Pith. sign in

REVIEW 4 major objections 5 minor 14 references

Teach Me to Trick: Exploring Adversarial Transferability via Knowledge Distillation

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A student model distilled from two heterogeneous teachers generates adversarial examples that transfer to a black-box target nearly as well as a teacher ensemble, while cutting attack generation time by up to six times.

desk verdict Useful question, plausible numbers, but the central attribution to KD rests on a missing control: a vanilla ResNet-18 baseline. read the letter →

arxiv 2507.21992 v1 pith:3PEHNHI7 submitted 2025-07-29 cs.LG cs.AI

Siddhartha Pradhan , Shikshya Shiwakoti , Neha Bathuri This is my paper · ORCID
classification cs.LGcs.AI MSC 68T0768T05
keywords knowledgedistillationadversarialtransferabilityblack-boxattackmulti-teachercurriculumlearningprojectedgradientdescentCIFAR-10modelcompression
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether knowledge distillation, a technique for compressing large models into smaller ones, can also make black-box adversarial attacks cheaper and more transferable. The authors train a ResNet-18 student on CIFAR-10 by distilling from a ResNet-50 and a DenseNet-161, using either curriculum-based teacher switching or joint optimization, and then use the student to craft FG, FGS, and PGD attacks against a black-box GoogLeNet. They report that the distilled student's attack success rate (0.95 for PGD) nearly matches a two-teacher ensemble (0.96) while taking about one-sixth of the time (33 seconds versus 201 seconds for 10,000 images). An ablation shows that a lower temperature and a hard-label loss component improve transferability. The larger implication is that KD can serve as a tool for efficient and effective black-box attacks, not only for compression.

What carries the argument

The central mechanism is the distillation loss $L_{\text{KD}} = \alpha L_{\text{hard}} + (1-\alpha) L_{\text{soft}}$, where $L_{\text{soft}}$ is a KL divergence between the softened outputs of the student and each teacher, and $L_{\text{hard}}$ is cross-entropy with ground-truth labels. The two multi-teacher strategies are curriculum-based switching, which alternates the teacher every four epochs, and joint optimization, which averages the soft losses from both teachers at each step. The authors use this machinery to argue that the student internalizes a blend of the teachers' decision boundaries, producing a model whose local gradient direction aligns with the black-box target.

What would settle it

Train a ResNet-18 on CIFAR-10 with the same hyperparameters and learning-rate schedule but using only hard-label cross-entropy (no teachers), generate PGD attacks against GoogLeNet, and compare the attack success rate and generation time. If the vanilla student matches or exceeds the distilled students' 0.95 PGD ASR, the paper's attribution of transferability to knowledge distillation is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that a lightweight student trained by multi-teacher knowledge distillation acquires decision boundaries that locally align with a black-box target's boundaries, making its gradients slightly more transferable. In their experiments the curriculum-trained student achieves an FGS attack success rate of 0.86 and a PGD success rate of 0.95 against GoogLeNet, compared with 0.77 and 0.96 for the teacher ensemble baseline, while generating the 10,000 PGD attacks in 33 seconds rather than 201 seconds. The paper also claims that setting the distillation temperature to $\tau=1$ and including hard-label supervision via $\alpha=0.3$ consistently improves transferability, and that both curriculum-based switching and joint optimization produce competitive students.

Load-bearing premise

The paper assumes that multi-teacher distillation, rather than the student's small architecture or a generic training setup, is what produces the transferable decision boundaries; because no normally trained ResNet-18 baseline is reported, the causal contribution of KD is not directly tested.

Editorial extensions

If this is right

  • Black-box attacks can be generated roughly six times faster without sacrificing transferability, which makes large-scale adversarial evaluation and adversarial training pipelines more practical.
  • Multi-teacher knowledge distillation offers a way to build small surrogate models that approximate the attack performance of a teacher ensemble.
  • The ablation's finding that low temperature and hard-label supervision improve transferability gives a concrete recipe for training surrogate models.
  • The student's 33-second PGD generation time suggests that iterative attacks can be run in settings where ensemble-based generation would be too slow.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the paper does not compare against a normally trained ResNet-18 without teachers, part of the speedup may simply reflect the student's small size; a no-distillation baseline would determine whether KD itself adds transferability beyond the architecture.
  • The decision-boundary argument implies a direct, testable measure: the cosine similarity between the student's input gradient and the black-box model's gradient should predict transferability; measuring it across models would validate the proposed mechanism.
  • The experiments are limited to CIFAR-10 and a single GoogLeNet target; on higher-resolution datasets or defended models, the local-alignment effect may not hold, and the speed advantage may shrink relative to larger inputs.
  • If the findings extend, adversarial defenses that erase local gradient alignment (for example, gradient masking) would be a natural countermeasure, and testing against such defenses would sharpen the practical scope.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper investigates whether multi-teacher knowledge distillation (KD) can improve the transferability of adversarial examples. The authors train ResNet-18 students using two multi-teacher strategies—curriculum-based switching and joint optimization—with ResNet-50 and DenseNet-161 as teachers on CIFAR-10, then generate FG, FGS, and PGD attacks and evaluate them against a black-box GoogLeNet target. They report attack success rates, RMSD, and PGD generation time, claiming that the best curriculum student achieves PGD ASR 0.95 versus 0.96 for the teacher ensemble while taking 33 seconds versus 201 seconds. An ablation over temperature τ and loss weight α is used to conclude that lower temperature and inclusion of hard-label supervision improve transferability.

Significance. If the central claim is substantiated, the result would be practically useful: a small distilled surrogate model generating adversarial examples with transferability comparable to an ensemble while reducing PGD attack generation time by roughly 6x. The paper provides clear tables, a reasonable experimental setup, and an honest limitations section that acknowledges the narrow scope of two teachers, one target, and one dataset. However, the causal attribution to knowledge distillation is currently untested because no no-distillation baseline is reported, and the headline configuration is selected post hoc from the ablation. These issues, if fixed, would make the paper a modest but useful empirical contribution; as it stands, the main mechanism claim is not supported by the evidence presented.

major comments (4)
  1. [Section 4.1, Eq. (3), Table 1] The central claim that multi-teacher KD is responsible for the observed transferability is untested because the experimental design never removes the teachers. The loss in Eq. (3) is LKD = α·Lhard + (1−α)·Lsoft, but the experiments only vary α ∈ {0, 0.3}, so every student is trained with teacher soft targets contributing 70–100% of the loss. No condition with α = 1 (which reduces the loss to hard-label cross-entropy) or with a normally trained ResNet-18 is reported. Consequently, the high ASRs in Table 1 could be due to architecture choice, optimization, or seed rather than to distillation. Please add a hard-label-only ResNet-18 baseline trained with the same optimization schedule and report its FG/FGS/PGD ASR and generation time; without it, the paper's contribution reduces to 'small surrogate models are faster,' which is already known.
  2. [Section 4.1, Section 4.2, Table 2] The headline result is selected post hoc from the ablation. The text states, 'We report the student models with the best transferability: trained with higher learning rate, α = 0.3 and τ = 1,' after presenting the full ablation in Table 2. With only two random seeds and no error bars or confidence intervals, choosing the best configuration from the same table risks overfitting to the specific target model. This is load-bearing because the claims about τ and α in Section 4.2 rely on ASR differences as small as 0.01–0.03 (e.g., PGD 0.95 vs. 0.94, 0.93 vs. 0.90). Please report mean and standard deviation over all seeds for every configuration, and either pre-register the selection rule or report results for all configurations without selecting the maximum.
  3. [Section 5.1 vs. Table 1] The geometric explanation in Section 5.1 is inconsistent with the quantitative results. The section claims that the student's PGD transferability 'falls off' relative to the ensemble because the student learns only a tight, local decision boundary, yet Table 1 shows the curriculum student at PGD ASR 0.95 versus 0.96 for the ensemble—a one-point gap—and for FG the student actually outperforms the ensemble (0.78 vs. 0.69). If the student's boundary is globally tight, one would expect a larger PGD deficit and not a simultaneous advantage on one-step attacks. Moreover, Figure 3 is a two-dimensional projection for a single image along one arbitrary orthogonal direction, and no quantitative link between the projected boundary and the reported ASRs is provided. Please either qualify Figure 3 as illustrative and reconcile it with Table 1, or provide a quantitative measure connecting the boundary geometry to the attack results.
  4. [Section 3.3, reproducibility] The attack hyperparameters are not specified, which prevents reproduction and comparison. Section 3.3 says that for PGD the perturbation magnitude, step size, and number of iterations are 'held constant across experiments,' but their values are never given; the same applies to ϵ for FG and FGS. The only reported attack budget is the approximate RMSD of 25. Please list the exact ϵ, step size, iteration count, and any projection details. Additionally, Table 3 in Appendix A reports PGD times identical to Table 2 (e.g., 33.01, 32.45) for models trained with a different learning rate; since the student models differ, identical times to the second decimal are suspicious and should be verified or explained.
minor comments (5)
  1. [Throughout] There are numerous typos and inconsistencies: 'DenseNet-151' appears instead of 'DenseNet-161' in Table 1 and the text; 'transerable' should be 'transferable'; the attack names are used inconsistently (FG/FGS in the main text vs. FGM/FGSM in Figure 2); and 'blackbox' and 'black-box' are mixed. A careful proofread is needed.
  2. [Section 3.4] The section 'Comparison Between Current Work and Initial Proposal' is unusual in a research paper; it reads like a project report. This material should be moved to a supplementary document or removed, since it does not contribute to the scientific content.
  3. [Figure 3] The construction of Figure 3 is underspecified. The caption states that the X-axis is the normalized gradient direction of the black-box model and the Y-axis is a random orthogonal direction, but the text does not explain how these directions are computed, how the boundary is extracted, or whether the shaded regions represent correct-class regions for each model. Please clarify.
  4. [References] The references contain a duplicate: Szegedy et al. (2013) and Szegedy et al. (2014) refer to the same paper but are listed separately and cited inconsistently in Section 2.1. The code and pretrained weights are referred to as 'here' and 'this link' without actual URLs; please include the links.
  5. [Section 2.2.1] The claim that 'prior works have extended KD to use multiple teachers' is supported by only three references, one of which is the original Hinton paper. Given that multi-teacher KD is a well-studied area, the related work should be expanded to include more representative methods, especially those that compare curriculum and joint training strategies.

Circularity Check

0 steps flagged · score 0.0 of 10

Central result is an external, measured comparison (student PGD ASR 0.95 vs ensemble 0.96 on black-box GoogLeNet), so nothing reduces to its inputs; the untested KD-causality concern is a missing-control validity gap, not circularity.

full rationale

The paper's central claims are empirical measurements against an external black-box target (GoogLeNet on CIFAR-10), so no derivation step reduces to its own inputs. The student PGD ASR of 0.95 (Table 1), the ensemble's 0.96, and the 33 s vs 201 s runtime are measured quantities; none is derivable from the distillation loss LKD = α·Lhard + (1−α)·Lsoft (Eq. 3), and the ASR outcome could have gone against the paper (the student in fact trails the ensemble on PGD and leads on FG/FGS, where differences are a few points). The KD loss and the ASR metric are independently defined — transferability is not a restatement of the training objective. There are no self-citations: all references (Hinton et al. 2015; Madry et al. 2018; Liu et al. 2017; Fukuda et al. 2017; etc.) are external, and no uniqueness theorem or ansatz is imported from the authors' own prior work, so self-citation patterns do not apply. Reported concerns about the headline configuration being chosen after inspecting the ablation (Section 4.1 picks α=0.3, τ=1, lr=1e−2 from Table 2) and the 'lower temperature and hard-label supervision enhance transferability' conclusion being read from the same table are selection/statistical-inference issues; they are not reduction-by-construction because the ASRs are externally measured and the full ablation is disclosed in Tables 2 and 3. The genuine weaknesses are correctness risks rather than circularity: (i) no vanilla ResNet-18 trained without teachers is evaluated, and the ablation grid α ∈ {0, 0.3} never removes the soft-target term (α=1), leaving the causal role of multi-teacher KD untested; (ii) Section 5.1's claim that student PGD transferability 'falls off' relative to the ensemble sits oddly with the 0.95 vs 0.96 gap; (iii) Section 6 properly scopes the study (two teachers, CIFAR-10, single GoogLeNet target), an acknowledged generalizability limitation. These affect the strength of the causal claim, not the circularity of the derivation.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The headline result depends on the selected distillation hyperparameters, the domain assumption that CIFAR-10 and GoogLeNet are representative, and the untested causal premise that KD (not architecture) drives transferability. No invented entities are introduced.

free parameters (4)
  • Distillation temperature tau = 1 (selected from {1,5})
    The headline results use tau=1 because it yielded highest ASR in Table 2; lower temperature is a post-hoc selection, not a derived optimum.
  • Loss weight alpha = 0.3 (selected from {0,0.3})
    alpha=0.3 chosen after ablation; alpha=0 (soft-only) often yields lower transferability, so the 'hard-label supervision helps' conclusion is based on this small grid.
  • Maximum learning rate = 1e-2 (selected from {1e-2,1e-3})
    Headline results use lr=1e-2 because the model achieving higher validation accuracy was reported; lower-lr results in Appendix A show lower PGD ASR for the same config.
  • PGD step size and epsilon budget = unreported values chosen to reach RMSD around 25
    Section 3.3 says settings are held constant but does not give epsilon or step size; the 6x runtime comparison depends on these unspecified values.
assumptions (4)
  • domain assumption CIFAR-10 is a representative benchmark for black-box adversarial transferability
    Only one dataset and one target (GoogLeNet) are used; the limitations section concedes results may differ on other benchmarks or targets.
  • domain assumption The pretrained teacher models provide decision boundaries that are useful for constructing transferable attacks
    The method presumes teachers have accurate and diverse decision boundaries; no analysis of teacher accuracy beyond attack ASR is provided.
  • ad hoc to paper Soft-label distillation from multiple teachers is the cause of student transferability, not architecture or seed
    No non-distilled ResNet-18 baseline is reported, so the attribution of transferability to KD is assumed rather than tested.
  • ad hoc to paper The 2D decision-boundary projection captures the geometry relevant to gradient alignment
    Section 5.1 and Figure 3 infer explanations from a 2D projection along the black-box gradient and a random orthogonal direction; this projection may miss relevant directions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Teach Me to Trick: Exploring Adversarial Transferability via Knowledge Distillation." pith.science (2026). https://pith.science/paper/3PEHNHI7

@misc{pith2026250721992,
  author       = {Pith},
  title        = {Pith review of: Teach Me to Trick: Exploring Adversarial Transferability via Knowledge Distillation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3PEHNHI7}},
  note         = {Machine review of arXiv:2507.21992}
}
read the original abstract

We investigate whether knowledge distillation (KD) from multiple heterogeneous teacher models can enhance the generation of transferable adversarial examples. A lightweight student model is trained using two KD strategies: curriculum-based switching and joint optimization, with ResNet50 and DenseNet-161 as teachers. The trained student is then used to generate adversarial examples using FG, FGS, and PGD attacks, which are evaluated against a black-box target model (GoogLeNet). Our results show that student models distilled from multiple teachers achieve attack success rates comparable to ensemble-based baselines, while reducing adversarial example generation time by up to a factor of six. An ablation study further reveals that lower temperature settings and the inclusion of hard-label supervision significantly enhance transferability. These findings suggest that KD can serve not only as a model compression technique but also as a powerful tool for improving the efficiency and effectiveness of black-box adversarial attacks.

Figures

Figures reproduced from arXiv: 2507.21992 by the authors.

Figure 1
Figure 1. General Workflow for our proposed Knowledge Distillation Training Setup. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Adversarial examples and Grad-CAM attributions. Top: predictions and confidences for original and [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Decision Boundaries for models using in this [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 3 canonical work pages

  1. [1]

    Nicholas Carlini and David Wagner. 2017. https://arxiv.org/abs/1608.04644 Towards evaluating the robustness of neural networks . IEEE Symposium on Security and Privacy (SP)

    arXiv 2017

  2. [2]

    Takashi Fukuda, Masayuki Suzuki, Gakuto Kurata, Samuel Thomas, Jia Cui, and Bhuvana Ramabhadran. 2017. https://doi.org/10.21437/Interspeech.2017-614 Efficient knowledge distillation from an ensemble of teachers . In Interspeech 2017, pages 3697--3701

    doi:10.21437/interspeech.2017-614 2017

  3. [3]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572

    arXiv 2015

  4. [4]

    Maybank, and Dacheng Tao

    Jianping Gou, Baosheng Yu, Stephen J. Maybank, and Dacheng Tao. 2021. https://doi.org/10.1007/s11263-021-01453-z Knowledge distillation: A survey . International Journal of Computer Vision, 129(6):1789–1819

    doi:10.1007/s11263-021-01453-z 2021

  5. [5]

    Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. https://arxiv.org/abs/1503.02531 Distilling the knowledge in a neural network . arXiv preprint arXiv:1503.02531

    arXiv 2015

  6. [6]

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. https://arxiv.org/abs/1611.02770 Delving into transferable adversarial examples and black-box attacks . In Proceedings of the 5th International Conference on Learning Representations (ICLR)

    arXiv 2017

  7. [7]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR)

    work page 2018

  8. [8]

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. In arXiv preprint arXiv:1605.07277

    arXiv 2016

Show all 14 references
  1. [9]

    Yunxiao Qin, Yuanhao Xiong, Xinyun Chen, Chang Liu, and Dawn Song. 2019. Training a meta-surrogate model for transfer attacks. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 1298--1306

    2019

  2. [10]

    Adriana Romero, Nicolas Ballas, Samira Ebrahimi Kahou, Antoine Chassang, Carlo Gatta, and Yoshua Bengio. 2015. https://arxiv.org/abs/1412.6550 Fitnets: Hints for thin deep nets . Preprint, arXiv:1412.6550

    2015 arXiv

  3. [12]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199

    2014 arXiv

  4. [13]

    Florian Tram \`e r, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2017. Space of transferable adversarial examples. In arXiv preprint arXiv:1704.03453

    2017 arXiv

  5. [14]

    Fei Yin, Yong Zhang, Qianru Li, Yinghui Zhang, Yi Tay, and Ngai-Man Cheung. 2020. Generalizable black-box adversarial attack with meta learning. In European Conference on Computer Vision (ECCV), pages 685--702. Springer

    2020

  6. [15]

    Hospedales, and Huchuan Lu

    Ying Zhang, Tao Xiang, Timothy M. Hospedales, and Huchuan Lu. 2017. https://arxiv.org/abs/1706.00384 Deep mutual learning . Preprint, arXiv:1706.00384

    2017 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.