Pith. sign in

REVIEW 4 major objections 5 minor 54 references

This paper argues that adversarial robustness optimization aligns defenses' remaining weak spots, so breaching one representative defense can expose the whole family without target-side access.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Simple transfer-only attacks expose shared vulnerabilities inside adversarial-training, purification, and robust-LVLM defense families.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection A careful, honest study whose headline purification-transfer result is confounded by the fixed non-robust downstream classifier; it deserves review but needs a control experiment. the 4 major comments →

arxiv 2607.18339 v1 pith:ERISYVDN submitted 2026-07-20 cs.CR

Shared Vulnerabilities in Robustness-Optimized Defenses: One Breach Exposes the Family

Hanrui Wang , Ruihao Zheng , Shuo Wang , Isao Echizen , Xingbo Dong , Zhe Jin This is my paper
classification cs.CR
keywords adversarial robustnessadversarial transferabilityadversarial purificationadversarial trainingdefense isolationPGDTransferAdversarial Sensitivity Mapslarge vision-language models
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish a risk that comes from the very success of adversarial robustness: optimizing different defenses toward the same robust behavior can align the directions in which they remain vulnerable. It claims that within a family—adversarially trained classifiers, purification-based defenses, or large vision-language models with robust visual encoders—an adversarial example built on one suitable surrogate transfers to the others with no target gradients, queries, or adaptation. The strongest evidence is a deliberately simple PGD-style attack, PGDTransfer, which reaches an average 80.4% transfer attack success rate across filtering-, compression-, and diffusion-based purifiers at a small 4/255 perturbation budget. To show this is genuine transfer rather than distortion, the paper introduces stricter transfer-only protocols and Adversarial Sensitivity Maps (AdvSMs), a ternary map of where each defense remains sensitive. If the claim is right, individual robustness numbers overstate security: the family, not the single model, is the meaningful unit of defense isolation.

Core claim

The paper's central claim is that robustness optimization creates shared adversarial sensitivity within a defense family, and that this shared sensitivity is sufficient for transfer even when the attack is simple. Concretely, PGDTransfer—projected gradient descent with expectation over transformation and a lightweight denoising diffusion surrogate—achieves an average transfer success rate of 80.4% across the eight evaluated purifiers under 4/255, outperforming adaptive attacks designed specifically for diffusion purifiers. The paper attributes this to AdvSM alignment: robust classifiers, robust visual encoders, and diverse purifiers (mean, Gaussian, JPEG, diffusion-based) all show positively

What carries the argument

The central object is the Adversarial Sensitivity Map (AdvSM), a ternary pixel-wise map that labels every location as positively sensitive, negatively sensitive, or insensitive/purified. For differentiable systems it is computed from the sign and magnitude of input gradients; for stochastic or non-differentiable purifiers it is measured from output responses to random sign perturbations. AdvSM cosine similarity across defenses quantifies how much robustness-optimized systems agree on which image regions remain adversarially usable. The paper uses AdvSMs both as explanatory evidence—aligned maps accompany high transfer—and as a surrogate-selection principle: a surrogate with a compact sensiti

Load-bearing premise

The load-bearing premise is that the shared, non-robust downstream components—the fixed classifier behind every purifier and the fixed language model behind every VQA system—are not themselves the cause of the measured transfer, so the effect can be attributed to alignment among the varied robustness-optimized components.

What would settle it

Re-run the purifier transfer experiment with the same DDIM surrogate and 4/255 budget but replace the shared fixed non-robust downstream classifier with a robust classifier, so surrogate and target pipelines share a robust rather than non-robust final stage. If the 80.4% average transfer collapses, the family-level claim is not established; the exposure would be in the common downstream pipeline, not in the purifier family. A second check: find two purifiers with high AdvSM similarity but zero attack transfer; that would break the proposed alignment-to-transfer link.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • An attacker with white-box access to a public representative defense can compromise private defenses in the same robustness family without target gradients, queries, or adaptation.
  • Randomly switching among defense modules no longer provides protection when the candidate modules share AdvSM-aligned sensitivity; one surrogate example can remain effective across all of them.
  • Current purification defenses are already at risk: a simple PGD-style attack reaches 80.4% average transfer success, so reported individual-robustness numbers overstate the protection a deployed purifier provides.
  • Currently stronger families, such as robust classifiers and robust visual encoders, show the same alignment pattern and may face the same exposure as attacks improve.
  • Future defense evaluation should measure vulnerability diversity and transfer-only isolation in addition to standalone robustness.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the cleanest way to test the attribution is to vary the shared downstream component. If replacing the fixed non-robust classifier behind every purifier with a robust classifier collapses the 80.4% transfer, then the experiment exposes the shared pipeline rather than the purifier family; the paper's indirect argument—weak surrogates transfer poorly to strong purifiers—would nee
  • Editorial inference: AdvSMs could serve as a pre-deployment auditing tool: measure the cosine similarity between a candidate defense and known public surrogates before deployment, and treat high alignment as a warning that one breach will propagate. The paper does not spell this practical consequence out.
  • Editorial inference: the same mechanism should appear wherever robustness optimization converges on shared invariant features, not only in vision; audited audio or tabular classifiers trained adversarially may show similar family-level transfer.
  • Editorial inference: the surrogate-selection principle suggests a concrete defense design: explicitly diversify sensitivity maps across defense instances—for example, adding an AdvSM decorrelation penalty during training—and verify that transfer-only attack success drops.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper argues that adversarial robustness optimization creates shared vulnerabilities within defense families: once a representative defense is breached, a simple PGD-style attack transfers to other defenses in the same family without target gradients, queries, or adaptation. It introduces stricter transfer-only evaluation protocols (small-budget untargeted, targeted, robustness-mismatch, clean-correct subset), a deliberately simple attack called PGDTransfer, and Adversarial Sensitivity Maps (AdvSMs) as a visualization and quantification tool. Experiments cover adversarially trained classifiers, purification-based defenses, and LVLMs with robust visual encoders. The headline result is an average transfer attack success rate of 80.4% across filtering-, compression-, and diffusion-based purifiers under epsilon=4/255, with a fixed non-robust ResNet-50 downstream classifier. The paper concludes that defense isolation, not just individual robustness, should be a security objective.

Significance. If the findings hold, the paper makes a practically important point: robustness evaluation that treats each defense in isolation may miss family-level transferable vulnerabilities. The protocol design is a genuine contribution: the clean-correct subset, the small-budget primary protocol, the targeted and architecture-mismatch controls, and the attempt to isolate component-level transfer are all reasonable and go beyond common practice. The AdvSM tool, despite the concerns below, is a useful attempt to measure sensitivity alignment beyond differentiable classifiers. The paper also ships code, which supports reproducibility. However, the central attribution claim—that transfer arises from aligned sensitivity within the purifier family—is not yet established because of a shared non-robust downstream classifier confound. The current evidence is consistent with a weaker but still important conclusion: a simple adaptive attack through one surrogate purifier finds perturbations that survive a range of purifiers and then fool the common non-robust classifier. Distinguishing these interpretations requires additional controls.

major comments (4)
  1. [§5.4, Eq. (3), Table 11] The headline purifier-transfer result does not isolate the purifier family as the source of transfer. Every surrogate and target in Table 11 is the composition F(x)=f(g(x)) with the same non-robust ResNet-50 f. PGDTransfer's gradient flows through f, and the 'No Purifier' column already reports 87.6% TASR, so the optimized perturbation is a strong adversarial example for f alone. The weak-surrogate contrast in Table 14 shows that some perturbations produced through f are removed by strong purifiers, but it does not test whether the surviving perturbations succeed because of shared purifier sensitivity or because any purifier that incompletely removes a strong f-adversarial perturbation will fail. A decisive control is to fix the purifier set g and vary the downstream classifier f, e.g., using an adversarially robust ResNet-50. If the 80.4% average collapses, the claim should be restated
  2. [§4.3, Eq. (25), Figure 4] The AdvSM similarity values for purifiers are not compared with any null or chance baseline. Since the ternary maps contain a large fraction of zeros and are defined on natural images, the observed 'all purifier pairs have positive similarity' may reflect shared map sparsity or common image statistics rather than robustness-aligned sensitivity. I request a permutation baseline (e.g., randomly permuting pixel labels within each map) or a comparison with a non-robust preprocessing pipeline, together with confidence intervals. Without such a baseline, the AdvSM-based causal story in §4.4 and §5.6 is not quantitatively supported.
  3. [§5.1, Appendix C, Table 14] The attack's default hyperparameters (EOT=5, DDIM surrogate with 3 denoising steps) and the choice of DDIM as the surrogate are selected using transfer results on the target purifiers. Tables 21 and 22 report ablations on exactly the targets used in Table 11, and Table 14 compares surrogates by their target TASR. This is a form of target-outcome-based adaptation, even though no target gradients or queries are used. Since the paper's contribution is 'natural transferability' from a deliberately simple attack, the protocol should either use a validation set disjoint from the evaluation targets or explicitly acknowledge that the reported 80.4% is the result of selecting among several feasible surrogate/parameter configurations. This does not eliminate the finding, but it materially weakens the 'no adaptation' claim.
  4. [§5.1, Tables 11 and 13] All transfer numbers are based on 500 clean-correct images with no confidence intervals or multiple runs. For stochastic purifiers, the binomial standard error at the reported TASR levels is roughly 1.8–2.2 percentage points, so several differences between PGDTransfer and prior adaptive attacks in Table 11 are within about two standard errors (e.g., DiffPure: 63.6 vs 60.0; ContrastDiff: 58.0 vs 54.6). The comparative claim that PGDTransfer 'achieves the highest TASR on every purifier' needs error bars or a significance test. The AdvSM similarity values in Figures 3, 4, and 6 are averages over 100 samples with no variance estimates; without them, the strength of the alignment claims is unclear.
minor comments (5)
  1. [§2.1] The paragraph on controlled component-level transfer argues that shared downstream modules alone cannot explain the results because weak surrogates transfer poorly. This conflates 'shared f is not sufficient' with 'shared f is not a confound.' Please rephrase to acknowledge that the shared f can still be a necessary contributor to the observed transfer.
  2. [§4.3, Eq. (25)] The ternary label assignment is hard to parse: '+1' is assigned 'otherwise', which includes mixed-sign and mixed-magnitude cases. Please spell out the exact condition for '+1' in words and explain why that condition corresponds to an adversarially 'sensitive' location.
  3. [Figure 2] The six panels in (d) are not individually labeled in the caption or text. Please annotate each panel with the corresponding purifier name so the reader can connect the qualitative claim to the specific defense.
  4. [References] Reference [49] has a typo: 'Devling' should be 'Delving.'
  5. [§5.6] The claim that weak purifiers leave many sensitive regions while strong purifiers suppress more regions is supported only by visual inspection of Figure 2(d). A quantitative summary, e.g., the fraction of non-zero AdvSM entries per purifier, would make the surrogate-selection principle more concrete.

Circularity Check

0 steps flagged

No circular derivation; central transfer results are empirical measurements under a defined threat model.

full rationale

The paper's central claims—that PGDTransfer achieves 80.4% average TASR across purification-based defenses, and that AdvSM similarity is aligned within robustness families—are empirical measurements, not outputs forced by construction. PGDTransfer is standard PGD on a fixed surrogate with EOT (Eqs. 8-13); transfer is evaluated on held-out targets without target gradients, queries, or adaptation, so the reported TASR values are measured outcomes rather than identities. AdvSMs are defined independently of attack success: for classifiers and LVLMs they are thresholded input gradients (Eq. 17), and for purifiers they are response maps to random sign perturbations (Eqs. 21-25), not to the adversarial examples whose transfer is later reported. The use of AdvSMs to choose a surrogate (Section 4.4) and then to explain transfer is explanatory and predictive rather than circular because the AdvSM criterion is not fitted to the target TASR values. The potential confound of a fixed non-robust downstream classifier (Eq. 3) is an identification threat that the paper attempts to address with weak-surrogate controls in Table 14; this is a validity concern, not a circularity. Self-citations appear (Refs. [31] and [47]) but are peripheral background and are not load-bearing for the main derivation. No equation in the paper reduces a predicted result to an input by definition, and no fitted parameter is renamed as a prediction.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 1 invented entities

The central claim rests on protocol assumptions (small-budget transfer indicates genuine shared sensitivity), component isolation (shared downstream modules do not drive transfer), and uncalibrated AdvSM thresholds. No physical entities are introduced; AdvSMs are a measurement construct with no external validation.

free parameters (5)
  • AdvSM gradient threshold tau = 1e-5
    Chosen to binarize/ternarize gradients in Section 4.2; no sensitivity analysis or principled derivation; changing tau changes the maps and the alignment block.
  • Purifier AdvSM response threshold theta = 2/255
    Set with perturbation epsilon=16/255, M=5, N=10 in Section 4.3/Table 15; no ablation; labels depend on these choices.
  • EOT samples K = 5
    Appendix C, Table 21: K=5 chosen because it improves transfer over K=1 while K=10 gives marginal gains; selected based on target TASR.
  • DDIM surrogate denoising steps = 3
    Appendix C, Table 22: chosen because transfer saturates after 3 steps; selected based on target TASR.
  • Surrogate purifier model = DDIM
    Table 14: DDIM gives the highest average TASR (80.4%) versus Mean (41.2%) and Gaussian (45.4%); chosen post hoc as the representative surrogate.
axioms (4)
  • domain assumption Small-budget untargeted transfer (epsilon=4/255) isolates shared adversarial directions rather than distortion-induced degradation.
    Primary protocol definition in Section 2.4; if 4/255 still distorts, TASR overestimates genuine transfer.
  • domain assumption Shared downstream components (fixed ResNet-50 / LLaVA) do not cause the measured transfer; variation in the purifier/encoder alone drives it.
    Section 2.1 and Sections 5.4/5.5; if the common downstream classifier/language model is the actual shared vulnerability, the family-level purifier claim fails.
  • domain assumption AdvSM ternary maps with fixed thresholds measure shared adversarial sensitivity; cosine similarity of such maps is a meaningful alignment statistic.
    Sections 4.2-4.3; no null model or threshold ablation is provided, so positive 'robust blocks' could reflect map sparsity.
  • domain assumption The 500 clean-correct samples and the NIPS 2017/VQAv2 subsets represent deployment conditions for these defenses.
    Section 5.1; all headline numbers are point estimates on this small subset.
invented entities (1)
  • Adversarial Sensitivity Maps (AdvSMs) and their ternary labels ('sensitive', 'smooth', 'purified') no independent evidence
    purpose: Quantify shared adversarial sensitivity for stochastic/non-differentiable defenses and guide surrogate selection (Section 4, Figure 2).
    The maps are constructed and validated only within the same experiments they are used to explain; no external calibration or formal definition of what a 'true' sensitivity map should be.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Shared Vulnerabilities in Robustness-Optimized Defenses: One Breach Exposes the Family." pith.science (2026). https://pith.science/paper/ERISYVDN

@misc{pith2026260718339,
  author       = {Pith},
  title        = {Pith review of: Shared Vulnerabilities in Robustness-Optimized Defenses: One Breach Exposes the Family},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ERISYVDN}},
  note         = {Machine review of arXiv:2607.18339}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Adversarial robustness optimization aims to preserve correct prediction under adversarial perturbations, and has produced substantial robustness gains through methods such as adversarial training and adversarial purification. However, we identify a new security risk: these gains can create shared vulnerabilities across defenses. Once one representative robustness-optimized defense is effectively breached, the broader family may become exposed. Studying this risk requires separating genuine transferability from distortion-induced degradation and from the algorithmic gains of sophisticated attacks. We therefore introduce stricter transfer-only protocols and a deliberately simple adaptive attack, PGDTransfer, to test whether robustness-optimized defenses share transfer-only vulnerability under controlled conditions. We further introduce Adversarial Sensitivity Maps (AdvSMs) to visualize and quantify shared alignment beyond differentiable classifiers, including stochastic and non-differentiable defenses. Across adversarially trained classifiers, purification-based defenses, and LVLMs with robust visual encoders, we identify natural transferability within each robustness family, i.e., transfer that arises even with simple PGD-style optimization rather than specialized transferable-attack design. The risk is already severe for purification: PGDTransfer reaches an average transfer attack success rate of $80.4\%$ across filtering-, compression-, and diffusion-based purifiers under $\epsilon=4/255$, suggesting that purifier defenses may no longer provide reliable protection. As attacks improve, currently stronger robustness families may face the same risk. Future defenses should therefore treat vulnerability diversity and transfer-only isolation as security objectives, rather than optimizing only individual robustness.

Figures

Figures reproduced from arXiv: 2607.18339 by Hanrui Wang, Isao Echizen, Ruihao Zheng, Shuo Wang, Xingbo Dong, Zhe Jin.

Figure 1
Figure 1. Figure 1: Illustration of defense-isolation risk. A regular attack on the down [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Adversarial sensitivity maps (AdvSMs) reveal shared sensitivity induced by robustness optimization. Compared with non-robust classifiers, robust [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: AdvSM similarity and nTASR among non-robust and robust classifiers. The left matrix reports AdvSM cosine similarity, and the right matrix [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: AdvSM similarity among purification-based defenses. Despite [PITH_FULL_IMAGE:figures/full_fig_p012_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Qualitative comparison of adversarial examples before and after DiffPure purification. The ASR values are measured against DiffPure under [PITH_FULL_IMAGE:figures/full_fig_p013_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: AdvSM similarity and nTASR among non-robust and robust [PITH_FULL_IMAGE:figures/full_fig_p013_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Purifier response maps on a clean input. Filtering- and compression-based purifiers remain closer to identity, whereas diffusion-based purifiers [PITH_FULL_IMAGE:figures/full_fig_p014_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

54 extracted references · 1 linked inside Pith

  1. [1]

    Explaining and harness- ing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  2. [2]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations (ICLR), 2018

    2018

  3. [3]

    On detecting adversarial perturbations,

    J. H. Metzen, T. Genewein, V . Fischer, and B. Bischoff, “On detecting adversarial perturbations,” inInternational Conference on Learning Representations (ICLR), 2017

    2017

  4. [4]

    Adversarial examples are not easily detected: Bypassing ten detection methods,

    N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,” inProceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017, pp. 3–14

    2017

  5. [5]

    Adversarial training for free!

    A. Shafahi, M. Najibi, A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!” inProceedings of the 33rd International Conference on Neural Information Processing Systems (NeurIPS), 2019, pp. 3358–3369

    2019

  6. [6]

    Fast is better than free: Revis- iting adversarial training,

    E. Wong, L. Rice, and J. Z. Kolter, “Fast is better than free: Revis- iting adversarial training,” inInternational Conference on Learning Representations (ICLR), 2020

    2020

  7. [7]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anandku- mar, “Diffusion models for adversarial purification,” inInternational Conference on Machine Learning (ICML). PMLR, 2022, pp. 16 805– 16 827

    2022

  8. [8]

    Robust evaluation of diffusion-based adver- sarial purification,

    M. Lee and D. Kim, “Robust evaluation of diffusion-based adver- sarial purification,” inProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 134–144

    2023

  9. [9]

    A comprehensive study on robustness of image classification models: Benchmarking and rethinking,

    C. Liu, Y . Dong, W. Xiang, X. Yang, H. Su, J. Zhu, Y . Chen, Y . He, H. Xue, and S. Zheng, “A comprehensive study on robustness of image classification models: Benchmarking and rethinking,”Inter- national Journal of Computer Vision, vol. 133, no. 2, pp. 567–589, 2025

    2025

  10. [10]

    Sample-specific noise injection for diffusion-based adversarial purification,

    Y . Sun, J. Zhang, Z. Ye, C. Xiao, and F. Liu, “Sample-specific noise injection for diffusion-based adversarial purification,” inInternational Conference on Machine Learning (ICML). PMLR, 2025, pp. 57 961– 57 983

    2025

  11. [11]

    On the robustness of randomized ensembles to adversarial perturbations,

    H. Dbouk and N. Shanbhag, “On the robustness of randomized ensembles to adversarial perturbations,” inInternational Conference on Machine Learning (ICML). PMLR, 2023, pp. 7303–7328

    2023

  12. [12]

    Do ad- versarially robust imagenet models transfer better?

    H. Salman, A. Ilyas, L. Engstrom, A. Kapoor, and A. Madry, “Do ad- versarially robust imagenet models transfer better?” inProceedings of the 34th International Conference on Neural Information Processing Systems (NeurIPS), 2020, pp. 3533–3545

    2020

  13. [13]

    When adversarial training meets vision transformers: recipes from training to architec- ture,

    Y . Mo, D. Wu, Y . Wang, Y . Guo, and Y . Wang, “When adversarial training meets vision transformers: recipes from training to architec- ture,” inProceedings of the 36th International Conference on Neural Information Processing Systems (NeurIPS), 2022, pp. 18 599–18 611

    2022

  14. [14]

    Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models,

    C. Schlarmann, N. D. Singh, F. Croce, and M. Hein, “Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models,” inInternational Conference on Ma- chine Learning (ICML). PMLR, 2024, pp. 43 685–43 704

    2024

  15. [15]

    Under- standing zero-shot adversarial robustness for large-scale models,

    C. Mao, S. Geng, J. Yang, X. Wang, and C. V ondrick, “Under- standing zero-shot adversarial robustness for large-scale models,” in The Eleventh International Conference on Learning Representations (ICLR), 2023

    2023

  16. [16]

    Sim-clip: Unsupervised siamese ad- versarial fine-tuning for robust and semantically-rich vision-language models,

    M. Z. Hossain and A. Imteaj, “Sim-clip: Unsupervised siamese ad- versarial fine-tuning for robust and semantically-rich vision-language models,” inThe International Joint Conference on Neural Networks (IJCNN), 2026

    2026

  17. [17]

    Digital image enhancement and noise filtering by use of local statistics,

    J.-S. Lee, “Digital image enhancement and noise filtering by use of local statistics,”IEEE Transactions on Pattern Analysis and Machine Intelligence, no. 2, pp. 165–168, 1980

    1980

  18. [18]

    A. K. Jain,Fundamentals of digital image processing. Prentice-Hall, Inc., 1989

    1989

  19. [19]

    The jpeg still picture compression standard,

    G. K. Wallace, “The jpeg still picture compression standard,”Com- munications of the ACM, vol. 34, no. 4, pp. 30–44, 1991

    1991

  20. [20]

    Defense-gan: Protect- ing classifiers against adversarial attacks using generative models,

    P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protect- ing classifiers against adversarial attacks using generative models,” in International Conference on Learning Representations (ICLR), 2018

    2018

  21. [21]

    Ape-gan: Adversar- ial perturbation elimination with gan,

    G. Jin, S. Shen, D. Zhang, F. Dai, and Y . Zhang, “Ape-gan: Adversar- ial perturbation elimination with gan,” inICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2019, pp. 3842–3846

    2019

  22. [22]

    Adversarial purification with score- based generative models,

    J. Yoon, S. J. Hwang, and J. Lee, “Adversarial purification with score- based generative models,” inInternational Conference on Machine Learning (ICML). PMLR, 2021, pp. 12 062–12 072

    2021

  23. [23]

    Stochastic security: Adver- sarial defense using long-run dynamics of energy-based models,

    M. Hill, J. C. Mitchell, and S.-C. Zhu, “Stochastic security: Adver- sarial defense using long-run dynamics of energy-based models,” in International Conference on Learning Representations (ICLR), 2021

    2021

  24. [24]

    Online adversarial purification based on self-supervised learning,

    C. Shi, C. Holtz, and G. Mishne, “Online adversarial purification based on self-supervised learning,” inInternational Conference on Learning Representations (ICLR), 2021

    2021

  25. [25]

    Purify unlearnable examples via rate-constrained variational autoencoders,

    Y . Yu, Y . Wang, S. Xia, W. Yang, S. Lu, Y .-P. Tan, and A. C. Kot, “Purify unlearnable examples via rate-constrained variational autoencoders,” inProceedings of the 41st International Conference on Machine Learning (ICML), 2024, pp. 57 678–57 702

    2024

  26. [26]

    Mimicdiffusion: Purifying adversarial perturbation via mimicking clean diffusion model,

    K. Song, H. Lai, Y . Pan, and J. Yin, “Mimicdiffusion: Purifying adversarial perturbation via mimicking clean diffusion model,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024, pp. 24 665–24 674

    2024

  27. [27]

    Diffusion models demand contrastive guidance for adversarial purifi- cation to advance,

    M. Bai, W. Huang, T. Li, A. Wang, J. Gao, C. F. Caiafa, and Q. Zhao, “Diffusion models demand contrastive guidance for adversarial purifi- cation to advance,” inInternational Conference on Machine Learning (ICML), 2024, pp. 2375–2391

    2024

  28. [28]

    Diffilter: Defending against adversarial perturbations with diffusion filter,

    Y . Chen, X. Li, P. Hu, D. Peng, and X. Wang, “Diffilter: Defending against adversarial perturbations with diffusion filter,”IEEE Transac- tions on Information Forensics and Security, vol. 19, pp. 6779–6794, 2024

    2024

  29. [29]

    Adbm: Adversarial diffusion bridge model for reliable adversarial purifi- cation,

    X. Li, W. Sun, H. Chen, Q. Li, Y . He, J. Shi, and X. Hu, “Adbm: Adversarial diffusion bridge model for reliable adversarial purifi- cation,” inThe Thirteenth International Conference on Learning Representations (ICLR), 2025

    2025

  30. [30]

    Divide and conquer: Heterogeneous noise integration for diffusion-based adversarial purification,

    G. Pei, S. Lyu, G. Chen, K. Ma, Q. Xu, Y . Sun, and Q. Huang, “Divide and conquer: Heterogeneous noise integration for diffusion-based adversarial purification,” inProceedings of the Computer Vision and Pattern Recognition Conference (CVPR), 2025, pp. 29 268–29 277

    2025

  31. [31]

    Iterative window mean filter: Thwarting diffusion-based adversarial purification,

    H. Wang, R. Sun, C. Chen, M. Xue, L.-K. Soon, S. Wang, and Z. Jin, “Iterative window mean filter: Thwarting diffusion-based adversarial purification,”IEEE Transactions on Dependable and Secure Comput- ing, vol. 22, no. 2, pp. 1827–1844, 2025

    2025

  32. [32]

    Lorid: Low-rank iterative diffusion for adversarial purification,

    G. Zollicoffer, M. N. Vu, B. Nebgen, J. Castorena, B. Alexandrov, and M. Bhattarai, “Lorid: Low-rank iterative diffusion for adversarial purification,” inProceedings of the AAAI Conference on Artificial Intelligence (AAAI), vol. 39, no. 21, 2025, pp. 23 081–23 089

    2025

  33. [33]

    Adversarial purification via super-resolution and diffusion,

    M. Park, C. Park, S. Lim, M. Koo, H. Lee, W. W. Ro, and S. Kim, “Adversarial purification via super-resolution and diffusion,” inPro- ceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2025, pp. 4605–4615

    2025

  34. [34]

    Making substitute models more bayesian can enhance transferability of adversarial examples,

    Q. Li, Y . Guo, W. Zuo, and H. Chen, “Making substitute models more bayesian can enhance transferability of adversarial examples,” in The Eleventh International Conference on Learning Representations (ICLR), 2023

    2023

  35. [35]

    Boosting the transferability of adversarial attacks with frequency- aware perturbation,

    Y . Wang, Y . Wu, S. Wu, X. Liu, W. Zhou, L. Zhu, and C. Zhang, “Boosting the transferability of adversarial attacks with frequency- aware perturbation,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 6293–6304, 2024

    2024

  36. [36]

    Improving the transfer- ability of adversarial examples through black-box feature attacks,

    M. Wang, J. Wang, B. Ma, and X. Luo, “Improving the transfer- ability of adversarial examples through black-box feature attacks,” Neurocomputing, vol. 595, p. 127863, 2024

    2024

  37. [37]

    Pixel2feature attack (p2fa): Rethinking the perturbed space to en- hance adversarial transferability,

    R. Liu, H. Wu, J. Zhang, X. Cheng, X. Luo, B. Ma, and J. Wang, “Pixel2feature attack (p2fa): Rethinking the perturbed space to en- hance adversarial transferability,” inInternational Conference on Machine Learning (ICML). PMLR, 2025, pp. 39 853–39 870

    2025

  38. [38]

    Enhancing adversarial transferability with adversarial weight tuning,

    J. Chen, Z. Feng, R. Zeng, Y . Pu, C. Zhou, Y . Jiang, Y . Gan, J. Li, and S. Ji, “Enhancing adversarial transferability with adversarial weight tuning,” inProceedings of the AAAI Conference on Artificial Intelligence (AAAI), vol. 39, no. 2, 2025, pp. 2061–2069

    2025

  39. [39]

    Boosting adversarial transferability through augmentation in hypothesis space,

    Y . Guo, W. Liu, Q. Xu, S. Zheng, S. Huang, Y . Zang, S. Shen, C. Wen, and C. Wang, “Boosting adversarial transferability through augmentation in hypothesis space,” inProceedings of the Computer Vision and Pattern Recognition (CVPR), 2025, pp. 19 175–19 185

    2025

  40. [40]

    Boosting adversarial transferability with low-cost optimization via maximin expected flatness,

    C. Qiu, A. Li, Y . Duan, S. Zhang, Y . Zhang, L. Zhao, and Q. Wang, “Boosting adversarial transferability with low-cost optimization via maximin expected flatness,”IEEE Transactions on Information Foren- sics and Security, vol. 21, pp. 2236–2251, 2026

    2026

  41. [41]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” inInternational Conference on Machine Learning (ICML). PMLR, 2018, pp. 274–283

    2018

  42. [42]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability,

    H. Xue, A. Araujo, B. Hu, and Y . Chen, “Diffusion-based adversarial sample generation for improved stealthiness and controllability,” in Proceedings of the 37th International Conference on Neural Infor- mation Processing Systems (NeurIPS), 2023, pp. 2894–2921

    2023

  43. [43]

    Diffattack: evasion attacks against diffusion-based adversarial purification,

    M. Kang, D. Song, and B. Li, “Diffattack: evasion attacks against diffusion-based adversarial purification,” inProceedings of the 37th International Conference on Neural Information Processing Systems (NeurIPS), 2023, pp. 73 919–73 942

    2023

  44. [44]

    Diffhammer: rethinking the robustness of diffusion-based adversarial purification,

    K. Wang, X. Fu, Y . Han, and Y . Xiang, “Diffhammer: rethinking the robustness of diffusion-based adversarial purification,” inProceedings of the 38th International Conference on Neural Information Process- ing Systems (NeurIPS), 2024, pp. 89 535–89 562

    2024

  45. [45]

    Diffbreak: Is diffusion-based purification robust?

    A. Kassis, U. Hengartner, and Y . Yu, “Diffbreak: Is diffusion-based purification robust?” inThe Thirty-ninth Annual Conference on Neu- ral Information Processing Systems (NeurIPS), 2025

    2025

  46. [46]

    Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,

    A. Demontis, M. Melis, M. Pintor, M. Jagielski, B. Biggio, A. Oprea, C. Nita-Rotaru, and F. Roli, “Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,” in28th USENIX security symposium (USENIX security 19), 2019, pp. 321– 338

    2019

  47. [47]

    Minimal cascade gradient smoothing for fast transferable preemptive adversarial defense,

    H. Wang, C.-C. Chang, C.-S. Lu, C.-C. Kao, S. Wang, and I. Echizen, “Minimal cascade gradient smoothing for fast transferable preemptive adversarial defense,”arXiv preprint arXiv:2407.15524, 2026

    arXiv 2026

  48. [48]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” inInternational Conference on Machine Learning (ICML). PMLR, 2018, pp. 284–293

    2018

  49. [49]

    Devling into adversarial transferability on image classification: Review, benchmark, and evaluation,

    X. Wang, Z. Ge, B. Liu, Z. Fang, F. Zhou, R. Zhang, S. Wang, and Y . Luo, “Devling into adversarial transferability on image classification: Review, benchmark, and evaluation,”arXiv preprint arXiv:2602.23117, 2026

    arXiv 2026

  50. [50]

    Nips 2017: De- fense against adversarial attack,

    A. K, B. Hamner, and I. Goodfellow, “Nips 2017: De- fense against adversarial attack,” https://kaggle.com/competitions/ nips-2017-defense-against-adversarial-attack, 2017, kaggle

    2017

  51. [51]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inEuropean Conference on Computer Vision (ECCV). Springer, 2014, pp. 740–755

    2014

  52. [52]

    Vqa: Visual question answering,

    S. Antol, A. Agrawal, J. Lu, M. Mitchell, D. Batra, C. L. Zitnick, and D. Parikh, “Vqa: Visual question answering,” inProceedings of the IEEE International Conference on Computer Vision (ICCV), 2015, pp. 2425–2433

    2015

  53. [53]

    Robustbench: a standard- ized adversarial robustness benchmark,

    F. Croce, M. Andriushchenko, V . Sehwag, E. Debenedetti, N. Flam- marion, M. Chiang, P. Mittal, and M. Hein, “Robustbench: a standard- ized adversarial robustness benchmark,” inThirty-fifth Conference on Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track (Round 2), 2021

    2021

  54. [54]

    Visual instruction tuning,

    H. Liu, C. Li, Q. Wu, and Y . J. Lee, “Visual instruction tuning,” in Proceedings of the 37th International Conference on Neural Infor- mation Processing Systems (NeurIPS), 2023, pp. 34 892–34 916. Appendix A. Full Experimental Settings This appendix summarizes the experimental settings used throughout this work. Table 15 lists the shared datasets, system...

    2023

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.