Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Defending Against Adversarial Iris Examples Using Wavelet Decomposition

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Removing the wavelet sub-bands an attack most corrupts detects adversarial iris images with up to 84% success, outperforming five published defenses.

desk verdict Per-sub-band wavelet denoising with reconstruction-error band selection is a plausible new defense idea for iris recognition, but the headline comparisons are undercut by post-hoc N/K selection and an undefined success-rate metric. read the letter →

arxiv 1908.03176 v1 pith:EMAWNHYT submitted 2019-08-08 cs.CV cs.LGeess.IVstat.ML

Sobhan Soleymani , Ali Dabouei , Jeremy Dawson , Nasser M. Nasrabadi This is my paper · ORCID
classification cs.CVcs.LGeess.IVstat.ML
keywords adversarialexamplesirisrecognitionwaveletdecompositiondenoisingautoencodersub-bandreconstructionerrorFGSMDeepFoolbiometricsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that adversarial iris images can be caught before they reach a recognition system by preprocessing each image in the wavelet domain instead of modifying the classifier. The core claim is that attacks damage only a few mid- and high-frequency wavelet sub-bands, while the low-frequency iris structure that recognition depends on stays intact, so removing or denoising the corrupted sub-bands makes the attack visible to the unchanged classifier. The strongest variant customizes this removal for each input by comparing each sub-band's reconstruction error against its expected error from a per-sub-band denoising autoencoder. If the claim holds, iris security systems could gain a preprocessing layer that beats adversarial training and generic denoising against FGSM, iterative gradient sign, and DeepFool attacks.

What carries the argument

The central object is the uniform wavelet decomposition, which splits each iris image into $4^L$ sub-bands; with $L=2$ there are 16 sub-bands representing different vertical, horizontal, and diagonal frequency ranges. The second and third strategies train one denoising autoencoder per sub-band on benign iris images and then compute the ratio $\alpha_i = D_i / D^{\mathrm{avg}}_i$ between the reconstruction error of sub-band $i$ for the current input and the average reconstruction error for benign validation images. The $N$ sub-bands with the largest $\alpha_i$ are treated as adversary-affected: strategy 2 removes them and reconstructs from the untouched remainder, while strategy 3 removes them and replaces the kept sub-bands with their denoised versions. The reconstructed image is then classified by the same classifier used for benign images, and a disagreement with the original label flags the input as adversarial.

What would settle it

Run an adaptive adversary that distributes its perturbation energy uniformly across all 16 wavelet sub-bands while still producing adversarial iris images by the paper's Hamming-distance criterion; if such attacks pass the defense at rates near the undefended baseline, the frequency-localization premise is false. Separately, re-run the full comparison with $N$ chosen on a validation set and with one shared balanced-accuracy definition; if the margins over the five baselines shrink or vanish, the headline result is an artifact of test-set selection.

Watch

Extended reading notes

Core claim

The paper claims that wavelet-domain preprocessing can detect adversarial iris examples with high reliability. Three strategies are tested: randomly zeroing mid- and high-frequency sub-bands and majority voting over many reconstructions; zeroing the sub-bands with the largest reconstruction-error ratios; and zeroing those same sub-bands while replacing the remaining sub-bands with their denoised versions. The third strategy reaches success rates of 81.65% on FGSM, 77.59% on iterative gradient sign, and 84.36% on DeepFool on a test set that is half benign and half adversarial, outperforming five state-of-the-art defenses, whose best reported success is 60.54%. The authors attribute the gain to per-input customization: the defense identifies which frequency bands the adversary actually touched rather than denoising blindly.

Load-bearing premise

The defense works only if adversarial perturbations to iris images are concentrated in a small number of mid- and high-frequency wavelet sub-bands; if an attack spreads its distortion evenly across sub-bands, the per-band error ratios no longer single out the corrupted bands, and the method's advantage disappears.

Editorial extensions

If this is right

  • The defense can be added as a preprocessing step to existing iris recognition pipelines without retraining the classifier.
  • Per-input selection of which sub-bands to suppress is what gives the third strategy its edge over generic denoising defenses.
  • Because the low-frequency sub-band is preserved, benign iris images are still recognized with over 98% accuracy when at most a few sub-bands are removed.
  • The method beats adversarial training on the tested attacks, suggesting that frequency-structure priors from the iris domain help more than generic robust training when the attack pipeline is known.
  • Success rates in the high 70s to mid 80s on a 50/50 benign/adversarial mixture mean the defense is not a complete solution; an attacker with more perturbation budget or adaptive knowledge may erode these numbers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The per-sub-band reconstruction-error ratio is a generic signal: any domain whose attacks concentrate in high-frequency bands could reuse this defense, provided per-band denoisers can be trained on benign data.
  • The reported comparison would be stronger if the number of removed sub-bands $N$ were selected on a validation set before seeing test attacks; as reported, $N$ is chosen after the fact for each attack, so the headline numbers likely overstate real deployment performance.
  • An adversary who knows the defense could spread the perturbation evenly across all sub-bands so that every $\alpha_i$ stays near its benign average; testing this adaptive attack is the natural next experiment.
  • The three attacks tested are all gradient-based and white-box; black-box or transfer attacks, or attacks aimed directly at the denoisers, may behave differently.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes three wavelet-domain preprocessing defenses that detect adversarial iris examples without modifying the underlying iris matcher. The first strategy randomly zeros up to N mid- and high-frequency wavelet sub-bands, reconstructs K denoised versions, and flags the input as adversarial when the majority vote of the classifier disagrees with the original label. The second and third strategies train one denoising auto-encoder per wavelet sub-band, compute per-sub-band reconstruction errors, remove the N sub-bands with the largest ratio to a validation-set baseline, and reclassify the reconstructed image; the third strategy also denoises the retained sub-bands. Experiments on BioCop/BIOMDATA report success rates for FGSM, iGSM, and Deepfool attacks, and the paper claims that the third strategy outperforms the other two and five state-of-the-art defenses (Tables 4 and 5).

Significance. If the empirical claims are supported, the paper offers a simple and interpretable defense tailored to iris recognition: it leaves the iris-code matcher untouched and uses wavelet sub-band reconstruction errors as a detection signal. The idea is plausible and the application domain is specific enough that per-sub-band denoising could be a reasonable preprocessing step. The paper also provides explicit network architectures and compares with several baselines. However, the significance is currently limited by evaluation issues: the success-rate metric is undefined, key hyperparameters appear to be selected on the test set, baseline instantiations are underspecified, and there is no uncertainty analysis or adaptive-attack evaluation. These issues are load-bearing because the headline conclusion of outperformance depends directly on them.

major comments (4)
  1. [§4.3, Tables 4–5] The success-rate metric is never formally defined. The text says only that the test set is 50% benign and 50% adversarial and that success means "recognizing the adversarial and benign examples." The paper must state whether the reported numbers are total accuracy, balanced accuracy, mean per-class accuracy, or something else. This is not a minor presentational point: under a balanced-accuracy interpretation, a baseline value such as 38.98% for [11] in Table 5 is below chance and could indicate a systematically different quantity rather than poor adversarial defense. Please report per-class rates (benign recognition and adversarial detection) or a confusion matrix for every defense and attack so the comparisons are unambiguous.
  2. [§4.3, Tables 3–5] The headline numbers in Table 5 are selected post hoc over N (and K) rather than being a fixed configuration. Ours#1's FGSM value of 76.08 is the maximum of Table 3 (K=30, N=5); Ours#3's FGSM and iGSM values use N=6 while its Deepfool value uses N=5; and Ours#2's Deepfool value of 84.21 does not match any value in Table 4, which shows 84.36 at N=5 and 78.21 at N=6. Moreover, Ours#1's iGSM and Deepfool entries in Table 5 are not derivable from any reported table. This means the claimed margins over the baselines are an upper envelope over hyperparameter choices, not an evaluation of a single method. The authors should select N and K on a separate validation set, report the fixed configuration used for the test results, and relegate the full grid to supplementary material.
  3. [§4.2–4.3] The comparison with the adversarial-training baselines is underspecified to the point of being non-reproducible. The proposed defense operates with the OSIRIS Hamming-distance matcher, which is not trained by backpropagation, yet [11], [41], and [18] are adversarial-training methods that modify the classifier. It is not explained how these baselines were instantiated for this matcher, whether they protected the same classifier, or whether they were evaluated on the same test examples. In addition, all attacks are generated non-adaptively against the surrogate network; the statement in Section 3 that the randomness of Ours#1 prevents an adversary from retraining is not a substitute for an adaptive-attack evaluation. The authors should either include an adaptive adversary or explicitly scope the claims to non-adaptive attacks.
  4. [§4.2, Tables 3–5] There are no error bars, confidence intervals, or significance tests anywhere in the results. The method has randomness in Ours#1 (the random selection of sub-bands) and threshold-like hyperparameters in Ours#2 and Ours#3, and neighboring N entries in Tables 3 and 4 differ by only a few percent. Single-point estimates on one 3,040-image test set are insufficient to support the reported margins of several percentage points. Please report multiple runs or bootstrap intervals and state the number of independent trials for the stochastic components.
minor comments (4)
  1. [§3.2, Eq. (6)] The text around Eq. (6) refers to "average distances for the sub-bands on the training set," while Eq. (4) defines D_i^avg on the validation set. Please align the terminology.
  2. [Table 4] The "No Attack" columns appear to report benign-only recognition accuracy. If so, state this explicitly and explain how it relates to the balanced accuracy reported in the attack rows, since the test set is 50% adversarial.
  3. [§4.1] The attack setup is incomplete: the FGSM and iGSM perturbation bounds (epsilon) are not reported, and the Deepfool implementation details are not given. Add these parameters for reproducibility.
  4. [Throughout] There are several typographical issues, including "donated as defense strategies" (Section 1), "we train a denoising auto-encoders" (Section 3.2), "the the encoding layers" (Section 4.2), and "prob" for "probe" (Section 4.2).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the evaluation is empirical and the central defense claims do not reduce to their inputs.

full rationale

This paper reports an empirical evaluation of three wavelet-domain defenses for adversarial iris examples. No load-bearing derivation step equates a conclusion with an input by construction. The attack-generation surrogate network is trained to mimic OSIRIS iris-code generation, and the cited prior work [28] supplies the training loss for that surrogate; this is a self-citation, but it supports an evaluation component rather than the defense claim itself. The defense decision rule (compare the class of the denoised reconstruction with the class of the input) is not tautological: benign examples can be falsely rejected and adversarial examples can be missed, as reflected in the varied accuracies across N and K. The selection of N and K from the same test-set tables is a validation-protocol weakness and a correctness concern, not a circularity, because the reported numbers are measured outcomes rather than predictions implied by the method's equations. The ambiguity in the undefined 'success rate' metric also affects comparability but is not an instance of a derived result reducing to an input. Overall, the paper's central claim is self-contained as an empirical benchmark against five external defenses, and no circular step can be exhibited from the text.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method depends on a domain assumption about where adversarial energy concentrates, a surrogate-network assumption because the real iris matcher is not differentiable, a threshold assumption from prior work for defining attacks, and two hyperparameters selected from the test results. No new physical entities are introduced.

free parameters (3)
  • N (number of wavelet sub-bands removed or zeroed) = N=5 or 6 depending on attack (Table 4); N=5 with K=30 for strategy 1
    Chosen per attack from test-set results; no prespecified selection rule. Directly controls the detection versus benign accuracy trade-off.
  • K (number of reconstructed denoised examples, strategy 1) = 30 (Table 3 and Table 5)
    Randomly zeroed sub-bands are classified and majority voted over K versions. K is selected from the same test data, and larger K increases computational cost.
  • Wavelet type and decomposition level = Haar wavelet, 2 levels (16 sub-bands)
    Chosen manually in Section 4.3; no comparison with other wavelets or decomposition levels is provided.
assumptions (4)
  • domain assumption Adversarial perturbations mainly alter mid- and high-frequency wavelet sub-bands, while low-frequency iris components are identity-rich and noise-robust.
    Core premise of all three strategies; stated in the Introduction and Section 3.2 to justify zeroing or denoising only selected sub-bands.
  • domain assumption A surrogate U-Net trained to mimic OSIRIS iris-code generation produces adversarial examples that are representative of attacks on the actual recognition pipeline.
    Used in Section 4.1 because OSIRIS is non-differentiable; no comparison with attacks optimized directly against the proposed defense is provided.
  • domain assumption Adversarial success is defined by a Hamming distance greater than 32% between the generated and benign iris codes, following reference [24].
    Section 4.1; this threshold defines the attack population and therefore the detection metric reported in the experiments.
  • standard math Standard wavelet filter-bank analysis and synthesis equations (Equations 1 and 2) are correct.
    All reconstructions rely on these equations; Equation 2 contains a typo using h[n] instead of h1[n] in the final term, which does not change the method's logic.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Defending Against Adversarial Iris Examples Using Wavelet Decomposition." pith.science (2026). https://pith.science/paper/EMAWNHYT

@misc{pith2026190803176,
  author       = {Pith},
  title        = {Pith review of: Defending Against Adversarial Iris Examples Using Wavelet Decomposition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EMAWNHYT}},
  note         = {Machine review of arXiv:1908.03176}
}
read the original abstract

Deep neural networks have presented impressive performance in biometric applications. However, their performance is highly at risk when facing carefully crafted input samples known as adversarial examples. In this paper, we present three defense strategies to detect adversarial iris examples. These defense strategies are based on wavelet domain denoising of the input examples by investigating each wavelet sub-band and removing the sub-bands that are most affected by the adversary. The first proposed defense strategy reconstructs multiple denoised versions of the input example through manipulating the mid- and high-frequency components of the wavelet domain representation of the input example and makes a decision upon the classification result of the majority of the denoised examples. The second and third proposed defense strategies aim to denoise each wavelet domain sub-band and determine the sub-bands that are most likely affected by the adversary using the reconstruction error computed for each sub-band. We test the performance of the proposed defense strategies against several attack scenarios and compare the results with five state of the art defense strategies.

Figures

Figures reproduced from arXiv: 1908.03176 by the authors.

Figure 1
Figure 1. In the first proposed defense strategy, the normalized iris image is considered as the input image example. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Training the denoising auto-encoders for the second and third proposed defense strategies. (a) These auto-encoders [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Second and third proposed defense strategies: The trained auto-encoders are employed to denoise each wavelet [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Iris code generation: The normalized iris image and the normalized mask are concatenated in depth as the input to [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Deep Sparse Band Selection for Hyperspectral Face Recognition

    cs.CV 2019-08 conditional novelty 4.0 of 10

    A VGG-19 network with group Lasso on its first convolutional layer selects 3 to 4 spectral bands per dataset and reaches about 99.9% accuracy on the CMU, HK PolyU, and UWA hyperspectral face datasets.

Reference graph

Works this paper leans on

42 extracted references · 13 canonical work pages · cited by 1 Pith paper

  1. [11]

    I. J. Goodfellow, J. Shlens, and C. Szegedy. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    arXiv 2014

  2. [41]

    Tram `er, A

    F. Tram `er, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel. Ensemble adversarial train- ing: Attacks and defenses. arXiv preprint arXiv:1705.07204, 2017

    arXiv 2017

  3. [18]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adver- sarial attacks. arXiv preprint arXiv:1706.06083, 2017

    arXiv 2017

  4. [1]

    Biocop database, http://biic.wvu.edu/

  5. [2]

    Abbasi and C

    M. Abbasi and C. Gagn ´e. Robustness to adversarial ex- amples through an ensemble of specialists. arXiv preprint arXiv:1702.06856, 2017

    arXiv 2017

  6. [3]

    Ba and R

    J. Ba and R. Caruana. Do deep nets really need to be deep? In Advances in neural information processing systems, pages 2654–2662, 2014

    work page 2014

  7. [4]

    Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks

    J. Bradshaw, A. G. d. G. Matthews, and Z. Ghahramani. Adversarial examples, uncertainty, and transfer testing ro- bustness in gaussian process hybrid deep networks. arXiv preprint arXiv:1707.02476, 2017

    work page Pith review arXiv 2017

  8. [5]

    Bruna, C

    J. Bruna, C. Szegedy, I. Sutskever, I. Goodfellow, W. Zaremba, R. Fergus, and D. Erhan. Intriguing properties of neural networks. International Conference on Learning Representations, 2014

    2014

Show all 42 references
  1. [6]

    Carlini and D

    N. Carlini and D. Wagner. Adversarial examples are not eas- ily detected: Bypassing ten detection methods. In Proceed- ings of the 10th ACM Workshop on Artificial Intelligence and Security, pages 3–14. ACM, 2017

    2017

  2. [7]

    Crihalmeanu, A

    S. Crihalmeanu, A. Ross, S. Schuckers, and L. Hornak. A protocol for multibiometric data acquisition, storage and dis- semination. Technical Report, WVU, Lane Department of Computer Science and Electrical Engineering, 2007

    2007

  3. [8]

    Dabouei, S

    A. Dabouei, S. Soleymani, J. Dawson, and N. Nasrabadi. Fast geometrically-perturbed adversarial faces. In 2019 IEEE Winter Conference on Applications of Computer Vision (WACV), pages 1979–1988, 2019

    2019

  4. [9]

    J. Daugman. How iris recognition works. In The essential guide to image processing, pages 715–739. 2009

    2009

  5. [10]

    Z. Gong, W. Wang, and W.-S. Ku. Adversarial and clean data are not twins. arXiv preprint arXiv:1704.04960, 2017

    2017 arXiv

  6. [12]

    Grosse, P

    K. Grosse, P. Manoharan, N. Papernot, M. Backes, and P. McDaniel. On the (statistical) detection of adversarial ex- amples. arXiv preprint arXiv:1702.06280, 2017

    2017 arXiv

  7. [13]

    G. Katz, C. Barrett, D. L. Dill, K. Julian, and M. J. Kochen- derfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In International Conference on Computer Aided Verification, pages 97–117, 2017

    2017

  8. [14]

    J. Kim, S. Cho, J. Choi, and R. J. Marks. Iris recognition using wavelet features. Journal of VLSI signal processing systems for signal, image and video technology , 38(2):147– 156, 2004

    2004

  9. [15]

    D. P. Kingma and J. Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  10. [16]

    Krichen, A

    E. Krichen, A. Mellakh, S. Salicetti, and B. Dorizzi. Osiris (open source for iris) reference system. BioSecure Project, 2008

    2008

  11. [17]

    Kurakin, I

    A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial ex- amples in the physical world. International Conference on Learning Representations-Workshop, 2017

    2017

  12. [19]

    Masek and P

    L. Masek and P. Kovesi. Matlab source code for a biometric identification system based on iris patterns. 2003

    2003

  13. [20]

    Meng and H

    D. Meng and H. Chen. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communica- tions Security, pages 135–147. ACM, 2017

    2017

  14. [21]

    Moosavi-Dezfooli, A

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Deep- fool: a simple and accurate method to fool deep neural net- works. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016

    2016

  15. [22]

    Papernot, P

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami. The limitations of deep learning in adversar- ial settings. In Security and Privacy (EuroS&P), 2016 IEEE European Symposium on, pages 372–387, 2016

    2016

  16. [23]

    Papernot, P

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE Symposium on Security and Privacy (SP), pages 582–597, 2016

    2016

  17. [24]

    Rathgeb and C

    C. Rathgeb and C. Busch. On the feasibility of creating mor- phed iris-codes. In 2017 IEEE International Joint Confer- ence on Biometrics (IJCB), pages 152–157, 2017

    2017

  18. [25]

    Ronneberger, P

    O. Ronneberger, P. Fischer, and T. Brox. U-net: Convo- lutional networks for biomedical image segmentation. In International Conference on Medical image computing and computer-assisted intervention, pages 234–241, 2015

    2015

  19. [26]

    Rozsa, E

    A. Rozsa, E. M. Rudd, and T. E. Boult. Adversarial di- versity and hard positive generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recogni- tion Workshops, pages 25–32, 2016

    2016

  20. [27]

    Shaham, J

    U. Shaham, J. Garritano, Y . Yamada, E. Weinberger, A. Cloninger, X. Cheng, K. Stanton, and Y . Kluger. Defend- ing against adversarial images using basis functions transfor- mations. arXiv preprint arXiv:1803.10840, 2018

    2018 arXiv

  21. [28]

    Soleymani, A

    S. Soleymani, A. Dabouei, J. Dawson, and N. M. Nasrabadi. Adversarial examples to fool iris recognition systems. arXiv preprint arXiv:1906.09300, 2019

    1906 arXiv

  22. [29]

    Soleymani, A

    S. Soleymani, A. Dabouei, S. M. Iranmanesh, H. Kazemi, J. Dawson, and N. M. Nasrabadi. Prosodic-enhanced siamese convolutional neural networks for cross-device text-independent speaker verification. arXiv preprint arXiv:1808.01026, 2018

    2018 arXiv

  23. [30]

    Soleymani, A

    S. Soleymani, A. Dabouei, H. Kazemi, J. Dawson, and N. M. Nasrabadi. Multi-level feature abstraction from convolu- tional neural networks for multimodal biometric identifica- tion. In 24th International Conference on Pattern Recogni- tion (ICPR), pages 3469–3476, 2018

    2018

  24. [31]

    Soleymani, A

    S. Soleymani, A. Torfi, J. Dawson, and N. M. Nasrabadi. Generalized bilinear deep convolutional neural networks for multimodal biometric identification. In 25th IEEE Inter- national Conference on Image Processing , pages 763–767, 2018

    2018

  25. [32]

    Y . Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv:1710.10766, 2017

    2017 arXiv

  26. [33]

    Szegedy, W

    C. Szegedy, W. Liu, Y . Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V . Vanhoucke, and A. Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 1–9, 2015

    2015

  27. [34]

    Szegedy, W

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. arXiv preprint, 2013

    2013

  28. [35]

    Szewczyk, K

    R. Szewczyk, K. Grabowski, M. Napieralska, W. Sankowski, M. Zubert, and A. Napieralski. A reliable iris recognition algorithm based on reverse biorthogonal wavelet transform. Pattern Recognition Letters, 33(8):1019–1026, 2012

    2012

  29. [36]

    Taherkhani, N

    F. Taherkhani, N. M. Nasrabadi, and J. Dawson. A deep face identification network enhanced by facial attributes predic- tion. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 553–560, 2018

    2018

  30. [37]

    Taherkhani, V

    F. Taherkhani, V . Talreja, H. Kazemi, and N. Nasrabadi. Fa- cial attribute guided deep cross-modal hashing for face im- age retrieval. In 2018 International Conference of the Bio- metrics Special Interest Group (BIOSIG), pages 1–6, 2018

    2018

  31. [38]

    Talreja, S

    V . Talreja, S. Soleymani, M. C. Valenti, and N. M. Nasrabadi. Learning to authenticate with deep multibiomet- ric hashing and neural network decoding. arXiv preprint arXiv:1902.04149, 2019

    1902 arXiv

  32. [39]

    Talreja, F

    V . Talreja, F. Taherkhani, M. C. Valenti, and N. M. Nasrabadi. Using deep cross modal hashing and error cor- recting codes for improving the efficiency of attribute guided facial image retrieval. In 2018 IEEE Global Conference on Signal and Information Processing (GlobalSIP), ...

    2018

  33. [40]

    Talreja, M

    V . Talreja, M. C. Valenti, and N. M. Nasrabadi. Multi- biometric secure system based on deep learning. In 2017 IEEE Global conference on signal and information process- ing (globalSIP), pages 298–302, 2017

    2017

  34. [42]

    X. Yuan, P. He, Q. Zhu, and X. Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 2019

    2019

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.