Pith. sign in

REVIEW 4 major objections 5 minor 13 references

ExAL: An Exploration Enhanced Adversarial Learning Algorithm

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ExAL claims that training a CNN on EMPSO-generated adversarial perturbations raises F1 scores on all twelve binary tasks.

desk verdict A cleanly described but narrowly evaluated variant of an existing adversarial game; the robustness claim rests on one fixed universal perturbation, so it is over-sold. read the letter →

arxiv 2411.15878 v1 pith:VCKFEYUF submitted 2024-11-24 cs.LG

A Vinil , Aneesh Sreevallabh Chivukula , Pranav Chintareddy This is my paper · ORCID
classification cs.LG
keywords adversariallearningparticleswarmoptimizationEMPSOrobustnessMNISTmalwaredetectionconvolutionalneuralnetworkexploration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ExAL is an adversarial training method that replaces simulated annealing with a particle-swarm optimizer, EMPSO, to produce a single adversarial perturbation vector. The paper's central claim is that training a CNN on this perturbed data makes the model more resilient: in every one of the twelve binary classification tasks reported, the ExAL-trained model achieves a higher F1 score than an identical model evaluated on the same perturbed test data. The perturbations are bounded to [-0.1, 0.1] per pixel, so the method aims to keep them visually subtle while maximally confusing the classifier. If the claim holds, ExAL offers a way to harden classifiers against evasion attacks using a comparatively simple optimization step.

What carries the argument

The central object is EMPSO, an Exponentially Weighted Momentum Particle Swarm Optimizer. Its velocity update rule combines an exponentially weighted momentum term m_i <- beta m_i + (1-beta) v_i with cognitive and social attraction terms, and the global best velocity v*_gbest is returned as the adversarial perturbation A*. The fitness of each candidate perturbation is the negative adversary payoff, payoff = 1 + (1 - recall) - ||a||_2, so the swarm seeks perturbations that raise classification error while staying small. EMPSO does the work of converting model loss into a concrete perturbation vector used in both attack and defense.

What would settle it

Run a separate attack (for example, a fast gradient sign or projected gradient descent step) on CNNsecure and compare its F1 against an ordinary CNN; if the ExAL-trained model does not hold up against an attack it was not trained on, the paper's claim of general resilience fails. Equally, re-optimizing A* per test batch rather than using the single fixed vector would test whether the reported robustness is specific to A*.

Watch

Extended reading notes

Core claim

The paper establishes that a single perturbation vector A*, found by EMPSO against the original model's weights, can be reused twice: once to augment training data and once to evaluate robustness. With that vector, CNNsecure = CNN(Xtrain + A*, Xtest + A*) outperforms CNNmanipulated = CNN(Xtrain, Xtest + A*) on all six MNIST label pairs (Table 1) and all six Blended Malware pairs (Table 2). The hypothesis boxed in the paper—that the adversary hones perturbations that erode the learner's accuracy—is reported as satisfied in every case. The mechanism is the EMPSO velocity update with exponential momentum, guided by a fitness function equal to minus the adversary payoff, where payoff is 1 plus classification error minus the L2 norm of the perturbation.

Load-bearing premise

The evaluation assumes that a single perturbation vector A*, optimized once against the original training model, transfers unchanged to the test set and fully represents what an adversary can do; if a different attack algorithm or a fresh per-sample perturbation would break the secure model, the general robustness claim collapses.

Editorial extensions

If this is right

  • A CNN trained on ExAL-generated perturbed data (CNNsecure) is reported to achieve F1 scores at or near those of the original model even when the same perturbation is applied at test time.
  • ExAL-generated perturbations are bounded per pixel to [-0.1, 0.1], so the defense is explored in a regime where perturbations remain visually subtle.
  • The pattern holds across two different data modalities—handwritten digit images and blended malware images—suggesting the method is not tied to one domain.
  • Increasing the perturbation scale from 0.5 to 5 makes the attack stronger against the manipulated model, but the secure model still reports near-perfect F1 on most malware pairs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension would compare ExAL against standard adversarial training methods that use per-sample gradient-based perturbations, since the paper does not include such a baseline.
  • Because the same A* is used for both training augmentation and test evaluation, the reported numbers may partly reflect memorization of one perturbation direction; testing with fresh EMPSO runs per batch would clarify.
  • The swarm fitness deliberately minimizes the L2 norm of the perturbation, so ExAL should naturally favor imperceptible attacks; this makes it a candidate for low-budget adversarial training in settings where visible corruption is unacceptable.
  • Applying ExAL to larger, more diverse datasets would reveal whether the single-vector strategy scales beyond the 1,000-sample binary tasks reported here.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes ExAL, an adversarial learning method that uses the Exponentially Weighted Momentum Particle Swarm Optimizer (EMPSO) to optimize a single universal perturbation A* against a clean-trained CNN, then retrains the CNN on the perturbed training set. The authors evaluate three models—CNNoriginal, CNNmanipulated (clean-trained, tested on perturbed test data), and CNNsecure (retrained and tested on the same perturbed data)—on six binary label pairs from MNIST and six from the Blended Malware dataset, reporting F1 scores. The central empirical claim is that the secure model consistently outperforms the manipulated model, which the paper interprets as evidence that ExAL improves adversarial robustness.

Significance. The idea of using PSO-based exploration to generate adversarial perturbations for adversarial training is potentially interesting, and the paper gives a fairly detailed algorithmic description. However, as it stands, the experiments support only a narrow covariate-shift adaptation result: training and testing on the same fixed perturbation improves F1 relative to a clean model tested on that same perturbation. The broader claim that ExAL 'significantly enhances model resilience to adversarial attacks' is not yet supported because no unseen perturbations, no per-example attacks, and no standard adversarial training baselines are evaluated. If the authors substantially extend the experimental evaluation and align the optimization objective with the stated game-theoretic formulation, the contribution could become a useful incremental result in adversarial learning.

major comments (4)
  1. [§4, Boxes 2 and 4, Tables 1–2] The evaluation uses a single fixed perturbation A* optimized once against the original model. CNNsecure is trained and evaluated on X+A*, while CNNmanipulated is evaluated only on the same Xtest+A*. This setup measures adaptation to a known distribution shift, not robustness to adversarial attacks in any general sense: no adversarial examples are generated against CNNsecure at test time, no per-example attack such as FGSM or PGD is considered, and no independently re-optimized perturbation is tested. The claim in the abstract that ExAL 'significantly enhances model resilience to adversarial attacks' is therefore underdetermined. Please add evaluations under unseen perturbations (for example, a re-optimized A*, FGSM, and PGD) and restrict the conclusions to the specific perturbation used in training until such evidence is provided.
  2. [§4, Tables 1–2] There are no comparison baselines such as standard adversarial training (FGSM/PGD-based), no repeated runs, and no error bars or significance tests. The statement in Section 6 that ExAL 'outperforms baseline models' is unsupported because no baseline adversarial training method is included in the experiments. The consistent ordering across all twelve rows is suggestive, but without variance estimates and baseline comparisons, the size and reliability of the reported improvements cannot be assessed.
  3. [§3.2 vs. Algorithm 4] There is an inconsistency between the mathematical formulation and the implemented fitness objective. Equation (7) states that A* = arg max_A L_adversary, i.e., the adversary maximizes the learner's loss, but Algorithm 4 computes the payoff as π = 1 + e − c, where c = ||a||_2. This means the optimized objective is e − ||a||_2, an unweighted combination of classification error and perturbation norm, not the learner's loss. The trade-off between these two terms is arbitrary and not derived from the game formulation. Please align the objective with Eq. (6)–(7) or explain and justify the penalty term.
  4. [Algorithm 6, lines 14–16] The pseudocode for the momentum update is internally inconsistent. Line 14 updates v_i using βm_i + (1−β)v_i plus cognitive and social terms, and line 16 then updates m_i as βm_i + (1−β)v_i. If the updated v_i is used on the right-hand side of line 16, the momentum update no longer matches Eq. (2); if the old v_i is intended, the pseudocode should use a temporary variable to avoid ambiguity. This is load-bearing because the paper's contribution is precisely the EMPSO update, and as written the algorithm is not reproducible.
minor comments (5)
  1. [Algorithm 2] There is a typo in line 3: 'cognititive' should be 'cognitive'.
  2. [§4.1, Box 3 and Tables 1–2] The model names are inconsistent: Box 3 uses 'CN Noriginal', while the tables and text use 'CNNorg', 'CNNmanip', and 'CNNsec'. Please define and use one consistent notation throughout.
  3. [Algorithm 4, line 7] The line 'r ← M.evaluate(Xadv, Ytrain)' is ambiguous: model evaluation typically returns loss and possibly several metrics, not directly a recall value. Please specify how recall is computed and which metric is used for the binary classification tasks.
  4. [§4.1] No hyperparameter values are reported for np, β, c1, c2, Tmax, the perturbation bounds beyond the MNIST value of ±0.1, or the CNN architecture and training hyperparameters. Without these details, the experiments cannot be reproduced.
  5. [§2.1 and §5] The related-work discussion is broad but omits standard adversarial training baselines (e.g., Madry et al. and Goodfellow et al.'s FGSM training) that are directly relevant to the claimed improvement; citing and comparing against these would strengthen the positioning of ExAL.

Circularity Check

1 steps flagged · score 6.0 of 10

The robustness claim reduces to evaluating the model on the same fixed perturbation A* used for training; the 'secure' model is defined as trained on Xtrain+A* and tested on Xtest+A*, so the reported improvement is a distribution-match effect rather than evidence of resilience to unseen attacks.

  1. fitted input called prediction [Section 3.2, Box 2 (CNN Model Definitions); also Algorithms 2-6 and Section 5]
    "Upon solving for A∗, the adversarial data X + A∗ is used to create manipulated datasets Xtrain + A∗ and Xtest+A∗. This setup results in three distinct CNN models ... Definition 3 (CNN Secure Model). The CNN trained and evaluated on adversarially manipulated data: CNNsecure = CNN(Xtrain + A∗, Xtest + A∗)"

    A* is a single perturbation vector fit by EMPSO against the clean-trained model on Xtrain (Algorithm 2, using fitness from Algorithms 3-4). The same A* is then added to both the secure model's training set and the test set, so CNNsecure is trained and evaluated on the same fixed additive shift. The robustness comparison in Tables 1 and 2 is CNNsecure versus CNNmanipulated, both evaluated on Xtest + A*; only CNNsecure has seen that exact perturbation in training. The F1 gap is therefore largely an adaptation-to-training-shift effect, not a demonstration of robustness to an unseen or independently generated attack.

full rationale

ExAL is an empirical optimization paper rather than a derivation from first principles, so most derivation-circularity patterns do not apply. The one structural circularity is in the robustness evaluation. A* is fit once by EMPSO on Xtrain against the clean model (Algorithms 2-6), and the same A* is then added to both the secure model's training set and the test set (Box 2: CNNsecure = CNN(Xtrain + A*, Xtest + A*)). Comparing CNNsecure to CNNmanipulated on Xtest + A* therefore measures whether a model trained on a fixed additive shift performs better than a model not trained on it; it does not measure robustness to an unseen or independently re-optimized perturbation. There is no per-example attack such as FGSM/PGD, no attack generated against CNNsecure, and no second A* optimized against the secure model. The consistent secure > manipulated ordering in Tables 1 and 2 is the expected adaptation-to-training-shift effect, so the abstract's general claim of enhanced resilience to adversarial attacks is partially circular: the tested attack is the fitted input itself. The self-citation to Chivukula and Liu (2019) supplies the two-player-game formulation and the CNN model definitions, but this citation is not load-bearing for the numerical F1 gap; it does not itself force the circular result.

Assumptions & free parameters 8 free parameters · 4 assumptions · 0 invented entities

The method rests on several unstated or hand-chosen choices: EMPSO hyperparameters, perturbation bounds, scale factors, fitness design, and the transferability of a single optimized perturbation. None of these are justified with ablations or sensitivity analysis, but none of them are invented physical or theoretical entities.

free parameters (8)
  • momentum factor beta = not reported
    EMPSO momentum factor used in Algorithm 6; no value or sensitivity analysis is given.
  • cognitive factor c1 = not reported
    EMPSO cognitive learning factor; no value or sensitivity analysis is given.
  • social factor c2 = not reported
    EMPSO social learning factor; no value or sensitivity analysis is given.
  • number of particles np = not reported
    Swarm population size in Algorithm 2; no value is reported.
  • maximum iterations Tmax = not reported
    EMPSO termination criterion in Algorithm 2; no value is reported.
  • perturbation bounds and scale factors = [-0.1, 0.1] for MNIST; 0.5, 1, 5 for malware
    Hand-chosen per dataset and class pair to keep perturbations 'imperceptible'; no perceptual metric is used.
  • CNN architecture and training hyperparameters = not reported
    Architecture is shown in Fig. 1 but layer details, optimizer, epochs, and learning rate are not specified.
  • payoff weighting coefficients = 1 and -1 fixed in Algorithm 4
    The payoff pi = 1 + e - c weights error and perturbation cost equally; no justification or ablation is given.
assumptions (4)
  • domain assumption EMPSO as defined in Mohapatra et al. (2022) is a suitable optimizer for this fitness landscape.
    The paper relies on EMPSO convergence and exploration properties without proof, ablation, or comparison to other optimizers.
  • domain assumption A single perturbation A* optimized on Xtrain transfers to Xtest.
    Section 4 evaluates CNNmanipulated and CNNsecure on Xtest + A*, assuming the train-optimized perturbation remains effective on test data.
  • ad hoc to paper Fitness based on recall of the original model on perturbed training data is a suitable proxy for adversarial impact.
    Algorithms 3-4 use recall and L2 norm in the payoff, but there is no justification or ablation for this design.
  • ad hoc to paper Bounds [-0.1, 0.1] (MNIST) and scale factors (malware) keep perturbations visually indistinguishable.
    Claimed in Section 4 but no perceptual or statistical metric is measured.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ExAL: An Exploration Enhanced Adversarial Learning Algorithm." pith.science (2026). https://pith.science/paper/VCKFEYUF

@misc{pith2026241115878,
  author       = {Pith},
  title        = {Pith review of: ExAL: An Exploration Enhanced Adversarial Learning Algorithm},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VCKFEYUF}},
  note         = {Machine review of arXiv:2411.15878}
}
read the original abstract

Adversarial learning is critical for enhancing model robustness, aiming to defend against adversarial attacks that jeopardize machine learning systems. Traditional methods often lack efficient mechanisms to explore diverse adversarial perturbations, leading to limited model resilience. Inspired by game-theoretic principles, where adversarial dynamics are analyzed through frameworks like Nash equilibrium, exploration mechanisms in such setups allow for the discovery of diverse strategies, enhancing system robustness. However, existing adversarial learning methods often fail to incorporate structured exploration effectively, reducing their ability to improve model defense comprehensively. To address these challenges, we propose a novel Exploration-enhanced Adversarial Learning Algorithm (ExAL), leveraging the Exponentially Weighted Momentum Particle Swarm Optimizer (EMPSO) to generate optimized adversarial perturbations. ExAL integrates exploration-driven mechanisms to discover perturbations that maximize impact on the model's decision boundary while preserving structural coherence in the data. We evaluate the performance of ExAL on the MNIST Handwritten Digits and Blended Malware datasets. Experimental results demonstrate that ExAL significantly enhances model resilience to adversarial attacks by improving robustness through adversarial learning.

Figures

Figures reproduced from arXiv: 2411.15878 by the authors.

Figure 1
Figure 1. CNN Model Architecture 4.2 Experiment 1: MNIST Dataset In this experiment, the MNIST Handwritten Digits dataset is used for binary classification tasks. For example, in the label pair (2, 8), the digit 2 is treated as the positive class, while the 8 is treated as the negative class. Adversarial data is generated by applying the perturbations A∗ to the original images, creating perturbed images. The leftmost image of… view at source ↗
Figure 2
Figure 2. Original image(left), Adversarial Perturbation wi [PITH_FULL_IMAGE:figures/full_fig_p016_2.png] view at source ↗
Figure 3
Figure 3. Original image(left), Adversarial Perturbation wi [PITH_FULL_IMAGE:figures/full_fig_p018_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Original image(left), Adversarial Perturbation wi [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

13 extracted references · 11 canonical work pages

  1. [1]

    Cai, Z., Xiong, Z., Xu, H., Wang, P., Li, W., and Pan, Y. (2021). Generative adversarial networks: A survey towards private and secure applications

    work page 2021

  2. [2]

    Chen, S., Xue, M., Fan, L., Hao, S., Xu, L., Zhu, H., and Li, B. (2017). Automated poisoning attacks and defenses in malware detection systems: An adversarial machine learning approach

    work page 2017

  3. [3]

    Chivukula, A. S. and Liu, W. (2019). Adversarial deep learning models with multiple adversaries. IEEE Transactions on Knowledge and Data Engineering , 31(6):1066--1079

    work page 2019

  4. [4]

    J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y

    Goodfellow, I. J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014). Generative adversarial networks

    work page 2014

  5. [5]

    and Tan, Y

    Hu, W. and Tan, Y. (2017). Generating adversarial malware examples for black-box attacks based on gan

    work page 2017

  6. [6]

    and Eberhart, R

    Kennedy, J. and Eberhart, R. (1995). Particle swarm optimization. In Proceedings of ICNN'95 - International Conference on Neural Networks , volume 4, pages 1942--1948 vol.4

    work page 1995

  7. [7]

    Kirkpatrick, S., Gelatt, C. D. J., and Vecchi, M. P. (1983). Optimization by simulated annealing. Science , 220(4598):671--680

    work page 1983

  8. [8]

    LeCun, Y., Cortes, C., and Burges, C. J. (1998). The mnist database of handwritten digits. http://yann.lecun.com/exdb/mnist/. Retrieved October 18, 2024

    work page 1998

Show all 13 references
  1. [9]

    Mohapatra, R., Saha, S., Coello, C. A. C., Bhattacharya, A., Dhavala, S. S., and Saha, S. (2022). Adaswarm: Augmenting gradient-based optimizers in deep learning with swarm intelligence. IEEE Transactions on Emerging Topics in Computational Intelligence , 6(2):329--340

    2022

  2. [10]

    Pendharkar, G. (2021). Blended malware image dataset. https://www.kaggle.com/datasets/gauravpendharkar/blended-malware-image-dataset

    2021

  3. [11]

    Salimans, T., Goodfellow, I., Zaremba, W., Cheung, V., Radford, A., and Chen, X. (2016). Improved techniques for training gans

    2016

  4. [12]

    , " * write output.state after.block = add.period write

    ENTRY address author booktitle chapter doi edition editor eid howpublished institution journal key month note number organization pages publisher school series title type url volume year label INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION in...

  5. [13]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.