ai-research-survey

scan.json (30142B)

---

 {
   "paper": {
     "title": "Exploring adversarial robustness of JPEG AI: methodology, comparison and new methods",
     "authors": [
       "Egor Kovalev",
       "Georgii Bychkov",
       "Khaled Abud",
       "Aleksandr Gushchin",
       "Anna Chistyakova",
       "Sergey Lavrushkin",
       "Dmitriy Vatolin",
       "Anastasia Antsiferova"
     ],
     "year": 2024,
     "venue": "arXiv",
     "arxiv_id": "2411.11795",
     "doi": "10.48550/arXiv.2411.11795"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The abstract states 'Our evaluation results and code are publicly available online (link is hidden for a blind review).' Since the link is hidden and no working URL is provided, this counts as NO."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All four evaluation datasets are publicly available standard benchmarks: KODAK Photo CD, CITYSCAPES, NIPS 2017 Adversarial Learning Development Set, and BSDS (Section 4.4)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.6 lists hardware (120× NVIDIA A100 80GB, Intel Xeon Ice Lake) and mentions Slurm, but provides no software dependencies, library versions, requirements.txt, or environment specification."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The code link is hidden for blind review, and the paper does not include a 'Reproducing Results' section."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as averaged metrics across 4 runs with varied parameters, but no confidence intervals, error bars, or uncertainty measures are shown in any figure or table."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparative claims (e.g., 'JPEG AI showed relatively high robustness,' 'CDC showed the lowest robustness') based solely on comparing averaged metric values without any statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Delta metrics (ΔPSNR, ΔMSE, ΔMS-SSIM, ΔVMAF) provide magnitude of quality degradation. BSQ-rate (Section 5.7) reports 'over 50% less bitrate with the same quality.' Fig. 7 shows specific transferability values. These provide meaningful effect size context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for why 4 datasets with specific sizes were chosen, why 4 parameter variations per attack were used, or any power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.6 states 'We applied each adversarial attack to each encoder four times with varied attack parameters. We then averaged the metrics for all launches.' No standard deviation, IQR, or any spread measure is reported."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Ten NIC models are compared (Table 2), including established baselines like Ballé 2018, mbt2018, and Cheng2020. Random noise is included as a baseline attack (Table 3)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include models from 2018–2024: CDC (2024), JPEG AI 6.1 (2024), Li-tcm (2023), qres-vae (2023), alongside older established codecs. The mix of historical and contemporary models is appropriate."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates and compares existing codecs, attacks, and defenses — it does not propose a novel system with components to ablate."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Seven evaluation metrics are used: ΔPSNR, ΔMSE, ΔMS-SSIM, ΔVMAF, BPP change, Color metric, and Texture metric (Sections 4.5, 5.4)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated using full-reference image quality metrics and artifact detection methods. No human perceptual evaluation of image quality under attack is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates pre-trained codecs on standard datasets but does not discuss whether any of these datasets were used in NIC model training, nor is there an explicit separation of tuning vs. evaluation data."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by codec (Fig. 3, 6), by attack type and loss function (Fig. 2), by bitrate (Fig. 4, 7), and by defense strategy (Fig. 8). Section 5.4 breaks down artifacts by codec."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 reports that reconstruction losses actually improve decoded quality rather than degrading it — a failure case for those attack objectives. Section 5.2 notes specific attacks are ineffective against JPEG AI while devastating for other codecs."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 reports that reconstruction losses produce negative ΔPSNR/ΔSSIM (decoded images improve after attack), which is a negative result for those attack strategies. 'More complex losses showed less efficiency' is also a negative finding."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims: new methodology for NIC robustness (supported by Section 4), first large-scale evaluation of JPEG AI (supported by Section 5 with 10 codecs, 6 attacks, 10 loss functions), and comparison with other NICs (supported by Figs. 2–9). Code availability claim is technically unfulfilled due to blind review."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims such as 'adversarial noise causes significant changes in latent representation, yielding noticeable quality degradation' (Section 5.2 on CDC), and 'This model may be less robust by design.' These claims are based on observational comparison, not controlled architectural ablation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The title and claims are specifically about JPEG AI and named NIC models. Claims are bounded to the tested codecs, attacks, and datasets. The paper explicitly scopes to white-box attacks with stated justification (Section 4.2)."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper offers single explanations for observations (e.g., CDC's vulnerability attributed to diffusion architecture, BPP increase attributed to noise structure) without considering alternative explanations or confounding factors."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper defines its metrics clearly (Equation 5, Section 4.5): Δscore measures quality drop caused by adversarial attack. The metrics directly measure what is claimed — the gap between measurement and framing is minimal. The paper does not over-generalize from ΔPSNR to broader 'robustness' without defining the connection."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific codec versions are listed in Table 2: JPEG AI 4.1, 5.1, 6.1 (each with HOP/BOP), and specific model variants for other codecs (e.g., Cheng2020+attn, mbt2018-mean). Section 4.6 notes they used source code of JPEG AI without additional pretraining."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates neural image compression codecs under adversarial attacks. No language model prompting is involved."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.6 states attacks were run 'four times with varied attack parameters (learning rate, number of iterations, and perturbation bound)' but the specific values are not reported. Random noise σ range is given (Table 3), but attack hyperparameters are missing."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. This is a neural image compression adversarial robustness study."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.4 lists datasets with basic descriptions (image count, resolution) but does not document any preprocessing, filtering, or transformation steps applied to the images before experimentation."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section. The conclusion mentions challenges ('assessing attack success in NICs remains challenging') but provides no substantive limitations discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to validity are discussed. The conclusion makes brief mentions of challenges in assessing attack success but does not identify specific methodological threats."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While Section 4.2 explains the focus on white-box attacks, the paper does not explicitly state what the results do NOT show. No systematic scope boundaries are provided — e.g., no discussion of how results may not extend to black-box settings, other image domains, or real-world deployment conditions."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Results and code are claimed to be available but the link is hidden for blind review. No raw experimental data (per-image metrics, per-run results) is provided in the paper or supplements."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 describes datasets used (KODAK, CITYSCAPES, NIPS 2017, BSDS) with image counts and resolutions. Section 4.6 describes the experimental procedure: attacks applied 4 times with varied parameters, results averaged."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All datasets are standard public benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The high-level pipeline is described (attack images → compress → measure quality delta) but intermediate steps are poorly documented. The specific attack parameter configurations, filtering of ~3000 images for artifact analysis (Section 5.4), and how results were aggregated across datasets and bitrates are not fully specified."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. Multiple institutional affiliations are listed (MSU Institute for AI, ISP RAS, Innopolis University) but no funding sources disclosed."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: MSU Institute for Artificial Intelligence, ISP RAS Research Center for Trusted Artificial Intelligence, Lomonosov Moscow State University, and Innopolis University."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, making it impossible to assess funder independence. The ISP RAS 'Research Center for Trusted Artificial Intelligence' affiliation raises questions about whether institutional interests favor particular robustness outcomes."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "None of the 10 NIC models have their training data described or training cutoff dates stated. The paper does not discuss what data was used to train any of the codecs."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether KODAK, CITYSCAPES, NIPS 2017, or BSDS images (or similar images) appeared in the training data of any NIC model. KODAK is commonly used in compression research and may well be in training sets."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "KODAK (1991) and other datasets predate all NIC models and are widely used in the compression field. The paper does not discuss whether NIC models may have been trained or tuned on these same benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.6 lists hardware (120× A100 80GB GPUs) but does not report per-image attack/compression time, total wall-clock time, or any cost metric for running the evaluation."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is listed (Section 4.6) but total GPU hours, experiment duration, or compute budget are not quantified. With 10 codecs × 6 attacks × 10 losses × 4 datasets × 4 runs, the total compute is likely substantial but unreported."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results are averaged across 4 runs with varied parameters but no seed sensitivity analysis is reported and no variance across runs is shown."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.6 explicitly states: 'We applied each adversarial attack to each encoder four times with varied attack parameters.'"
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Attack parameters (learning rate, iterations, perturbation bound) were varied across 4 configurations but the specific values and selection rationale are not reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper averages results across all 4 parameter configurations rather than selecting the best one, avoiding cherry-picking. Section 4.6: 'We then averaged the metrics for all launches.'"
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors do not acknowledge potential bias in their evaluation methodology or discuss whether their modified JPEG AI interface could affect results. Section 4.6 notes they made 'minor changes to the interface' but does not discuss how this might bias comparisons."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Different codecs have vastly different computational requirements (noted in Section 2.2 — HOP vs BOP trade off efficiency and complexity) but performance is never reported as a function of compute budget."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses ΔPSNR, ΔVMAF, etc. as robustness measures without discussing whether these metrics adequately capture perceptual robustness or whether the adversarial threat model reflects realistic deployment conditions."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is involved in this study."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation datasets (KODAK 1991, CITYSCAPES 2016, BSDS 2011) all predate the NIC models being tested. The paper does not discuss whether models were tuned on these or similar datasets."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup introduces information leakage. The white-box attack setting is intentional but the potential for evaluation-time information leakage beyond the intended threat model is not discussed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether evaluation images overlap with or are similar to NIC training data. KODAK is ubiquitous in compression research and very likely in many models' training pipelines."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are used. No analysis of train/test overlap for any of the 10 codecs."
       }
     }
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "claims": [
     {
       "claim": "JPEG AI shows relatively high adversarial robustness compared to other NIC models.",
       "evidence": "Section 5.2, Fig. 3: ΔVMAF heatmap across all codecs and attacks shows JPEG AI versions with smaller quality drops than most competitors. 'JPEG AI showed relatively high robustness compared to other NIC models.'",
       "supported": "moderate"
     },
     {
       "claim": "JPEG AI achieves over 50% bitrate reduction at equivalent VMAF quality compared to mbt2018.",
       "evidence": "Section 5.7, Fig. 9: BSQ-rate comparison shows JPEG AI versions (especially 6.1 HOP and 5.1 HOP) at the bottom of the chart with lowest BSQ-rate, indicating largest bitrate savings.",
       "supported": "strong"
     },
     {
       "claim": "Adversarial attacks increase compressed image size even when not explicitly targeting BPP.",
       "evidence": "Section 5.3, Fig. 4: Shows BPP increase across codecs and bitrates for attacks not targeting BPP. Explained by 'more noise structure of adversarial images, which yields a different rate-distortion trade-off.'",
       "supported": "moderate"
     },
     {
       "claim": "JPEG AI's robustness improves with newer versions (6.1 better than 5.1).",
       "evidence": "Section 5.2: 'the robustness of JPEG AI improved with a newer version (6.1 compared to 5.1).' Fig. 6 shows decreasing artifacts across versions.",
       "supported": "moderate"
     },
     {
       "claim": "Diffusion-based CDC method shows the lowest robustness to adversarial attacks.",
       "evidence": "Section 5.2: 'the diffusion-based CDC method showed the lowest robustness to various attacks. This model may be less robust by design.' Visible as worst performer in Fig. 3.",
       "supported": "moderate"
     },
     {
       "claim": "Quality degradation from adversarial attacks is primarily due to color artifacts rather than texture artifacts.",
       "evidence": "Section 5.4, Fig. 5: Spearman correlation shows Color metric correlates above 0.5 with ΔPSNR (0.72), while Texture metric shows minimal correlation with other metrics. Fig. 6 confirms stronger color artifacts in reconstructed images.",
       "supported": "moderate"
     },
     {
       "claim": "Simple reversible defenses (Flip, Random Ensemble, Random Roll) can partially negate adversarial attacks.",
       "evidence": "Section 5.6, Fig. 8: ΔPSNR values are lower (better) for Flip, Random Ensemble, and Random Roll compared to no defense.",
       "supported": "moderate"
     },
     {
       "claim": "Adversarial attacks on one JPEG AI version transfer to other versions, especially from lower to higher bitrates.",
       "evidence": "Section 5.5, Fig. 7: Transferability matrix shows positive ˆΔVMAF values between JPEG AI versions and bitrates, with higher values when transferring from low to high bitrate.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "JPEG AI demonstrates relatively high adversarial robustness compared to other neural image compression codecs, with robustness improving across successive versions (4.1→5.1→6.1). Diffusion-based compression (CDC) is the most vulnerable to adversarial attack. Adversarial attacks on NIC models cause quality degradation primarily through color artifacts, and even attacks not targeting bitrate increase compressed file size. Simple reversible preprocessing defenses (flipping, rolling) can partially mitigate attacks, and adversarial examples transfer between JPEG AI versions, particularly from lower to higher bitrates.",
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are averaged across 4 parameter-varied runs with no standard deviation, confidence intervals, or error bars reported. Comparative claims between codecs are made without any statistical tests."
     },
     {
       "flag": "Attack hyperparameters not disclosed",
       "detail": "Section 4.6 states attacks were run with 'varied attack parameters (learning rate, number of iterations, and perturbation bound)' but the actual values are not reported, making reproduction impossible."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no dedicated limitations or threats-to-validity section. Key limitations (white-box only, dataset-specific results, no discussion of real-world deployment scenarios) are not systematically addressed."
     },
     {
       "flag": "Parameter variation conflated with randomness",
       "detail": "The 4 runs use different attack parameter settings (learning rate, iterations, perturbation bound) which are then averaged together. This conflates the effect of parameter choice with run-to-run variance, making it impossible to assess the stability of any single configuration."
     },
     {
       "flag": "Potential benchmark familiarity",
       "detail": "KODAK (1991) is extremely widely used in compression research and likely present in training pipelines of multiple evaluated codecs. No discussion of whether models were trained or tuned on evaluation datasets."
     }
   ],
   "cited_papers": [
     {
       "title": "A survey on adversarial attacks and defences",
       "authors": ["Anirban Chakraborty", "Manaar Alam", "Vishal Dey", "Anupam Chattopadhyay", "Debdeep Mukhopadhyay"],
       "year": 2021,
       "relevance": "Comprehensive survey on adversarial robustness techniques, relevant to AI safety and model reliability evaluation."
     },
     {
       "title": "Towards evaluating the robustness of neural networks",
       "authors": ["Nicholas Carlini", "David Wagner"],
       "year": 2017,
       "relevance": "Foundational work on evaluating neural network robustness through adversarial attacks, widely used methodology in AI safety research."
     },
     {
       "title": "Towards deep learning models resistant to adversarial attacks",
       "authors": ["Aleksander Madry", "Aleksandar Makelov", "Ludwig Schmidt", "Dimitris Tsipras", "Adrian Vladu"],
       "year": 2018,
       "relevance": "Introduces PGD attack and adversarial training framework, foundational to adversarial robustness evaluation methodology."
     },
     {
       "title": "Diffusion models for adversarial purification",
       "authors": ["Weili Nie", "Brandon Guo", "Yujia Huang", "Chaowei Xiao", "Arash Vahdat", "Anima Anandkumar"],
       "year": 2022,
       "arxiv_id": "2205.07460",
       "relevance": "State-of-the-art adversarial defense using diffusion models, relevant to understanding AI model robustness and defense strategies."
     },
     {
       "title": "A survey on universal adversarial attack",
       "authors": ["Chaoning Zhang", "Philipp Benz", "Chenguo Lin", "Adil Karjauv", "Jing Wu", "In So Kweon"],
       "year": 2021,
       "arxiv_id": "2103.01498",
       "relevance": "Survey of universal adversarial attacks applicable across neural network architectures, relevant to AI safety evaluation."
     },
     {
       "title": "Physical adversarial attack meets computer vision: A decade survey",
       "authors": ["Hui Wei", "Hao Tang", "Xuemei Jia"],
       "year": 2024,
       "relevance": "Recent survey on physical adversarial attacks covering real-world deployment safety concerns for neural network systems."
     },
     {
       "title": "Attack and defense analysis of learned image compression",
       "authors": ["Tianyu Zhu"],
       "year": 2024,
       "arxiv_id": "2401.10345",
       "relevance": "Directly related work analyzing adversarial robustness of learned image compression systems."
     },
     {
       "title": "Toward robust neural image compression: Adversarial attack and model finetuning",
       "authors": ["Tong Chen", "Zhan Ma"],
       "year": 2023,
       "relevance": "Proposes FTDA attack and geometric self-ensemble defense for neural image compression, foundational methodology adopted in this paper."
     },
     {
       "title": "Comparing the robustness of modern no-reference image- and video-quality metrics to adversarial attacks",
       "authors": ["Anastasia Antsiferova", "Khaled Abud", "Aleksandr Gushchin"],
       "year": 2024,
       "relevance": "Evaluates adversarial robustness of quality assessment models, related work on AI model vulnerability evaluation."
     },
     {
       "title": "Boosting adversarial attacks with momentum",
       "authors": ["Yinpeng Dong", "Fangzhou Liao", "Tianyu Pang", "Hang Su", "Jun Zhu", "Xiaolin Hu", "Jianguo Li"],
       "year": 2018,
       "relevance": "Influential adversarial attack methodology using momentum, widely used in robustness evaluation of neural networks."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Relevant to image compression researchers and standards bodies but not immediately actionable for general practitioners."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Confirms expected vulnerability of neural networks to adversarial attacks; the JPEG AI standard context adds moderate novelty but no fundamental surprise."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that the first international neural compression standard (JPEG AI), intended for consumer devices, is vulnerable to adversarial attacks with transferable exploits across versions."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict; a straightforward evaluation study with results favorable to JPEG AI's relative robustness."
     },
     "demo_ability": {
       "score": 0,
       "justification": "Code link is hidden for blind review, so no one can try the evaluation pipeline."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "JPEG is a recognized standard but JPEG AI is not yet widely known outside the compression community."
     }
   }
 }