Pith. sign in

REVIEW 3 major objections 6 minor 43 references

Topological Signatures of Adversaries in Multimodal Alignments

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial attacks on multimodal models leave detectable topological signatures.

desk verdict The paper's real contribution is a solid empirical finding about topological losses tracking adversarial fractions in multimodal alignments, alongside a promising detection method whose statistical validity is not yet fully established. read the letter →

arxiv 2501.18006 v1 pith:MVRBNZBK submitted 2025-01-29 cs.LG cs.AIcs.CR

Minh Vu , Geigh Zollicoffer , Huy Mai , Ben Nebgen , Boian Alexandrov , Manish Bhattarai This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords topologicaldataanalysispersistenthomologyadversarialdetectionmultimodalalignmentCLIPBLIPmaximummeandiscrepancytotalpersistence
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to prove that adversarial attacks on multimodal image-text models such as CLIP and BLIP leave a measurable topological trace in the alignment between image and text embeddings, and that this trace can be turned into a detector. It introduces two topological-contrastive losses — one built on total persistence and one on a multi-scale kernel — that compare the persistent-homology summaries of image and text point clouds, and reports that these losses change monotonically as the fraction of adversarial images in a batch grows, across many models, datasets, and attacks. It then back-propagates the losses to individual inputs to obtain per-sample gradient features, and incorporates them into a Maximum Mean Discrepancy two-sample test. In the reported experiments, the resulting tests (TPSAMMD and MKSAMMD) match or beat the SAMMD baseline and other two-sample tests, with the largest gains at small perturbation sizes and small test batches. If correct, this gives a practical, interpretable signal for detecting adversarial samples in multimodal systems.

What carries the argument

The engine of the argument is a pair of topological-contrastive losses between embedding point clouds, plus their gradients. The total-persistence loss $\mathcal{L}^\alpha_{TP}(X,Y)=\sum_i |\operatorname{Pers}^\alpha_i(X)-\operatorname{Pers}^\alpha_i(Y)|$ sums absolute differences of lifetime sums across homology dimensions; the multi-scale-kernel loss $\mathcal{L}^\sigma_{MK}(X,Y)=\sum_i k_\sigma(D_i(X),D_i(Y))$ compares persistence diagrams with a Gaussian kernel on birth-death pairs that is stable with respect to the 1-Wasserstein distance. Both are computed from Vietoris–Rips filtrations of image and text embeddings, and the sample-level features used for detection are the gradients $\dot Y = \nabla_Y \mathcal{L}_{TC}(Y \cup Z, T)$ taken with respect to image logits, with a hold-out set $Z$ and text embeddings $T$ as references. These gradient features enter a modified semantic-aware MMD kernel. The Poisson cluster process model is a supporting mechanism: it links the adversarial-scattering assumption to longer minimum spanning trees and therefore larger 0-dimensional total persistence.

What would settle it

Compute TPSAMMD two ways on the same data — once with the paper's batch shortcut $\dot Y = \nabla_Y \mathcal{L}_{TC}(Y\cup Z,T)$ and once with exact per-sample features using a separate filtration for each point — and compare Type-I error and power; if the exact version loses the reported advantage or the batch version's Type-I error climbs above 5% as $|Z|/|Y|$ decreases, the detection claim is undermined.

Watch

Extended reading notes

Core claim

The central claim is that the image-text alignment learned by CLIP and BLIP has a topology, and adversarial perturbations change that topology in a systematic way. To make this precise, the paper extracts the image and text logits before alignment, builds Vietoris–Rips filtrations on both point clouds, and compares them using the $\alpha$-total persistence $\operatorname{Pers}^\alpha_i(X) = \sum_{(b,d)\in D_i(X)}(d-b)^\alpha$ and the multi-scale kernel of Reininghaus et al. The observed pattern is monotonic: as clean samples are replaced by adversarial ones, the total-persistence loss rises in nearly all settings while the multi-scale-kernel loss rises or falls consistently depending on the model family. Because both losses are differentiable, their gradients with respect to image inputs, computed on a batch together with a larger hold-out set, serve as sample-level topological features. Inserting these features into the SAMMD deep kernel yields TPSAMMD and MKSAMMD, which the paper reports achieve higher test power than existing baselines, especially for small perturbations, while keeping Type-I error around the nominal 5% level. A Poisson cluster process model of logits, together with the fact that 0-dimensional persistence equals minimum spanning tree length, is used to explain why more scattered adversarial logits should produce higher total persistence.

Load-bearing premise

The detection test's validity rests on the assumption that gradient features computed from one shared Vietoris–Rips filtration on the combined test-plus-hold-out batch behave like independent exchangeable samples; the paper demonstrates the resulting Type-I error empirically but does not quantify how much dependence this shared computation introduces.

Editorial extensions

If this is right

  • Batch-level TP and MK losses give a contamination signal that grows or falls consistently with the fraction of adversarial samples, so the losses can be used to monitor a stream of inputs without labeling any single sample.
  • TPSAMMD and MKSAMMD are usable two-sample tests for adversarial detection, with test power at or above SAMMD while keeping Type-I error near 5% in the reported settings.
  • The gains over baselines are largest exactly where detection is hardest: small perturbation magnitudes such as $\epsilon = 1/255$ and small batches of 50 rather than 500 samples.
  • The effect appears across CLIP and BLIP variants and across many attack families, suggesting the topological signature is tied to the alignment mechanism rather than to one architecture or attack.
  • If the monotonicity claim holds, attacks that disturb label-cluster structure in logits can be detected before any defense or retraining, because the TC losses are computed from the attacked model's own embeddings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the same construction should transfer to other contrastively aligned modalities, such as audio-text, video-text, or code-text, because the losses are model-agnostic functions of two embedding point clouds.
  • Inference: the shared-filtration approximation in Eq. (6) makes a testable prediction: shrinking the hold-out set $Z$ toward the test batch size $|Y|$ should inflate Type-I error if the dependence among gradient features is the reason the shortcut works.
  • Inference: the PCP/MST account predicts that attacks which translate logits to a new label cluster without scattering them should not raise 0-dimensional total persistence, so targeted low-variance attacks may evade this detector.
  • Inference: the gradient features may themselves be useful as inputs to other statistical tests or anomaly detectors, not only MMD kernels.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The manuscript studies the alignment of image and text embeddings in CLIP and BLIP models and proposes two topological-contrastive (TC) losses, the total persistence (TP) loss L_TP^α and the multi-scale kernel (MK) loss L_MK^σ, computed from persistence diagrams of embedding point clouds. Using batches that mix clean and adversarial images, the authors report that the normalized TC losses change monotonically as the proportion of adversaries increases across many models, attacks, and datasets (Section 3.2, Table 1, Figures 3 and 10-14). They then define sample-level topological features as gradients of the TC losses (Equation 6) and combine these features with the SAMMD kernel to construct TPSAMMD and MKSAMMD two-sample tests (Section 4). Experimental results (Section 5 and Appendix E) indicate that TPSAMMD often outperforms SAMMD and other baselines in test power at small perturbation magnitudes while keeping Type-I error near 5%. A Poisson Cluster Process (PCP) model (Section 3.3) is used to argue that adversarial scattering of logits increases 0-dimensional total persistence, providing an explanation for the observed TP increase.

Significance. If the results hold, the paper offers a novel and interpretable use of persistent homology for multimodal adversarial detection, and the experimental breadth across 5 CLIP models, 3 BLIP models, 6 attack methods, and 3 datasets is a clear strength. The idea of back-propagating topological losses to obtain per-sample features is an original contribution that could inspire further work in statistical adversarial detection. However, the two central empirical claims, namely the monotonicity of TC losses and the reliable Type-I control of the topological MMD tests, are not yet established with the necessary statistical rigor. The unquantified batch-computation approximation in Equation (6) threatens the validity of the MMD null distribution, and the monotonicity claim lacks uncertainty quantification and has acknowledged exceptions. These issues are fixable with additional diagnostics and experiments, so the work is a promising candidate for publication after a major revision.

major comments (3)
  1. [Section 4, Eq. (6)] The batch-computation of topological features does not preserve the independence required for the MMD test. In Eq. (6), ˙Y = ∇_Y L_TC(Y∪Z,T), so each feature ˙y_i is a function of the entire batch Y, not just of y_i and the fixed holdout Z. The paper acknowledges this and asserts that 'the introduced error is acceptable when |Z| is significantly larger than |Y|', but no bound, diagnostic, or convergence argument is given. Because the features depend on the batch composition, the standard permutation null that shuffles labels while holding features fixed does not reproduce the null distribution of features computed from a clean batch; the reported Type-I error control and the power gains of TPSAMMD over SAMMD could therefore be artifacts of test miscalibration. The authors should quantify the approximation error by comparing batch features with per-sample features on a subset, or provide a null procedure that respects the dependence (e.g., a batch-level bootstrap or block permutation), and report the empirical null distribution of the test statistic under H0.
  2. [Section 3.2, Table 1 and Fig. 3] The central monotonicity claim is presented without uncertainty quantification. Figures 3 and 10-14 show single loss trajectories with no error bars or repeated random draws, and Table 1 contains numerous dashes (non-monotonic behavior) and FGSM rows with mixed patterns; the appendix itself concedes that 'Except for FGSM, the TC loss shows monotonic behavior'. The paper also provides no statistical test of monotonicity. Since the abstract states the monotonic pattern as a key finding, the authors should report the distribution of the losses over multiple batch reshuffles, provide a quantitative monotonicity measure (e.g., Kendall's tau or an isotonic-regression fit), and state the frequency of monotonic behavior across replicates and settings. This would make the claim falsifiable and would clarify the status of the acknowledged exceptions.
  3. [Section 3.3 and Fig. 15] The PCP-based explanation is a post-hoc consistency check rather than a predictive test. The MLE in Fig. 15 fits the Dirichlet concentration parameters to the very logits whose TP behavior the model is meant to explain, and the Monte Carlo simulation in Fig. 5 then shows that less concentrated PCP parameters yield larger MST length. This does not independently validate the adversarial scattering assumption; it only shows that the fitted model implies the observed direction. Moreover, the simulation addresses only 0-dimensional persistence (MST length), whereas the TP loss in Eq. (3) sums over all homology dimensions. To make the theoretical justification load-bearing, the authors should either derive an analytical bound, test the model on held-out attack types or perturbation magnitudes without refitting, or provide evidence that higher-dimensional persistence behaves similarly under scattering.
minor comments (6)
  1. [Section 4, kernel definition] The displayed formula for kτ has a typographical ambiguity: the bracket structure '(1−ϵ0) τ + ϵ0' should be written as [(1−ϵ0)τ + ϵ0] to make clear that the bracket multiplies ν, and the parentheses around the product are missing.
  2. [Algorithm 1, line 13] The TP loss in Algorithm 1 is written as ∥ Σ_i Pers_i^α(Y∪Z) − Pers_i^α(T) ∥_α, without the per-dimension absolute value used in Eq. (3). Please correct the pseudocode to match the definition, or state that the norm is used intentionally and explain the effect on the gradient.
  3. [Appendix A] The statement in Appendix A that 'Except for FGSM, the TC loss shows monotonic behavior' conflicts with the dashes for other attacks in Table 1; the authors should define the criteria for monotonicity and for a dash, and ensure the text and table use the same criteria.
  4. [Figures 7-9 and Appendix E] Type-I error is reported from only 100 trials per setting; at a nominal 5% level the Monte Carlo standard error is about 2.2%, so the claim that error is 'strictly below 5%' needs confidence intervals or more trials to be meaningful.
  5. [Appendix E, reproducibility] Appendix E states that the code is under review for release; to allow verification, a reference implementation or a detailed description of the Vietoris-Rips and gradient computations should be provided at submission time.
  6. [Equation (4)] Equation (4) writes the kernel prefactor as 1/8πσ, which is readily misread as (1/8)πσ; use 1/(8πσ) to match the normalization in Reininghaus et al.

Circularity Check

1 steps flagged · score 4.0 of 10

The measured loss trends and MMD gains are not circular; the PCP 'theoretical justification' is a fitted-input explanation that re-simulates MLE-estimated scattering to reproduce the TP increase.

  1. fitted input called prediction [Sect. 3.3 and Appx. B (Fig. 15)]
    "The final part of this section presents a theoretical explanation for the observed overall increase in TP of adversaries. ... Under that assumption, our hypothesis is that the scattering behavior of adversarial logit leads to a higher TP. ... We empirically validate the aforementioned assumption through the experiments presented in Fig. 15. ... We then employ Maximum Likelihood Estimation to fit the PCP's α parameter."

    The scattering premise is not an independent theoretical input; it is obtained by MLE-fitting the PCP to the same clean and adversarial logits whose TP increase is the target of explanation (Fig. 15, class 0 from CLIP-ViT-L/14@336px on CIFAR-10). The Monte Carlo then shows that this fitted scattering difference increases MST length / 0-th TP. The 'prediction' that adversarial logits have higher TP is therefore a restatement of the fitted concentration difference plus a simulation of its metric consequence, not a derivation from first principles. This is a post-hoc consistency argument rather than a genuine prediction, but the main empirical monotonicity in Sect. 3.2 and the MMD comparisons in Sect. 5 are measured, not circular.

full rationale

The central empirical claims are self-contained against the data: the monotonic TC-loss trends in Table 1 and Fig. 3 are direct measurements, and the TPSAMMD and MKSAMMD gains in Figs. 7-9 are benchmark comparisons against SAMMD, ME, SCF, and C2ST; no fitted parameter is renamed as a prediction in those parts. No load-bearing self-citation or imported uniqueness theorem was found. The only reduction is in the PCP explanation of the TP increase: the adversarial-scattering assumption is validated by fitting Dirichlet/PCP parameters to the very logits whose persistence is being explained, and then the simulation returns the TP ordering that was already observed. This is a fitted input used as an explanatory prediction, so it is partially circular, but it does not by itself force the detection results. The Eq. (6) batch approximation (features computed on Y∪Z rather than per-sample) is an acknowledged limitation with no quantified error bound; this is a correctness and validity concern about the MMD null distribution, not a circular derivation, so it does not raise the circularity score.

Assumptions & free parameters 7 free parameters · 7 assumptions · 0 invented entities

The central claims rest on standard TDA quantities plus several modeling assumptions (scattering, batch approximation, gradient stability) and a set of undisclosed hyperparameters; no new physical or mathematical entities are postulated.

free parameters (7)
  • PCP concentration parameter alpha_small (alpha_s) = not reported numerically (MLE fit, Fig. 15)
    Fitted by MLE to clean and adversarial logits of CLIP-ViT-L/14@336px on CIFAR-10 (Appx B, Fig. 15); drives the simulation-based explanation that scattering raises total persistence.
  • PCP bias ratio r = 1/alpha_tilde_small = not reported numerically
    Controls cluster-center placement near simplex vertices in the PCP; varied in Monte Carlo simulations (Fig. 5) to argue scattering increases MST length.
  • Kernel blend weight epsilon0 in k_tau = not disclosed
    Weights topological versus embedding similarity in the TPSAMMD/MKSAMMD kernel (Sect. 4); its selection procedure is not described, which affects test-power comparisons.
  • Kernel bandwidths sigma and sigma_TC = not disclosed
    Gaussian bandwidths of kappa and kappa_TC in k_tau (Sect. 4); learned by gradient descent like SAMMD, but the optimization protocol (validation versus test data) is not stated.
  • TP order alpha and homology dimension K = not disclosed
    Equations 2-3 and Algorithm 1 leave alpha and K unspecified in the main text; results depend on these choices.
  • MK scale sigma (multi-scale kernel) = not disclosed
    Scale of the Reininghaus kernel in Eq. 4; values used in the experiments are not reported.
  • PCP per-cluster point counts N_i = 500 or 1000 in simulations
    Monte Carlo setting in Fig. 5; the connection between N_i and actual logit batch sizes is not made.
assumptions (7)
  • domain assumption Manifold Hypothesis: natural data and embeddings lie on a low-dimensional manifold
    Invoked in the Introduction to justify applying persistent homology to embedding point clouds; standard but unproved assumption in ML.
  • domain assumption Adversarial scattering assumption: adversarial attacks change the top logit without preserving the new label cluster's structure, so adversarial logits are more scattered
    Stated in Sect. 3.3; load-bearing for the PCP explanation of higher TP. Partially supported by MLE fits in Fig. 15 on the same data.
  • standard math Pers^alpha_0(X) equals the length of the minimum spanning tree of X
    Used in Sect. 3.3 to compute 0-dimensional total persistence via MST; follows from 0-dimensional persistence theory (Koyama et al. 2023).
  • standard math Multi-scale kernel is 1-Wasserstein stable (Theorem 2 of Reininghaus et al. 2014)
    Relied on in Sect. 3.1 as justification for using the MK loss as a robust topological summary.
  • domain assumption Comparing the persistence diagrams of image-embedding and text-embedding point clouds measures alignment quality
    The core modeling choice of Sect. 3.1; the two point clouds live in spaces of different dimension and size, and the paper does not validate that TP/MK differences track semantic misalignment rather than mere cardinality or scale differences.
  • domain assumption Batch-approximation error in Eq. 6 is acceptable when |Z| >> |Y|
    Sect. 4 asserts the dependence introduced by the shared VR filtration is negligible for |Z|=1000/3000 versus |Y|=50/100, without quantification; the MMD null distribution relies on this being true.
  • domain assumption Gradients of TC losses through VR filtrations are well-defined and stable
    Backpropagation (Eq. 6, Alg. 1) differentiates through persistence-diagram construction via the pytorch-topological library; persistence diagrams are only piecewise smooth functions of the point cloud, and gradient stability is not analyzed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Topological Signatures of Adversaries in Multimodal Alignments." pith.science (2026). https://pith.science/paper/MVRBNZBK

@misc{pith2026250118006,
  author       = {Pith},
  title        = {Pith review of: Topological Signatures of Adversaries in Multimodal Alignments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MVRBNZBK}},
  note         = {Machine review of arXiv:2501.18006}
}
read the original abstract

Multimodal Machine Learning systems, particularly those aligning text and image data like CLIP/BLIP models, have become increasingly prevalent, yet remain susceptible to adversarial attacks. While substantial research has addressed adversarial robustness in unimodal contexts, defense strategies for multimodal systems are underexplored. This work investigates the topological signatures that arise between image and text embeddings and shows how adversarial attacks disrupt their alignment, introducing distinctive signatures. We specifically leverage persistent homology and introduce two novel Topological-Contrastive losses based on Total Persistence and Multi-scale kernel methods to analyze the topological signatures introduced by adversarial perturbations. We observe a pattern of monotonic changes in the proposed topological losses emerging in a wide range of attacks on image-text alignments, as more adversarial samples are introduced in the data. By designing an algorithm to back-propagate these signatures to input samples, we are able to integrate these signatures into Maximum Mean Discrepancy tests, creating a novel class of tests that leverage topological signatures for better adversarial detection.

Figures

Figures reproduced from arXiv: 2501.18006 by the authors.

Figure 1
Figure 1. Highlights of our results in ImageNet (top) and CIFAR10 (bottom) in CLIP’s alignment: (1st and 2nd columns) The TP and MK losses of the data batch monotonically change as the proportion of adversaries (AA for AutoAttack and PGD for Projected Gradient Descent) in the batch increases. (3rd and 4th columns) Utilizing the topological signatures derived from TP and MK losses can significantly improve the Test power of ex… view at source ↗
Figure 2
Figure 2. The computations of the TC loss LT C ∈ {Lα T P , L σ MK} and the backward computations of the topological features. trastive losses, i.e., the TP and the MK losses (Subsect. 3.1). Then, results from extensive experiments on CLIP and BLIP models will show that the presence of adversaries in the in￾put data batch introduces distinct topological signatures captured by TP and ML losses (Subsect. 3.2). We further attempt… view at source ↗
Figure 3
Figure 3. Normalized TP (row 1,3 and 5) and MK losses (row 2, 4 and 6) vs. the proportion of adversaries in the data batch (ϵ = 4/255) in CLIP-CIFAR10, CLIP-ImageNet and BLIP-ImageNet. that the topological signatures of the logits exhibit a con￾sistent, monotonic change as the proportion of adversarial examples in the data batch increases. Experimental Setting: Our analysis of multimodal adver￾saries is conducted on 10000 tes… view at source ↗
Figures from the paper (17 more)
Figure 4
Figure 4. Figure 4: Points generated from PCP(αs, r) in 2D-simplex. TP of PCP: We utilize the PCP to investigate how the scattering of logits affects the TP. Due to the high com￾plexity, we focus on connected components (0-dimensional homology), which are the most straightforward to analy…
Figure 5
Figure 5. Figure 5: Monte Carlo simulations of the length of the MST (Persα 0 (X)) for different parameters of the PCP model. Although Persα 0 (X) is the length of the MST, calculating it theoretically is still very challenging (Aldous & Steele, 1992), and the impact of the scattering of …
Figure 7
Figure 7. Figure 7: Test power and average Type-I error (last column) of adversarial detection methods in CIFAR10 with CLIP embedding. To ensure the independence assumption in SAD, the topo￾logical features need to be computed independently. This can be achieved by utilizing a hold-out da…
Figure 8
Figure 8. Figure 8: Test power and average Type-I error (last column) of adversarial detection methods in ImageNet with CLIP embedding [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Test power and average Type-I error (last column) of adversarial detection methods in ImageNet with BLIP embedding. tudes. Nevertheless, TPSAMMD shows a slight advantage in PGD and AA. Additionally, we average the Type-I errors for all tests in the first 4 columns at ϵ…
Figure 10
Figure 10. Figure 10: Normalized Total Persistence versus Adversarial data proportions in CIFAR10. 13 [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: Normalized Total Persistence versus Adversarial data proportions in CIFAR100. 14 [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: Normalized Total Persistence versus Adversarial data proportions in ImageNet. 15 [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]
Figure 13
Figure 13. Figure 13: Normalized Multi-scale Kernel loss versus Adversarial data proportions in CIFAR10. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_13.png]
Figure 14
Figure 14. Figure 14: Normalized Multi-scale Kernel loss versus Adversarial data proportions in ImageNet. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: MLE of Dirichlet’s α coefficients for different logits: the MLE of clean logits results in the Dirichlet distribution with the lowest variance. We empirically validate the aforementioned assumption through the experiments presented in [PITH_FULL_IMAGE:figures/full_fi…
Figure 16
Figure 16. Figure 16: Test power of different methods in detecting ImageNet’s adversaries. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_16.png]
Figure 17
Figure 17. Figure 17: Type-I error of different methods in detecting ImageNet’s adversaries [PITH_FULL_IMAGE:figures/full_fig_p021_17.png]
Figure 18
Figure 18. Figure 18: Test power of different methods in detecting CIFAR10’s adversaries [PITH_FULL_IMAGE:figures/full_fig_p021_18.png]
Figure 19
Figure 19. Figure 19: Type-I error of different methods in detecting CIFAR10’s adversaries. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_19.png]
Figure 20
Figure 20. Figure 20: Test power of different methods in detecting CIFAR100’s adversaries [PITH_FULL_IMAGE:figures/full_fig_p022_20.png]
Figure 21
Figure 21. Figure 21: Type-I error of different methods in detecting CIFAR100’s adversaries. 22 [PITH_FULL_IMAGE:figures/full_fig_p022_21.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 20 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Pytorch topological

    AidosLab. Pytorch topological. https://github.com/aidos-lab/pytorch-topological, 2023. Accessed: 2025-01-27

    work page 2023

  3. [3]

    and Steele, J

    Aldous, D. and Steele, J. M. Asymptotics for euclidean minimal spanning trees on random points. Probability Theory and Related Fields, 92 0 (2): 0 247--258, 1992. doi:10.1007/BF01194923. URL https://doi.org/10.1007/BF01194923

    work page doi:10.1007/bf01194923 1992

  4. [4]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

    Brendel, W., Rauber, J., and Bethge, M. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248, 2017

    arXiv 2017

  5. [5]

    P., Ramdas, A., Sejdinovic, D., and Gretton, A

    Chwialkowski, K. P., Ramdas, A., Sejdinovic, D., and Gretton, A. Fast two-sample testing with analytic representations of probability measures. In Neural Information Processing Systems, 2015. URL https://api.semanticscholar.org/CorpusID:10043524

    work page 2015

  6. [6]

    Detecting adversarial samples using influence functions and nearest neighbors

    Cohen, G., Sapiro, G., and Giryes, R. Detecting adversarial samples using influence functions and nearest neighbors. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 14453--14462, 2020

    work page 2020

  7. [7]

    C., Roxo, T., Proença, H., and Inácio, P

    Costa, J. C., Roxo, T., Proença, H., and Inácio, P. R. M. How deep learning sees the world: A survey on adversarial attacks and defenses. IEEE Access, 12: 0 61113--61136, 2024. doi:10.1109/ACCESS.2024.3395118

    arXiv 2024

  8. [8]

    Daley, D. J. and Vere-Jones, D. An Introduction to the Theory of Point Processes. Probability and Its Applications. Springer New York, NY, 2 edition, 2003. ISBN 978-0-387-95541-4. doi:10.1007/b97277. URL https://doi.org/10.1007/b97277. Originally published in the series: Springer Series in Statistics

    doi:10.1007/b97277 2003

Show all 43 references
  1. [9]

    ImageNet: A Large-Scale Hierarchical Image Database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. ImageNet: A Large-Scale Hierarchical Image Database . In CVPR09, 2009

    2009

  2. [10]

    and Polonik, W

    Divol, V. and Polonik, W. On the choice of weight functions for linear representations of persistence diagrams. Journal of Applied and Computational Topology, 3 0 (3): 0 249--283, 2019. ISSN 2367-1734. doi:10.1007/s41468-019-00032-z. URL https://doi.org/10.1007/s41468-019-00032-z

    2019 doi

  3. [11]

    and Harer, J

    Edelsbrunner, H. and Harer, J. L. Computational topology: an introduction. American Mathematical Society, 2022

    2022

  4. [12]

    R., Shintre, S., and Gardner, A

    Feinman, R., Curtin, R. R., Shintre, S., and Gardner, A. B. Detecting adversarial samples from artifacts. ArXiv, abs/1703.00410, 2017. URL https://api.semanticscholar.org/CorpusID:5157373

    2017 arXiv

  5. [13]

    Maximum mean discrepancy test is aware of adversarial attacks

    Gao, R., Liu, F., Zhang, J., Han, B., Liu, T., Niu, G., and Sugiyama, M. Maximum mean discrepancy test is aware of adversarial attacks. In Meila, M. and Zhang, T. (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine...

    2021

  6. [14]

    Elementary Applied Topology

    Ghrist, R. Elementary Applied Topology. CreateSpace Independent Publishing Platform, 2014. ISBN 9781502880857. URL https://books.google.com.vn/books?id=Z5ATogEACAAJ

    2014

  7. [15]

    Deep learning, volume 1

    Goodfellow, I., Bengio, Y., Courville, A., and Bengio, Y. Deep learning, volume 1. MIT Press, 2016

    2016

  8. [16]

    Goodfellow, I. J. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  9. [17]

    Gretton, A., Sejdinovic, D., Strathmann, H., Balakrishnan, S., Pontil, M., Fukumizu, K., and Sriperumbudur, B. K. Optimal kernel choice for large-scale two-sample tests. In Pereira, F., Burges, C., Bottou, L., and Weinberger, K. (eds.), Advances in Neural Information Processin...

    2012

  10. [18]

    On the (statistical) detection of adversarial examples

    Grosse, K., Manoharan, P., Papernot, N., Backes, M., and Mcdaniel, P. On the (statistical) detection of adversarial examples. ArXiv, abs/1702.06280, 2017. URL https://api.semanticscholar.org/CorpusID:16863734

    2017 arXiv

  11. [19]

    Safe lora: the silver lining of reducing safety risks when fine-tuning large language models, 2024

    Hsu, C.-Y., Tsai, Y.-L., Lin, C.-H., Chen, P.-Y., Yu, C.-M., and Huang, C.-Y. Safe lora: the silver lining of reducing safety risks when fine-tuning large language models, 2024. URL https://arxiv.org/abs/2405.16833

    2024 arXiv

  12. [20]

    J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W

    Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. Lo RA : Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=nZeVKeeFYf9

    2022

  13. [21]

    P., and Gretton, A

    Jitkrittum, W., Szab \'o , Z., Chwialkowski, K. P., and Gretton, A. Interpretable distribution features with maximum testing power. Advances in Neural Information Processing Systems, 29, 2016

    2016

  14. [22]

    Torchattacks: A pytorch repository for adversarial attacks

    Kim, H. Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950, 2020

    2010 arXiv

  15. [23]

    A., Robins, V., Turner, K., and Memoli, F

    Koyama, M. A., Robins, V., Turner, K., and Memoli, F. Reduced vietoris-rips complexes: New methods to compute vietoris-rips persistent homology. arXiv preprint arXiv:2307.16333, 2023

    2023 arXiv

  16. [24]

    Learning multiple layers of features from tiny images

    Krizhevsky, A. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. URL https://www.cs.toronto.edu/ kriz/learning-features-2009-TR.pdf

    2009

  17. [25]

    A simple unified framework for detecting out-of-distribution samples and adversarial attacks

    Lee, K., Lee, K., Lee, H., and Shin, J. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information processing systems, 31, 2018

    2018

  18. [26]

    Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation

    Li, J., Li, D., Xiong, C., and Hoi, S. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In ICML, 2022

    2022

  19. [27]

    and Li, F

    Li, X. and Li, F. Adversarial examples detection in deep networks with convolutional filter statistics. In Proceedings of the IEEE international conference on computer vision, pp.\ 5764--5772, 2017

    2017

  20. [28]

    Liu, F., Xu, W., Lu, J., Zhang, G., Gretton, A., and Sutherland, D. J. Learning deep kernels for non-parametric two-sample tests. In International conference on machine learning, pp.\ 6316--6326. PMLR, 2020

    2020

  21. [29]

    M., Wijewickrema, S

    Ma, X., Li, B., Wang, Y., Erfani, S. M., Wijewickrema, S. N. R., Houle, M. E., Schoenebeck, G. R., Song, D. X., and Bailey, J. Characterizing adversarial subspaces using local intrinsic dimensionality. ArXiv, abs/1801.02613, 2018. URL https://api.semanticscholar.org/CorpusID:1248661

    2018 arXiv

  22. [30]

    Learning to characterize adversarial subspaces

    Mao, X., Chen, Y., Li, Y., He, Y., and Xue, H. Learning to characterize adversarial subspaces. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp.\ 2438--2442. IEEE, 2020

    2020

  23. [31]

    H., Park, J., Chung, S., Kim, J., Oh, M

    Park, L. H., Park, J., Chung, S., Kim, J., Oh, M. G., and Kwon, T. Poster: Adversarial defense with deep learning coverage on magnet's purification. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS '22, pp.\ 3439–3441, New York, NY,...

    2022

  24. [32]

    W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al

    Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp.\ 8748--8763. PMLR, 2021

    2021

  25. [33]

    A stable multi-scale kernel for topological machine learning

    Reininghaus, J., Huber, S., Bauer, U., and Kwitt, R. A stable multi-scale kernel for topological machine learning. 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 4741--4748, 2014. URL https://api.semanticscholar.org/CorpusID:8712891

    2015

  26. [34]

    J., Tung, H.-Y., Strathmann, H., De, S., Ramdas, A., Smola, A., and Gretton, A

    Sutherland, D. J., Tung, H.-Y., Strathmann, H., De, S., Ramdas, A., Smola, A., and Gretton, A. Generative models and model criticism via optimized maximum mean discrepancy. In International Conference on Learning Representations, 2016

    2016

  27. [35]

    U ber den h \

    Vietoris, L. \"U ber den h \"o heren zusammenhang kompakter r \"a ume und eine klasse von zusammenhangstreuen abbildungen. Mathematische Annalen, 97: 0 454--472, 1927. URL https://api.semanticscholar.org/CorpusID:121172198

    1927

  28. [36]

    Inferaligner: Inference-time alignment for harmlessness through cross-model guidance, 2024 a

    Wang, P., Zhang, D., Li, L., Tan, C., Wang, X., Ren, K., Jiang, B., and Qiu, X. Inferaligner: Inference-time alignment for harmlessness through cross-model guidance, 2024 a . URL https://arxiv.org/abs/2401.11206

    2024 arXiv

  29. [37]

    Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting

    Wang, Y., Liu, X., Li, Y., Chen, M., and Xiao, C. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. arXiv preprint arXiv:2403.09513, 2024 b

    2024 arXiv

  30. [38]

    Towards adversarial attack on vision-language pre-training models

    Zhang, J., Yi, Q., and Sang, J. Towards adversarial attack on vision-language pre-training models. In Proceedings of the 30th ACM International Conference on Multimedia, pp.\ 5005--5013, 2022

    2022

  31. [39]

    Vision-language models for vision tasks: A survey, 2024 a

    Zhang, J., Huang, J., Jin, S., and Lu, S. Vision-language models for vision tasks: A survey, 2024 a . URL https://arxiv.org/abs/2304.00685

    2024 arXiv

  32. [40]

    Detecting adversarial data by probing multiple perturbations using expected perturbation score

    Zhang, S., Liu, F., Yang, J., Yang, Y., Li, C., Han, B., and Tan, M. Detecting adversarial data by probing multiple perturbations using expected perturbation score. In Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J. (eds.), Proceedings of the 4...

    2023

  33. [41]

    Jailguard: A universal detection framework for llm prompt-based attacks, 2024 b

    Zhang, X., Zhang, C., Li, T., Huang, Y., Jia, X., Hu, M., Zhang, J., Liu, Y., Ma, S., and Shen, C. Jailguard: A universal detection framework for llm prompt-based attacks, 2024 b . URL https://arxiv.org/abs/2312.10766

    2024 arXiv

  34. [42]

    The first to know: How token distributions reveal hidden knowledge in large vision-language models?, 2024

    Zhao, Q., Xu, M., Gupta, K., Asthana, A., Zheng, L., and Gould, S. The first to know: How token distributions reveal hidden knowledge in large vision-language models?, 2024. URL https://arxiv.org/abs/2403.09037

    2024 arXiv

  35. [43]

    Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning

    Zhou, Z., Hu, S., Li, M., Zhang, H., Zhang, Y., and Jin, H. Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. In Proceedings of the 31st ACM International Conference on Multimedia, pp.\ 6311--6320, 2023

    2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.