DP-RAE: A Dual-Phase Merging Reversible Adversarial Example for Image Privacy Protection

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-07 12:08:51

Abstract: In digital security, Reversible Adversarial Examples (RAE) blend adversarial attacks with Reversible Data Hiding (RDH) within images to thwart unauthorized access. Traditional RAE methods, however, compromise attack efficiency for the sake of perturbation concealment, diminishing the protective capacity of valuable perturbations and limiting applications to white-box scenarios. This paper proposes a novel Dual-Phase merging Reversible Adversarial Example (DP-RAE) generation framework, combining a heuristic black-box attack and RDH with Grayscale Invariance (RDH-GI) technology. This dual strategy not only evaluates and harnesses the adversarial potential of past perturbations more effectively but also guarantees flawless embedding of perturbation information and complete recovery of the original image. Experimental validation reveals our method's superiority, secured an impressive 96.9\% success rate and 100\% recovery rate in compromising black-box models. In particular, it achieved a 90\% misdirection rate against commercial models under a constrained number of queries. This marks the first successful attempt at targeted black-box reversible adversarial attacks for commercial recognition models. This achievement highlights our framework's capability to enhance security measures without sacrificing attack performance. Moreover, our attack framework is flexible, allowing the interchangeable use of different attack and RDH modules to meet advanced technological requirements.

Main paper: 
 background: 
 Adversarial Attacks are broadly classified into white-box and black-box strategies. White-box attacks entail complete access to the target models' architecture and parameters. Goodfellow et al. [11] introduced the Fast Gradient Sign Method (FGSM) in 2014, leveraging single-step gradient updates for generating perturbations:EQUATIONExpanding on FGSM, Kurakin et al. [20] developed the Basic Iterative Method (BIM) in 2016, enhancing the granularity and attack success rate through iterative small-step perturbations. Dong et al. [6] subsequently introduced the Momentum Iterative Fast Gradient Sign Method (MI-FGSM) in 2018, which integrates a momentum component to ensure the attack progresses in a steady direction, thereby improving the precision and reliability of adversarial attack.In contrast, black-box attacks lack direct model knowledge, instead leveraging output observations. The Query-Efficient Boundarybased blackbox Attack (QEBA) [22] estimates decision boundaries via gradient direction, while the Simple Black-box Attack (SimBA) [12] alters inputs based on output changes. Surfree [27] generates perturbations by exploiting classifier decision boundary geometry, showcasing the advancement in adversarial techniques and the nuanced understanding of model vulnerabilities.Reversible Data Hiding (RDH) is a typical technique to extract embedded hidden data from labeled camouflage images. Tian et al. [38] pioneered the RDH technique via difference expansion, embedding secret data by enlarging the differences between adjacent pixels. Subsequent research has explored utilizing the histogram properties of images for data hiding [23, 47] . However, conventional RDH methods often induce distortions in the grayscale versions of images, which is important in feature analyses of images. Therefore, our paper adopted the RDH with Grayscale Invariance (RDH-GI) proposed by Hou et al. [14] , which uses the R and B channels of the color image to embed information and ensure grayscale invariance by adjusting the pixel value of the G channel. 
proposed method 3.1 overview: 
 In Before delving into GQBE, it's essential to address RDH's limitations on information length, making perturbation data compression vital. Our study introduces GQBE, a white-box attack leveraging super-pixels for efficient perturbation compression. This method reduces storage needs while maintaining adversarial effectiveness through gradient smoothing over super-pixels. Consequently, the perturbations retain their capacity to effectively challenge models despite the reduced data footprint. We denote 𝑥 as the clean image with the dimensions C × H × W, 𝑦 𝑡𝑟𝑢𝑒 as the true label, and y as the model 𝑓 output result: 𝑦 = F 𝜃 (𝑥). Super-pixel size as ℎ × 𝑤, 𝜂 represents the perturbation generated by GQBE. The adversarial examples 𝑥 ′ 𝑎𝑑𝑣 can be expressed as:EQUATION)where T is a function designed for dimension expansion and padding. Due to the intervention of super-pixels, 𝜂 essentially acts as a compressed two-dimensional matrix perturbation with dimensions (⌊H /ℎ⌋ , ⌊W/𝑤⌋). More specifically, 𝜂 𝑖 𝑗 represents the perturbation of the super-pixel at position (𝑖, 𝑗), and the T function expands this perturbation to cover the area (𝑐, 𝑖 : 𝑖 + ℎ, 𝑗 : 𝑗 + 𝑤), where 0 ≤ 𝑖 ≤ ⌊H /ℎ⌋ , 0 ≤ 𝑗 ≤ ⌊W/𝑤⌋. We use 𝜖 as the unit of perturbation, employing a three-bit code to denote the magnitude of perturbation at 𝜂 𝑖 𝑗 , which signifies the count of unit perturbations. Then, we dissect how to craft perturbations based on the deviation of the gradients. Initially, the purpose of GQBE is to mislead classifier F 𝜃 through perturbations:EQUATIONwhere M represents the maximum multiplicative factor stored in three bits. To generate 𝑥 ′ 𝑎𝑑𝑣 , we compute pixel-wise gradients from the loss function, adding perturbations to increase the loss in nontargeted attacks. Given the variability of gradient values across different positions, applying uniform perturbations would lead to varied impacts on the loss function. Recognizing this, we prioritize larger perturbations at points with a more significant influence on the loss function, as these regions are more sensitive to changes in input that substantially affect the final classification decision, potentially making the attack more effective. Consequently, by smoothing the gradients for each super-pixel:EQUATIONand obtain the the absolute value matrix A through ∇ 𝜂 J (𝑥, 𝑦 true ):EQUATIONfinally, compute the gradient contribution score E:E 𝑖 𝑗 = 𝑒𝑥𝑝 (A 𝑖 𝑗 ) 𝑖 × 𝑗 𝑝=0 𝑒𝑥𝑝 (A 𝑝 ) , 𝑠.𝑡 .𝑖 ∈ [0, ⌊H /ℎ⌋] , 𝑗 ∈ [0, ⌊W/𝑤⌋] (6)where E denotes the impact of perturbations at different positions on the loss function, termed as the contribution score of gradients to the deviation in the loss function. Given the varied contributions, the generated perturbation values are quantized into multiple levels.The algorithmic procedure is outlined as Algorithm 1.It is noteworthy that the GQBE framework exhibits compatibility with a broad spectrum of gradient-based methods, serving as its foundational mechanism. Such versatility enables the dynamic refinement of our attack's potency, ensuring its alignment with the evolving landscape of adversarial attack methodologies. This paper illustrates the application of the GQBE framework by deploying the ensemble attack strategy within MI-FGSM [6] , a paradigmatic example that elucidates our attack process in detail. For ensemble attacks, we fuse the logits of K different models:EQUATIONwhere 𝑙 𝑘 (𝑥) represents the logits of the k-th model and 𝑤 𝑘 as it weight. To decrease the confidence 𝑝 (𝑥), the loss function J is defined as:EQUATIONwhere 1 After integrating preprocessing techniques derived from white-box attacks, the DP-RAE execute a black-box attack on an unexposed model. We utilize the perturbation 𝜂 generated by the Algorithm 2 and clean image 𝑥 as the input. A direction 𝑞 is randomly selected by choosing 𝜂 𝑖 𝑗 . Adding a perturbation in the 𝑞 direction will change the confidence 𝑝 in the model. If the direction 𝑞 fails to decrease the 𝑝 (𝑦 𝑡𝑟𝑢𝑒 |𝑥 + T (𝜂 +𝑞 •𝜖)), the direction of 𝑞 will be reversed. For each perturbed point, we document its contribution to the reduction in confidence. Following a predefined number 𝑚 of perturbation iterations, we identify and select the three points that exhibit the most substantial decrease in model confidence from these documented instances. As the super-pixel blocks of perturbations may have already reached their maximum threshold, augmenting these pairs of perturbations may not directly affect the confidence. Therefore, we excluded these points and only augmented the perturbations for the points that could be added. DP-RAE can utilize RDH-GI technology to embed additional data intricately into adversarial images. Upon generating the adversarial examples with the dual-phase attack mechanism, DP-AE, the perturbation matrix is encoded into a binary information stream. This stream is then meticulously embedded into the adversarial image alongside pertinent auxiliary data, ensuring the integrity of the embedded information while maintaining the adversarial nature of the image. When the recovery of the original image becomes necessary, the hidden information within DP-RAE is extracted using the RDH-GI technology. This enables accurate reconstruction of the perturbation matrix and lossless recovery of the pristine image upon its removal. Through this innovative approach, DP-RAE not only maintains the efficacy of adversarial attacks but also ensures the reversibility of the process, allowing for the seamless restoration of the unmodified original image. 
experiments 4.1 experiment setup: 
 We use ILSVRC2012 [31] as the dataset for our experiments, which is widely used in deep learning and is highly representative and influential. The dataset covers 1000 different categories, and each image is correctly labeled. In terms of model selection, we chose several models to test the migration performance of adversarial attack samples across different models, including Resnet34 (RN-34) [13] , Resnet50 (RN-50) [13] , Resnet152 (RN-152) [13] , DenseNet-121 (DN-121) [17] , MobileNet-v2 (Mob-v2) [32] , MobileNet-v3 (Mob-v3) [15] , VGG-16 [33] , VGG-19 [33] , AlexNet [19] , Inception-v3 (Inc-v3) [36] . To ensure the rigor and fairness of the experiment, we randomly selected 1000 images from ILSVRC2012, each of which can be reliably classified by the above models.The parameter settings for DP-RAE are as follows: the superpixel size is set to 4, the unit perturbation 𝜖 is set to 4/255, the number of iterations for GQBE is set to 10, and the PCT is set to 50%. As for TISA, the attack is set to 3000 iterations, with an additional adjustment added every ten perturbations. All experiments were performed on the NVIDIA A40 GPU.To rigorously assess the efficacy of DP-RAE, we focus on three key dimensions: attack ability, restoration quality, and visual integrity. We evaluate DP-AE and DP-RAE using established benchmarks for image quality assessment, specifically Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) [40] . In addition, we evaluate the model's susceptibility to adversarial attacks using the Attack Success Rate (ASR), which measures the probability of adversarial examples causing misclassifications.To demonstrate the superior performance of DP-RAE, we compared it to a comprehensive set of adversarial attack methods. These include classical white-box attacks such as the FGSM [11] , BIM [20] , and Projected Gradient Descent (PGD) [26] , alongside advanced black-box techniques like the SimBA [12] , Discrete Cosine Transform-based SimBA (SimBA-DCT) [12] , and fast surrogate-free black-box attack (Surfree) [27] . Our comparison focuses on the capability of attacks and their robustness, the experimental results are detailed in Table 1 .The experimental data reveal that white-box adversarial examples are robust across different models, suggesting that these examples maintain misdirection effects even on models with significantly different architectures. This observation hints at universally vulnerable decision boundaries. Traditional white-box attacks, however, often overfit a single model, compromising robustness when the target model's structure or data distribution varies from others. To address this, DP-RAE adopts a multi-model strategy to enhance adversarial example transferability and minimize model-specific overfitting, thereby demonstrating improved migration performance across various models compared to conventional white-box attacks.In black-box attack scenarios, attackers are constrained by their lack of access to the target model's internal mechanisms. While query-based black-box attacks primarily exploit a model's superficial characteristics, they fall short of uncovering deeper vulnerabilities. Notably, black-box attacks generally show limited robustness. Adversarial examples generated by SimBA, SimBA-DCT and Surfree have only achieved single-digit success rates on other models. Our DP-RAE addresses these limitations by initially identifying common vulnerability features across various models through GQBE. Subsequently, it leverages TISA for precise attacks on black-box models, integrating the strengths of both methodologies. DP-RAE has an ASR of over 50% on multiple models, and it achieves a remarkable ASR of up to 94.3% in black-box models under query constraints.This section presents the ablation studies conducted on DP-RAE to evaluate the impact of different parameters and strategies on its performance. We first focus on the impact of super-pixel size 2 shows that adversarial examples created with smaller super-pixel sizes can obtain higher transferability across different models. This is because the effectiveness of adversarial examples depends on the precision and spatial arrangement of the perturbations. As DNNs are highly sensitive to the feature representation of input data, using excessively large super-pixel blocks will oversimplify detailed perturbations. This will reduce their impact on the models' decision boundaries and weaken the attack ability. However, a small size will geometrically increase the number of super-pixels, as shown in Figure 3 , the small super-pixel size leads to a dramatic increase in the amount of stored information. Based on the experimental result, we suggest that selecting a super-pixel size of 4 achieves an optimal balance between a high ASR and minimal data storage requirements.To evaluate the efficacy of GQBE when integrated with various gradient-based adversarial attack methodologies, we employed it with FGSM, BIM, and MI-FGSM, respectively. This experimental setup enabled a comprehensive analysis of how different gradient computation techniques affect the performance of GQBE. According to the data presented in Table 2 , iterative methods BIM and MI-FGSM, which calculate perturbations across multiple iterations, outperform FGSM in terms of effectiveness. The iterative refinement of super-pixel perturbations allows for a more precise alignment of adversarial examples with the model's decision boundaries. Notably, MI-FGSM exhibits a marginally superior efficacy to BIM, attributed to the incorporation of momentum, enhancing the To systematically evaluate the effects of iteration count and the PCT on the performance of GQBE, a series of experiments were conducted, iterating over a range of PCT values. The empirical findings, as summarized in Table 3 , demonstrate a less number of iterations impedes the perturbation's convergence, leading to diminished attack performance. Consequently, an iteration count of 10 is the optimal setting to ensure adequate convergence while maintaining computational efficiency. Further examination of the impact of PCT indicates a performance peak when the parameter is set beyond 50%. This suggests a higher proportion of reinforced pixels contributes to a more effective perturbation strategy, likely due to the enhanced potential for inducing misclassifications within the target model. Therefore, we advocate for a PCT setting of 50%, representing the threshold at which additional increments cease to yield proportional gains in attack performance.To evaluate the hypothesis that a dual-phase strategy-integrating both black-box and white-box attacks-can leverage the strengths of each approach, we designed ablation studies focusing on three distinct strategies: solely employing GQBE, solely employing TISA, and a combined DP-AE targeting RN-50. For TISA, we fixed the Subsequent robustness tests across the three strategies reveal distinct performance profiles in adversarial example generation. As Table 2 shows, GQBE produced adversarial examples exhibit commendable generalization across diverse models yet fall short of achieving an optimal ASR against the targeted RN-50 model. Conversely, TISA generated samples demonstrate a high degree of specificity in compromising unknown models but suffer from limited transferability, undermining their robustness. Notably, adversarial examples generated via the DP-AE strategy not only excel in model-specific attacks but also benefit from enhanced transferability, showcasing an advantageous blend of robustness and specificity. Our findings thus advocate for the DP-AE approach, which embodies a harmonious balance between achieving targeted model vulnerability and ensuring broad applicability across various model architectures.In real-world scenarios, images often undergo preprocessing via defensive mechanisms before being fed into neural networks, aiming to retain critical content while reducing the impact of perturbations. Hence, the necessity for adversarial examples to exhibit considerable robustness becomes paramount. This section explores the effects of various defense strategies on adversarial examples, including Spatial Squeezing (Spatial) [5] , Random Resizing and Padding (Random) [42] , Gaussian Blurring (Gaussian) [1] , JPEG Compression (JPEG) [5] , and Super-resolution (Super) [29] . As depicted in Table 4 , perturbations from black-box attacks tend to lose their potency under defensive measures, likely due to preprocessing adding uncertainty to the model and thus diluting the effectiveness of query-based attacks. Conversely, DP-RAE employs the white-box preprocessing technique, GQBE, which identifies and exploits common vulnerabilities across models, diminishing the impact of defensive methods. By integrating multiple models, DP-RAE addresses the overfitting issue and enhances resilience against defensive tactics. As a result, DP-RAE showcases exceptional adaptability and robustness, maintaining high attack success rates against diverse defense strategies. The restoration effect of adversarial images is pivotal in underscoring DP-RAE's efficacy. Notably, prior works have not extensively explored the recovery performance of RAEs. To validate the restoration capabilities of RAEs, we compared images restored by DP-RAE with their original counterparts. As depicted in Figure 4 , while adversarial manipulations may marginally impact visual quality, they do not hinder the accurate recognition of the content by human observers. The restoration process effectively neutralizes DP-RAE's To validate our RAE's effectiveness on real-world systems, we targeted Baidu's cloud vision API1 , a service for object recognition. We aimed to eliminate the top label from the API's top-3 returned labels, considering the constraints on perturbations and queries. We prepared 50 images, correctly identified by the API, for enhanced robustness through white-box attacks. These attacks successfully misled 70% of the images, thanks to significant perturbations, which are reversible in RAEs, minimizing the impact on legitimate users. Subsequent black-box attacks on the rest, by probing the API for decision boundaries, achieved a 90% success rate. As shown in Figure 5 , we achieve the model misclassify from the original label "rocking chair" to the wrong label "historic sites", underscoring our method's threat to commercial black-box models and its role in protecting user privacy. Given the limitation on the number of queries allowed for commercial models, we believe that increasing the number of queries can effectively enhance the success rate of the attack. All relevant details and the corresponding analyses of the evaluation results are included in our provided supplemental material. https://ai.baidu.com/tech/imagerecognition/general2024-04-13 09:03. Page 8 of 1-9. 
: 
 profit-driven goals. For example, personal data belonging to millions of Facebook users leakage and was analysed by Cambridge Analytica for political advertising [3] .Recent research has exposed DNN vulnerabilities, proposing algorithms to deceive these models with minimal image modifications, thereby inducing incorrect classifications [35, 37, 44, 45, 48] . This paper leverages such adversarial characteristics to develop a novel privacy protection mechanism within social networks. While traditional adversarial attacks can effectively mislead DNNs [7-9, 25, 39] , preventing targeted information retrieval and key feature extraction based on DNN models, introducing perturbations to protected images compromises their quality. Hence, there is a pressing need for a privacy-preserving mechanism that upholds both the visual integrity of images and their ability to counteract diverse DNN analyses. Our in-depth research leads to developing Reversible Adversarial Examples (RAE) [24, 43, 46] , showcasing their significant capability in confusing DNN classification and analysis while allowing images to be reverted back to their original form. Illustrated in Figure 1 , RAEs not only deceive DNNs but also provide a method to revert images to their normal state, introducing an innovative method for protecting image privacy.In the emerging area of Reversible Adversarial Examples (RAE), existing research is still developing. Xiong et al. [43] was the first to apply Reversible Data Hiding (RDH) techniques in black-box attacks by embedding compressed data of perturbations into the images. This approach allows the original images to be recovered. Besides, Their method, by integrating ensemble model techniques [6] , demonstrates the potential of adversarial examples to be applied across different models due to their transferability, yet it falls short in accurately attacking models that have not been previously encountered. On a different note, Zhang et al. [46] explored an alternative approach to reverse adversarial examples. They introduced an RGAN, consisting of an attack encoder network and a recovery decoder network, aimed at efficiently producing adversarial examples and then reversing them. While this approach is effective in recovering the original state of images, it underperforms against black-box models.Given the specialized use cases of RAE, most current RAE research relies on the transferability of white-box attacks for implementing black-box scenarios. Yet, the success of this transferability depends greatly on the strength of the perturbations. The RDH methods used in RAE have strict limits on the perturbation size, creating a design conflict that substantially reduces the effectiveness of RAE against unknown black-box models.To overcome the inherent challenges for existing RAE methodologies, specifically the tension between executing effective adversarial attacks and adhering to the stringent perturbation constraints of RDH technologies, we propose a Dual-Phase merging Reversible Adversarial Example (DP-RAE) generation framework. This framework adeptly marries the transferability strengths of both white-box and black-box attacks through a bifurcated attack process, significantly improving cross-model applicability. Besides, to address the perturbation storage issues posed by RDH, we propose two novel perturbation optimization techniques: Gradient Quantized Binary Encoding (GQBE) for white-box scenarios and Threshold-Informed Superpixel Attack (TISA) for black-box contexts. The GQBE approach capitalizes on integrated gradient information from models to classify gradient magnitudes into discrete perturbation levels during iterative updates. This stratification reduces the complexity of perturbation data, facilitating its conversion into binary streams for seamless RDH integration. Conversely, if GQBE fails to achieve transferable attacks on uncharted black-box models, TISA is employed to bolster transferability. TISA segments images into superpixel blocks, selecting them randomly to apply uniform perturbations. The impact on model confidence is assessed following each perturbation; a rise in confidence prompts a reversal in the perturbation direction of the targeted superpixel block. Following every set of 𝑚 perturbations, an analysis of historical alterations identifies three points below the perturbation cap for additional adjustment. The culmination of this meticulously designed process allows for the final perturbations to be stored as binary streams via RDH, thereby ensuring their effective preservation within the RDH framework without compromising image integrity.In summary, the main contributions of this paper are as follows:• We propose a novel dual-phase merging framework for RAE generation, significantly enhancing the transferability of adversarial examples to both unknown and commercial black-box models. To the best of our knowledge, our approach is the first successful application of RAE attacks on commercial black-box models.• We propose the GQBE and TISA as innovative solutions for reversible perturbations with RDH technologies. These methodologies address the critical challenge of maintaining the integrity of adversarial examples while ensuring their reversibility.• Experimental results affirm the superiority of our attack framework, achieving a 96.9% Attack Success Rate (ASR) for reversible adversarial examples on specific models, with a 100% restoration rate for the recovered images. These outcomes validate the practical feasibility of our approach. 
 
 Appendix:  


Decision: This paper presents a new dual-phase merging framework called Dual-Phase Merging Reversible Adversarial Example (DP-RAE) for RAE generation. The reviewers unanimously recommend accepting the paper. However, the authors are urged to address Reviewer EbyV's concerns in their final version.

Reviews: review: paper_summary: paper_summary: This research proposes a two-stage merging framework for generating RAEs (reversible adversarial samples) and introduces two novel perturbation optimization techniques: gradient-quantized binary encoding (GQBE) for white-box scenarios and threshold-aware superpixel attack (TISA) for black-box environments, thus solving the problem of perturbation storage posed by RDH (reversible data hiding).The DP-RAE framework aims to Create robust adversarial samples against specific black-box models, which are made more robust by initial white-box attack preprocessing and simplify subsequent black-box attacks. Combining heuristic black-box attacks with RDH-GI (Reversible Data Hiding with Gray Scale Invariance) techniques not only maintains the effectiveness of the adversarial attacks, but also ensures the reversibility of the process, which allows for the seamless recovery of the unmodified original image. In addition, this research validates a realistic system for the first time.
strength_weakness: strength_weakness: The DP-RAE framework introduces a biphasic approach combining white-box and black-box attack techniques, enhancing the portability and robustness of the adversarial samples. A solid theoretical foundation is demonstrated by optimizing perturbations using GQBE and TISA. Detailed algorithmic descriptions and mathematical formulations validate the correctness of the techniques. The effectiveness of the framework is demonstrated in extensive experiments on a variety of models, achieving a 96.9% attack success rate and 100% recovery rate. Ablation studies and comparisons with state-of-the-art methods comprehensively demonstrate the superiority of the framework. Furthermore, DP-RAE marks the first application of reversible adversarial samples in a commercial black-box model, combining recoverability and robustness to provide a novel privacy-preserving solution.
limitations: limitations: The paper does not discuss in depth the limitations and potential drawbacks of the proposed method, such as computational complexity or impact on image quality in real-time applications.
While the paper compares DP-RAE with several counter-attack methods, a more in-depth comparison with more recent state-of-the-art techniques could have enhanced the evaluation.
The sensitivity of the framework to various parameter settings could be explored in more detail to better understand its robustness and adaptability.
paper_summary: paper_summary: The paper presents a novel dual-phase merging framework called Dual-Phase Merging Reversible Adversarial Example (DP-RAE) for RAE generation, significantly enhancing the transferability of adversarial examples. The framework aims to protect image privacy on social networks by preventing unauthorized access and analysis by DNNs, while maintaining image quality for authorized users.
strength_weakness: strength_weakness: 1.	The paper introduces a dual-phase strategy that merges heuristic black-box attacks with RDH technology, ensuring both effective adversarial attacks and the complete recovery of the original image.
2.	The paper introduces innovative perturbation optimization techniques like Gradient Quantized Binary Encoding (GQBE) for white-box scenarios and Threshold-Informed Superpixel Attack (TISA) for black-box contexts, which maintain the integrity of adversarial examples while ensuring their reversibility.
3.	The evaluation of the paper covers multiple aspects of the framework’s performance. DP-RAE shows superior performance compared to other methods, with high ASR across various models, especially against black-box models under query constraints.
4.	The proposed framework achieves a 100% restoration rate for perturbed images, indicating that the original image can be perfectly restored after the attack.
5.	The paper is clearly structured and easy to read.
limitations: limitations: 1.	Although the paper claims a high success rate and recovery rate, it may benefit from a more comprehensive evaluation, including a wider range of datasets and an analysis of potential failure cases. The authors can also try more combinations of different target models and ensemble models.
2.	The dual-phase approach and the integration of different attacks and RDH module may result in increased computational complexity, potentially affecting the efficiency of the method.
3.	The attack described in the paper interferes with all pixels of the image, which may reduce image quality and make it easily detectable.
4.	The paper indicates that smaller super-pixel sizes achieve higher ASR, but they also lead to a significant increase in the amount of stored information. The authors could attempt to balance the ASR and data storage by limiting the size of the perturbation-covered image area.
paper_summary: paper_summary: The paper introduces a novel framework called Dual-Phase Merging Reversible Adversarial Example (DP-RAE) which integrates adversarial attacks and Reversible Data Hiding (RDH). This is aimed at thwarting unauthorized access while maintaining image quality.
strength_weakness: strength_weakness: * The paper presents a unique integration of adversarial attacks and reversible data hiding, addressing the dual needs of effective adversarial manipulation and complete image recovery.

* Experimental results are impressive, with a high attack success rate and high quailty of the recovery, substantiating the method’s effectiveness.
limitations: limitations: 1.The method proposed in this article should be compared with other RAE methods since this article focuses on Reversible Adversarial Examples (RAE), instead of only considering traditional adversarial attacks as the baseline.

2. According to the visual results presented in Figure 4, it appears that the adversarial examples (DP-RAE) introduce perceptible perturbations that could be easily detected by humans. Furthermore, the quantitative image quality results presented in Table 5 are difficult to assess due to a lack of comparisons with other methods.

3. Questions regarding the technical details: What is the difference between \eta and \xi in the GQBE algorithm? Could you provide more insight or experimental justification for the particular selection of the three points that exhibit the most substantial decrease (Sec 3.3)?
paper_summary: paper_summary: This paper proposes a dual-phase merging reversible adversarial example method for image privacy protection by combining a heuristic black-box attack and reversible data hiding with grayscale invariance. The author conducts extensive experiments, including the effectiveness of adversarial attacks and data hiding, to demonstrate the effectiveness of their method.
strength_weakness: strength_weakness: 1. The author uses adversarial examples to perform privacy protection, which enriches the practical use of adversarial examples. However, a more realistic scenario should be considered to verify its useless, for example, a facial recognition system.
2. The author conducts extensive experiments to evaluate the effectiveness of their method.
limitations: limitations: 1. The writing and logic of the paper needed improvement. In the abstract, lack of a clear introduction to their proposed method. Moreover, the author spends a lot of text introducing their attack method while a little introduction to the data embedding and recovery.
2. I wonder to know, how to calculate the gradient with respect to super-pixels, as the dimension expansion and padding are not differentiable.
3. Lack of some necessary ablation study, for example, 1) How to determine the percentage of PCT, and how does it influence the attack performance? 2) How to determine the weight of wk for each ensemble model?
4. The discussion about the embed and recovery is limited. Does the embedded data degrade the attack performance? And how to ensure the recover accuracy when the adversarial example with secret data is distorted.
5. There are some typo errors, for example, the notion of y in line 274. 
6. As reported in Table 1, the comparison of adversarial attacks is unfair; the author adopts four models to perform an ensemble attack, while the comparison method is to perform a single model attack.
Moreover, as the baseline of adversarial attack, the comparison method is to old, latest baseline should be considered, for example, admix[1], ssifgsm[2], and cwa [3]. 
[1] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 16158–16167, 2021.
[2] Long, Yuyang, et al. "Frequency domain model augmentation for adversarial attack." European conference on computer vision.Cham: Springer Nature Switzerland, 2022.
[3] Chen, Huanran, et al. "Rethinking Model Ensemble in Transfer-based Adversarial Attacks." The Twelfth International Conference onLearning Representations. 2024.