Adversarial examples expose classifier sensitivity to crafted inputs [4], [11]. Projected Gradient Descent (PGD) evaluates a first-order attack inside a chosen feasible set [5], while Carlini–Wagner methods and AutoAttack supply complementary empirical challenges [6], [10]. Weak or obfuscated gradients can mislead empirical assessment [12]. Madry-style adversarial training modifies classifier weights and differs from subsequent tuning of fixed decision thresholds. Ensemble adversarial training is another classifier-level approach [13]. Gaussian randomized smoothing supplies certificates for a separately defined smoothed classifier against L2 perturbations, conditional on its probability estimation procedure [8]; it does not directly certify the L∞ classifier and attack used in the tables.

Differential evolution, SHADE and particle-swarm updates are established search components [1-3]. Their use in Adversarial-Aware Population Optimization (AAPO) does not itself prove a new saddle-point algorithm or convergence on a mixed decision space. The relevant methodological distinction is the candidate scoring rule: a finite PGD attack is embedded in each outer fitness evaluation [5]. Its interpretation depends on whether gradients follow the full candidate-specific prediction pipeline, how invalid feature perturbations are repaired, and whether the same evaluation budget is applied to each comparator. Those implementation details are absent from the supplied execution record.

CICIDS2017 is a relevant source dataset for network intrusion detection [9]. The manuscript also presents MNIST image classification as a second benchmark, but feature-vector perturbations for network flows need validity constraints beyond a simple L∞ box to correspond to realizable packets. The author reports an additional UNSW-NB15 analysis in an appendix that is not present in this supplied document. No cross-dataset result is therefore used here. The deployed decision layer, base-model weights, feature preprocessing and attack feasibility must be archived to interpret a cybersecurity benefit.

For genuinely independent problem blocks, the Friedman and Nemenyi procedures compare ranks across algorithms; Demšar gives the reference critical-difference construction [14]. Repeated random seeds on the same datasets or classes are not automatically independent datasets. Paired tests, effect sizes and bootstrap intervals require the raw paired observations and an explicit sampling unit. Holm correction must state its test family and whether exact or asymptotic p-values were used [15]. The supplied rank and pairwise summaries are treated as reported values until those inputs are recovered. Morris elementary effects screen input sensitivity through one-factor changes along trajectories [9]; a trajectory for eight parameters uses nine model evaluations, not nine for each parameter.

The intended attacker perturbs deployment inputs within a stated L∞ budget and has limited query access. The source calls this setting grey-box because the attacker may know the classifier family but not the deployed decision vector. The specified PGD inner loop, however, differentiates a candidate-dependent loss using the optimizer's current w and true labels. That is a defender-side attack surrogate with stronger information, not an implementation of the unknown-w, Q-query deployment attacker. No exact Q value, query accounting or transfer test is supplied. Limited-query black-box evaluations require their own protocol [16].

The scope is test-time input evasion [7]. Neither changing the training set nor compromising code is modeled. Gaussian smoothing, if implemented on a smoothed base classifier, offers an L2 statement for that classifier [8]. No white-box, L∞ or production-system certificate is established by the proposed decision-layer search. For CICIDS2017, normalized feature perturbations must additionally map to valid, causally consistent traffic records. Otherwise the experiment is a numerical feature-space stress test rather than a packet-level adversary.

Let w be a defender decision vector and δ an admissible input perturbation. The ideal loss and a specified L∞ feasible set are written below. The expectation is over the target data distribution, whereas an empirical finite-batch attack acts only on the provided sample. The admissible set must also enforce data-domain constraints where coordinates encode categorical values, counts or protocol relations [5].

R(w; ε) = (x,y)∼ [maxℓ(g(h(x + δ; θ), w), y)] , Δε = {δ: ∥ δ ∥∞≤ ε}.

δ∈Δε

The ideal outer problem minimizes R(w; ε). A PGD return δ̂ is feasible, so its per-input loss is at most the exact inner maximum; this is a lower estimate, not the claimed stochastic upper bound [5]. Random starts and larger K may find a stronger feasible attack but give no uniform approximation guarantee. The scaling of estimation variance as 1/(B·R) would need independent losses or an explicit covariance model; restarts on the same input share dependence. The source's finite score is thus a training surrogate for the intended robust objective.

The source algorithm scores candidates by the mean loss over B inputs and R PGD restarts. For a fixed batch and returned attacks, restart mean ≤ maximum returned loss ≤ exact constrained maximum, sample by sample. Choosing the maximum returned loss usually produces a stronger empirical attack than taking the mean, though neither is an upper bound on the exact worst case. Averaging may smooth the observed score; it is not generally unbiased for the maximum. The source also describes a separate held-out attack batch without identifying that batch, its reuse, independence from outer selection or how trial and incumbent candidates share the same random draws. Those choices determine selection bias and score variance.

Its right-hand operator box and some labels are cropped in the original bitmap. The figure shows an offline candidate-specific PGD surrogate and adaptive outer search; it does not document a query-limited deployment attack or a worst-case loss certificate. The original scientific image is retained unchanged pending the editable plotting source (Fig. 1).

The source describes a population of 30 candidate decision vectors, up to 300 generations, and three operators. Each candidate is scored with a finite-batch, ten-restart PGD loss mean; reported operator credits then guide a softmax choice. Feasible projection and discrete ranking are described as repair operations. The exact update pseudocode, data-dependent attack gradient, candidate caching, common randomness and stopping logic require an executable implementation. A single candidate-specific gradient routine cannot be assumed to handle discontinuous rule priorities without a documented relaxation or surrogate.

A change in the current population does not by itself make a fixed objective nonstationary. Different attack batches, random starts, adaptive preprocessing or changing base models could make observed scores vary over generations. The rationale for recency-weighted operator credit is therefore a design hypothesis until the fitness sampling and controlled ablations are documented. Operator attribution also requires comparing accepted trial values against incumbent values under matched attack draws.

The proposed portfolio uses DE/rand/1 [2], a particle-swarm update [1] and a Lévy-style trial perturbation. The source specifies α = 1.5 for the latter, recency factor γ = 0.7, and an operator softmax with temperature raised when population diversity declines. These are design parameters rather than derived optimum values. The variable x in the reported scale 0.05·(x_ub−x_lb) must be resolved against w coordinates, simplex projection and mixed discrete units. Without synchronized attacks on incumbent and trial, credit differences can reward favorable attack noise instead of genuine improvement.

The source monitors ten-bin marginal entropy and mean pairwise L2 distance, stopping after both fall below five percent of initial values for 25 generations or at generation 300. These are population diagnostics, not proof of convergence. Initial entropy can be zero in a constrained dimension; bin edges, normalization and treatment of zero baselines must be specified. Marginal entropy and pairwise distance may also hide distinct high-dimensional search configurations.

Algorithm 1 records the author's search sketch. It evaluates each candidate by summing the losses from ten PGD restarts and dividing by their count, then uses a credit-weighted operator and accepts lower estimated scores. The notation PGD-Attack must state whether it differentiates through the candidate's decision rule, which true label it uses, how the L∞ box is projected onto valid input features, and how it budgets queries. AutoAttack is named as an additional empirical evaluator [10], but the supplied record gives neither per-attack results nor the executable configuration needed to test transfer or masking.

Algorithm 1. Source-reported AAPO workflow (implementation to be verified).

Input: population N, generations T, attack budget ε, PGD steps K, restarts R, batch B 1. Initialize feasible decision candidates and operator credits.

2. For each generation and candidate, generate feasible PGD attacks on B records with R starts; average their observed losses.

3. Update operator credits from reported fitness changes and compute diversity indicators.

4. Propose a DE, PSO or Lévy-style trial, project onto feasible decision variables, and compare under a defined common attack batch.

5. Accept an improving trial according to the chosen finite attack score.

6. Stop at T or at the source's sustained diversity threshold; return the lowest scored candidate.

This sketch does not specify executable gradients for mixed decision variables, query budget Q, valid network-flow perturbations or common-random-number controls. Those must be supplied before reproducing the proposed algorithm.

If one candidate evaluation uses B inputs, R starts and K gradient steps, the inner loop entails O(NBRK) input-gradient steps per generation, each priced by the base classifier and input dimension. Treating d, the number of decision parameters, as the PGD gradient dimension conflates decision and input spaces. Source values N = 30, B = 64, R = 10, K = 100 and T = 300 imply 1,920,000 sample-level PGD steps per generation before trial rescoring and 576,000,000 such steps for a full 300-generation run, if every loop is executed as written. B samples may be evaluated in parallel mini-batches, so this is not a count of distinct accelerator kernels or wall-time units. These figures do not by themselves verify the reported 7.4- or 11.6-second generation times or 38-/58-minute totals. The 7×10⁴ claimed relative-cost factor also depends on actual update and backward-pass costs; hardware logs and code are required.

The source identifies CICIDS2017 [9] and MNIST as the evaluated datasets. It describes a chronological 70/15/15 split for network flows, a three-model CICIDS ensemble with weights and an alert threshold, and an MNIST classifier with per-class thresholds. These statements require indices, leakage checks, trained model states and preprocessing. The manuscript uses L∞ input budgets 0.05, 0.1 and 0.2, but gives no unit-scale convention for heterogeneous network-flow fields or categorical validity. Its stated decision dimension d ∈ {8,16} does not follow from three ensemble weights plus one threshold (four) and ten class thresholds (ten); any additional variables must be enumerated. The claimed UNSW-NB15 appendix is absent.

The supplied comparison names GA, PSO [1], DE [2], SHADE [3], CMA-ES [17] and a Madry-PGD-trained model [5]. Baseline roles differ: adversarially trained classifier weights are not merely another decision-vector optimizer. Equal N and T cannot establish equal gradient calls or wall time when one baseline trains its classifier and another tunes thresholds. Clean and PGD-attack accuracies are retained in the source figures and tables as reported. Randomized smoothing [8] concerns a separately specified L2 smoothed classifier; its radius must be validated through class-probability bounds and cannot be directly compared with L∞ accuracy. Statistical units are left unresolved by the competing references to thirty seeds and eight problem instances.

The source lists thirty seeds, an A100 GPU and library versions, but supplies no runnable repository, public deposit identifier, split indices, trained checkpoint or Docker image. These details are a recorded protocol rather than evidence that the reported execution was reproduced. A complete release must include the exact source code and environment lockfile, base models, preprocessing, feature-repair rules, full attacks, initial states, per-seed predictions, raw paired observations and generated figures. The stated release and Zenodo deposit remain unverified.

Checkmarks do not establish tested attack coverage or certification. The unknown-w, query-limited setting, AutoAttack configuration, L2 smoothing classifier and feature-domain validity need separate evidence; the matrix should be revised from executable evaluations before publication (Table 1).

The supplied Fig. 2 depicts median attack-surrogate loss over thirty purported runs at ε = 0, 0.05, 0.1 and 0.2. Larger ε would weakly enlarge an identical exact inner feasible set for a fixed w and data, but the chart plots separately optimized approximate scores, so monotone visual ordering is a descriptive observation. The attribution of wider bands or slower decline to operator credits, landscape roughness and attack variance requires per-generation attack draws, credit trajectories and controlled alternatives. Source curves alone do not identify that mechanism.

The source bitmap is retained. Neither exact worst-case loss nor the causal role of operator selection is established by these curves (Fig. 2).

In the source's MNIST summary at ε = 0.1, AAPO records robust accuracy 80.1% and the Madry-PGD-trained comparator 74.2%, a difference of 5.9 percentage points. The source charts show clean accuracy near 93.9% for AAPO, but the illustrated robust values for several other baselines do not reconcile with the increments in Table 2. Figs. 3 and 4 are therefore shown as original figures with an explicit data-provenance hold; their point clouds, bootstrap bars and Pareto line cannot establish a common benchmark comparison without the generating table and plot script. A Pareto frontier requires comparing the same operational objectives and compatible methods, not merely drawing a line through source markers.

For other comparators the bar heights disagree with Table 2's stated gains; the original bitmap is retained for author reconciliation, not interpreted as validated statistics (Fig. 3).

Its comparator centers must be reconciled with Fig. 3 and Table 2 using per-seed results. A drawn dashed line is not proof of a globally optimal multiobjective frontier (Fig. 4).

Table 2 preserves six source-reported pairwise deltas, Cliff's δ, Hedges' g, bootstrap intervals and Holm-adjusted p-values; its Madry comparator delta is +5.9 pp. The reported test unit is ambiguous: eight problem instances are named while thirty seeds also appear. With exactly eight untied independent paired differences and an exact two-sided signed-rank test, the smallest raw p-value is 2/2⁸ = 0.0078125, and a six-comparison Holm family cannot all have adjusted p-values below 0.01. Ties, an asymptotic approximation, pooling or a different observation unit might change the calculation; the raw paired data and code must resolve it. The source's effect-size labels do not establish an independent-domain or deployment advantage.

The source reports Friedman χ² = 31.4 and seven mean ranks of 1.25, 3.10, 3.85, 4.35, 4.95, 5.85 and 6.55 over eight stated blocks. These sum to 29.90; with seven algorithms, ranks within each complete block must sum to 28, and so must the mean ranks. The raw rank matrix or corrected values are necessary before recalculating Friedman significance. For seven algorithms and eight independent blocks, Demšar's two-sided Nemenyi q at α = 0.05 is 2.949, giving CD = 2.949√[7·8/(6·8)] ≈ 3.185 [14]. The source's CD = 1.94 is therefore incompatible with those stated units. The AAPO–Madry mean-rank gap of 1.85 does not exceed even that source CD. No all-baseline Nemenyi conclusion follows from the retained chart.

Its ranks sum to 29.90 rather than the required 28, and its 1.94 critical difference is not the standard two-sided Nemenyi value for seven methods and eight independent blocks (approximately 3.185). The plotted significance annotation is invalid pending source-rank reconstruction (Fig. 5).

Table 3 reports PGD-attack accuracies for AAPO and the Madry-PGD-trained comparator at three L∞ budgets; the observed differences are 4.5, 5.9 and 6.6 percentage points at ε = 0.05, 0.1 and 0.2, respectively. These source figures describe the tested finite attacks, conditional on common evaluation inputs and matching attack strength. They do not guarantee generalization to adaptive or higher-budget attackers. The source separately states 71.4% versus 65.2% certified accuracy at L2 radius 0.05 under σ = 0.25; neither a smoothed model specification nor class-probability bounds are provided, and no L∞ certificate follows from an L2 radius [8].

Table 4 retains the reported one-component-at-a-time ablations. Omitting the inner attack is associated with a 17.0 pp lower score, while omitting the operator schedule, Lévy operator or the dual-diversity stop rule is associated with 4.8, 3.1 and 1.4 pp lower scores. These contrasts do not sum to a causal decomposition; each changed configuration may interact with the others and have a different compute budget. The source also calls the reference setting both a single-island search and a multi-deme topology, and contrasts warm-start with random restarts without specifying how those restarts enter the previously described inner loop. A factorial or matched-budget ablation and code are needed before assigning distinct benefits.

Fig. 6 reports source-assigned Morris μ* and σ values for eight hyperparameters and four outputs. Twenty trajectories across eight parameters require 20·(8+1) = 180 model evaluations in total for the standard one-at-a-time path design [18], not 180 per hyperparameter. Each evaluation may itself include many population and PGD operations. The chart displays ε_train and K as large robust-accuracy effects, but parameter scaling, step size, trajectory generation, bootstrap variability and the output metric definitions are absent. μ* screens scaled elementary effects; σ mixes nonlinear and interaction contributions and does not isolate either mechanism. The reported ranking is descriptive until the design and raw effects are supplied.

Original numeric annotations and bitmap are retained. Twenty nine-point trajectories imply 180 whole-model evaluations; parameter ranges and raw elementary effects are needed to interpret magnitudes and interactions (Fig. 6) [18].

No certified optimization gap follows from this record. A longer AAPO run that improves the incumbent by at most a reported 0.6 percentage points on the inspected configurations cannot upper-bound all improvement still available in a nonconvex search space. Comparing finite PGD at 100 and 1000 steps on a subset likewise cannot bound the supremum of its gap from the exact inner maximum. Moreover, the source expression mixes an empirical score at the unknown true minimizer with a continued-search quantity without a justified decomposition or measurable global terms. The reported 1.8 pp is a sum of two local diagnostic values, not a valid bound on global suboptimality. A rigorous guarantee would need explicit assumptions, attack optimality bounds and a search certificate; the current paper makes no such claim.

The reported MNIST Table 3 contrast suggests decision-parameter tuning merits further study alongside classifier adversarial training [4]. It does not isolate why AAPO differs: method, base checkpoint, optimizer budget, attack adaptation and threshold selection are all potential contributors. A simplex constraint is continuous and not by itself nondifferentiable; thresholded decisions or discrete rule ranks can cause nondifferentiability. The source does not establish that those components were actually optimized in each benchmark. A matched study with the same checkpoint and decision space could test the proposed complementarity.

A population can average noisy fitness differences, but averaging across candidates does not automatically regularize an attack approximation or improve statistical efficiency. Candidate evaluations can share data and attack draws. The source provides no variance comparison with a strong gradient-based decision-layer baseline and no per-gradient wall-time accounting. The rationale remains a plausible optimization hypothesis rather than an identified cause of the reported score differences.

Clean and attacked accuracy form a practical trade-off. A decision maker must also account for false alarms, attack misses, class prevalence and the operational cost of each threshold, because overall accuracy alone does not specify security utility. The supplied scatter uses source-inconsistent comparator values and cannot establish an empirical Pareto set. The optimizer returns a population, but no measured nondominated set or selection rule is reported; any operational choice would require calibrated, independently validated cost functions.

The three recorded test budgets show higher AAPO than Madry-PGD-train values under the specified finite PGD attack. This is a descriptive cross-budget comparison, not a guarantee against an adaptive attacker or an unseen feasible feature transformation. Gaussian smoothing may offer a separate L2 certificate if applied and validated on the actual deployed classifier [8]. The required threat set and validation protocol must be specified for any production claim.

The source lists seeds and software versions but no resolvable code, Zenodo record, image digest or downloadable container. A code release cannot be asserted on the supplied evidence. Reproduction requires the exact attacker and defender implementations, network-flow feasibility constraints, base-model weights, split indices, per-seed metrics, rank matrices, sensitivity trajectories, and bitmap-generation inputs [10], [12]. Until these are supplied, the tabulated and figured outcomes remain author-reported observations.

The evaluated inner attack uses candidate-specific gradients and labels, whereas the stated deployment threat concerns unknown decision weights and restricted queries. Adaptive query-limited surrogate attacks are not tested [16]. Poisoning and compromise of training or optimization infrastructure fall outside this test-time evasion formulation [7]. The manuscript's original scope matrix cannot substitute for independent attacks on each threat category. The features of a feasible network packet must be specified before a CICIDS2017 L∞ experiment can be interpreted operationally.

The source selects γ, Lévy scale, diversity bins and patience without releasing validation traces. Transferring those defaults from network flows to MNIST is an assertion needing code and split-level evidence. The listed sensitivity heatmap suggests that ε, K and R affect the reported outcomes, but cannot identify stable defaults without stated parameter ranges and matched compute. Runtime estimates need benchmark logs including PGD backward passes, trial rescoring and the attack hardware.

The proposed population process has no demonstrated irreducible, aperiodic Markov-chain model or bounded discretization error for continuous and mixed decision variables. The diagnostic comparison at 100 versus 1000 PGD steps and the extra 100 outer generations do not certify an approximation or optimization gap. The no-free-lunch theorem [19] neither predicts this method's outcome nor licenses an unverifiable advantage; conclusions must remain conditional on the specified problems and measured attacks.

Security research can aid both defense and attack. This work describes standard attack families for evaluation [5], [10] and proposes tuning a defender's decision layer. An operator considering use would need feature-valid evasion tests, class-specific false-alarm and missed-attack costs, protected-group performance where relevant, and drift monitoring. The source does not supply a deployment study or evidence that periodic retuning preserves adversarial robustness.