Pith. sign in

REVIEW 5 major objections 5 minor 57 references

MetaAdvDet: Towards Robust Detection of Evolving Adversarial Attacks

T0 review · 5 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A few labeled examples of a new adversarial attack suffice to start detecting it.

desk verdict A legitimate few-shot meta-learning application to adversarial detection with reusable benchmarks, but the evidence is weaker than the claims and the labeling assumption is unexamined. read the letter →

arxiv 1908.02199 v1 pith:CVNPBTWK submitted 2019-08-06 cs.CV cs.LG

Chen Ma , Chenxu Zhao , Hailin Shi , Li Chen , Junhai Yong , Dan Zeng This is my paper · ORCID
classification cs.CVcs.LG
keywords adversarialexampledetectionmeta-learningfew-shotlearningevolvingattacksdouble-networkframeworkcross-adversarybenchmarkwhite-boxattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial image attacks evolve faster than detectors can be retrained, because collecting tens of thousands of labeled examples for each new attack is too slow. This paper argues that the problem should be framed as few-shot meta-learning and shows a detector that, after training on many simulated attack tasks, can recognize a previously unseen attack after fine-tuning on only one or five labeled examples of it. The authors construct four few-shot benchmark protocols, covering new attack types, new data domains, new classifier architectures, and white-box attacks, and report that their MetaAdvDet detector outperforms standard DNN detectors and two existing detection baselines on them. If the claim holds, defenders can update to new attacks with a handful of samples rather than large labeled collections.

What carries the argument

The central mechanism is a double-network meta-learning loop. A master network stores a general detection strategy; for each task, a task-dedicated network is cloned from the master network, updated on that task's support set by ordinary gradient descent (the inner update), and then scored on the task's query set. Gradients from all tasks in a mini-batch are accumulated and applied to the master network (the outer update), so the master network learns an initialization that adapts quickly to new tasks. Tasks are two-way classification problems, real examples versus adversarial examples from one attack type, and each task has a disjoint support set and query set.

What would settle it

Run Algorithm 2 on an attack family that was not among the fifteen training adversaries while withholding the support-set labels; if F1 stays near chance, the claimed few-shot capability depends on labeled examples and on similarity to training attacks.

Watch

Extended reading notes

Core claim

The paper claims that the ability to detect a newly evolved adversarial attack can be learned as a meta-task: instead of training a binary real-versus-adversarial classifier once, the detector is trained on a distribution of small tasks, each pairing real images with one known attack, so that it learns how to adapt its decision boundary to an unfamiliar attack. At test time the master network is copied, fine-tuned for a few steps on a labeled support set of the new attack, and evaluated on a query set. The paper reports F1 scores showing this procedure beats conventional DNN training and the two detection baselines it compares against across four benchmark dimensions, including attacks that are white-box and detector-aware.

Load-bearing premise

The method assumes that, when a genuinely new attack appears, someone can supply a handful of correctly labeled examples of it for the fine-tuning step.

Editorial extensions

If this is right

  • A deployed detector can be updated to a new attack with one or five labeled examples instead of tens of thousands of samples.
  • The same meta-learned detector transfers across data domains and across classifier architectures used to generate the adversarial examples.
  • Detection survives white-box attacks in which the adversary knows the detector and constructs examples to bypass it, because fine-tuning on a few examples restores the decision boundary.
  • The proposed benchmark protocols give future evolving-attack detectors a common few-shot evaluation setup.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Outside the paper, the strongest practical bottleneck is the need for labels: a brand-new attack that arrives with no human labeling cannot be fine-tuned, so real deployments would need an anomaly-detection or active-learning front end to create the support set.
  • The task structure is generic binary novelty detection, so the same double-network scheme could be tested on other one-vs-novel-class problems such as defect detection, fraud, or out-of-distribution inputs.
  • Because the cross-adversary benchmark splits attacks by similarity, the reported 'new attack' result may not cover attacks from a completely unrelated perturbation family; a test with an attack designed after training would clarify the boundary.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper introduces MetaAdvDet, a meta-learning approach for detecting newly appearing adversarial attacks from only one or five labeled examples. The method uses a double-network framework: a task-dedicated network is copied from a master network, fine-tuned on a small support set of a given attack, and the master network is updated by accumulating gradients from many such tasks. The authors construct four few-shot benchmarks—cross-adversary, cross-domain, cross-architecture, and white-box attack—on CIFAR-10, MNIST, and Fashion-MNIST, and report F1 scores for 1-shot and 5-shot settings, comparing against a DNN baseline, a balanced DNN, TransformDet, and NeuralFP. The central claim is that MetaAdvDet outperforms these detectors in detecting new, unseen attacks with limited examples.

Significance. If the central claim is supported, the paper addresses a practical gap: adversarial attacks evolve faster than labeled data can be collected, and few-shot detection is a sensible formulation. The paper is one of the first to cast adversarial detection as a meta-learning few-shot problem, and it makes several useful contributions: a public code release, a reproducible benchmark construction with a fixed train/test adversary partition, and a systematic evaluation across domains, architectures, and white-box settings. However, the significance is currently tempered by three issues: the evaluation assumes labeled support sets for the new attack, which is not the situation described in the motivation; no MAML or Meta-SGD baseline is included, so the contribution of the double-network design is not isolated; and several reported numbers contradict the text's claims of superiority. These issues are addressable and should be fixed before the empirical claims can be fully accepted.

major comments (5)
  1. [§2.1, Algorithm 2] Algorithm 2, lines 3–7, requires a small, correctly labeled support set of the newly evolved attack for fine-tuning using cross-entropy with ground-truth labels. The motivating scenario in §2.1 explicitly describes a new attack that first appears "without publishing the source code," which is exactly the situation where labels are hardest to obtain. The paper offers no labeling mechanism: no human-in-the-loop protocol, no confidence-based filtering, and no unsupervised or self-supervised adaptation. The master network without fine-tuning is also never evaluated, so the reported F1 scores conflate the benefit of the meta-learned initialization with the benefit of supervised fine-tuning on labeled support. The claim that MetaAdvDet "detects new adversarial attacks with limited examples" is therefore only supported for the supervised few-shot setting, not for the unlabeled evolving-attack scenario described in the introduction. Please either provide a labeling protocol, evaluate the no-fine-tuning case, or explicitly reframe the claim as supervised few-shot detection.
  2. [§5.5–§5.8, Tables 9–13] No MAML [11] or Meta-SGD [24] baseline is included. The proposed double-network learning-to-learn scheme is closely related to MAML's gradient-based meta-learning; the double network is essentially an implementation mechanism to accumulate gradients from multiple tasks before applying the outer update. Without a comparison to MAML or Meta-SGD using the same backbone and the same task construction, the experiments do not isolate the contribution of the double-network design. Please add these standard meta-learning baselines or justify why they are not applicable to detection tasks.
  3. [§5.5, Table 9 and §5.8, Table 13] The text overstates the empirical results. In Table 9, on AdvCIFAR 1-shot, MetaAdvDet scores 0.685 while NeuralFP scores 0.698, so MetaAdvDet does not outperform all baselines in this cell. The Conclusion states that "NeuralFP gets lower F1 scores than ours under different benchmarks," which is contradicted by this result. In Table 13, on the CIFAR-10 white-box benchmark with I-FGSM, TransformDet scores 0.593 (1-shot) and 0.728 (5-shot), whereas MetaAdvDet scores 0.553 and 0.633. These cases should be acknowledged and discussed rather than summarized as universal superiority.
  4. [§5.2, Tables 9–13] All reported F1 scores are point estimates without error bars, confidence intervals, or significance tests. Differences such as 0.685 vs 0.698 in Table 9 are within plausible run-to-run variation for neural network training. Given that the paper's central claim is comparative superiority over baselines, the authors should report means and standard deviations over multiple random seeds, or perform a paired statistical test across the 1000 test tasks, before claiming a large margin of improvement.
  5. [§4.1, Table 1] Table 1 lists statistics only for adversarial examples generated by attacking the conv-4 network, but the cross-architecture benchmark in Table 12 uses examples generated by attacking ResNet-10 and ResNet-18. The paper does not provide the corresponding statistics for the other architectures, and it is unclear whether Table 1 is meant to represent the entire dataset. Please clarify the dataset sizes for all architectures used in the experiments.
minor comments (5)
  1. [§3.2] The text says "MiniImagenet" but the correct spelling is "MiniImageNet."
  2. [§1] "DNN based methods that use‘ the traditional training approach" contains a stray typographic quote; please fix the punctuation.
  3. [§1, References] Reference [43] is cited as a detection technique but appears to be a computer architecture paper on shared-memory multiprocessors (SafetyNet). This citation seems inappropriate and should be replaced with the intended adversarial detection work.
  4. [Algorithm 1] In Algorithm 1, line 5 uses "Tθ←M θ" while line 6 then defines "Tθ′←Tθ"; the priming notation is confusing because the copy operation and the subsequent gradient computation would be clearer if the inner-update parameters were named consistently throughout.
  5. [Figures 1 and 2] Figures 1 and 2 are dense and the captions do not fully explain the relationship between "ways" and attack types; adding the attack name to each support/query block in the figure would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MetaAdvDet's few-shot detection claim rests on an empirical training/evaluation protocol, not on a derivation that reduces to its own inputs.

full rationale

The paper contains no mathematical derivation in which an output quantity is defined in terms of the very quantity it is claimed to predict. The central claim is empirical: a MAML-style double-network meta-learning procedure is trained on tasks built from known attacks and then fine-tuned on a small labeled support set from a held-out attack, with F1 evaluated on a held-out query set. The method's components (master network, task-dedicated network, inner/outer updates) are implemented in Algorithms 1 and 2, and the reported results in Tables 9 through 13 are comparisons against external baselines (DNN, DNN balanced, NeuralFP, TransformDet), not predictions derived from fitted values. Hyperparameters are disclosed as set on a validation set, so there is no hidden fitted input being renamed as a prediction. No self-citation is load-bearing: the meta-learning machinery is attributed to prior external work such as MAML and Meta-SGD, and the compared detectors are independent published methods. The only notable caveat is that Algorithm 2 requires ground-truth labels for the support set of the newly appearing attack, which is a practical deployment limitation rather than circularity, since the paper explicitly defines the few-shot-fashion evaluation as including a supervised fine-tune step and does not claim label-free detection. Author-constructed benchmarks and the choice of held-out attack groups may affect generalizability, but they do not make the evaluation circular. Accordingly, the appropriate finding is no significant circularity.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

No mathematical derivation is offered; the central claims are empirical. The approach depends on the representativeness of the 15 CleverHans attacks and 3 architectures, on the availability of labeled support sets for new attacks, and on several hyperparameters tuned on the validation set. There are no invented physical or theoretical entities.

free parameters (7)
  • inner learning rate lambda1 = 0.001
    Set empirically, reported in Table 6 and Section 5.1.
  • outer learning rate lambda2 = 0.0001
    Set ten times smaller than lambda1 because gradients are summed across tasks, reported in Table 6.
  • inner update times = 12 during training
    Chosen empirically and reported in Table 6.
  • fine-tune times = 20 during testing
    Chosen because performance stabilizes, reported in Table 6 and Figure 4b.
  • task number K per mini-batch = 30
    Selected empirically and reported in Table 6 and Figure 3b.
  • train query set size = 70
    Chosen empirically, reported in Table 6 and Figure 3a.
  • total tasks = 20000
    Set to cover all samples of the original datasets, reported in Table 6.
assumptions (4)
  • domain assumption The 15 adversarial attacks from CleverHans and the 3 classifier architectures represent the distribution of future evolving attacks.
    Section 4.1 constructs the datasets from these attacks; if future attacks lie outside this family, the meta-learned initialization may not adapt. No evidence beyond these attacks is provided.
  • domain assumption At test time, a few labeled examples of the new attack are available for fine-tuning.
    Algorithm 2 lines 3 to 7 require a labeled support set for each test task. The paper does not address the unlabeled new-attack scenario.
  • domain assumption Learning to distinguish real versus adversarial examples on old attack tasks transfers to tasks built from new attacks.
    Section 3.2 assumes the learning-to-learn strategy over seen attacks yields fast adaptation to unseen attacks; this is the central transfer assumption and is not proven.
  • ad hoc to paper The fixed-way label assignment is the correct protocol for all experiments.
    Section 5.4 and Table 8 show the fixed-way setting was chosen because it outperformed randomized-way on the validation set; this choice is then applied to all benchmarks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MetaAdvDet: Towards Robust Detection of Evolving Adversarial Attacks." pith.science (2026). https://pith.science/paper/CVNPBTWK

@misc{pith2026190802199,
  author       = {Pith},
  title        = {Pith review of: MetaAdvDet: Towards Robust Detection of Evolving Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CVNPBTWK}},
  note         = {Machine review of arXiv:1908.02199}
}
read the original abstract

Deep neural networks (DNNs) are vulnerable to adversarial attack which is maliciously implemented by adding human-imperceptible perturbation to images and thus leads to incorrect prediction. Existing studies have proposed various methods to detect the new adversarial attacks. However, new attack methods keep evolving constantly and yield new adversarial examples to bypass the existing detectors. It needs to collect tens of thousands samples to train detectors, while the new attacks evolve much more frequently than the high-cost data collection. Thus, this situation leads the newly evolved attack samples to remain in small scales. To solve such few-shot problem with the evolving attack, we propose a meta-learning based robust detection method to detect new adversarial attacks with limited examples. Specifically, the learning consists of a double-network framework: a task-dedicated network and a master network which alternatively learn the detection capability for either seen attack or a new attack. To validate the effectiveness of our approach, we construct the benchmarks with few-shot-fashion protocols based on three conventional datasets, i.e. CIFAR-10, MNIST and Fashion-MNIST. Comprehensive experiments are conducted on them to verify the superiority of our approach with respect to the traditional adversarial attack detection methods.

Figures

Figures reproduced from arXiv: 1908.02199 by the authors.

Figure 1
Figure 1. The procedure of MetaAdvDet training in one [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The details of constructing tasks for training [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Ablation study results of train query set size and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Ablation study results of shots and fine-tune itera [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 38 canonical work pages

  1. [11]

    Chelsea Finn, Pieter Abbeel, and Sergey Levine. 2017. Model-agnostic meta- learning for fast adaptation of deep networks. In Proceedings of the 34th Interna- tional Conference on Machine Learning-Volume 70. JMLR. org, 1126–1135

    work page 2017

  2. [24]

    Zhenguo Li, Fengwei Zhou, Fei Chen, and Hang Li. 2017. Meta-sgd: Learning to learn quickly for few-shot learning. arXiv preprint arXiv:1707.09835 (2017)

    arXiv 2017

  3. [1]

    Naveed Akhtar, Jian Liu, and Ajmal Mian. 2018. Defense against universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 3389–3398

    work page 2018

  4. [2]

    Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated Gra- dients Give a False Sense of Security: Circumventing Defenses to Adversar- ial Examples. In Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research) , Jennifer Dy and Andreas Krause (Eds.), Vol. 80. PMLR, StockholmsmÃďssan, Stock...

    work page 2018

  5. [3]

    Arjun Nitin Bhagoji, Daniel Cullina, and Prateek Mittal. 2017. Dimensionality Reduction as a Defense against Evasion Attacks on Machine Learning Classifiers. CoRR abs/1704.02654 (2017). arXiv:1704.02654 http://arxiv.org/abs/1704.02654

    arXiv 2017

  6. [4]

    Nicholas Carlini and David A. Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In IEEE Symposium on Security and Privacy (SP) . 39–57. https://doi.org/10.1109/SP.2017.49

    doi:10.1109/sp.2017.49 2017

  7. [5]

    Fabio Carrara, Fabrizio Falchi, Roberto Caldelli, Giuseppe Amato, Roberta Fu- marola, and Rudy Becarelli. 2017. Detecting Adversarial Example Attacks to Deep Neural Networks. In Proceedings of the 15th International Workshop on Content-Based Multimedia Indexing (CBMI ’17). ACM, New York, NY, USA, Article 38, 7 pages. https://doi.org/10.1145/3095713.3095753

    arXiv 2017

  8. [6]

    Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. 2018. Ead: elastic-net attacks to deep neural networks via adversarial examples. In Thirty-second AAAI conference on artificial intelligence

    work page 2018

Show all 57 references
  1. [7]

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. 2017. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. ACM, 15–26

    2017

  2. [8]

    Sumanth Dathathri, Stephan Zheng, Richard M Murray, and Yisong Yue. 2018. Detecting Adversarial Examples via Neural Fingerprinting. arXiv preprint arXiv:1803.03870 (2018)

    2018 arXiv

  3. [9]

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting Adversarial Attacks With Momentum. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  4. [10]

    Grif- fiths

    Sergey Levine Trevor Darrell Erin Grant, Chelsea Finn and Thomas L. Grif- fiths. 2018. Recasting Gradient-Based Meta-Learning as Hierarchical Bayes. In International Conference on Learning Representations

    2018

  5. [12]

    Nicholas Frosst, Sara Sabour, and Geoffrey Hinton. 2018. DARCCC: Detecting Adversaries by Reconstruction from Class Conditional Capsules. arXiv preprint arXiv:1811.06969 (2018)

    2018 arXiv

  6. [13]

    Ian Goodfellow, Yao Qin, and David Berthelot. 2019. Evaluation Methodology for Attacks Against Confidence Thresholding Models. https://openreview.net/ forum?id=H1g0piA9tQ

    2019

  7. [14]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. [n. d.]. Explaining and harnessing adversarial examples (2014). arXiv preprint arXiv:1412.6572 ([n. d.])

    2014 arXiv

  8. [15]

    Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. 2017. On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280 (2017)

    2017 arXiv

  9. [16]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

    2016

  10. [17]

    Hossein Hosseini, Baicen Xiao, Mayoore Jaiswal, and Radha Poovendran. 2017. On the limitation of convolutional neural networks in recognizing negative images. In 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA). IEEE, 352–358

    2017

  11. [18]

    Muhammad Abdullah Jamal and Guo-Jun Qi. 2019. Task Agnostic Meta-Learning for Few-Shot Learning. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2019

  12. [19]

    Uyeong Jang, Xi Wu, and Somesh Jha. 2017. Objective metrics and gradient descent algorithms for adversarial examples in machine learning. In Proceedings of the 33rd Annual Computer Security Applications Conference . ACM, 262–277

    2017

  13. [20]

    Alex Krizhevsky. 2009. Learning multiple layers of features from tiny images . Technical Report

    2009

  14. [21]

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. ICLR Workshop (2017). https://arxiv.org/abs/1607.02533

    2017 arXiv

  15. [22]

    Yann LeCun and Corinna Cortes. 2010. MNIST handwritten digit database. http://yann.lecun.com/exdb/mnist/. (2010). http://yann.lecun.com/exdb/mnist/

    2010

  16. [23]

    Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. 2019. NAT- TACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks. arXiv preprint arXiv:1905.00441 (2019)

    2019 arXiv

  17. [25]

    Liang, H

    B. Liang, H. Li, M. Su, X. Li, W. Shi, and X. Wang. 2018. Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction. IEEE Transactions on Dependable and Secure Computing (2018), 1–1. https://doi.org/ 10.1109/TDSC.2018.2874243

    2018

  18. [26]

    Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. 2018. Defense Against Adversarial Attacks Using High-Level Representa- tion Guided Denoiser. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  19. [27]

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. Delving into Transferable Adversarial Examples and Black-box Attacks. In Proceedings of 5th International Conference on Learning Representations

    2017

  20. [28]

    Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Michael E

    Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Michael E. Houle, Dawn Song, and James Bailey. 2018. Charac- terizing Adversarial Subspaces Using Local Intrinsic Dimensionality. In Interna- tional Conference on Learning Representations...

    2018

  21. [29]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversar- ial Attacks. In International Conference on Learning Representations . https: //openreview.net/forum?id=rJzIBfZAb

    2018

  22. [30]

    Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. 2017. On Detecting Adversarial Perturbations. In International Conference on Learning Representations

    2017

  23. [31]

    Nikhil Mishra, Mostafa Rohaninejad, Xi Chen, and Pieter Abbeel. 2018. A Simple Neural Attentive Meta-Learner. In International Conference on Learning Represen- tations. https://openreview.net/forum?id=B1DmUzWAW

    2018

  24. [32]

    Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, Ken Nakae, and Shin Ishii

  25. [33]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2016

  26. [34]

    Tianyu Pang, Chao Du, Yinpeng Dong, and Jun Zhu. 2018. Towards Robust Detection of Adversarial Examples. In Advances in Neural Information Processing Systems 31, S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (Eds.). Curran Associates, Inc., ...

    2018

  27. [35]

    Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Fein- man, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexan- der Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhav Garg, ...

  28. [36]

    Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 (2016)

    2016 arXiv

  29. [37]

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. The limitations of deep learning in adversarial settings. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 372–387

    2016

  30. [38]

    Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami

  31. [39]

    Sachin Ravi and Hugo Larochelle. 2017. Optimization as a Model for Few- Shot Learning. In International Conference on Learning Representations . https: //openreview.net/forum?id=rJY0-Kcll

    2017

  32. [40]

    Mohammad Sabokrou, Mohammad Khalooei, Mahmood Fathy, and Ehsan Adeli

  33. [41]

    In IEEE Symposium on Security and Privacy (SP)

    Distillation as a defense to adversarial perturbations against deep neural networks. In IEEE Symposium on Security and Privacy (SP) . IEEE

  34. [42]

    Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman

  35. [43]

    D. J. Sorin, M. M. K. Martin, M. D. Hill, and D. A. Wood. 2002. SafetyNet: im- proving the availability of shared memory multiprocessors with global check- point/recovery. In Proceedings 29th Annual International Symposium on Computer Architecture. 123–134. https://doi.org/10....

    2002 arXiv

  36. [44]

    In Proceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Adversarially learned one-class classifier for novelty detection. In Proceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . 3379–3388

  37. [45]

    Jake Snell, Kevin Swersky, and Richard Zemel. 2017. Prototypical networks for few-shot learning. In Advances in Neural Information Processing Systems . 4077–4087

    2017

  38. [46]

    Jonathan Uesato, Brendan O’Donoghue, Pushmeet Kohli, and Aaron van den Oord. 2018. Adversarial Risk and the Dangers of Evaluating Against Weak Attacks. In Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research) , Jennifer...

    2018

  39. [47]

    In International Conference on Learning Represen- tations

    PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples. In International Conference on Learning Represen- tations. https://openreview.net/forum?id=rJUYGxbCW

  40. [48]

    Weitao Wan, Yuanyi Zhong, Tianpeng Li, and Jiansheng Chen. 2018. Rethinking Feature Distribution for Loss Functions in Image Classification. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  41. [49]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In International Conference on Learning Representations . https://openreview.net/ forum?id=B1gJ1L2aW

    2014

  42. [50]

    Shixin Tian, Guolei Yang, and Ying Cai. 2018. Detecting Adversarial Examples Through Image Transformation. https://aaai.org/ocs/index.php/AAAI/AAAI18/ paper/view/17408

    2018

  43. [51]

    Weilin Xu, David Evans, and Yanjun Qi. 2018. Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018. http://wp.internetsociety.org/...

    2018

  44. [52]

    Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Koray Kavukcuoglu, and Daan Wierstra. 2016. Matching Networks for One Shot Learning. In Proceedings of the 30th International Conference on Neural Information Processing Systems (NIPS’16) . Curran Associates Inc., USA, 3637–3...

    2016

  45. [54]

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song

  46. [55]

    In International Conference on Learning Representations

    Spatially Transformed Adversarial Examples. In International Conference on Learning Representations. https://openreview.net/forum?id=HyydRMZC-

  47. [56]

    Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017. Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms. arXiv:cs.LG/cs.LG/1708.07747

    2017 arXiv

  48. [2016]

    International Conference on Learning Representations (2016)

    Distributional smoothing with virtual adversarial training. International Conference on Learning Representations (2016)

    2016

  49. [2018]

    arXiv preprint arXiv:1610.00768 (2018)

    Technical Report on the CleverHans v2.1.0 Adversarial Examples Library. arXiv preprint arXiv:1610.00768 (2018)

    2018 arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.