REVIEW 3 major objections 3 minor 1 cited by
Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training
T0 review · 3 major / 3 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read This paper claims that the accuracy-robustness trade-off in adversarial training comes from over-learning hard adversarial examples, not under-learning them, and proposes a Robust Perception Adversarial Training (RPAT) objective that…
desk verdict The abstract promises RPAT adversarial training, but the body is an unrelated CoT compression paper; as submitted the central claim has zero support, though the body itself is a decent paper on its own. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the Robust Perception objective, which formalizes the idea that a model's internal representation should vary smoothly with the size of the input perturbation. RPAT trains the network so that this smooth-perception requirement supports the decision boundary in an appropriate place; the claimed effect is that the network stops treating adversarial noise as meaningless and instead uses the perturbation direction to transition gradually toward the boundary.
What would settle it
Check the paper's experimental section and code repository for the RPAT loss and the reported CIFAR-10, CIFAR-100, and Tiny-ImageNet results against the twelve baselines; if the method or experiments are absent, the central claim has no evidence. A direct re-run of RPAT versus standard adversarial training on ResNet-18 with CIFAR-10, reporting clean accuracy and robust accuracy under the same attack, would settle whether the trade-off improvement is real.
Extended reading notes
Core claim
The central claim is that hard adversarial samples that can still attack the robust model after adversarial training are already learned better than those that are successfully defended, so the accuracy-robustness trade-off comes from over-sufficient learning of these hard samples, which degrades the decision boundary. The proposed remedy is Robust Perception Adversarial Training (RPAT), a new training objective defined by a Robust Perception principle: the model's perception should change smoothly as input perturbations increase, so the decision boundary can settle at an appropriate location rather than being distorted. The paper reports that RPAT outperforms four common baselines and twelve prior methods on CIFAR-10, CIFAR-100, and Tiny-ImageNet using ResNet-18, PreActResNet-18, and WideResNet-34-10.
Load-bearing premise
The load-bearing premise is that the reported experimental validation actually exists and is correct, since the supplied full text is a different manuscript and contains no RPAT definition, no loss formula, and none of the CIFAR experiments.
Editorial extensions
If this is right
- If over-learning of hard samples is the true cause, adversarial training objectives should stop escalating pressure on samples that already attack the model and instead regularize perception smoothness.
- The accuracy-robustness trade-off would be a correctable training artifact rather than an inherent limit, since the boundary is being misplaced by excessive consistency pressure.
- Robust Perception-style objectives could be combined with existing adversarial training losses to improve clean accuracy without lowering robustness.
- The reported gains across three datasets and three architectures, if valid, would show the effect is not limited to one benchmark.
- Standard diagnostics of under-learning, such as focusing more iterations on the hardest samples, would be expected to worsen the trade-off under this account.
Reading between the lines
- The supplied full text is a different paper on chain-of-thought redundancy compression; it never defines Robust Perception or RPAT and reports no adversarial-training experiments, so the abstract's claims currently rest on experiments described only in the abstract.
- If the over-learning account is correct, one testable extension is that continued training on already-attacking hard samples should increase boundary distortion, such as larger curvature or smaller margins, while early training on them should not.
- Another testable extension is that the smooth-perception principle can be measured layer by layer; the trade-off should be most severe in layers where perception changes abruptly under perturbation, and RPAT would be expected to flatten precisely those changes.
- If RPAT works, the same smooth-perception idea might transfer to other robustness settings, such as certified defenses or out-of-distribution detection, where boundary geometry also matters.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The abstract of arXiv:2508.02186 announces a new adversarial training method, Robust Perception Adversarial Training (RPAT), which is claimed to mitigate the accuracy-robustness trade-off by encouraging the model perception to change smoothly with input perturbations. The abstract reports experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet with several architectures and comparisons to 12 baselines, with code available at a GitHub URL. However, the manuscript body is a completely different paper on chain-of-thought (CoT) reasoning compression, titled 'Reconsidering Overthinking: Penalizing Internal and External Redundancy in CoT Reasoning.' The body defines internal and external redundancy, proposes a dual-penalty reinforcement learning framework, and reports experiments on GSM8K, MATH500, and AIME24. It contains no definition of RPAT, no perception-consistency objective, no adversarial training procedure, no decision-boundary analysis, and no vision experiments. Thus, the submitted manuscript provides zero support for the claims in its abstract.
Significance. If the abstract's claims were substantiated, the paper would present a novel and potentially impactful perspective on adversarial training, namely that hard adversarial samples are over-learned rather than under-learned, and that a smooth-perception training objective can improve both clean accuracy and robustness. That result would be of interest to the computer vision and security communities. However, because the manuscript body is an unrelated paper on CoT compression, the abstract's claims have no derivational or experimental backing within the submitted artifact. The scientific significance therefore cannot be assessed; the paper as submitted is not a self-contained contribution to adversarial training.
major comments (3)
- [Abstract vs. Full Text] The abstract describes RPAT, a novel adversarial training objective, and claims extensive experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet with ResNet-18, PreActResNet-18, and WideResNet-34-10, comparing against 12 state-of-the-art baselines. The full text of the manuscript, however, is an entirely different paper on chain-of-thought redundancy compression (arXiv:2508.02178v3). There is no mention of RPAT, no definition of 'perception consistency' as a training signal, no adversarial training procedure, and no vision experiments. The central claim of the abstract is therefore completely unsupported by the manuscript body.
- [Sections III-V (body content)] The body's equations (1)-(9) define External Redundancy Degree (ERD), Internal Redundancy Degree (IRD), and the Accuracy-Efficiency Score (AES) for CoT compression. Section IV presents a dual-redundancy penalty for reinforcement learning, and Section V reports results on GSM8K, MATH500, AIME24, GPQA, and LiveCodeBench. None of this material relates to adversarial training, decision boundaries, robust models, or the accuracy-robustness trade-off. This is not a minor oversight; it means the manuscript does not contain the method or the experiments that the abstract promises.
- [Conclusion (Section VIII)] The conclusion summarizes findings about CoT redundancy: external redundancy can be removed with little performance loss, while internal redundancy compression follows a sensitive accuracy-efficiency trade-off. This conclusion repeats the CoT paper's message and says nothing about adversarial training or the Robust Perception objective. The mismatch between the abstract and the conclusion reinforces that the submitted text is a different paper, and no part of it can be re-interpreted as supporting the abstract's RPAT claims.
minor comments (3)
- [Title and Author List] The title and author affiliations in the body correspond to the CoT compression paper, not to the title and abstract of arXiv:2508.02186. This inconsistency should have been caught at submission time.
- [References] All references in the body are about large language models, chain-of-thought reasoning, and reinforcement learning. There are no references to adversarial training, robust optimization, or the CIFAR/Tiny-ImageNet benchmark literature, which would be expected if the abstract's content were actually present.
- [Figures and Tables] Figures 1-9 and Table I in the body illustrate CoT redundancy and compression results. No figure or table presents any adversarial robustness result, clean accuracy result, or comparison with the claimed baselines.
Circularity Check
The abstract's claims are unsupported by the manuscript body, but no circularity can be identified because no RPAT derivation, fitted parameters, or supporting experiments appear in the paper.
full rationale
The abstract asserts a counterintuitive result about adversarial training and proposes a Robust Perception Adversarial Training (RPAT) method, reporting experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet. The full text provided is instead a different paper on chain-of-thought redundancy ('Reconsidering Overthinking', arXiv:2508.02178v3), whose equations (1)-(9) define ERD, IRD, and AES for CoT compression and whose experiments concern GSM8K, MATH500, AIME24, GPQA, and LiveCodeBench. The body contains no RPAT loss, no definition of Robust Perception, no decision-boundary analysis, and no CIFAR/Tiny-ImageNet evaluations. Consequently there is no derivation chain in the artifact that could be circular: the abstract's claims are unsupported rather than derived from their own inputs. Unsupported claims and missing experiments are completeness and correctness concerns, not circularity. Under the instruction to claim circularity only when a specific reduction can be quoted and exhibited, no such reduction exists in this manuscript. The score is therefore 0.
Assumptions & free parameters
assumptions (3)
- ad hoc to paper Perception consistency is a valid way to measure how well a sample is learned.
- ad hoc to paper Over-sufficient learning of hard adversarial samples, rather than under-learning, degrades the decision boundary and drives the trade-off.
- ad hoc to paper The proposed Robust Perception objective can be optimized to produce a smoother decision boundary without hurting clean accuracy.
Cite this review
Pith. "Pith review of Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training." pith.science (2026). https://pith.science/paper/4GDUBYV4
@misc{pith2026250802186,
author = {Pith},
title = {Pith review of: Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training},
year = {2026},
howpublished = {\url{https://pith.science/paper/4GDUBYV4}},
note = {Machine review of arXiv:2508.02186}
}
read the original abstract
Adversarial Training (AT) is one of the most effective methods to train robust Deep Neural Networks (DNNs). However, AT creates an inherent trade-off between clean accuracy and adversarial robustness, which is commonly attributed to the more complicated decision boundary caused by the insufficient learning of hard adversarial samples. In this work, we reveal a counterintuitive fact for the first time: From the perspective of perception consistency, hard adversarial samples that can still attack the robust model after AT are already learned better than those successfully defended. Thus, different from previous views, we argue that it is rather the over-sufficient learning of hard adversarial samples that degrades the decision boundary and contributes to the trade-off problem. Specifically, the excessive pursuit of perception consistency would force the model to view the perturbations as noise and ignore the information within them, which should have been utilized to induce a smoother perception transition towards the decision boundary to support its establishment to an appropriate location. In response, we define a new AT objective named Robust Perception, encouraging the model perception to change smoothly with input perturbations, based on which we propose a novel Robust Perception Adversarial Training (RPAT) method, effectively mitigating the current accuracy-robustness trade-off. Experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet with ResNet-18, PreActResNet-18, and WideResNet-34-10 demonstrate the effectiveness of our method beyond four common baselines and 12 state-of-the-art (SOTA) works. The code is available at https://github.com/FlaAI/RPAT.
Forward citations
Cited by 1 Pith paper
-
CEAR: Certified Ensemble Adversarial Robustness in DNNs
CEAR is a hybrid ensemble method that adds per-network Gaussian noise and temperature scaling, uses two voting schemes on noisy logits, and extends randomized smoothing to deliver certified robustness on MNIST, CIFAR-...
Reference graph
Works this paper leans on
-
[1]
A. Jaech, A. Kalai, A. Lerer, A. Richardson, A. El-Kishky, A. Low, A. Helyar, A. Madry, A. Beutel, A. Carneyet al., “Openai o1 system card,”arXiv preprint arXiv:2412.16720, 2024
arXiv 2024
-
[2]
Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,
D. Guo, D. Yang, H. Zhang, J. Song, P. Wang, Q. Zhu, R. Xu, R. Zhang, S. Ma, X. Biet al., “Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,”arXiv preprint arXiv:2501.12948, 2025
arXiv 2025
-
[3]
Do not think that much for 2+ 3=? on the overthinking of o1-like llms,
X. Chen, J. Xu, T. Liang, Z. He, J. Pang, D. Yu, L. Song, Q. Liu, M. Zhou, Z. Zhanget al., “Do not think that much for 2+ 3=? on the overthinking of o1-like llms,”arXiv preprint arXiv:2412.21187, 2024
arXiv 2024
-
[4]
Stop overthinking: A survey on efficient reasoning for large language models,
Y . Sui, Y .-N. Chuang, G. Wang, J. Zhang, T. Zhang, J. Yuan, H. Liu, A. Wen, S. Zhong, N. Zouet al., “Stop overthinking: A survey on efficient reasoning for large language models,”arXiv preprint arXiv:2503.16419, 2025
arXiv 2025
-
[5]
Efficient Reasoning Through Suppression of Self-Affirmation Reflections in Large Reasoning Models
K. Liu, C. Shen, Z. Zhang, J. Liu, X. Yuanet al., “Efficient reasoning through suppression of self-affirmation reflections in large reasoning models,”arXiv preprint arXiv:2506.12353, 2025
work page Pith review arXiv 2025
-
[6]
On reasoning strength planning in large reasoning models,
L. Sheng, A. Zhang, Z. Wu, W. Zhao, C. Shen, X. Wang, T.-S. Chua et al., “On reasoning strength planning in large reasoning models,”Ad- vances in Neural Information Processing Systems, vol. 38, pp. 62 978– 63 012, 2026
work page 2026
-
[7]
C. Wang, Y . Feng, D. Chen, Z. Chu, R. Krishna, and T. Zhou, “Wait, we don’t need to” wait”! removing thinking tokens improves reasoning efficiency,”arXiv preprint arXiv:2506.08343, vol. 3, 2025
arXiv 2025
-
[8]
Thoughts are all over the place: On the underthinking of o1-like llms,
Y . Wang, Q. Liu, J. Xu, T. Liang, X. Chen, Z. He, L. Song, D. Yu, J. Li, Z. Zhanget al., “Thoughts are all over the place: On the underthinking of o1-like llms,”arXiv preprint arXiv:2501.18585, 2025
arXiv 2025
Show all 31 references
-
[9]
O1-pruner: Length-harmonizing fine-tuning for o1-like reasoning pruning,
H. Luo, L. Shen, H. He, Y . Wang, S. Liu, W. Li, N. Tan, X. Cao, and D. Tao, “O1-pruner: Length-harmonizing fine-tuning for o1-like reasoning pruning,”arXiv preprint arXiv:2501.12570, 2025
2025 arXiv
-
[10]
Training language models to reason effi- ciently,
D. Arora and A. Zanette, “Training language models to reason effi- ciently,”Advances in Neural Information Processing Systems, vol. 38, pp. 60 770–60 808, 2026
2026
-
[11]
Chain-of-thought prompting elicits reasoning in large language models,
J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V . Le, D. Zhouet al., “Chain-of-thought prompting elicits reasoning in large language models,”Advances in neural information processing systems, vol. 35, pp. 24 824–24 837, 2022
2022
-
[12]
Reasoning with language model prompting: A survey,
S. Qiao, Y . Ou, N. Zhang, X. Chen, Y . Yao, S. Deng, C. Tan, F. Huang, and H. Chen, “Reasoning with language model prompting: A survey,” inProceedings of the 61st annual meeting of the Association for Computational Linguistics (volume 1: long papers), 2023, pp. 5368– 5393
2023
-
[13]
Dast: Difficulty-adaptive slow-thinking for large reasoning models,
Y . Shen, J. Zhang, J. Huang, S. Shi, W. Zhang, J. Yan, N. Wang, K. Wang, Z. Liu, and S. Lian, “Dast: Difficulty-adaptive slow-thinking for large reasoning models,” inProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: Industry Track, 2025, ...
2025
-
[14]
Think when you need: Self-adaptive chain- of-thought learning,
J. Yang, K. Lin, and X. Yu, “Think when you need: Self-adaptive chain- of-thought learning,”arXiv preprint arXiv:2504.03234, 2025
2025 arXiv
-
[15]
Token-budget- aware llm reasoning,
T. Han, Z. Wang, C. Fang, S. Zhao, S. Ma, and Z. Chen, “Token-budget- aware llm reasoning,” inFindings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 24 842–24 855
2025
-
[16]
Can language models learn to skip steps?
T. Liu, Q. Guo, X. Hu, C. Jiayang, Y . Zhang, X. Qiu, and Z. Zhang, “Can language models learn to skip steps?”Advances in Neural Information Processing Systems, vol. 37, pp. 45 359–45 385, 2024
2024
-
[17]
Cot-valve: Length- compressible chain-of-thought tuning,
X. Ma, G. Wan, R. Yu, G. Fang, and X. Wang, “Cot-valve: Length- compressible chain-of-thought tuning,” inProceedings of the 63rd An- nual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 6025–6035
2025
-
[18]
Data-efficient rein- forcement learning for complex nonlinear systems,
V . S. Donge, B. Lian, F. L. Lewis, and A. Davoudi, “Data-efficient rein- forcement learning for complex nonlinear systems,”IEEE transactions on cybernetics, vol. 54, no. 3, pp. 1391–1402, 2023
2023
-
[19]
Kimi k1. 5: Scaling reinforcement learning with llms,
K. Team, A. Du, B. Gao, B. Xing, C. Jiang, C. Chen, C. Li, C. Xiao, C. Du, C. Liaoet al., “Kimi k1. 5: Scaling reinforcement learning with llms,”arXiv preprint arXiv:2501.12599, 2025
2025 arXiv
-
[20]
Thinkprune: Pruning long chain-of-thought of llms via reinforcement learning,
B. Hou, Y . Zhang, J. Ji, Y . Liu, K. Qian, J. Andreas, and S. Chang, “Thinkprune: Pruning long chain-of-thought of llms via reinforcement learning,”arXiv preprint arXiv:2504.01296, 2025
2025 arXiv
-
[21]
Optimizing length compression in large reasoning models,
Z. Cheng, D. Chen, M. Fu, and T. Zhou, “Optimizing length compression in large reasoning models,”arXiv preprint arXiv:2506.14755, 2025
2025 arXiv
-
[22]
Learn to reason efficiently with adaptive length-based reward shaping,
W. Liu, R. Zhou, Y . Deng, Y . Huang, J. Liu, Y . Deng, Y . Zhang, and J. He, “Learn to reason efficiently with adaptive length-based reward shaping,” inThe Fourteenth International Conference on Learning Representations, 2026
2026
-
[23]
A survey on reinforcement learning for recommender systems,
Y . Lin, Y . Liu, F. Lin, L. Zou, P. Wu, W. Zeng, H. Chen, and C. Miao, “A survey on reinforcement learning for recommender systems,”IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 10, pp. 13 164–13 184, 2023
2023
-
[24]
Gpqa: A graduate-level google-proof q&a benchmark,
D. Rein, B. L. Hou, A. C. Stickland, J. Petty, R. Y . Pang, J. Dirani, J. Michael, and S. R. Bowman, “Gpqa: A graduate-level google-proof q&a benchmark,”arXiv preprint arXiv:2311.12022, 2023
2023 arXiv
-
[25]
Livecodebench: Holistic and contamination free evaluation of large language models for code,
N. Jain, A. Gu, W.-D. Li, F. Yan, T. Zhang, S. Wang, A. Solar-Lezama, K. Sen, and I. Stoica, “Livecodebench: Holistic and contamination free evaluation of large language models for code,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 58 791– 58 831
2025
-
[26]
Hybridflow: A flexible and efficient rlhf framework,
G. Sheng, C. Zhang, Z. Ye, X. Wu, W. Zhang, R. Zhang, Y . Peng, H. Lin, and C. Wu, “Hybridflow: A flexible and efficient rlhf framework,” inProceedings of the Twentieth European Conference on Computer Systems, 2025, pp. 1279–1297
2025
-
[27]
Deepseekmath: Pushing the limits of mathematical reasoning in open language models,
Z. Shao, P. Wang, Q. Zhu, R. Xu, J. Song, X. Bi, H. Zhang, M. Zhang, Y . Li, Y . Wuet al., “Deepseekmath: Pushing the limits of mathematical reasoning in open language models,”arXiv preprint arXiv:2402.03300, 2024
2024 arXiv
-
[28]
Deepscaler: Surpassing o1-preview with a 1.5 b model by scaling rl,
M. Luo, S. Tan, J. Wong, X. Shi, W. Y . Tang, M. Roongta, C. Cai, J. Luo, T. Zhang, L. E. Liet al., “Deepscaler: Surpassing o1-preview with a 1.5 b model by scaling rl,”Notion Blog, vol. 3, no. 5, 2025
2025
-
[29]
Training verifiers to solve math word problems,
K. Cobbe, V . Kosaraju, M. Bavarian, M. Chen, H. Jun, L. Kaiser, M. Plappert, J. Tworek, J. Hilton, R. Nakanoet al., “Training verifiers to solve math word problems,”arXiv preprint arXiv:2110.14168, 2021
2021 arXiv
-
[30]
Measuring mathematical problem solving with the math dataset,
D. Hendrycks, C. Burns, S. Kadavath, A. Arora, S. Basart, E. Tang, D. Song, and J. Steinhardt, “Measuring mathematical problem solving with the math dataset,”arXiv preprint arXiv:2103.03874, 2021
2021 arXiv
-
[31]
Mind the gap: Bridging thought leap for improved chain-of-thought tuning,
H. Xu, Y . Yan, Y . Shen, W. Zhang, G. Hou, S. Jiang, K. Song, W. Lu, J. Xiao, and Y . Zhuang, “Mind the gap: Bridging thought leap for improved chain-of-thought tuning,”Advances in Neural Information Processing Systems, vol. 38, pp. 143 665–143 694, 2026
2026
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.