{"id":"fe0c2a11-bb95-4e61-a085-e5ba9de8c8d1","arxiv_id":"2608.08734","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"IDATA combines an EDICT-style invertible diffusion path with wavelet low-frequency latent constraints to generate unrestricted transferable adversarial examples with reduced GPU memory.","lead":"This paper presents IDATA, an adversarial attack method that uses an invertible diffusion process and low-frequency latent perturbations to craft transferable, visually subtle adversarial images for black-box models. A generalist reader might care because it attacks a known memory bottleneck in diffusion-based attacks while claiming better cross-model transferability.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 4's ablation contradicts the abstract: LFCM lowers AVG (67.1→64.4 without IDM, 67.3→65.0 with IDM), so the claimed transferability benefit of LFCM is not supported by the paper's own data.","rationale":"The reader's conditional verdict is reasonable, but I would put the sharpest concern on the LFCM ablation rather than on exact invertibility. The O(1)-memory claim rests on invertibility of the reverse chain, which is algebraically plausible (Eq. 5-6 are the inverse of Eq. 1-2 for a fixed epsilon_theta) and should be validated with a memory-vs-depth curve, but the paper's own Table 4 already provides a direct, controlled test of the transferability benefit, and the result is negative. This is stronger than a missing reconstruction-error report: it is an internal contradiction of the abstract's central claim. The exact-invertibility issue remains a secondary request: report a clean-image inversion error and a peak-memory-vs-T sweep. Neither observation implies fraud; they are addressable with code and small experiments. Keeping the paper CONDITIONAL is appropriate until the LFCM claim is corrected or re-validated.","tokens_in":19691,"tokens_out":13558,"duration_ms":146338,"concrete_test":"Run the four ablation rows of Table 4 with the released code on the same ImageNet-Compatible subset, identical hyperparameters, and at least three seeds; report mean±std AVG and per-target ASR. The decisive comparison is AVG(IDM-only) vs AVG(IDM+LFCM) under otherwise identical settings. If LFCM again reduces AVG, the abstract's transferability claim must be revised and the paper should present LFCM as an imperceptibility/regularization module only. If the no-module base again outperforms the full method, the causal story of IDATA's reported SOTA transferability requires re-benchmarking.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Table 4 is the paper's own controlled comparison. The no-IDM/no-LFCM pipeline attains AVG 67.1; adding LFCM to it drops AVG to 64.4. With IDM present, AVG is 67.3 without LFCM and 65.0 with LFCM. So LFCM consistently reduces attack success by about 2-3 points while improving LPIPS (0.162→0.143 without IDM; 0.159→0.138 with IDM). This directly contradicts the abstract's claim that LFCM 'restricts perturbations to ... low-frequency subspaces, thereby improving transferability,' and it also makes the full IDATA (65.0) worse in transferability than its own base pipeline (67.1), which itself already exceeds the reported DiffAttack AVG in Table 1. The headline contribution 'LFCM improves transferability' is therefore not just unverified but internally contradicted. At minimum, the authors must either correct the claim (positioning LFCM as a pure imperceptibility regularizer) or show that the Table 4 AVG numbers are computed under a different protocol than Table 1. This is a load-bearing internal-consistency issue, not a disagreement with external consensus.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes IDATA, a diffusion-based unrestricted adversarial transfer attack combining an Invertible Diffusion Module (IDM) and a Low-Frequency Constraint Module (LFCM). IDM reformulates forward diffusion and reverse denoising as coupled invertible transformations, claiming constant-memory backpropagation by reconstructing intermediate states on demand. LFCM applies a Haar DWT to intermediate latents and injects the adversarial perturbation only into the low-frequency components, which the authors argue improves transferability and imperceptibility. The method is evaluated on an ImageNet-compatible benchmark, CUB-200-2011, and Stanford Cars against CNNs, Transformers, MLPs, and defended models, reporting state-of-the-art attack success rates, lower LPIPS/FID, and reduced GPU memory compared with diffusion-based baselines.","tokens_in":19926,"tokens_out":8642,"duration_ms":90885,"significance":"If the central claims hold, IDATA would be a meaningful step for diffusion-based attacks: an O(1)-memory trajectory optimization would enable substantially deeper adversarial optimization than existing methods, and the empirical gains in imperceptibility are consistent across several tables. The paper includes code, compares against external baselines, and provides ablations. However, two load-bearing issues currently undermine the claims: the ablation in Table 4 contradicts the abstract's assertion that LFCM improves transferability, and the stated use of different classifier-free guidance scales during inversion and reverse denoising breaks the exact invertibility on which the O(1)-memory and reconstruction arguments depend. These are internal consistency problems, not disagreements with external consensus, and they must be resolved before the main contributions can be accepted.","major_comments":[{"comment":"The ablation in Table 4 directly contradicts the claim that LFCM improves transferability. Without IDM, adding LFCM reduces AVG from 67.1 to 64.4; with IDM, adding LFCM reduces AVG from 67.3 to 65.0. In both rows LPIPS improves (0.162 to 0.143 and 0.159 to 0.138), so LFCM behaves as an imperceptibility regularizer, not a transferability enhancer. Yet the abstract states that LFCM restricts perturbations to low-frequency subspaces \"thereby improving transferability,\" and Sec. 4.2 says the design \"improves cross-model transferability.\" This is a load-bearing internal inconsistency. The authors must either reposition LFCM as a pure imperceptibility/quality module and revise the abstract accordingly, or provide a controlled comparison under the same protocol as Table 1 that shows a transferability benefit. As written, the full IDATA (65.0) is worse in transferability than its own base pipeline without LFCM (67.1).","section":"Abstract, Sec. 4.2, Table 4"},{"comment":"The O(1)-memory claim relies on exact algebraic invertibility between the forward IDM equations (1)-(2) and the reverse equations (5)-(6). However, Sec. 5.1 states \"The guidance scale is 0 during inversion and 1 during reverse denoising.\" If epsilon_theta is evaluated with different classifier-free guidance scales in the forward and reverse passes, then the reverse transformation is not the inverse of the forward transformation, so reconstructing z_t from z_{t-1} via Eq. (1)-(2) will not recover the actual intermediate state used in the reverse pass. This breaks the on-demand reconstruction procedure that is the basis of the constant-memory backpropagation claim, and it also means gradients are computed through a trajectory that is not the one actually optimized. The paper reports no clean-image reconstruction error for the forward-then-reverse IDM chain, so the exactness assumption is unverified. Please either use the same guidance scale in both directions, provide a reconstruction-error measurement (e.g., max/mean absolute error in latent or pixel space) for the forward IDM followed by IDM^{-1}, and explain how exact inverses are maintained under CFG, or revise the memory-efficiency claim accordingly.","section":"Sec. 4.1 and Sec. 5.1 (Implementation Details)"},{"comment":"Several key hyperparameters—perturbation timestep tau, step size eta, perceptual weight lambda, mixing weight p, and guidance scale g—are selected using the same evaluation benchmarks and surrogate models on which the final results are reported (Fig. 1 and Fig. 6). No held-out validation split is used. In addition, the paper reports no error bars or multiple-seed variance for any table. Given that the margins in Table 1 are often only 1-3 percentage points (e.g., IDATA 62.7 vs. DiffAttack 60.9 for Res-50), the SOTA claim could be an artifact of tuning on the test set. Please report results over at least 3 seeds with standard deviations and, if possible, tune hyperparameters on a separate validation split or demonstrate that the chosen values are not overfit to the evaluation benchmark.","section":"Sec. 5.1, Sec. 5.3, Fig. 6"}],"minor_comments":[{"comment":"The Clean row contains an apparent typo: \"3 6.3\" should likely be \"3.6\" or \"36.3\"; please correct the formatting.","section":"Table 1"},{"comment":"In the Stanford Cars DiffAttack row, \"16.20.095\" is missing a space or separator between the FID and LPIPS values; please fix the typesetting.","section":"Table 3"},{"comment":"The AVG column in Table 4 is not defined: it is unclear which surrogate model, target set, and evaluation protocol produce these numbers, making it difficult to reconcile with Table 1. Please specify the protocol (e.g., Mix-B surrogate, ImageNet-compatible dataset, same as Table 1).","section":"Table 4"},{"comment":"The text says \"we enforce a strict perceptual budget LPIPS <= 0.14\" for the tau ablation, but Fig. 1 appears to show some IDATA points with LPIPS values above 0.14 (e.g., 0.17). Please clarify whether the budget is enforced during optimization or only used as a reporting filter.","section":"Sec. 5.3 (Perturbation Timestep)"},{"comment":"The paragraph says IDM is \"fundamentally redesigned for adversarial optimization rather than faithful reconstruction,\" yet the O(1)-memory argument depends on faithful reconstruction of intermediate states. Please clarify how these two statements are reconciled.","section":"Sec. 4.1 (Difference from EDICT)"}],"recommendation":"major_revision","confidential_remarks":"The LFCM ablation contradiction is a decisive internal-consistency issue: the paper's headline claim that LFCM improves transferability is contradicted by its own controlled comparison. The guidance-scale mismatch is also serious because it undermines the exact-invertibility argument that is the core novelty of IDM. These are fixable in principle—reposition LFCM as an imperceptibility module and re-run or re-report the invertibility analysis with consistent guidance—but if the authors cannot provide reconstruction-error evidence, the memory-efficiency claim should be withdrawn. The paper is otherwise well positioned in the literature and the empirical comparisons are extensive."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: IDATA is a well-engineered attack that borrows EDICT's invertible diffusion for memory-efficient trajectory optimization and adds a DWT low-frequency constraint. The memory result is real and useful. But the paper's headline claim that the low-frequency module improves transferability is contradicted by its own ablation, and the exact-invertibility story has a hole. Worth refereeing, but it needs major revision.\n\nWhat's new: the combination is new, and the O(1)-memory backprop for diffusion attacks is a practical contribution. The experiments are broad—multiple surrogates, defenses, datasets—and the code is public. Credit where due: the memory scaling plot and the defense results are genuinely informative.\n\nSoft spots, in order of severity. First, Table 4 kills the LFCM transferability claim. Adding LFCM drops AVG from 67.1 to 64.4 without IDM, and from 67.3 to 65.0 with IDM, while improving LPIPS. The abstract says LFCM 'improves transferability.' That's not supported. The ablation also doesn't say which surrogate/protocol is used; the numbers don't match Table 1, so the reader can't tell what's being averaged. At minimum the claim must be corrected to 'improves imperceptibility at a small transferability cost,' or the protocol for Table 4 disclosed.\n\nSecond, the exact-invertibility assumption is not verified. No clean-image reconstruction error is reported for the forward-reverse IDM chain. More concerning, the implementation uses CFG scale 0 during inversion and 1 during reverse denoising. If so, the forward and reverse noise estimators differ, and the coupled transformations in Eq. (5)-(6) are not exact inverses. The O(1)-memory claim depends on exact invertibility, so this needs a direct test.\n\nThird, minor: no error bars or seeds, and hyperparameters are tuned on the same benchmarks. That limits confidence but is common in this literature.\n\nBottom line: the method is plausible and the memory trick is valuable, but the paper overclaims on LFCM and hasn't demonstrated invertibility. I'd send it to review—the core idea deserves scrutiny—but I'd expect major revision and a corrected narrative.","headline":"Useful memory trick for diffusion attacks, but the LFCM ablation contradicts the abstract and the invertibility claim needs verification.","tokens_in":20473,"tokens_out":4328,"would_cite":false,"duration_ms":40491,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"IDATA: memory-efficient invertible diffusion attacks achieve deeper trajectories at constant memory and better black-box transferability.","keywords":["adversarial attack","adversarial transferability","invertible diffusion","constant-memory backpropagation","low-frequency perturbation","discrete wavelet transform","black-box robustness","unrestricted adversarial example"],"falsifier":"Run a clean image through the forward IDM to step $\\tau$ and then through the reverse IDM back to $t=0$, decode, and measure LPIPS/PSNR against the original; additionally, measure peak GPU memory at increasing diffusion depths (e.g., 10, 20, 50 steps) to check whether memory actually stays constant.","tokens_in":19465,"feed_emoji":"🎯","tokens_out":4993,"duration_ms":47218,"temperature":0.7,"pith_summary":"The paper tries to establish that diffusion-based unrestricted adversarial transfer attacks can escape two bottlenecks at once: the memory cost of backpropagating through many denoising steps, and the tendency of full-latent perturbations to overfit high-frequency, surrogate-specific details. By making the denoising trajectory exactly invertible, IDATA backpropagates through arbitrarily deep trajectories at constant memory, and by restricting perturbations to low-frequency wavelet components it improves cross-model transferability while keeping images visually close to the originals. The paper reports consistent gains over prior diffusion-based attacks across CNN, transformer, and MLP classifiers, under purification defenses, and on fine-grained datasets. A sympathetic reader would care because it turns a scalability limitation into a practical knob: deeper attack optimization no longer demands proportionally more GPU memory.","feed_headline":"Invertible diffusion delivers deeper, cheaper adversarial attacks","feed_subtitle":"The same GPU fits deeper diffusion steps, and black-box success rises across CNNs, transformers, and MLPs.","key_machinery":"The Invertible Diffusion Module (IDM) duplicates the clean image into a primary and an auxiliary latent branch and applies two coupled affine transformations per step: a feature mixing that blends the branches with parameter $p$, followed by scheduled noise addition using coefficients $a_t, b_t$ and the shared noise estimator $\\epsilon_\\theta$. Because each transformation is sequentially parameterized, the reverse process recovers all intermediate states in closed form from the final latent pair, so gradients flow through the entire trajectory without storing activations. The Low-Frequency Constraint Module (LFCM) concatenates the two branch latents, applies a Haar Discrete Wavelet Transform, adds the learnable perturbation only to the low-frequency approximation $\\mathbf{Y}_L$, and reconstructs the latent via the inverse wavelet transform before resuming denoising.","core_discovery":"IDATA's central claim is that an adversarial latent perturbation can be optimized along a deep diffusion trajectory with O(1) activation memory by using an invertible diffusion module whose forward and reverse steps are exact algebraic inverses, and that constraining the perturbation to the low-frequency subspace of intermediate latents (via a discrete wavelet transform) yields superior transferability and imperceptibility compared with full-latent perturbation. The reported ablation shows peak GPU memory dropping from 37.9 GB to 13.1 GB when the invertible module is enabled, while average attack success stays level, and adding the low-frequency constraint improves LPIPS from 0.162 to 0.143 in the same setting. Across normally trained models, defended models, and two fine-grained datasets, IDATA reports the best or near-best average attack success rate among diffusion-based baselines.","pith_inferences":["If exact invertibility holds to numerical precision, the same on-demand reconstruction trick could apply to other trajectory-based latent optimizations—classifier guidance, style transfer, or inverse problems—where memory currently limits depth.","The frequency decomposition result suggests that intermediate diffusion latents have timestep-dependent frequency semantics, and that steering perturbations toward low-frequency components may be a general recipe for transferability, testable by ablating frequency bands at different timesteps.","A reader cannot yet verify the exact-invertibility assumption because the paper does not report a clean-image reconstruction error for the forward-and-reverse IDM chain; that single number would directly test whether the reconstructed states used in backpropagation are faithful."],"forward_implications":["Deep trajectory optimization becomes practical: the reported ablation shows peak GPU memory falling from 37.9 GB to 13.1 GB when IDM is enabled, with no loss in attack success.","Restricting perturbations to low-frequency latent components is reported to improve both visual imperceptibility (LPIPS 0.162 to 0.143 in the ablation) and transferability compared with full-latent perturbation.","IDATA reports the highest average attack success rate on normally trained models across CNN, transformer, and MLP surrogates, and the smallest average success-rate drop under purification defenses such as DiffPure.","On CUB-200-2011 and Stanford Cars, IDATA reports the best or near-best transferability across three surrogate settings while keeping LPIPS and FID competitive with or better than diffusion-based baselines."],"supporting_citations":[{"why":"Supplies the coupled affine invertible transformation design that IDM adapts for constant-memory backpropagation.","marker":"[58]"},{"why":"The primary diffusion-based attack baseline whose memory-intensive trajectory backpropagation IDM is designed to replace.","marker":"[5]"},{"why":"Establishes the paradigm of optimizing adversarial perturbations along diffusion denoising trajectories, which IDATA builds on.","marker":"[6]"},{"why":"Provides the discrete wavelet transform framework used by LFCM to split latents into low- and high-frequency components.","marker":"[40]"},{"why":"The momentum iterative fast gradient sign method used to stabilize adversarial latent optimization across diffusion steps.","marker":"[12]"},{"why":"The latent diffusion backbone (Stable Diffusion v2.0) and its VAE encoder/decoder that the full pipeline operates on.","marker":"[48]"}],"fun_headline_variants":["Invertible diffusion cuts memory 3x, lifts attack transfer","Constant-memory diffusion attack beats black-box baselines","Low-frequency constraint improves diffusion adversarial transfer","IDATA: invertible diffusion with low-frequency constraint"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The memory-efficiency and attack-quality claims rest on the assumption that the reverse denoising steps are the exact algebraic inverse of the forward steps using the same noise estimator, with no approximation from classifier-free guidance, VAE encoding or decoding, or numerical precision.","fun_headline_variants_meta":{"raw":{"variants":["Invertible diffusion cuts memory 3x, lifts attack transfer","Constant-memory diffusion attack beats black-box baselines","Low-frequency constraint improves diffusion adversarial transfer","IDATA: invertible diffusion with low-frequency constraint"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000724,"raw_usage":{"total_tokens":3259,"prompt_tokens":973,"completion_tokens":2286,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":589,"completion_tokens_details":{"reasoning_tokens":2223}},"tokens_in":589,"tokens_out":2286,"duration_ms":18091,"temperature":1.0,"reasoning_tokens":2223,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:26:22.951651+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a clean image through the forward IDM to step $\\tau$ and then through the reverse IDM back to $t=0$, decode, and measure LPIPS/PSNR against the original; additionally, measure peak GPU memory at increasing diffusion depths (e.g., 10, 20, 50 steps) to check whether memory actually stays constant.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the coupled affine invertible transformation design that IDM adapts for constant-memory backpropagation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The primary diffusion-based attack baseline whose memory-intensive trajectory backpropagation IDM is designed to replace."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes the paradigm of optimizing adversarial perturbations along diffusion denoising trajectories, which IDATA builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the discrete wavelet transform framework used by LFCM to split latents into low- and high-frequency components."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The momentum iterative fast gradient sign method used to stabilize adversarial latent optimization across diffusion steps."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The latent diffusion backbone (Stable Diffusion v2.0) and its VAE encoder/decoder that the full pipeline operates on."}],"review_version":1}