Pith. sign in

REVIEW 4 major objections 4 minor 45 references

EM-MIAs: Enhancing Membership Inference Attacks in Large Language Models through Ensemble Modeling

T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By feeding four weak membership signals into an XGBoost classifier, EM-MIAs claims to lift membership-inference AUC from near random to 0.58–0.81 on large language models.

desk verdict Plausible empirical trend in Table I, but oracle-label training and missing reproducibility make the attack claim unverifiable. read the letter →

arxiv 2412.17249 v1 pith:ZN2J4JNN submitted 2024-12-23 cs.RO cs.CR

Zichen Song , Sitan Huang , Zhongfeng Kang This is my paper · ORCID
classification cs.ROcs.CR
keywords largelanguagemodelsmembershipinferenceattacksensemblemodelingXGBoostprivacyauditingAUC-ROCmin-kattackzlibentropy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Membership inference attacks ask whether a given text was part of a language model's training data, and the paper argues that existing single-signal attacks—loss, reference-model loss difference, min-k token likelihood, and zlib-normalized loss—are too weak on modern large models, often near random guessing. The paper's central claim is that feeding all four signals as features into an XGBoost classifier, the EM-MIAs ensemble, raises attack quality sharply, from AUC around 0.48–0.58 for individual methods to 0.58–0.81 across seven datasets and model sizes from 160M to 12B. If true, this gives privacy auditors a more sensitive tool built from existing pieces, with no new attack principle needed.

What carries the argument

The central object is the feature vector $f(x)=[f_{\text{LOSS}}(x), f_{\text{Ref}}(x), f_{\text{Min-k}}(x), f_{\text{zlib}}(x)]$: the model's cross-entropy loss on $x$, the loss difference against a reference model trained on a disjoint set, the average likelihood of the $k\%$ lowest-probability tokens, and the loss divided by the text's zlib compression size. These features are fed to an XGBoost classifier trained on binary membership labels. The mechanism is that XGBoost learns nonlinear combinations and threshold interactions among weak signals, which the authors claim lets the ensemble stay above random where each individual attack fluctuates or collapses.

What would settle it

Run the same EM-MIAs pipeline but train the XGBoost classifier only on texts whose membership the attacker could plausibly know, and evaluate on a target model with a training set that is not disclosed; if the AUC falls back to the level of the best individual signal rather than the reported 0.58–0.81, the ensemble's advantage depends on label access rather than on complementary features.

Watch

Extended reading notes

Core claim

The paper's central claim is that an ensemble of four known membership-inference signals, combined by XGBoost, detects training-data membership in large language models far better than any single signal. In the reported experiments, every individual method sits between roughly 0.48 and 0.58 AUC, while EM-MIAs reaches 0.58–0.81 AUC across Wikipedia, Github, Pile CC, PubMed Central, ArXiv, DM Math, HackerNews, and The Pile, with the largest gaps on Github and the smallest on DM Math. The authors interpret this as evidence that the four features carry complementary information that XGBoost can combine into a more robust privacy-auditing tool.

Load-bearing premise

The reported attack accuracy assumes the XGBoost classifier can be trained on a dataset with correct binary membership labels for the target model, but the paper does not explain how an attacker would obtain those ground-truth labels.

Editorial extensions

If this is right

  • If EM-MIAs is correct, privacy audits of large language models can be made substantially more sensitive by combining existing weak signals rather than designing a new attack from scratch.
  • The trend on Wikipedia and Github suggests that larger models may expose more membership signal to an ensemble, so privacy risk should be re-measured as model scale grows.
  • Individual MIA scores near random should not be read as evidence of low privacy risk, since the same signals can jointly support a much stronger inference.
  • Because the reference-based feature requires a reference model on a disjoint dataset, applying EM-MIAs to a real deployed model inherits the cost and assumptions of obtaining that reference.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The most natural extension the paper does not test is feature ablation: removing one input at a time would show whether the gain comes from all four signals or from one dominant feature such as reference loss difference.
  • A stricter test would train EM-MIAs under a realistic attacker who has no membership labels at all, using surrogate data; the reported numbers likely represent an upper bound on audit power rather than a real-world attack.
  • If the ensemble gain persists under defenses like differentially private training or temperature scaling, ensembling remains a useful auditor of those defenses; if it collapses, the four signals are largely redundant under privacy protection.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes EM-MIAs, an ensemble membership inference attack for large language models that concatenates the scores of LOSS, Reference-based, Min-k%, and zlib entropy attacks into a feature vector and trains an XGBoost classifier to predict membership. The authors report AUC-ROC results over seven datasets and model parameter sizes from 160M to 12B, claiming that the ensemble consistently and 'significantly' outperforms each individual attack method. The main body describes the attack components, an XGBoost training setup with binary membership labels, and a results analysis with a single table of AUC-ROC values. The paper does not name the exact models, describe the reference-model construction, provide data splits or hyperparameters, or release code or data.

Significance. If the claims were valid under a genuine membership-inference threat model, the paper would provide a practical way to amplify weak MIA signals on large single-epoch-trained LLMs, which is a relevant contribution to privacy auditing. A positive feature of the manuscript is that Table I shows the ensemble above all four individual attacks in every one of the 35 reported dataset-size rows, which is a consistent directional pattern rather than a few cherry-picked cells. However, the contribution is framed as an attack while the training procedure requires ground-truth membership labels, so the reported numbers describe a supervised audit, not a real-world attack. The lack of experimental specification, absence of statistical testing, and the presence of irrelevant references and a foreign XML block further prevent the results from being verified. The paper ships no code, data, or machine-checked proofs, and as an attack it is currently unsupported.

major comments (4)
  1. [Section II-C and Section II-A] The core attack construction is not a membership inference attack as defined. Section II-C states that the XGBoost model is trained on 'a dataset with binary labels indicating membership,' but a real attacker does not know which texts were in the target model's training set and therefore cannot obtain such labels for the target model. The paper never specifies a shadow-model procedure, a label-free training scheme, or any other way an attacker could obtain training labels. Consequently, the results in Table I are the performance of a supervised audit with oracle membership knowledge, not the performance of a membership inference attack. The abstract's claim that EM-MIAs 'significantly improves' attack methods is therefore unsupported. A concrete remedy would be to retrain and evaluate the ensemble under a proper shadow-model threat model, or to explicitly reframe the contribution as a privacy-auditing method and adjust the claims accordingly.
  2. [Section III-A and Table I] The experimental setup is insufficiently specified for reproducibility. Table I lists only parameter sizes (160M to 12B) but never names the LLMs evaluated; it does not describe how the reference model for the Reference-based attack is constructed, how member and non-member sets are built, how the XGBoost training/test split is made, or how many samples are used. Section II-E says hyperparameters are tuned via grid search and 5-fold cross-validation, but no resulting hyperparameters, data splits, or validation details are given. Without these details, the numerical results cannot be independently checked or meaningfully compared with prior MIA benchmarks.
  3. [Section III-B and Table I] The claim of 'significant improvements' is not supported by any statistical test. Table I reports means and standard deviations over three repetitions, but the paper does not provide matched significance tests, confidence intervals, or effect sizes. Given the tiny standard deviations (0.002-0.004) relative to the reported differences, a paired test across the same data splits is needed before the word 'significantly' can be used. The absence of such tests affects the central claim of the paper, not a peripheral detail.
  4. [References and Section III-A] The manuscript contains substantial extraneous and irrelevant material. The reference list [1]-[45] is composed almost entirely of point cloud registration papers and is incompatible with the stated topic of membership inference attacks; the in-text citation brackets do not correspond to the cited works. Additionally, Section III-A contains an unrelated XML block labeled '<LLMTask>...' and the Figure 1 caption ends with the fragment '(EM-MIAs)'. These issues indicate that the manuscript was assembled carelessly and must be corrected before any further review.
minor comments (4)
  1. [Section II-B] The LOSS attack formula is written as a C-class cross-entropy, but for the LLM setting the relevant loss is the per-token next-token log-likelihood; the formula should be aligned with the text's description of language-model training.
  2. [Section II-B and Section II-C] The Min-k% feature is described as computing the average likelihood of the lowest-k% tokens, but it is not stated whether this is an average probability or an average log-likelihood, nor how the value of k is chosen; this matters because the scale of the feature affects the XGBoost model.
  3. [Section III-C] The 'Parameter Analysis' section discusses 'thresholds' without defining what threshold is varied for each attack method; the text should specify the threshold or the operating point used to generate the AUC-ROC curves.
  4. [Section III-A] The text said the datasets include 'The Pile' but Table I lists a separate 'The Pile' row in addition to 'Pile CC'; it should be clarified whether these are overlapping or distinct subsets.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: EM-MIAs is a supervised ensemble of independent MIA features, and its reported gains are empirical, not derived from its inputs by construction.

full rationale

The paper's central claim is that an XGBoost classifier trained on features from four established MIA methods (LOSS, Reference-based, Min-k%, zlib) achieves higher AUC-ROC than each individual method. Each individual method is an externally defined baseline: cross-entropy loss, loss difference against a reference model, average likelihood of the lowest-k% tokens, and loss normalized by zlib compression size. The ensemble feature vector in Section II-C is a concatenation of these externally defined features, and the XGBoost model is trained with binary membership labels and evaluated on disjoint held-out data (Section II-E). The reported improvement over individual attacks is therefore an empirical, falsifiable result rather than an identity or a fitted parameter renamed as a prediction. No equation in the paper defines the target result in terms of itself, and no load-bearing step relies on the authors' prior work; the self-citations [31]-[32] concern layer-importance analysis, not membership inference, and are not used to justify the ensemble's validity. The main weakness is a threat-model gap: Section II-C assumes access to binary membership labels for training the attack model, and the paper does not explain how a real attacker would obtain such labels. That is a missing-evidence and external-validity concern, not circularity. Accordingly, no specific circular step can be exhibited with a quote-and-reduction argument, and the appropriate score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central result rests on the availability of membership labels and reference models, on unspecified hyperparameters and feature values, and on the identity of the target LLMs, none of which the paper provides.

free parameters (3)
  • XGBoost hyperparameters = not reported
    Tuned via grid search and 5-fold cross-validation (Section II-E); exact values are omitted, so the reported gains cannot be separated from hyperparameter selection.
  • Min-k% percentile k = not reported
    The Min-k% feature in Section II-B requires a value of k, but the k used in the experiments is never stated.
  • Reference model construction = not reported
    The Reference-based feature depends on a reference model M_ref trained on a disjoint dataset; no details of the reference model or its training data are given.
assumptions (4)
  • domain assumption The attacker has ground-truth membership labels to train the XGBoost attack model.
    Section II-C states training uses "a dataset with binary labels indicating membership", but no threat model explains how an attacker obtains those labels for the target model.
  • domain assumption The named datasets are the exact pretraining sources of the target LLMs.
    Section III-A names Wikipedia, Github, Pile CC, PubMed Central, ArXiv, DM Math, and HackerNews, but never identifies the LLMs, so the membership ground truth is unverifiable.
  • domain assumption A reference model trained on disjoint data is available to the attacker.
    The Reference-based attack in Section II-B assumes a reference model M_ref; availability, training data, and computational cost are not described.
  • domain assumption The evaluation sets are balanced and drawn from the same distribution as the training data.
    AUC-ROC interpretation depends on the composition of member and non-member test sets, but this composition is not reported in Section III.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EM-MIAs: Enhancing Membership Inference Attacks in Large Language Models through Ensemble Modeling." pith.science (2026). https://pith.science/paper/ZN2J4JNN

@misc{pith2026241217249,
  author       = {Pith},
  title        = {Pith review of: EM-MIAs: Enhancing Membership Inference Attacks in Large Language Models through Ensemble Modeling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZN2J4JNN}},
  note         = {Machine review of arXiv:2412.17249}
}
read the original abstract

With the widespread application of large language models (LLM), concerns about the privacy leakage of model training data have increasingly become a focus. Membership Inference Attacks (MIAs) have emerged as a critical tool for evaluating the privacy risks associated with these models. Although existing attack methods, such as LOSS, Reference-based, min-k, and zlib, perform well in certain scenarios, their effectiveness on large pre-trained language models often approaches random guessing, particularly in the context of large-scale datasets and single-epoch training. To address this issue, this paper proposes a novel ensemble attack method that integrates several existing MIAs techniques (LOSS, Reference-based, min-k, zlib) into an XGBoost-based model to enhance overall attack performance (EM-MIAs). Experimental results demonstrate that the ensemble model significantly improves both AUC-ROC and accuracy compared to individual attack methods across various large language models and datasets. This indicates that by combining the strengths of different methods, we can more effectively identify members of the model's training data, thereby providing a more robust tool for evaluating the privacy risks of LLM. This study offers new directions for further research in the field of LLM privacy protection and underscores the necessity of developing more powerful privacy auditing methods.

Figures

Figures reproduced from arXiv: 2412.17249 by the authors.

Figure 1
Figure 1. The diagram illustrates the LLM architecture and the process flow of various attack methods, including Loss-Attack, Zlib-Attack, Ref-Attack, and [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 42 canonical work pages

  1. [1]

    Jiang, N

    Z. Jiang, N. Danis, Y . Bi, M. Zhou, ”Precise repositioning of robotic ultrasound: Improving registration-based motion compensation using ultrasound confidence optimization,” IEEE Trans. Instrum. Meas. , vol. 71, pp. 1–11, 2022, doi: 10.1109/TIM.2022.3200360

    arXiv 2022

  2. [45]

    X. Zhu, H. Xu, S. Wang, and L. Zhou, ”Learning hierarchical features from RGB-D images for 3D point cloud classification,” IEEE Trans. Image Process., vol. 30, pp. 1109-1122, 2021

    work page 2021

  3. [2]

    J. Yu, L. Ren, W. Zhou, Y . Zhang, L. Lin, and G. Dai, ”PEAL: Prior-embedded explicit attention learning for low-overlap point cloud registration,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2023, pp. 17702–17711

    work page 2023

  4. [3]

    Wang et al., ”Robust multiview point cloud registration with reliable pose graph initialization and history reweighting,” in Proc

    H. Wang et al., ”Robust multiview point cloud registration with reliable pose graph initialization and history reweighting,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2023, pp. 9506–9515

    work page 2023

  5. [4]

    Wang et al

    H. Wang et al. , ”RoReg: Pairwise point cloud registration with ori- ented descriptors and local rotations,” IEEE Trans. Pattern Anal. Mach. Intell. , vol. 45, no. 8, pp. 10376–10393, Aug. 2023, doi: 10.1109/TPAMI.2023.3244951

    arXiv 2023

  6. [5]

    Yu et al., ”Rotation-invariant transformer for point cloud matching,” in Proc

    H. Yu et al., ”Rotation-invariant transformer for point cloud matching,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR) , Jun. 2023, pp. 5384–5393

    work page 2023

  7. [6]

    G. Chen, M. Wang, Q. Zhang, L. Yuan, and Y . Yue, ”Full transformer framework for robust point cloud registration with deep information interaction,” IEEE Trans. Neural Netw. Learn. Syst. , early access, 2023

    work page 2023

  8. [7]

    Ghorbani, H

    F. Ghorbani, H. Ebadi, A. Sedaghat, and N. Pfeifer, ”A novel 3-D local DAISY-style descriptor to reduce the effect of point displacement error in point cloud registration,” IEEE J. Sel. Topics Appl. Earth Observ. Remote Sens., vol. 15, pp. 2254–2273, 2022

    work page 2022

Show all 45 references
  1. [8]

    Z. Dong, B. Yang, F. Liang, R. Huang, and S. Scherer, ”Hierarchical registration of unordered TLS point clouds based on binary shape context descriptor,” ISPRS J. Photogramm. Remote Sens. , vol. 144, pp. 61–79, Oct. 2018

    2018

  2. [9]

    Fengguang, D

    X. Fengguang, D. Biao, H. Wang, P. Min, K. Liqun, and H. Xie, ”A local feature descriptor based on rotational volume for pairwise registration of point clouds,” IEEE Access, vol. 8, pp. 100120–100134, 2020

    2020

  3. [10]

    S. Ao, Q. Hu, H. Wang, K. Xu, and Y . Guo, ”BUFFER: Balancing accuracy, efficiency, and generalizability in point cloud registration,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR) , Jun. 2023, pp. 1255–1264

    2023

  4. [11]

    Z. Qin, H. Yu, C. Wang, Y . Peng, and K. Xu, ”Deep graph-based spatial consistency for robust non-rigid point cloud registration,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2023, pp. 5394–5403

    2023

  5. [12]

    Xu et al

    W. Xu et al. , ”Feature curve-based registration for airborne LiDAR bathymetry point clouds,” Int. J. Appl. Earth Observ. Geoinf. , vol. 112, Aug. 2022, Art. no. 102883

    2022

  6. [13]

    B. Fei, W. Yang, L. Ma, and W.-M. Chen, ”DcTr: Noise-robust point cloud completion by dual-channel transformer with cross-attention,” Pattern Recognit., vol. 133, Jan. 2023, Art. no. 109051

    2023

  7. [14]

    Z. J. Yew and G. H. Lee, ”REGTR: End-to-end point cloud corre- spondences with transformers,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2022, pp. 6677–6686

    2022

  8. [15]

    Y . Wu, X. Hu, Y . Zhang, M. Gong, W. Ma, and Q. Miao, ”SACF-Net: Skip-attention based correspondence filtering network for point cloud registration,” IEEE Trans. Circuits Syst. Video Technol. , vol. 33, no. 8, pp. 3585–3595, Aug. 2023

    2023

  9. [16]

    Wu et al

    Y . Wu et al. , ”Evolutionary multiform optimization with two-stage bidirectional knowledge transfer strategy for point cloud registration,” IEEE Trans. Evol. Comput. , vol. 28, no. 1, pp. 62–76, 2022

    2022

  10. [17]

    Y . Yan, J. An, J. Zhao, and F. Shen, ”Hybrid optimization with uncon- strained variables on partial point cloud registration,” Pattern Recognit., vol. 136, Apr. 2023, Art. no. 109267

    2023

  11. [18]

    Y . Shen, L. Hui, H. Jiang, J. Xie, and J. Yang, ”Reliable inlier evaluation for unsupervised point cloud registration,” in Proc. AAAI Conf. Artif. Intell., 2022, vol. 36, no. 2, pp. 2198–2206

    2022

  12. [19]

    J. Li, P. Shi, Q. Hu, and Y . Zhang, ”QGORE: Quadratic-time guaranteed outlier removal for point cloud registration,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 9, pp. 11136–11151, 2023

    2023

  13. [20]

    Y . Wu, Y . Zhang, X. Fan, M. Gong, Q. Miao, and W. Ma, ”INENet: Inliers estimation network with similarity learning for partial overlapping registration,” IEEE Trans. Circuits Syst. Video Technol. , vol. 33, no. 3, pp. 1413–1426, Mar. 2022

    2022

  14. [21]

    X. Bai, Z. Luo, L. Zhou, H. Fu, L. Quan, and C.-L. Tai, ”D3Feat: Joint learning of dense detection and description of 3D local features,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR) , Jun. 2020, pp. 6359–6367

    2020

  15. [22]

    Huang, Z

    S. Huang, Z. Gojcic, M. Usvyatsov, A. Wieser, and K. Schindler, ”Predator: Registration of 3D point clouds with low overlap,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2021, pp. 4267–4276

    2021

  16. [23]

    S. Ren, Y . Zeng, J. Hou, and X. Chen, ”CorrI2P: Deep image-to-point cloud registration via dense correspondence,” IEEE Trans. Circuits Syst. Video Technol., vol. 33, no. 3, pp. 1198–1208, Mar. 2023

    2023

  17. [24]

    K. Fu, S. Liu, X. Luo, and M. Wang, ”Robust point cloud registration framework based on deep graph matching,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR) , Jun. 2021, pp. 8893–8902

    2021

  18. [25]

    S. Ao, Q. Hu, B. Yang, A. Markham, and Y . Guo, ”SpinNet: Learning a general surface descriptor for 3D point cloud registration,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2021, pp. 11753–11762

    2021

  19. [26]

    Z. Qin, H. Yu, C. Wang, Y . Guo, Y . Peng, and K. Xu, ”Geometric transformer for fast and robust point cloud registration,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR) , Jun. 2022, pp. 11143–11152

    2022

  20. [27]

    A. Zeng, S. Song, M. Nießner, M. Fisher, J. Xiao, and T. Funkhouser, ”3DMatch: Learning local geometric descriptors from RGB-D recon- structions,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Jul. 2017, pp. 1802–1811

    2017

  21. [28]

    Z. Wu, S. Song, A. Khosla, F. Yu, ”3D ShapeNets: A deep representation for volumetric shapes,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2015, pp. 1912–1920

    2015

  22. [29]

    L. Pan, Z. Cai, and Z. Liu, ”Robust partial-to-partial point cloud registration in a full range,” 2021, arXiv:2111.15606

    2021 arXiv

  23. [30]

    Geiger, P

    A. Geiger, P. Lenz, and R. Urtasun, ”Are we ready for autonomous driving? The KITTI vision benchmark suite,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , Jun. 2012, pp. 3354–3361

    2012

  24. [31]

    Z. Song, Y . Wu, S. Huang, and Z. Kang, ”A VSS: Layer Im- portance Evaluation in Large Language Models via Activation Variance-Sparsity Analysis,” in arXiv, 2024, [Online]. Available: https://arxiv.org/abs/2411.02117

    2024 arXiv

  25. [32]

    Z. Song, S. Huang, Y . Wu, and Z. Kang, ”Layer Importance and Hallucination Analysis in Large Language Models via Enhanced Activation Variance-Sparsity,” in arXiv, 2024, [Online]. Available: https://arxiv.org/abs/2411.10069

    2024 arXiv

  26. [33]

    Pan et al., ”Variational relational point completion network,” in Proc

    L. Pan et al., ”Variational relational point completion network,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2021, pp. 8524–8533

    2021

  27. [34]

    C. Choy, J. Park, and V . Koltun, ”Fully convolutional geometric fea- tures,” in Proc. IEEE/CVF Int. Conf. Comput. Vis. (ICCV) , Oct. 2019, pp. 8958–8966

    2019

  28. [35]

    H. Xu, S. Liu, G. Wang, G. Liu, and B. Zeng, ”OMNet: Learning overlapping mask for partial-to-partial point cloud registration,” in Proc. IEEE/CVF Int. Conf. Comput. Vis. , Oct. 2021, pp. 3132–3141

    2021

  29. [36]

    Mei et al

    G. Mei et al. , ”Unsupervised deep probabilistic approach for partial point cloud registration,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2023, pp. 13611–13620

    2023

  30. [37]

    Zhang, J

    X. Zhang, J. Yang, S. Zhang, and Y . Zhang, ”3D registration with maximal cliques,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , Jun. 2023, pp. 17745–17754

    2023

  31. [38]

    Y . Aoki, H. Goforth, R. A. Srivatsan, and S. Lucey, ”PointNetLK: Robust efficient point cloud registration using PointNet,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), Jun. 2019, pp. 7156–7165

    2019

  32. [39]

    Wang and J

    Y . Wang and J. M. Solomon, ”Deep closest point: Learning represen- tations for point cloud registration,” in Proc. IEEE Int. Conf. Comput. Vis., Nov. 2019, pp. 3523–3532

    2019

  33. [40]

    Z. J. Yew and G. H. Lee, ”RPM-Net: Robust point matching using learned features,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recog- nit., Jun. 2020, pp. 11824–11833

    2020

  34. [41]

    J. Li, C. Zhang, Z. Xu, H. Zhou, and C. Zhang, ”Iterative distance-aware similarity matrix convolution with mutual-supervised point elimination for efficient point cloud registration,” in Proc. Eur. Conf. Comput. Vis. , 2020, pp. 378–394

    2020

  35. [42]

    Y . Wang, Y . Sun, Z. Liu, S. E. Sarma, M. M. Bronstein, and J. M. Solomon, ”Dynamic graph CNN for learning on point clouds,” ACM Trans. Graph., vol. 38, no. 5, pp. 1-12, 2019

    2019

  36. [43]

    C. R. Qi, H. Su, K. Mo, and L. J. Guibas, ”PointNet: Deep learning on point sets for 3D classification and segmentation,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2017, pp. 652-660

    2017

  37. [44]

    Y . Yue, M. Y . Yang, and L. van Gool, ”Robust 3D point cloud recognition by self-organization,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2021, pp. 3644-3653

    2021

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.