Pith. sign in

REVIEW 4 major objections 5 minor 31 references

Universal, transferable and targeted adversarial attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims to construct adversarial inputs that are at once universal (one learned mapping), targeted (all pushed to a single class), and transferable (they fool networks the attacker never saw), and it locates the key to…

desk verdict Interesting core idea, but the evaluation is internally inconsistent and the central claim is unsupported as written. read the letter →

arxiv 1908.11332 v4 pith:W4V4NQUM submitted 2019-08-29 cs.LG cs.CVstat.ML

Junde Wu , Rao Fu This is my paper · ORCID
classification cs.LGcs.CVstat.ML
keywords adversarialexamplestargetedattackuniversaltransferabilityblack-boxfoolingimageslow-frequencyperturbationsrepresentationmatching
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to show that the hardest kind of adversarial example exists: one that is produced by a single universal mapping, pushes every source image into one chosen target class, and still transfers to models the attacker never saw. The authors argue that the obstacle to transferability is high-frequency noise, which clings to the source network's decision-boundary curvature. Their recipe is to first build low-frequency 'fooling images'—meaningless images that a network confidently labels as the target—and then train a generator (FTN) whose outputs match those images' high-level representations. If the paper is right, black-box image services can be forced to misclassify arbitrary images at scale, and transferability is a property of low-frequency structure rather than of a specific architecture.

What carries the argument

The carrying object is the Fooling Transfer Net (FTN), an encoder-decoder whose decoder is built from AdaIN Residual Blocks: adaptive instance normalization layers that shift the normalized latent code of the source image using per-channel means and variances read from the high-level features of a low-frequency fooling image. Training matches two distributions—the generated adversarial examples' representations and the fooling images' representations—via Maximum Mean Discrepancy (MMD) at VGG19's ReLU 5-2, 5-3, and 5-4 layers, supervised jointly by an SSIM content loss and a total-variance regularizer. The same construction is also used to generate the low-frequency fooling images themselves (transformation robustness, Fourier decorrelation, and CPPN variants), which the paper shows transfer to other models far better than unconstrained high-frequency fooling images.

What would settle it

Run FTN using naive high-frequency fooling images as the representation target instead of low-frequency ones; if the produced adversarial examples still transfer at roughly 90 percent to Inception-v3, ResNet, DenseNet, and Clarifai, then the low-frequency premise is not what carries the transferability, and the paper's explanation would be wrong.

Watch

Extended reading notes

Core claim

The central claim, stated as the paper's goal, is the existence of universal, transferable, targeted adversarial examples: adversarial inputs that all come from one learned mapping, are all classified as a fixed target class, and transfer across architectures and to a black-box service. The paper reports that low-frequency fooling images (generated by transformation robustness, Fourier decorrelation, or a gradient-optimized CPPN) transfer to Inception-v3, ResNet-18/50, and DenseNet far better than unconstrained high-frequency fooling images, and that FTN's generated adversarial examples reach transfer success rates of around 86 to 98 percent across those models and Clarifai.com while keeping pixel distortion small. The underlying mechanism is presented as a manifold argument: low-frequency fooling images sit near the natural-image manifold, where decision boundaries are more uniform across models, so the attack is decoupled from any single network's boundary curvature.

Load-bearing premise

The load-bearing premise is that low-frequency fooling images are more transferable than high-frequency ones because they are less tied to any one network's structure, and that the high-level representations of those images carry that transferability into the generated adversarial examples.

Editorial extensions

If this is right

  • A single forward pass through FTN turns arbitrary natural images into targeted attacks, so black-box services can be forced to label whole batches as a chosen class without per-image optimization.
  • Because the transferable examples are low-frequency, defenses that simply filter high-frequency noise will not stop them; robust training may need to consider low-frequency adversarial structure.
  • The reported transfer rates to Clarifai.com indicate that the effect holds outside laboratory models, extending to a service whose architecture and data are unknown.
  • The method improves on the universal-perturbation baseline in both transfer success and distortion, suggesting that universal attacks need not be additive noise patterns.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the low-frequency premise is right, then adversarial robustness and transferability are governed by proximity to the natural-image manifold, which implies that defenses trained on natural-image augmentations alone may be insufficient; one could test this by measuring FTN transfer to models trained on heavily augmented or adversarially robust backbones.
  • The mean/variance clustering of fooling-image representations suggests the target class forms a cluster in representation space; a testable extension would be to replace MMD with a learned discriminator or a direct cluster-distance metric and see whether transfer rates track cluster separation.
  • The method could be extended beyond single target classes to distributions over targets or to other tasks (object detection, segmentation) by choosing appropriate high-level representation layers, since the construction does not depend on the classifier's output layer.
  • One open question the paper leaves implicit is whether the frequency constraint is necessary in representation space; a direct test is to low-pass filter the generated adversarial examples and check whether transfer success persists.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper claims to demonstrate the existence of adversarial examples that are simultaneously universal, transferable, and targeted. The proposed method has two stages: first, low-frequency "fooling images" are generated for a chosen target class using constrained optimization (TR, DR, Gradient-CPPN, EA-CPPN); second, a generator network called FTN (Fooling Transfer Net) is trained to map arbitrary source images to adversarial examples, supervised by a content loss (SSIM), a representation loss (MMD on high-level features of fooling images), and a total-variation loss. Experiments are reported on VGG19 as the training victim model, with transfer tested on Inception-v3, ResNet-18, ResNet-50, DenseNet, and the black-box Clarifai.com service. The central claim, stated in Section 2, is that this is the first demonstration of universal, transferable, targeted adversarial examples.

Significance. If the empirical claims were reliable, the paper would make a strong contribution: it targets the hardest corner of the attack taxonomy and validates on a real black-box API, which is unusual and valuable. The problem formulation is clear, and the idea of constraining attack perturbations to low-frequency directions is worth investigating. However, the reported evidence is internally contradictory and not reproducible: the central success rates conflict across tables, the code release is a placeholder, and the experimental protocol selects hyperparameters on the validation victims with no held-out procedure or error bars. As written, the paper does not establish its central claim, so the contribution is not publishable in its current form.

major comments (4)
  1. [Section 5.1, Tables 2 and 3] Tables 2 and 3 report mutually incompatible results for the same method and the same victim models. In Table 2, the Gradient-CPPN row reports RMSD 5.21 and entries 13.32, 13.39, 12.13, 12.23, and 12.11 for Inception-v3, ResNet-18, ResNet-50, DenseNet, and Clarifai.com. The text immediately before Table 2 states that the table shows "RTD and RMSD", and RTD is defined in Eq. (10) as transfer success rate divided by RMSD times 100. If these entries are RTD, then the implied success rates for Gradient-CPPN are about 0.69% (e.g., 13.32 × 5.21 / 100), which contradicts the FTN row in Table 3, which reports RMSD 3.41 and success rates of 98%, 94%, 93%, 95%, and 94% on the same five targets. If instead the Table 2 entries are transfer success rates, then the table is mislabeled and the text's claim about RTD is false. Either way, the manuscript does not provide a consistent set of numbers supporting the central claim that FTN produces universal, transferable, targeted attacks.
  2. [Section 5.1, Section 5.2] The experimental protocol does not support the claimed transfer success rates. Section 5.1 states that "we adjust the hyper-parameters for every method to get their best effects", and Section 5.2 says that the targeted representation layers (ReLU 5-2, ReLU 5-3, ReLU 5-4) were chosen after trying many combinations, with the selected layers being "most effective" for the reported victims. This means the same validation victim models used for the final transfer numbers also guided hyperparameter selection; there is no held-out protocol. No error bars, confidence intervals, or multiple-seed results are given anywhere in the paper. Given that the central claim is purely empirical, the absence of a protocol that prevents selection on the test victims is a load-bearing weakness.
  3. [Section 3, Section 4.1, Section 6] The central mechanism is supported only by assumption and speculation. Section 3 labels as "a plausible assumption" the claim that low-frequency fooling images are more transferable because they are "unrelated to the structure of networks". Section 4.1 then relies on "a reasonable assumption that these high-level features preserve the attributions of Ilf: targeted and transferable", and says this assumption is "proved" by comparing mean and variance of representations, but no quantitative evidence for that comparison is shown. Section 6 offers a manifold-based explanation, but it is qualitative and not tested. Because the main result is an existence claim backed by Tables 3 and 4, these assumptions would be less critical if the tables were consistent; as it stands, they do not compensate for the contradictory experimental record.
  4. [Abstract, Section 4.2, Section 5] The paper is not reproducible as submitted. The code link in the abstract and in Section 4.2 is the placeholder string "xxxxx". Section 4.2 refers to the code for network details, and Section 4.3 refers to the code for the loss-weight values gamma and lambda, but no code or complete setting is available. Without code or a complete specification of all hyperparameters, the reported numbers cannot be checked, which is especially problematic given the internal inconsistency between Tables 2 and 3.
minor comments (5)
  1. [Table 1] The header of the third column spells "Naive" as "Niave".
  2. [Section 2, Reference [18]] There is a formatting typo "Odena et al. [18]]" with a duplicated closing bracket.
  3. [Section 5.1, Table 2] Table 2's column headers are just model names; the table does not indicate whether the reported numbers are percentages, RTD values, or something else, and no percent signs or units appear in the cells.
  4. [Section 5, Section 5.1] The evaluation set size is inconsistent and underreported: Section 5 says the model is tested on the ILSVRC 2017 validation set, while Section 5.1 says Table 1 reports "randomly selected 100 samples"; Tables 3 and 4 do not state how many source images were used.
  5. [Section 5.2] The ablation discussion states that AdaIN results are "not substantially different" but no ablation table or quantitative comparison is presented to support that statement.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found: the central claim is an empirical existence result supported by external transfer experiments, not an equation-level reduction to its own inputs.

full rationale

The paper's chain is: generate low-frequency fooling images Ilf by constrained gradient optimization on VGG19, measure their transferability on validation victim models and on the black-box Clarifai.com (Table 1), then train FTN to map source images to adversarial examples via a content loss and an MMD representation loss against VGG19 features of Ilf, and finally measure transfer success on held-out victim models (Tables 3-4). None of these steps defines the reported transfer success rates in terms of the training objective itself. The representation loss in Eq. (7) only enforces similarity between φl and φa in VGG19 feature space; it does not directly optimize the validation victim models' labels, and Ilf transferability is established independently on those models before FTN is introduced. There are no load-bearing self-citations, no imported uniqueness theorems, and no parameter fitted to the evaluation metric and then renamed as a prediction. The conflicting numerical claims in Tables 2 and 3 (e.g., FTN with Gradient-CPPN shows 13.32% vs 98% on Inception-v3) are a serious correctness and reproducibility concern, and the placeholder code link 'xxxxx' removes verifiability, but these are evidentiary problems rather than circularity. Because no specific equation or fitted input is shown to be equivalent by construction to the claimed output, the circularity score is 0.

Assumptions & free parameters 5 free parameters · 3 assumptions · 2 invented entities

The central claim rests on several tuned hyperparameters (gamma, lambda, target layers, sampling number, target class) and on unproven assumptions about the transferability of low-frequency representations. No independent evidence is provided for the two invented constructs (Ilf and FTN) beyond the paper's own experiments.

free parameters (5)
  • Gamma (representation loss weight) = not reported (referenced to code)
    Weight of Lrep in Eq. (9); chosen to optimize performance, tuned per method.
  • Lambda (total variation loss weight) = not reported
    Weight of Ltv in Eq. (9); tuned for best effects.
  • Targeted representation layers = ReLU 5-2, 5-3, 5-4 of VGG19
    Chosen as 'most effective' in Sec. 5.2 after trying many combinations.
  • Sampling number N for fooling images = not reported
    Batch size of Ilf and Ia matched; specific value omitted.
  • Targeted class = starfish
    Chosen because 'almost impossible to tangle with other classes'; this is a favorable class choice.
assumptions (3)
  • domain assumption Adversarial examples transfer across models with similar architectures.
    Relies on transferability phenomenon cited from Papernot et al. [20].
  • ad hoc to paper Low-frequency fooling images are more transferable than high-frequency ones because they lie closer to the natural image manifold.
    Stated as a 'plausible assumption' in Sec. 3 and 'we speculate' in Sec. 6; not proven or independently validated.
  • ad hoc to paper High-level representations of low-frequency fooling images preserve targeted and transferable attributions when used to guide generation.
    Called a 'reasonable assumption' in Sec. 4.1; the evidence is an empirical clustering observation, not a guarantee.
invented entities (2)
  • Low-frequency fooling image (Ilf)
    purpose: Transferable target representation for the generator
    A paper-specific construct; no external falsifiable handle, only internal experiments.
  • Fooling Transfer Net (FTN)
    purpose: Universal mapping from source images to adversarial examples
    A neural architecture introduced by the paper; it is a method, not an independently verified entity.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Universal, transferable and targeted adversarial attacks." pith.science (2026). https://pith.science/paper/W4V4NQUM

@misc{pith2026190811332,
  author       = {Pith},
  title        = {Pith review of: Universal, transferable and targeted adversarial attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W4V4NQUM}},
  note         = {Machine review of arXiv:1908.11332}
}
read the original abstract

Deep Neural Networks have been found vulnerable re-cently. A kind of well-designed inputs, which called adver-sarial examples, can lead the networks to make incorrectpredictions. Depending on the different scenarios, goalsand capabilities, the difficulties of the attacks are different.For example, a targeted attack is more difficult than a non-targeted attack, a universal attack is more difficult than anon-universal attack, a transferable attack is more difficultthan a nontransferable one. The question is: Is there existan attack that can meet all these requirements? In this pa-per, we answer this question by producing a kind of attacksunder these conditions. We learn a universal mapping tomap the sources to the adversarial examples. These exam-ples can fool classification networks to classify all of theminto one targeted class, and also have strong transferability.Our code is released at: xxxxx.

Figures

Figures reproduced from arXiv: 1908.11332 by the authors.

Figure 1
Figure 1. The taxonomy of adversarial attacks - Non-targeted misclassification forces the victim model to incorrectly classify the source image into an arbitrary class. - Targeted misclassification forces the victim model to incorrectly classify all of the source images as a specific targeted class. • Adversarial Knowledge - White-box attacks assume threat model knows every￾thing about the victim model, including the network … view at source ↗
Figure 2
Figure 2. The comparison of fooling image and visualized [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Some samples of high-frequency fooling image: [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: A summary of FTN. Source images Is pass through an encoder-decoder structure to get the final adversarial example Ia. Sampled low-frequency fooling image ˆIlf is sent to a pretrained classifier to get high-level representations φ l . The mean and variance vectors learn…
Figure 5
Figure 5. Figure 5: The adversarial examples generated by FTN with different fooling images [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: FTN supervised by different layers in VGG19. ReLU 5-4 denotes the fourth ReLU layer in the fifth block in [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 15 canonical work pages

  1. [1]

    Carlini and D

    N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pages 39–57. IEEE, 2017

    2017

  2. [2]

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Pro- ceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pages 15–26. ACM, 2017

    work page 2017

  3. [3]

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li. Boosting adversarial attacks with momentum. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018

    work page 2018

  4. [4]

    Adversarial Examples for Semantic Image Segmentation

    V . Fischer, M. C. Kumar, J. H. Metzen, and T. Brox. Ad- versarial examples for semantic image segmentation. arXiv preprint arXiv:1703.01101, 2017

    work page Pith review arXiv 2017

  5. [5]

    L. A. Gatys, A. S. Ecker, and M. Bethge. Image style trans- fer using convolutional neural networks. In Proceedings of the IEEE conference on computer vision and pattern recog- nition, pages 2414–2423, 2016

    work page 2016

  6. [6]

    I. J. Goodfellow, J. Shlens, and C. Szegedy. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    arXiv 2014

  7. [7]

    K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learn- ing for image recognition. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 770–778, 2016

    2016

  8. [8]

    Huang, Z

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Wein- berger. Densely connected convolutional networks. In Pro- ceedings of the IEEE conference on computer vision and pat- tern recognition, pages 4700–4708, 2017

    2017

Show all 31 references
  1. [9]

    Huang, N

    S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel. Adversarial attacks on neural network policies. arXiv preprint arXiv:1702.02284, 2017

    2017 arXiv

  2. [10]

    Jia and P

    R. Jia and P. Liang. Adversarial examples for eval- uating reading comprehension systems. arXiv preprint arXiv:1707.07328, 2017

    2017 arXiv

  3. [11]

    Kurakin, I

    A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial ma- chine learning at scale. arXiv preprint arXiv:1611.01236 , 2016

    2016 arXiv

  4. [12]

    M.-Y . Liu, T. Breuel, and J. Kautz. Unsupervised image- to-image translation networks. In I. Guyon, U. V . Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Pro- cessing Systems 30, pages 700–708. Curran Associ...

    2017

  5. [13]

    M.-Y . Liu, X. Huang, A. Mallya, T. Karras, T. Aila, J. Lehti- nen, and J. Kautz. Few-shot unsupervised image-to-image translation. arXiv preprint arXiv:1905.01723, 2019

    1905 arXiv

  6. [14]

    Y . Liu, X. Chen, C. Liu, and D. Song. Delving into trans- ferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770, 2016

    2016 arXiv

  7. [15]

    Moosavi-Dezfooli, A

    S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard. Universal adversarial perturbations. InProceed- ings of the IEEE conference on computer vision and pattern recognition, pages 1765–1773, 2017

    2017

  8. [16]

    Moosavi-Dezfooli, A

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Deep- fool: a simple and accurate method to fool deep neural net- works. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016

    2016

  9. [17]

    Nguyen, J

    A. Nguyen, J. Yosinski, and J. Clune. Deep neural networks are easily fooled: High confidence predictions for unrec- ognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 427–436, 2015

    2015

  10. [18]

    Odena, V

    A. Odena, V . Dumoulin, and C. Olah. Deconvolution and checkerboard artifacts. Distill, 2016

    2016

  11. [19]

    C. Olah, A. Mordvintsev, and L. Schubert. Feature vi- sualization. Distill, 2017. https://distill.pub/2017/feature- visualization

    2017

  12. [20]

    Papernot, P

    N. Papernot, P. McDaniel, and I. Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277, 2016

    2016 arXiv

  13. [21]

    Papernot, P

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami. The limitations of deep learning in adversar- ial settings. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pages 372–387. IEEE, 2016

    2016

  14. [22]

    Quadrianto, J

    N. Quadrianto, J. Petterson, and A. J. Smola. Distribution matching for transduction. In Advances in Neural Informa- tion Processing Systems, pages 1500–1508, 2009

    2009

  15. [23]

    Rozsa, E

    A. Rozsa, E. M. Rudd, and T. E. Boult. Adversarial di- versity and hard positive generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recogni- tion Workshops, pages 25–32, 2016

    2016

  16. [24]

    Simonyan and A

    K. Simonyan and A. Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  17. [25]

    K. O. Stanley. Compositional pattern producing networks: A novel abstraction of development. Genetic programming and evolvable machines, 8(2):131–162, 2007

    2007

  18. [26]

    J. Su, D. V . Vargas, and K. Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolu- tionary Computation, 2019

    2019

  19. [27]

    Szegedy, V

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818–2826, 2016

    2016

  20. [28]

    Szegedy, W

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  21. [29]

    Tram `er, A

    F. Tram `er, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel. Ensemble adversarial train- ing: Attacks and defenses. arXiv preprint arXiv:1705.07204, 2017

    2017 arXiv

  22. [30]

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Confer- ence on Computer Vision, pages 1369–1378, 2017

    2017

  23. [31]

    Z. Zhao, D. Dua, and S. Singh. Generating natural adversar- ial examples. arXiv preprint arXiv:1710.11342, 2017. 4329

    2017 arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.