Pith. sign in

REVIEW 3 major objections 6 minor 21 cited by

Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks

T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A new gradient attack transfers to defended models with 93.5 percent success.

desk verdict Solid, reproducible incremental attack paper; the combined method clearly improves transferability, and the scale-invariance mechanism is under-supported but not load-bearing. read the letter →

arxiv 1908.06281 v5 pith:Z6JA3YWA submitted 2019-08-17 cs.LG cs.CRstat.ML

Jiadong Lin , Chuanbiao Song , Kun He , Liwei Wang , John E. Hopcroft This is my paper · ORCID
classification cs.LGcs.CRstat.ML
keywords adversarialexamplestransferabilityblack-boxattacksNesterovacceleratedgradientscale-invariancemodelaugmentationiterativeFGSMdefenses
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

To make adversarial examples transfer from the model they were crafted on to unseen or defended models, this paper attacks the optimization process itself. It proposes NI-FGSM, which replaces the plain momentum used in iterative attacks with Nesterov accelerated gradient, so each update first jumps ahead in the accumulated-gradient direction; and SIM, which optimizes the perturbation over several scaled copies of the input at once. The scaling trick rests on an empirical scale-invariance property of deep classifiers: their loss is roughly unchanged when the input is rescaled, so scaled copies behave like a family of related models and cheaply act as model augmentation. Combined with translation-invariant kernels and random-resize/padding diversity, the resulting SI-NI-TI-DIM attack reaches 93.5% average black-box success on adversarially trained models and 90.3% on six advanced defenses, about 15 points above the previous best baseline.

What carries the argument

The load-bearing mechanism is the pairing of a Nesterov look-ahead step with a scale-copy ensemble objective. The look-ahead step $x^\text{nes}_t = x^\text{adv}_t + \alpha\cdot\mu\cdot g_t$ modifies iterative FGSM: before gradients are computed, the accumulated gradient is used to make a probe jump, which helps the attack escape poor local maxima. The scale-copy ensemble objective $\max_{x^\text{adv}}\frac{1}{m}\sum_{i=0}^{m-1}J(S_i(x^\text{adv}),y)$ with $S_i(x)=x/2^i$ is the core of SIM: it averages gradients over a family of derived models $f(S_i(x))$, implementing model augmentation from a single classifier. The paper defines the loss-preserving transformation and model augmentation concepts that justify SIM, and validates the needed scale-invariance empirically over scale range $[0.1,1.3]$ on normally trained models.

What would settle it

Measure $J(x/2^i,y)$ on adversarially trained and defended models at the scales actually used by the attack ($i=0,\dots,4$, so factors $1,1/2,1/4,1/8,1/16$), and compare. If the loss at $1/16$ diverges sharply while SI-NI-TI-DIM still transfers well, the scale-invariant premise is not what carries the result; alternatively, rerunning SIM with the scales restricted to the validated $[0.1,1.3]$ range and seeing whether the transfer gain disappears would settle it.

Watch

Extended reading notes

Core claim

The paper's central claim is that two optimizer-level changes make gradient-based adversarial attacks substantially more transferable. First, Nesterov's accelerated gradient—taking a look-ahead step $x^\text{nes}_t = x^\text{adv}_t + \alpha\cdot\mu\cdot g_t$ before computing the gradient—stabilizes and corrects the ascent direction, so NI-FGSM outperforms MI-FGSM at equal iteration counts and needs fewer iterations to reach the same success rate. Second, because deep models appear scale-invariant in loss, the Scale-Invariant attack Method (SIM) maximizes the average loss $\frac{1}{m}\sum_{i=0}^{m-1} J(S_i(x),y)$ over scale copies $S_i(x)=x/2^i$, turning a single white-box model into an ensemble of augmented models without training extra networks. The full combination SI-NI-TI-DIM integrates SIM and NI-FGSM with translation-invariant and diverse-input processing, achieving average success rates of 93.5% against adversarially trained ensembles and 90.3% against HGD, R&P, NIPS-r3, FD, ComDefend, and randomized smoothing.

Load-bearing premise

The SIM component depends on the claim that the attacked classifier's loss is essentially unchanged when an image is scaled down by factors as small as $1/16$; the paper verifies this only for four normally trained models over a narrower range and does not show that adversarially trained or defended models share the property.

Editorial extensions

If this is right

  • SI-NI-TI-DIM raises average black-box success on adversarially trained models (Inc-v3 ens3, Inc-v3 ens4, IncRes-v2 ens) to 93.5%, so those defenses offer little robustness against this attack.
  • Against HGD, R&P, NIPS-r3, FD, ComDefend, and randomized smoothing, the same attack averages 90.3%, beating TI-DIM by 14.7 percentage points.
  • NI-FGSM reaches a given transfer success with fewer iterations than MI-FGSM, so the look-ahead idea accelerates adversarial example generation, not just final success.
  • SIM can be dropped into existing gradient-based attacks (DIM, TIM, TI-DIM) and improves each, showing the scale-copy ensemble is a general plug-in.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct testable extension the paper leaves open is whether SIM degrades when batch-normalization statistics are frozen, since the paper speculates that batch normalization may be what makes deep models scale-invariant.
  • The same model-augmentation recipe could in principle use any loss-preserving transformation, such as rotations, crops, color shifts, or blur; the paper only demonstrates scaling.
  • The look-ahead result suggests that other optimizer improvements that help generalization could also improve attack transferability, with Adam-style updates an obvious next candidate.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper proposes two new transferable adversarial attack components: NI-FGSM, which incorporates Nesterov accelerated gradient into iterative FGSM, and SIM, which averages gradients over scaled copies of the input based on an empirically observed scale-invariance property. The authors integrate these with existing methods (DIM, TIM, TI-DIM) and evaluate on ImageNet against normally trained, adversarially trained, and defended models. The best combination, SI-NI-TI-DIM, reports average attack success rates of 93.5% on adversarially trained models and 90.3% on advanced defenses, surpassing the TI-DIM baseline by a large margin. The paper includes code release, comparisons against strong baselines, and additional analysis of iteration counts.

Significance. If the reported results hold, the work is significant for the adversarial-example community: it demonstrates that combining a better optimization trajectory (Nesterov momentum) with input-scale ensembling can substantially improve black-box transferability, and the reported margins over TI-DIM are large and consistent across tables. The paper's strengths include the public code, the use of strong baselines, evaluation across three defense categories, and the observation that scale transformation can serve as a form of model augmentation without training multiple models. The empirical core is internally consistent; however, the mechanism proposed for SIM is not fully validated by the presented evidence, and the manuscript contains a reproducibility-relevant inconsistency between the formulation and the algorithm. These issues are fixable and do not contradict the empirical claims themselves.

major comments (3)
  1. [Section 3.3 / Section 4.2 / Algorithm 1] The validation of the scale-invariant property does not cover the scale range actually used by SIM. Figure 1 shows average loss for scale sizes in [0.1, 2.0] and claims the property holds in [0.1, 1.3], but Algorithm 1 with m=5 computes gradients at scales 1, 1/2, 1/4, 1/8, and 1/16; the smallest scale, 1/16 = 0.0625, lies below the validated range. The paper should validate scale-invariance over the exact scales used by the attack, including on adversarially trained and defended models, or justify why extrapolation below 0.1 is safe.
  2. [Section 4.2 / Definition 1] The validation of scale invariance is performed on average cross-entropy loss over 1000 images, but Definition 1 requires J(T(x),y_true) ≈ J(x,y_true) for any input x. More importantly, SIM sums gradients rather than comparing losses; equal average losses do not imply that the gradients at scaled copies are aligned. Without per-image loss statistics or direct gradient-alignment measurements (e.g., cosine similarity between gradients at original and scaled inputs), the stated 'model augmentation' mechanism for SIM's improved transferability is not directly supported. Please add such evidence or soften the mechanism claim.
  3. [Section 3.3, Eq (9) vs Algorithm 1] There is an inconsistency between the definition of SIM and the algorithm implementation. Equation (9) sums over i=0 to m, which for m=5 gives six scale copies including 1/32, whereas Algorithm 1 loops over i=0 to m-1, giving five copies with smallest scale 1/16. This directly affects reproducibility; please clarify the exact number of scale copies and the smallest scale used in all experiments.
minor comments (6)
  1. [Section 4.1] The text says 'Denote our SI-NI-FGSM integrated with other attacks as SI-NI-DIM, SI-NI-TIM, and SI-NI-TIM-DIM, respectively.' The last name should be SI-NI-TI-DIM, consistent with the rest of the paper.
  2. [Section 4.1 / Table 3] The 'NIPS-r3' defense is referenced only by a footnote link; please provide the full citation and a one-sentence description in the text, as done for HGD and R&P.
  3. [Section 4.2 / Figure 1] The figure shows only average loss curves without per-image variability or confidence intervals, and the scale range starts at 0.1, omitting the smaller scales used in the attack. Consider plotting per-image quantiles or error bars and extending the range down to 1/16.
  4. [Section 4.3-4.5 / Tables 1-3] All success rates are reported as point estimates without error bars, repeated runs, or statistical significance tests. Given that the numbers are based on 1000 images, reporting variance or at least multiple runs for the key comparisons would strengthen the claims.
  5. [Section 4.1 / Hyper-parameters] There is no sensitivity analysis for the number of scale copies m or the momentum decay factor μ, even though both are free parameters. A small study showing the effect of m and μ on transferability would help justify the chosen defaults.
  6. [Section 4.4 / Table 2] The table header 'IncRes-v2*' and the body 'IncRes-v2ens' are adjacent and visually similar; clarify the distinction between the normally trained and ensemble-adversarially-trained models in the table caption or formatting.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: attack recipes are evaluated on held-out target models, with no fitted parameter renamed as a prediction.

full rationale

The paper's derivation chain is empirical rather than analytical: NI-FGSM applies Nesterov accelerated gradient to iterative FGSM, and SIM averages gradients over scaled copies of the input. Neither method's definition is stated in terms of the reported success rates, and no constant is fitted to the transferability numbers that are then claimed as predictions. The scale-invariant property is presented as an empirical discovery used to motivate SIM, and Section 4.2 validates it with average losses measured on the models under attack; this is motivation, not an output of the method that is subsequently tested. The central results in Tables 1, 2, and 3 are evaluated against held-out black-box models and defense methods that were not used to tune the attack, so the transferability claims are externally falsifiable rather than forced by construction. Hyperparameters such as epsilon, iterations, step size, and decay factor are taken from Dong et al. (2018), and the number of scale copies m=5 is a fixed choice, not a parameter fitted to the target success rates. Self-citations, including Song et al. (2019), Song et al. (2020), and Wang et al. (2019), appear only as background or future-work references and are not load-bearing for the main claims. The skeptical concern that Section 4.2 validates average loss rather than per-example gradient alignment, and that SIM uses scales down to 1/16 while validation stops at 1.3, is a correctness and support gap for the proposed mechanism, but it is not a circularity: the reported empirical gains could be under-explained, yet they are not equivalent to the paper's inputs by definition.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The new attack methods rely on the NAG adaptation and the scale-invariance assumption; neither is derived from first principles. The only hand-tuned parameter specific to the new methods is m. No new physical or computational entities are introduced.

free parameters (2)
  • Number of scale copies m = 5
    Set by hand for SIM and SI-NI-FGSM; no sensitivity analysis is reported, so the improvement could depend on this choice.
  • Momentum decay factor mu = 1.0
    Taken from MI-FGSM defaults; not fitted to the new data, but it is a hand-set hyperparameter of the new attack.
assumptions (4)
  • domain assumption Cross-entropy loss is the right objective to maximize for non-targeted transfer attacks in the l-infinity ball.
    Used in Eq. (9) and throughout; standard in the adversarial attack literature, but not proven to maximize transferability.
  • domain assumption A model f'(x)=f(T(x)) derived from a loss-preserving transformation T is a useful model augmentation that improves transferability.
    Section 3.3 Definition 2 and motivation in Section 3.1; the paper relies on this analogy between generalization and transferability without proof.
  • domain assumption Deep models are scale-invariant for the loss J for scales in [0.1, 1.3].
    Section 4.2 empirically validates this on 1000 ImageNet images and four normally trained models; the paper does not prove it and later attacks use scales down to 0.0625.
  • domain assumption Nesterov accelerated gradient's looking-ahead property remains beneficial when used with sign updates and gradient normalization.
    Section 3.2 adapts NAG to sign-based attacks; no convergence analysis is given for this non-smooth, non-convex setting.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks." pith.science (2026). https://pith.science/paper/Z6JA3YWA

@misc{pith2026190806281,
  author       = {Pith},
  title        = {Pith review of: Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z6JA3YWA}},
  note         = {Machine review of arXiv:1908.06281}
}
read the original abstract

Deep learning models are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on benign inputs. However, under the black-box setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversarial example generation as an optimization process, we propose two new methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial examples. While SIM is based on our discovery on the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial perturbations over the scale copies of the input images so as to avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient-based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of-the-art gradient-based attacks.

Figures

Figures reproduced from arXiv: 1908.06281 by the authors.

Figure 1
Figure 1. The average losses for Inc-v3, Inc-v4, IncRes-v2 and Res-101 at each scale size. The results are averaged over 1000 images. 4.3 ATTACKING A SINGLE MODEL In this subsection, we integrate our SI-NI-FGSM with TIM, DIM and TI-DIM, respectively, and compare the black-box attack success rates of our extensions with the baselines under single model setting. As shown in [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Attack success rates (%) of NI-FGSM and MI-FGSM on various number of itera￾tions. The adversarial examples are crafted on Inc-v3 model against (a) Inc-v3 model, (b) Inc-v4 model and (c) IncRes-v2 model. Comparison with classic attacks. We consider to make addition comparison with classic attacks, including FGSM (Goodfellow et al., 2014), I-FGSM (Kurakin et al., 2016), PGD (Madry et al., 2018) and C&W (Carlini & Wagn… view at source ↗
Figure 3
Figure 3. Visualization of randomly picked benign images and their corresponding adversarial im [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 21 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation

    cs.CR 2025-04 conditional novelty 7.0 of 10

    A classifier trained to be random on clean inputs and accurate on a fixed trigger-shifted input becomes resistant to transferred adversarial attacks, though it remains vulnerable to attackers who replicate the trigger.

  2. Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks

    cs.LG 2026-08 conditional novelty 6.0 of 10

    BMAT couples initialization, perturbation, and surrogate adaptation in one bilevel-minimax optimization, markedly improving adversarial example transfer to unseen victims.

  3. Non-Adaptive Adversarial Face Generation

    cs.CV 2025-07 conditional novelty 6.0 of 10

    A non-adaptive batch of 100 face queries against a face recognition API can produce synthetic faces that impersonate a target identity with a chosen attribute, exceeding 93% success against AWS CompareFaces at its def...

  4. Towards more transferable adversarial attack in black-box manner

    cs.LG 2025-05 conditional novelty 6.0 of 10

    ScorePGD and U-ScorePGD craft transferable black-box adversarial examples by optimizing the log-likelihood of a time-dependent classifier on a single noisy sample, matching or beating DiffPGD at roughly 10x lower cost.

  5. Benchmarking Unified Face Attack Detection via Hierarchical Prompt Tuning

    cs.CV 2025-05 conditional novelty 6.0 of 10

    The authors release UniAttackData+, a unified face attack detection dataset with 54 attack types and 697,347 videos, and propose HiPTune, a hierarchical prompt tuning model that outperforms baselines on multiple UAD b...

  6. Attention-aggregated Attack for Boosting the Transferability of Facial Adversarial Examples

    cs.CV 2025-05 conditional novelty 6.0 of 10

    AAA aggregates mid-layer gradient attention maps from an MIM adversarial trajectory into a single importance map, and uses it in a feature-level attack to boost transferability of facial adversarial examples.

  7. Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation

    cs.CV 2025-11 conditional novelty 5.0 of 10

    A single universal adversarial image perturbation can route different input semantics to different attacker-defined outputs in multimodal LLMs, with up to 66% success over five targets.

  8. Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognition

    cs.CV 2025-09 conditional novelty 5.0 of 10

    A local-mixing and logit-optimization attack improves transferability of adversarial examples for remote sensing object recognition, outperforming 12 prior methods on two benchmarks.

  9. ViT-EnsembleAttack: Augmenting Ensemble Models for Stronger Adversarial Transferability in Vision Transformers

    cs.CV 2025-08 conditional novelty 5.0 of 10

    ViT-EnsembleAttack augments each ViT surrogate with three randomized strategies, tunes their parameters by Bayesian optimization, and ensembles them to substantially improve adversarial transferability.

  10. Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformation

    cs.CV 2025-07 conditional novelty 5.0 of 10

    A Segmented Gaussian Pyramid transformation that averages gradients over three downsampled scales improves black-box adversarial transferability against defense models.

  11. Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion

    cs.CV 2025-05 conditional novelty 5.0 of 10

    FSA combines Fourier high-frequency augmentation with Gaussian pyramid gradient fusion to boost adversarial transferability against defended black-box models.

  12. FSPGD: Rethinking Black-box Attacks on Semantic Segmentation

    cs.CV 2025-02 conditional novelty 5.0 of 10

    FSPGD uses two feature-similarity losses to craft segmentation attacks that transfer across CNN and transformer models, and reports large mIoU drops on Pascal VOC and Cityscapes.

  13. Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferability

    cs.CV 2024-12 conditional novelty 5.0 of 10

    Averaging adversarial examples over the fine-tuning trajectory, called AaF, improves targeted adversarial transferability across CNN and transformer victim models compared with endpoint-only fine-tuning.

  14. Random Batch Method with Momentum Correction

    math.NA 2024-12 reject novelty 5.0 of 10

    A momentum-corrected random batch method is proposed and claimed to reduce the error of the standard random batch method for singular interaction kernels.

  15. Three-in-One: Robust Enhanced Universal Transferable Anti-Facial Retrieval in Online Social Networks

    cs.CV 2024-12 conditional novelty 5.0 of 10

    TOAP generates a single universal perturbation that prevents deep-hash face retrieval from matching a person's photos after online social network post-processing, and it transfers across different models.

  16. Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition

    cs.CV 2025-05 conditional novelty 4.0 of 10

    ASL-PAR creates universal adversarial noise using label and semantic perturbation, dropping PromptPAR's mean accuracy by up to 40 points on standard PAR benchmarks, while a filter-and-prompt defense restores most of the drop.

  17. Enhancing Adversarial Transferability via Component-Wise Transformation

    cs.CV 2025-01 conditional novelty 4.0 of 10

    A block-wise interpolation and selective rotation attack, CWT, improves adversarial transferability across CNN and transformer models on ImageNet.

  18. Attribution for Enhanced Explanation with Transferable Adversarial eXploration

    cs.AI 2024-12 reject novelty 4.0 of 10

    Using transferable adversarial attacks like MIG and GRA inside AttEXplore raises insertion scores on ImageNet, but the best attack is chosen post hoc on the test set and deletion scores worsen.

  19. AdvIRL: Reinforcement Learning-Based Adversarial Attacks on 3D NeRF Models

    cs.CV 2024-12 reject novelty 4.0 of 10

    AdvIRL uses PPO to adjust Instant-NGP parameters so that CLIP misclassifies rendered 3D objects, with results on banana, truck, horse, and lighthouse scenes.

  20. Watertox: The Art of Simplicity in Universal Attacks A Cross-Model Framework for Robust Adversarial Generation

    cs.CV 2024-12 conditional novelty 3.0 of 10

    Watertox combines a two-stage FGSM with a four-model ensemble vote to generate adversarial images that reportedly reduce unseen-model accuracy by up to 98.8%.

  21. Permutation Randomization on Nonsmooth Nonconvex Optimization: A Theoretical and Experimental Study

    cs.LG 2025-05 reject novelty 2.0 of 10

    Coordinate permutation is claimed to guarantee coverage of the global optimum in nonsmooth nonconvex optimization, but the proof assumes the coverage property it concludes and the convergence-rate result is a tautolog...

Reference graph

Works this paper leans on

35 extracted references · 23 canonical work pages · cited by 21 Pith papers

  1. [1]

    On the robustness of semantic segmentation models to adversarial attacks

    Anurag Arnab, Ondrej Miksik, and Philip HS Torr. On the robustness of semantic segmentation models to adversarial attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 888--897, 2018

    work page 2018

  2. [2]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp.\ 39--57, 2017

    work page 2017

  3. [3]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp.\ 1310--1320, 2019

    work page 2019

  4. [4]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 9185--9193, 2018

    work page 2018

  5. [5]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 4312--4321, 2019

    work page 2019

  6. [6]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    arXiv 2014

  7. [7]

    Countering adversarial images using input transformations

    Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations, 2018

    work page 2018

  8. [8]

    Identity mappings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision, pp.\ 630--645. Springer, 2016

    work page 2016

Show all 35 references
  1. [9]

    Comdefend: An efficient image compression model to defend adversarial examples

    Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 6084--6092, 2019

    2019

  2. [10]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  3. [11]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016

    2016 arXiv

  4. [12]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations, 2017

    2017

  5. [13]

    Adversarial attacks and defences competition

    Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie, et al. Adversarial attacks and defences competition. In The NIPS'17 Competition: Building Intelligent Systems, pp.\ 195--231. Springer, 2018

    2018

  6. [14]

    Defense against adversarial attacks using high-level representation guided denoiser

    Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 1778--1787, 2018

    2018

  7. [15]

    Delving into transferable adversarial examples and black-box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770, 2016

    2016 arXiv

  8. [16]

    Feature distillation: Dnn-oriented jpeg compression against adversarial examples

    Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 860--868, 2019

    2019

  9. [17]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

    2018

  10. [18]

    A method for unconstrained convex minimization problem with the rate of convergence o (1/k\^ 2)

    Yurii Nesterov. A method for unconstrained convex minimization problem with the rate of convergence o (1/k\^ 2). In Doklady AN USSR, volume 269, pp.\ 543--547, 1983

    1983

  11. [19]

    Some methods of speeding up the convergence of iteration methods

    Boris T Polyak. Some methods of speeding up the convergence of iteration methods. USSR Computational Mathematics and Mathematical Physics, 4 0 (5): 0 1--17, 1964

    1964

  12. [20]

    Imagenet large scale visual recognition challenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115 0 (3): 0 211--252, 2015

    2015

  13. [21]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  14. [22]

    Hopcroft

    Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Improving the generalization of adversarial training with domain adaptation. In International Conference on Learning Representations, 2019

    2019

  15. [23]

    Hopcroft

    Chuanbiao Song, Kun He, Jiadong Lin, Liwei Wang, and John E. Hopcroft. Robust local features for improving the generalization of adversarial training. In International Conference on Learning Representations, 2020

    2020

  16. [24]

    On the importance of initialization and momentum in deep learning

    Ilya Sutskever, James Martens, George Dahl, and Geoffrey Hinton. On the importance of initialization and momentum in deep learning. In International conference on machine learning, pp.\ 1139--1147, 2013

    2013

  17. [25]

    Intriguing properties of neural networks

    Christian Szegedy, Google Inc, Wojciech Zaremba, Ilya Sutskever, Google Inc, Joan Bruna, Dumitru Erhan, Google Inc, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, Workshop Track, 2014

    2014

  18. [26]

    Rethinking the inception architecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 2818--2826, 2016

    2016

  19. [27]

    Inception-v4, inception-resnet and the impact of residual connections on learning

    Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Thirty-First AAAI Conference on Artificial Intelligence, 2017

    2017

  20. [28]

    Ensemble adversarial training: Attacks and defenses

    Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations, 2018

    2018

  21. [29]

    Hopcroft

    Xiaosen Wang, Kun He, and John E. Hopcroft. AT-GAN: A generative attack model for adversarial transferring on generative adversarial nets. CoRR, abs/1904.07793, 2019

    1904 arXiv

  22. [30]

    Mitigating adversarial effects through randomization

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In International Conference on Learning Representations, 2018

    2018

  23. [31]

    Improving transferability of adversarial examples with input diversity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 2730--2739, 2019

    2019

  24. [32]

    Hopcroft, and Liwei Wang

    Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John E. Hopcroft, and Liwei Wang. Adversarially robust generalization just requires more unlabeled data. CoRR, abs/1906.00555, 2019

    1906 arXiv

  25. [33]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  26. [34]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  27. [35]

    T j 8˾ \ i-W@n I ( 1|2h:Œ 8 3 |9G ܠO >

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.