper leaves this untested, and the 3.4% bound may not survive it.","The 3.4% figure is established on only two ATS-based DeiT variants; whether it holds for other pruning mechanisms (e.g., attention-score based pruning or trained token selectors) is open and can be checked with the same pipeline.","Since the pipeline is image-space only, it may also transfer to efficiency attacks on other input-adaptive systems (early-exit or dynamic-width networks), although the paper does not evaluate that."],"forward_implications":["Deploying MOAT requires no retraining or architecture changes, so it can be layered onto existing efficient ViT systems with minimal integration effort.","The same fixed pipeline transfers across models of different capacity (DeiT-Tiny and DeiT-Small) and keeps adversarial GFLOPs within 3.4% of baseline, supporting the model-agnostic claim.","Overhead of the defense is negligible (0.15–0.57% of baseline GFLOPs), which is crucial for resource-constrained and real-time settings.","The combination of transformations is essential: single transformations yield attack success rates of 15.4%–32.1%, while the full pipeline drops it to 7.5%.","The defense trades off clean accuracy: clean-sample accuracy falls from 83.5% to 76.5% (DeiT-Small) and 79.0% to 67.4% (DeiT-Tiny), a cost that must be weighed against robustness."],"supporting_citations":[{"why":"Supplies the ATS token-pruning framework that is the target; the defense aims to restore its token-sampling behavior under attack.","marker":"[1]"},{"why":"The DeSparsify attack, the exact adversarial efficiency attack used in all experiments to generate perturbed inputs.","marker":"[3]"},{"why":"Slowformer, the other prior efficiency attack; cited to motivate the defense and for comparison of defense landscape (token capping and adversarial training).","marker":"[4]"},{"why":"DDPM-based Rectifier defense used for overhead comparison, establishing that MOAT's 0.15–0.57% overhead is far lower.","marker":"[20]"},{"why":"Prior evidence that aggressive randomization harms clean-sample accuracy; used to justify moderate randomness in MOAT.","marker":"[21]"}],"fun_headline_variants":["Model-agnostic preprocessing thwarts ViT efficiency attacks within 3.4% GFLOPs","Preprocessing alone blocks ViT token-pruning sabotage at under 3.4% GFLOPs","Randomized input transforms stop adversarial token-pruning cost blowup","Input tweaks neutralize ViT efficiency attacks without retraining"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense is assumed to hold against the specific PGD-based single-image attack used in the evaluation (DeSparsify on ATS), and the fixed hyperparameters are assumed to generalize; the paper explicitly does not test adaptive attackers who know the full defense and can use techniques such as expectation over transformation.","fun_headline_variants_meta":{"raw":{"variants":["Model-agnostic preprocessing thwarts ViT efficiency attacks within 3.4% GFLOPs","Preprocessing alone blocks ViT token-pruning sabotage at under 3.4% GFLOPs","Randomized input transforms stop adversarial token-pruning cost blowup","Input tweaks neutralize ViT efficiency attacks without retraining"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000715,"raw_usage":{"total_tokens":3203,"prompt_tokens":919,"completion_tokens":2284,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":535,"completion_tokens_details":{"reasoning_tokens":2196}},"tokens_in":535,"tokens_out":2284,"duration_ms":19917,"temperature":1.0,"reasoning_tokens":2196,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T19:03:35.674029+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same DeSparsify attack on DeiT-Tiny/DeiT-Small with an adaptive variant that computes gradients via expectation over transformation across the random resize and uses a differentiable approximation or straight-through estimator for median filtering and JPEG compression. If the resulting GFLOPs exceeds the unattacked baseline by more than 3.4% (or attack success rate rises substantially above ~9%), the paper's central robustness claim is falsified.","supporting_citations":[{"cited_title":"Adaptive token sampling for efficient vision trans- formers,","cited_arxiv_id":null,"evidence_quote":"Supplies the ATS token-pruning framework that is the target; the defense aims to restore its token-sampling behavior under attack."},{"cited_title":"Desparsify: Adversarial attack against token spar- sification mechanisms,","cited_arxiv_id":null,"evidence_quote":"The DeSparsify attack, the exact adversarial efficiency attack used in all experiments to generate perturbed inputs."},{"cited_title":"Slowformer: Adversarial attack on compute and energy consumption of efficient vision transformers,","cited_arxiv_id":null,"evidence_quote":"Slowformer, the other prior efficiency attack; cited to motivate the defense and for comparison of defense landscape (token capping and adversarial training)."},{"cited_title":"Diffpure: Certifiably robust deep learning via diffusion models against adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"DDPM-based Rectifier defense used for overhead comparison, establishing that MOAT's 0.15–0.57% overhead is far lower."},{"cited_title":"Barrage of random transforms for adversarially robust defense,","cited_arxiv_id":null,"evidence_quote":"Prior evidence that aggressive randomization harms clean-sample accuracy; used to justify moderate randomness in MOAT."}],"review_version":1}