REVIEW 4 major objections 6 minor 1 cited by
Beneficial Perturbations Network for Defending Adversarial Examples
T0 review · 4 major / 6 minor · reviewed 2026-08-27 · deepseek-v4-flash
Pith's one-line read Training only on clean images, a network can defend against adversarial examples by updating extra bias units with reversed fast-gradient-sign steps recycled from the ordinary backpropagation pass.
desk verdict A cheap-defense idea with a real bug: Eq. 7 is gradient ascent as written, and without code the reported results cannot be explained by the method described. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the beneficial perturbation bias $b^i_{BP}$: a bias term attached to a fully connected layer, updated by a fast-gradient-sign rule rather than by the usual bias gradient. Its update recycles the stochastic-gradient-descent gradient already computed for that layer, so it costs a sign and a multiply per layer. The second piece is the cancellation identity $x^*_{cln} \approx x^*_{cln} + \delta^*_{AP} + \delta_{BP}$ in activation space, which asserts that the learned bias direction is the opposite of the adversarial direction and therefore restores the clean activation. Together these two pieces turn adversarial robustness into a parameter update rather than a data-augmentation step.
What would settle it
Train a BPN variant that flips the sign of the bias update (gradient descent instead of ascent) under the same datasets, attack parameters, and training budget. If this descent variant retains the reported adversarial robustness, the claimed reversal mechanism is not what carries the defense. If the ascent variant fails to defend PGD Linf on MNIST at $\epsilon=0.3$, the paper's generalization claim is falsified. A third check: replace the recycled gradient direction with random signs of the same magnitude; if random-sign biases work equally well, no information about the adversarial direction is being used.
Extended reading notes
Core claim
BPN treats adversarial robustness as a distribution-drift problem in activation space rather than input space. It adds a beneficial perturbation bias $b^i_{BP}$ to the last few fully connected layers, so the forward pass becomes $V_{i+1} = W_i V_i + b^i_{BP}$. During training, the bias is updated by recycling the already-computed SGD gradient: $b^i_{BP} = b^i_{BP} - \eta (-\epsilon \, \mathrm{sign}(\sum \mathrm{Grad}_{SGD}))$, which the paper describes as a reverse FGSM attack. The intended mechanism is cancellation: if an adversarial perturbation $\delta^*_{AP}$ shifts the activation of a clean sample, the learned beneficial perturbation $\delta_{BP}$ approximately undoes it, $x^*_{cln} \approx x^*_{cln} + \delta^*_{AP} + \delta_{BP}$. Experiments on MNIST, Fashion-MNIST, and TinyImageNet are offered as evidence that this bias update, trained only on clean examples, restores high accuracy on FGSM and PGD adversarial inputs while leaving clean accuracy nearly intact.
Load-bearing premise
The defense assumes that making the bias push against the gradient of the loss on clean images is the right way to cancel adversarial perturbations; no derivation or comparison with the opposite direction is given.
Editorial extensions
If this is right
- If BPN works as reported, adversarial defense no longer requires instantiating adversarial images during training; robustness can be added to a clean-only training pipeline.
- Training time stays close to clean training: the paper measures 0.00% extra forward FLOPs and 0.006% extra backward FLOPs, versus at least double for classic adversarial training.
- Clean accuracy is hurt less than by adversarial training, addressing the robustness/accuracy trade-off.
- FGSM-trained BPN transfers to PGD Linf and PGD L2 attacks on MNIST and TinyImageNet, suggesting defenses can generalize beyond the attack seen in training.
Reading between the lines
- The paper does not ablate the sign of the bias update, so the simplest alternative explanation of its results is a regularizing effect of any structured bias perturbation rather than true reversal of adversarial directions; a signed-versus-random ablation would settle this.
- If the mechanism is cancellation in activation space, the same bias-unit scheme could be transferred to attention layers or normalization parameters in attention-based architectures, where adversarial perturbations also cause distribution shift.
- Training with PGD-recycled gradients instead of FGSM may extend the reported transfer further; the paper itself suggests alternative update rules, so this is a natural next experiment.
- Because only three datasets and two attack families are tested, the unseen-attack generalization claim would be strengthened by evaluating against an adaptive attack that backpropagates through the bias update before deployment.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Beneficial Perturbation Network (BPN), which adds extra bias terms to the fully connected layers of a network and updates those biases during clean training using the sign of the loss gradient with respect to the bias. The authors claim that these "beneficial perturbations" are opposite to adversarial perturbations, that they cancel adversarial perturbations in activation space, and that they therefore provide robustness at negligible computational cost, with less clean-accuracy degradation than adversarial training and with transfer from FGSM-based training to PGD attacks. The paper reports experiments on MNIST, Fashion-MNIST, and TinyImageNet under three training scenarios: clean-only, adversarial-only, and mixed clean-plus-adversarial training.
Significance. If the claims were established, the paper would offer a practically important result: adversarial robustness without instantiating adversarial examples and with negligible overhead over clean training. The paper deserves credit for framing the problem in terms of distribution drift, for measuring FLOPs overhead, and for evaluating white-box transfer to PGD attacks. However, the central update rule is internally inconsistent as written, the cancellation mechanism in Eq. (2) is asserted rather than derived, and some reported numbers contradict the headline claims; the significance is therefore not currently established.
major comments (4)
- [3.3, Eq. (7)] Eq. (7) as written is a gradient-ascent step on the loss with respect to the beneficial-perturbation bias: substituting Eq. (4) into Eq. (5) and Eq. (6) gives b_BP = b_BP + eta * eps * sign(sum GradSGD), which increases the training loss. The surrounding text says the update moves "away from the adversarial vector," which would require the opposite sign. This is not a cosmetic issue: a bias updated by gradient ascent should degrade clean training, yet Table 2 reports 99.17% MNIST clean accuracy, essentially matching the baseline. The authors must state exactly which sign was implemented, provide a derivation of the update, and report an ablation with the opposite sign. Without code or checkpoints, the reader cannot determine whether the tested method is the method described in the paper.
- [3.1, Eq. (2)] The cancellation x*_cln approximately equals x*_cln + delta*_AP + delta_BP is assumed, not derived. Since delta_BP is a per-layer constant bias stored in the fully connected layers, while delta*_AP is an input-dependent activation perturbation, it is not evident how a fixed bias can cancel arbitrary test-time perturbations that vary per sample. The paper should either derive conditions under which the cancellation holds or provide a controlled experiment measuring the alignment between the learned bias directions and the distribution of adversarial directions across the test set.
- [5.1, Table 2] The claim that BPN "hurts the accuracy on clean examples much less" than adversarial training is contradicted by the clean-only scenario on TinyImageNet, where clean accuracy drops from 64.30 to 57.55, a 6.75-point loss. Additionally, Table 5 shows PGD L2 accuracy of 16.23 versus 15.11 for the classical network, a difference of about one point with no error bars; this is weak evidence for the claimed generalization to unseen attacks. The paper should report multiple seeds with error bars and explain the TinyImageNet clean-accuracy drop.
- [4, Experiments] The experiments are not reproducible as reported: no code or checkpoints are provided, and the paper omits key details such as learning-rate schedules, epoch counts for MNIST and Fashion-MNIST, the number of fully connected layers receiving beneficial-perturbation biases, and the selection procedure for epsilon. This omission is particularly load-bearing given the sign ambiguity in Eq. (7), because the reader cannot verify which update rule actually produced the reported accuracies.
minor comments (6)
- [5.4] The paper refers to "PDG attack" but should be "PGD attack."
- [Table 1] The table header says "RestNet-50"; the correct spelling is "ResNet-50."
- [5.1] The abstract and Section 5.1 give different overhead numbers: the abstract says 0% forward and 0.006% backward increase, while Section 5.1 states the current implementation incurs an extra 9% due to a custom PyTorch layer. Please clarify which number corresponds to the actual implementation.
- [3.1, Eq. (2)] The star notation in Eq. (2) is confusing: x*_cln is used for an activation representation, but the equation also adds delta*_AP and delta_BP as if they were in the same space. Please define all starred quantities explicitly.
- [7, Fig. 5] The y-axis label and legend in Figure 5 are unclear; the figure should state directly which colors correspond to MNIST and FashionMNIST.
- [6.2, Ref. [26]] Reference [26] appears to be prior work by the same authors that already introduces beneficial perturbation networks; the paper should explicitly state what is new in the present manuscript relative to that work, particularly regarding the defense setting.
Circularity Check
No significant circularity: the main robustness claims are empirical and measured on held-out attacks, while Eq. 2 is a stated design identity rather than a fitted or derived prediction.
full rationale
The derivation chain here does not reduce to its own inputs in a way that would constitute circularity. The beneficial-perturbation bias is updated by Eq. 7 using gradients already computed during clean training; Eq. 5 defines d_BP = -d_AP, so the cancellation expressed in Eq. 2 follows from the definition of the method rather than being an independently derived or test-fitted result. That is a design assumption, not a circular prediction. The central empirical claims, including the preservation of clean accuracy and the generalization from FGSM to PGD attacks, are evaluated on adversarial examples generated at test time and not used for training. In particular, Table 5 reports PGD robustness for a model trained only on clean examples with FGSM-based bias updates; those accuracies are measurements, not by-construction consequences of the update rule. The only self-citation, reference [26], is used to note earlier work on beneficial perturbations for catastrophic forgetting and is not load-bearing for the adversarial-robustness claims made here. The apparent sign inconsistency in Eq. 7, where the update appears to be gradient ascent on the loss with respect to the bias, is a correctness and reproducibility concern, not a circularity, because the reported results are empirical measurements rather than quantities forced by definition. No fitted parameter is renamed as a prediction, and no uniqueness theorem is imported from prior work. Accordingly, there is no significant circularity.
Assumptions & free parameters
free parameters (2)
- epsilon (perturbation budget) =
0.3 for all main experiments
- number of fully connected layers with beneficial perturbation bias =
last few FC layers (3 for ResNet, 2 for LeNet)
assumptions (3)
- ad hoc to paper Adding the sign of the loss gradient to the bias produces a perturbation that cancels adversarial perturbations (Eq. 2).
- domain assumption The gradient of the loss with respect to the bias can be approximated by the mini-batch sum of backpropagated gradients and recycled from clean training.
- domain assumption Neural networks exhibit excessive linearity and a large adversarial subspace, so bias perturbations in activation space can transfer across inputs.
invented entities (1)
-
Beneficial perturbation bias (b_BP)
Cite this review
Pith. "Pith review of Beneficial Perturbations Network for Defending Adversarial Examples." pith.science (2026). https://pith.science/paper/OE5DY3QF
@misc{pith2026200912724,
author = {Pith},
title = {Pith review of: Beneficial Perturbations Network for Defending Adversarial Examples},
year = {2026},
howpublished = {\url{https://pith.science/paper/OE5DY3QF}},
note = {Machine review of arXiv:2009.12724}
}
read the original abstract
Deep neural networks can be fooled by adversarial attacks: adding carefully computed small adversarial perturbations to clean inputs can cause misclassification on state-of-the-art machine learning models. The reason is that neural networks fail to accommodate the distribution drift of the input data caused by adversarial perturbations. Here, we present a new solution - Beneficial Perturbation Network (BPN) - to defend against adversarial attacks by fixing the distribution drift. During training, BPN generates and leverages beneficial perturbations (somewhat opposite to well-known adversarial perturbations) by adding new, out-of-network biasing units. Biasing units influence the parameter space of the network, to preempt and neutralize future adversarial perturbations on input data samples. To achieve this, BPN creates reverse adversarial attacks during training, with very little cost, by recycling the training gradients already computed. Reverse attacks are captured by the biasing units, and the biases can in turn effectively defend against future adversarial examples. Reverse attacks are a shortcut, i.e., they affect the network's parameters without requiring instantiation of adversarial examples that could assist training. We provide comprehensive empirical evidence showing that 1) BPN is robust to adversarial examples and is much more running memory and computationally efficient compared to classical adversarial training. 2) BPN can defend against adversarial examples with negligible additional computation and parameter costs compared to training only on clean examples; 3) BPN hurts the accuracy on clean examples much less than classic adversarial training; 4) BPN can improve the generalization of the network 5) BPN trained only with Fast Gradient Sign Attack can generalize to defend PGD attacks.
Figures
Figures from the paper (2 more)
Forward citations
Cited by 1 Pith paper
-
Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation
A black-box face recognition attack that augments surrogate models with diverse parameter initializations and hard-model feature perturbations, achieving higher transferability.
Reference graph
Works this paper leans on
-
[1]
Evasion attacks against machine learning at test time
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nel- son, Nedim Šrndi´c, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowl- edge discovery in databases, pages 387–402. Springer, 2013
work page 2013
-
[2]
Automating string processing in spreadsheets using input-output examples
Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Sub- biah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakan- tan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. arXiv preprint arXiv:2005.14165, 2020
work page Pith review arXiv 2005
-
[3]
Improved Baselines with Momentum Contrastive Learning
Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Im- proved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297, 2020
work page Pith review arXiv 2003
-
[4]
J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. ImageNet: A Large-Scale Hierarchical Image Database. In CVPR09, 2009
2009
-
[5]
Imagenet: A large-scale hierarchical image database
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009
2009
-
[6]
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018
work page Pith review arXiv 2018
-
[7]
Towards Adversarial Training with Moderate Performance Improvement for Neural Network Classification
Xinhan Di, Pengqian Yu, and Meng Tian. Towards adversarial training with moderate performance improvement for neu- ral network classification. arXiv preprint arXiv:1807.00340, 2018
work page Pith review arXiv 2018
-
[8]
advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin. Ad- verTorch v0.1: An adversarial robustness toolbox based on pytorch. arXiv preprint arXiv:1902.07623, 2019
work page Pith review arXiv 1902
Show all 29 references
-
[9]
Adversarial examples and adver- sarial training
Goodfellow. Adversarial examples and adver- sarial training. stanford cs231n lecture16 slides. http://cs231n.stanford.edu/slides/2017/ cs231n_2017_lecture16.pdf, 2017
2017
-
[11]
Explaining and harnessing adversarial examples (2014).arXiv preprint arXiv:1412.6572, 2014
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples (2014).arXiv preprint arXiv:1412.6572, 2014
2014 arXiv
-
[12]
Deep residual learning for image recognition
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CoRR, abs/1512.03385, 2015
2015 arXiv
-
[13]
Deep residual learning for image recognition
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016
2016
-
[14]
Learning with a strong adversary
Ruitong Huang, Bing Xu, Dale Schuurmans, and Csaba Szepesvári. Learning with a strong adversary. CoRR, abs/1511.03034, 2015
2015 arXiv
-
[15]
Adversarial examples are not bugs, they are features
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175, 2019
1905 arXiv
-
[16]
Adver- sarial logit pairing
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adver- sarial logit pairing. arXiv preprint arXiv:1803.06373, 2018
2018 arXiv
-
[17]
Ad- versarial examples in the physical world
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016
2016 arXiv
-
[18]
Gradient-based learning applied to document recogni- tion
Yann LeCun, Léon Bottou, Yoshua Bengio, Patrick Haffner, et al. Gradient-based learning applied to document recogni- tion. Proceedings of the IEEE, 86(11):2278–2324, 1998
1998
-
[19]
Towards deep learn- ing models resistant to adversarial attacks
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017
2017 arXiv
-
[20]
Simple black-box adversarial perturbations for deep networks
Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-box adversarial perturbations for deep networks. arXiv preprint arXiv:1612.06299, 2016
2016 arXiv
-
[21]
Adversarial training can hurt gener- alization
Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John C Duchi, and Percy Liang. Adversarial training can hurt gener- alization. arXiv preprint arXiv:1906.06032, 2019
1906 arXiv
-
[22]
Are labels required for improving adversarial robustness? arXiv preprint arXiv:1905.13725, 2019
Robert Stanforth, Alhussein Fawzi, Pushmeet Kohli, et al. Are labels required for improving adversarial robustness? arXiv preprint arXiv:1905.13725, 2019
1905 arXiv
-
[23]
Intriguing properties of neural networks
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013
2013 arXiv
-
[24]
Ensemble ad- versarial training: Attacks and defenses
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Good- fellow, Dan Boneh, and Patrick McDaniel. Ensemble ad- versarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204, 2017
2017 arXiv
-
[25]
The space of transferable ad- versarial examples
Florian Tramèr, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. The space of transferable ad- versarial examples. arXiv preprint arXiv:1704.03453, 2017
2017 arXiv
-
[26]
S. Wen, A. Rios, Y . Ge, and L. Itti. Beneficial perturbation network for designing general adaptive artificial intelligence systems. IEEE Transactions on Neural Networks and Learn- ing Systems, pages 1–14, 2021
2021
-
[27]
Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms
Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017
2017 arXiv
-
[28]
Feature denoising for improving ad- versarial robustness
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving ad- versarial robustness. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 501–509, 2019
2019
-
[29]
Theoretically principled trade-off between robustness and accuracy
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv preprint arXiv:1901.08573, 2019
1901 arXiv
-
[30]
Influence of adversarial perturbation budget The higher the adversarial perturbation budget, the higher the chance it can successfully attack a neural network
Supplementary 7.1. Influence of adversarial perturbation budget The higher the adversarial perturbation budget, the higher the chance it can successfully attack a neural network. How- ix ever, attacks with higher adversarial perturbation budgets are easier to detect by a progra...
Reviewed August 27, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.