Pith. sign in

REVIEW 4 major objections 6 minor 23 references

Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformation

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a Segmented Gaussian Pyramid input transformation raises black-box attack transferability against defended models by 2.3 to 32.6 percentage points on average, and composes with existing input transformations to give…

desk verdict SGP is an incremental but genuinely plug-in input-transformation attack with consistent gains, yet the headline numbers are confounded by a 7x compute multiplier and m tuned on the evaluation defenses. read the letter →

arxiv 2507.01791 v1 pith:JAZDPD4D submitted 2025-07-02 cs.CV

Zihong Guo , Chen Wan , Yayin Zheng , Hailing Kuang , Xiaohai Lu This is my paper
classification cs.CV
keywords adversarialexamplestransferabilityblack-boxattacksinputtransformationmulti-scaleGaussianpyramiddefensemodelsMI-FGSM
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to establish that a simple multi-scale input transformation, the Segmented Gaussian Pyramid (SGP), makes adversarial examples transfer to defended black-box models more often than existing single-scale input transformations. SGP smooths the image with a Gaussian filter and downsamples it three ways, rows and columns, rows only, and columns only, across several pyramid layers, producing seven versions at the default depth, then averages the loss gradients over all versions to update the perturbation. The paper reports average attack-success gains of 2.3% to 32.6% for SGP alone against seven defenses, and larger gains when SGP is inserted into existing transformations such as DIM, TIM, SIM, Admix, SSA, and BSR. The practical point is that the method needs no knowledge of the target model and is an off-the-shelf add-on to gradient-based attacks.

What carries the argument

The central object is the Segmented Gaussian Pyramid (SGP), an input transformation that at each layer convolves the current image with a $5\times5$ Gaussian kernel and then produces three downsampled versions by taking odd rows and columns, odd rows only, or odd columns only; the next layer continues from the row-and-column version. With $m$ layers this yields $3m-2$ multi-scale examples, so $m=3$ gives seven. The gradients of the loss with respect to each resized version are averaged into one composite gradient, and that averaged gradient is fed into the momentum update of MI-FGSM or into whatever attack the transformation is attached to. The mechanism is diversification: the multi-resolution versions force the perturbation to generalize across input scales rather than overfit a single white-box model.

What would settle it

Run SGP with depths 1 through 8 against a fresh set of defended models that played no part in choosing the depth, and compare each depth's average attack success to the best single-scale baseline; if depth 3 does not beat depths 4 through 8, or does not beat DIM, TIM, SIM, Admix, and SSA by the reported margin, the paper's central claim fails.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that replacing a single input image with a segmented Gaussian pyramid, at the default three layers, one original plus six filtered-and-downsampled variants, and averaging the gradients computed on each variant yields transferable adversarial examples that are consistently more effective against seven defended models than examples crafted with DIM, TIM, SIM, Admix, or SSA alone. The reported improvements are based purely on transferability: the adversarial examples are crafted on normally trained white-box models and evaluated on defended models they were never trained against. The same pyramid operation also composes with existing input transformations, and the paper reports that the combined attacks improve average success rates over the base transformations by 10.6 to 33.7 percentage points, with SGP-BSR reaching a 74.1 percent average against the seven defenses on Inc-v3-crafted examples; in the ensemble-model setting the gains are 12.3 to 35.6 points.

Load-bearing premise

The headline gains assume that the choice of three pyramid layers, selected by trying depths 1 through 8 on only three of the seven evaluation defenses, also gives the best or near-best results on the other four defenses, and that 1000 images is enough to make the reported averages stable.

Editorial extensions

If this is right

  • SGP-MI-FGSM alone beats each single-scale input transformation it is compared with, with average success-rate gains from 2.3 to 32.6 points across seven defended models.
  • Because SGP is composed at the input level, it stacks with attacks whose internal logic is gradient averaging; every such combination is reported to improve over its base method.
  • The largest reported single-model gain comes from SGP-BSR: 74.1 percent average success on seven defenses versus the BSR baseline, an increase of 33.7 points.
  • The cost of the transformation is predictable: $T$ attack iterations require $(3m-2)T$ gradient evaluations, so the default $m=3$ multiplies the per-iteration cost by seven.
  • Ensemble-crafted SGP attacks reach 84.3 percent average success for SGP-STDM and 86.4 percent for SGP-BSR, suggesting the gain is not an artifact of a single source model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the pyramid depth $m$ was fixed to 3 using an ablation on three ensemble defenses, the most direct test of the paper's headline is whether $m=3$ remains optimal when chosen on held-out defenses; if it does not, the reported 2.3 to 32.6 point range would need to be re-estimated.
  • The anisotropic sampling, row-only and column-only, is unusual among input transformations; a natural extension would be to test whether those versions specifically help against defenses that exploit aspect-ratio or translation cues, and whether other anisotropic schemes such as stripe or checkerboard sampling behave similarly.
  • All experiments use one 1000-image subset with $\epsilon=16$ and 10 iterations; the transferability gap could shrink or grow at other perturbation budgets, so the practical claim should be read as applying to this operating point until wider sweeps are run.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Segmented Gaussian Pyramid (SGP), an input transformation for transfer-based black-box attacks. SGP builds a pyramid of multi-scale images by Gaussian filtering followed by row&column, row-only, and column-only downsampling, then averages gradients over the resulting 3m-2 transformed examples at each iteration. The method is integrated with MI-FGSM and with existing transformations (DIM, TIM, SIM, Admix, SSA, BSR) and evaluated on 1000 ImageNet images against seven defense models, reporting average attack success rate gains of 2.3% to 32.6% in single-transformation experiments and larger gains when combined with other transformations.

Significance. If the reported gains are attributable to the multi-scale transformation itself, SGP would be a simple, plug-in enhancement to a broad class of transfer attacks, and the paper would be a useful empirical contribution. The table results are internally consistent: SGP beats the corresponding baseline in nearly every reported cell across Tables 1-3, and the extensibility experiments are thorough in covering six existing transformations. However, the central quantitative claims are currently confounded by an unequal computational budget: with m=3, SGP uses 7 gradient evaluations per iteration against 1 for the baselines, so the headline percentages do not isolate the effect of the pyramid construction. The lack of error bars or significance tests, the selection of m on defense models that later appear in the main evaluation, and the absence of released code further limit the interpretability and reproducibility of the results.

major comments (4)
  1. [Section 3.3, Eq. (4), Algorithm 1] The experiments compare SGP against baselines under unequal computational budgets. With m=3, Eq. (4) and Algorithm 1 average gradients over 3m-2 = 7 multi-scale examples per iteration, so each SGP update requires 7 forward-backward passes, versus 1 for MI-FGSM and for each single-scale baseline. With T=10, SGP uses 70 gradient evaluations per image while the baselines use 10; the same 7x multiplier applies when SGP is combined with DIM, TIM, SIM, Admix, SSA, or BSR. The paper acknowledges the added cost in Section 3.3 but never compares against a baseline with an equal number of gradient evaluations or reports wall-clock time. As a result, the reported 2.3% to 32.6% improvements could reflect ensembling over many more gradient computations rather than the specific pyramidal composition of scales. The central claim would be supported only if SGP outperforms a fixed-compute baseline, e.g., MI-FGSM with T=70, or a baseline that averages gradients over 7 independently sampled single-scale transformations.
  2. [Section 4.5, Fig. 3] The pyramid layer count m=3 is chosen in the ablation study of Section 4.5 using three defense models (Inc-v3ens3, Inc-v3ens4, IncRes-v2ens) that are also part of the seven-model evaluation set in Tables 1-3. Selecting a hyperparameter on the same defense families that are later used to report headline improvements risks optimism in the claimed 2.3%-32.6% gains. The authors should either fix m on an independent validation set (e.g., defenses not used in the main table) or explicitly report results for a range of m across all defenses to show the gains are not an artifact of this selection.
  3. [Tables 1-3, Section 4.1] All attack success rates are reported as point estimates on a 1000-image subset, with no error bars, confidence intervals, or significance tests. Differences of 2.3% (e.g., Iv3 SGP 32.8% vs. SSA 29.1% in Table 1) are small relative to the likely binomial sampling noise at n=1000 (about ±3% at the 95% level for rates near 30%). Without variability information or a per-image paired comparison, the claim that SGP 'significantly enhances' transferability is not statistically supported, even abstracting away from the compute-budget issue.
  4. [Section 4.2, Table 1] The single-transformation comparison mixes SGP with single-scale baselines but does not include a multi-scale baseline that does not use the Gaussian pyramid structure, such as averaging gradients over several random resized crops or over several SIM scales of equal count. Adding such a control would isolate whether the benefit comes from multi-scale processing per se or simply from averaging more, distinct gradient signals; this is a necessary experiment for the paper's stated motivation.
minor comments (6)
  1. [Section 3.2 title] The section title reads 'Segmented Gaussion Pyramid'; 'Gaussion' should be 'Gaussian'.
  2. [Section 3.3] The phrase 'as fallows' should be 'as follows'; also, the earlier sentence 'the crafted adversarial example is x_{t+1}^{adv}' uses the subscript inconsistently with Algorithm 1, where the update produces x_{t+1}^{adv} from x_t^{adv}.
  3. [Section 3.2, Eq. (3)] The indexing in Eq. (3) is ambiguous: it states 0 ≤ i ≤ m-1 but x[i+1] is elsewhere defined for i ≥ 1, and the text says 'when i=1, x[1] is the input example.' Please clarify whether layers are counted from 0 or from 1, and align the range of i in Eq. (3) with the definition of m and with the 3m-2 count.
  4. [Section 4.1 and Tables 1-3] There are inconsistent abbreviations across the paper: 'SPG' appears instead of 'SGP' in the text above Table 1 and in the contribution list; 'NPR' in Table 2 and in the model list appears as 'NRP' in Table 3; and 'SGP-SI-TI-DM' in Section 4.3 is written as 'SGP-STDM' in Table 2. These should be harmonized.
  5. [Section 4.4, Table 3] The last row of Table 3 reports '85.6↑26.1' for both the first column (Inc-v3ens3) and the Average column, but the surrounding numbers are different; please verify that the entries are correct and that the average is computed consistently with the per-defense values.
  6. [References] Reference [6] is a previous work by the same group (Wan and Huang) but is cited in the introduction alongside unrelated methods; if it is meant to illustrate an advanced gradient method, please clarify the connection, or move it to a more appropriate place in the related-work discussion.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: SGP is an empirically evaluated transformation; its reported gains are benchmark measurements, not derived consequences of its own assumptions.

full rationale

The paper contains no derivation chain that reduces to its inputs. SGP is defined constructively by Eqs. (1)-(4) and Algorithm 1: Gaussian filtering, three downsampling schemes, and averaging of gradients over 3m-2 multi-scale examples. The headline claim (2.3%-32.6% average improvement over baselines, Tables 1-3) is an empirical comparison against external black-box defense models, not a quantity obtained by definition from a fitted parameter. The only self-citation, Ref. [6] (Wan and Huang, Prediction-Correction), is used in the Introduction as an example of 'advanced gradient computations' and plays no role in justifying SGP's mechanism; it is therefore not load-bearing. The m=3 hyperparameter is chosen in Section 4.5 by an ablation on three of the seven defense models (Inc-v3ens3, Inc-v3ens4, IncRes-v2ens) that also appear in the main evaluation tables. That is a standard hyperparameter-selection procedure and a possible source of optimistic evaluation, but it is not circular reasoning: no reported success rate is the algebraic identity of an input. Likewise, the unequal gradient-budget comparison (7 gradient evaluations per iteration for SGP with m=3 versus 1 for baselines, acknowledged in Section 3.3) is an experimental control concern about interpretability, not a circularity. Overall, the paper's central claim has independent empirical content and is not forced by self-citation or by definition.

Assumptions & free parameters 6 free parameters · 3 assumptions · 0 invented entities

The method is empirical; the only axioms are domain heuristics about multi-scale gradient averaging and dataset representativeness. The main free parameter is m, tuned on the evaluation defenses, while the Gaussian kernel, sampling schemes, and resize behavior are hand-chosen. No new physical or architectural entities are introduced.

free parameters (6)
  • Pyramid layer count m = 3
    Selected via ablation on Inc-v3ens3, Inc-v3ens4, and IncRes-v2ens (Sec. 4.5), which are three of the seven target defense models; all headline tables use m=3.
  • Gaussian kernel weights (5x5, Eq. 1) = 1/256 times binomial(4) kernel
    Fixed by hand, not derived; central to the blur stage of the pyramid.
  • Downsampling scheme set (row&column, row-only, column-only) = three schemes
    Design choice; no ablation over alternative anisotropic sampling schemes is reported.
  • Resize operation R(.) = not specified
    All multi-scale examples are resized to the input dimension, but the interpolation method is not stated.
  • Attack hyperparameters epsilon, T, mu = 16, 10, 1
    Standard MI-FGSM settings from prior work; they affect absolute success rates but not the relative comparisons.
  • Baseline transformation hyperparameters = DIM p=0.5, TIM 7x7, SIM 5, Admix 3/0.2, SSA 0.5/epsilon, BSR 2x2/24deg
    Copied from the cited baseline papers; not retuned for SGP, but they influence the size of reported gains.
assumptions (3)
  • domain assumption Averaging gradients over Gaussian pyramid scales of the input improves transferability.
    Motivated in Sec. 3.1 by analogy to the human visual system and a citation to spatial-context work, but never proven; the entire method rests on this heuristic.
  • ad hoc to paper The m=3 layer count chosen by ablation is treated as a fixed hyperparameter for all main results.
    The choice is empirical and made partly on the target defenses, so the reported gains may be optimistic if m is overfit.
  • domain assumption The 1000-image ImageNet subset and the seven defense models are representative enough to support average success-rate claims.
    Sec. 4.1 defines the dataset and models; no confidence intervals, multiple subsets, or statistical tests are provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformation." pith.science (2026). https://pith.science/paper/JAZDPD4D

@misc{pith2026250701791,
  author       = {Pith},
  title        = {Pith review of: Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JAZDPD4D}},
  note         = {Machine review of arXiv:2507.01791}
}
read the original abstract

The transferability of adversarial examples poses a significant security challenge for deep neural networks, which can be attacked without knowing anything about them. In this paper, we propose a new Segmented Gaussian Pyramid (SGP) attack method to enhance the transferability, particularly against defense models. Unlike existing methods that generally focus on single-scale images, our approach employs Gaussian filtering and three types of downsampling to construct a series of multi-scale examples. Then, the gradients of the loss function with respect to each scale are computed, and their average is used to determine the adversarial perturbations. The proposed SGP can be considered an input transformation with high extensibility that is easily integrated into most existing adversarial attacks. Extensive experiments demonstrate that in contrast to the state-of-the-art methods, SGP significantly enhances attack success rates against black-box defense models, with average attack success rates increasing by 2.3% to 32.6%, based only on transferability.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

23 extracted references · 18 canonical work pages

  1. [1]

    In: AAAI Conference on Artificial Intelligence

    Chen, M., Lin, M., Li, K., Shen, Y., Wu, Y., Chao, F., Ji, R.: CF-ViT: A General Coarse-to- Fine Method for Vision Transformer. In: AAAI Conference on Artificial Intelligence. (2022)

    work page 2022

  2. [2]

    In: 2023 IEEE/CVF International Confer- ence on Computer Vision (ICCV), pp

    Wei, Y., Zhao, L., Zheng, W., Zhu, Z., Zhou, J., Lu, J.: SurroundOcc: Multi -Camera 3D Occupancy Prediction for Autonomous Driving. In: 2023 IEEE/CVF International Confer- ence on Computer Vision (ICCV), pp. 21672-21683. (2023)

    work page 2023

  3. [3]

    In: 2023 IEEE/CVF International Conference on Computer Vision (ICCV), pp

    Dan, J., Liu, Y., Xie, H., Deng, J., Xie, H., Xie, X., Sun, B.: TransFace: Calibrating Trans- former Training for Face Recognition from a Data-Centric Perspective. In: 2023 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 20585-20596. (2023)

    work page 2023

  4. [4]

    In: 2024 IEEE International Conference on Mul- timedia and Expo (ICME), pp

    Deng, H., Fang, Y., Huang, F.: Enhancing Adversarial Transferability on Vision Trans- former by Permutation-Invariant Attacks. In: 2024 IEEE International Conference on Mul- timedia and Expo (ICME), pp. 1-6. (2024)

    work page 2024

  5. [5]

    In: 2021 IEEE International Conference on Multimedia and Expo (ICME), pp

    Huang, L., Gao, C., Zhuang, W., Liu, N.: Enhancing Adversarial Examples Via Self -Aug- mentation. In: 2021 IEEE International Conference on Multimedia and Expo (ICME), pp. 1-6. (2021)

    work page 2021

  6. [6]

    arXiv:2306.01809 (2023)

    Wan, C., Huang, F.: Adversarial Attack Based on Prediction-Correction. arXiv:2306.01809 (2023)

    arXiv 2023

  7. [8]

    In: Proc

    Wang, X., He, X., Wang, J., He, K.: Admix: Enhancing the transferability of adversarial attacks. In: Proc. IEEE Int. Conf. on Computer Vision (ICCV), pp. 16158-16167. (2021)

    work page 2021

  8. [9]

    In: Proc

    Wang, K., He, X., Wang, W., Wang, X.: Boosting adversarial transferability by block shuffle and rotation. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 24336-24346. (2024) 12 Z. Guo, C. Wan, Y. Zheng, H. Kuang, X. Lu

    work page 2024

Show all 23 references
  1. [10]

    In: AAAI Conference on Artificial Intelligence

    Li, Y., Bai, S., Zhou, Y., Xie, C., Zhang, Z., Yuille, A.L.: Learning Transferable Adversarial Examples via Ghost Networks. In: AAAI Conference on Artificial Intelligence. (2018)

    2018

  2. [11]

    In: Proc

    Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., Yuille, A.L.: Improving transferability of adversarial examples with input diversity. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 2730-2739. (2019)

    2019

  3. [12]

    In: Proc

    Dong, Y., Pang, T., Su, H., Zhu, J.: Evading defenses to transferable adversarial examples by translation -invariant attacks. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 4312-4321. (2019)

    2019

  4. [13]

    arXiv:1908.06281 (2019)

    Lin, J., Song, C., He, K., Wang, L., Hopcroft, J.E.: Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv:1908.06281 (2019)

    2019 arXiv

  5. [14]

    In: Proc

    Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J.: Boosting adversarial attacks with momentum. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 9185-9193. (2018)

    2018

  6. [15]

    In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp

    Saha, A., Subramanya, A., Patil, K., Pirsiavash, H.: Role of Spatial Context in Adversarial Robustness for Object Detection. In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 3403-3412. (2019)

    2019

  7. [16]

    arXiv:1705.07204 (2017)

    Tramè r, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P.: Ensemble adversarial training: Attacks and defenses. arXiv:1705.07204 (2017)

    2017 arXiv

  8. [17]

    In: Proc

    Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., Zhu, J.: Defense against adversarial attacks using high-level representation guided denoiser. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 1778-1787. (2018)

    2018

  9. [18]

    arXiv:1711.01991 (2017)

    Xie, C., Wang, J., Zhang, Z., Ren, Z., Yuille, A.: Mitigating adversarial effects through randomization. arXiv:1711.01991 (2017)

    2017 arXiv

  10. [19]

    In: Proc

    Naseer, M., Khan, S., Hayat, M., Khan, F.S., Porikli, F.: A self -supervised approach for adversarial robustness. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 262-271. (2020)

    2020

  11. [20]

    arXiv:1611.02770 (2016)

    Liu, Y., Chen, X., Liu, C., Song, D.X.: Delving into Transferable Adversarial Examples and Black-box Attacks. arXiv:1611.02770 (2016)

    2016 arXiv

  12. [21]

    In: Proc

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the inception architecture for computer vision. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 2818-2826. (2016)

    2016

  13. [22]

    In: Proc

    Szegedy, C., Ioffe, S., Vanhoucke, V., Alemi, A.: Inception -v4, inception-resnet and the impact of residual connections on learning. In: Proc. AAAI Conf. on Artificial Intelligence (AAAI). (2017)

    2017

  14. [23]

    In: 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp

    He, K., Zhang, X., Ren, S., Sun, J.: Deep Residual Learning for Image Recognition. In: 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770 -778. (2015)

    2015

  15. [24]

    In: Proc

    Long, Y., Zhang, Q., Zeng, B., Gao, L., Liu, X., Zhang, J., Song, J.: Frequency domain model augmentation for adversarial attack. In: Proc. Eur. Conf. on Computer Vision (ECCV), pp. 549-566. Springer (2022)

    2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.