Pith. sign in

REVIEW 4 major objections 5 minor 47 references

Improving Adversarial Robustness via Phase and Amplitude-aware Prompting

T0 review · 4 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper shows that adding per-class Fourier phase and amplitude prompts to images before classification stabilizes model predictions and improves adversarial robustness by large margins over existing prompt-based defenses, without…

desk verdict Strong empirical prompt-based defense whose adaptive-attack evaluation does not match the deployed prompt-selection procedure; deserves review with a request for a fully adaptive attack and code release. read the letter →

arxiv 2502.03758 v2 pith:T7R6BCI2 submitted 2025-02-06 cs.CV

Yibo Xu , Dawei Zhou , Decheng Liu , Nannan Wang This is my paper · ORCID
classification cs.CV
keywords adversarialrobustnessprompt-baseddefensephasespectrumamplitudeFouriertransformvisualpromptingtest-timetransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that adversarial robustness can be improved by prompting images with semantic-specific Fourier patterns rather than mixed pixel or frequency patterns. It claims that learning one phase-level and one amplitude-level prompt per class, and weighting the amplitude prompt by the ratio of robust accuracies each prompt type achieves during training, lets a fixed model resist AutoAttack, C&W, and DDN attacks substantially better than the C-AVP and Freq prompting baselines. If true, this offers a cheap complement to adversarial training: the target network's weights stay frozen and no purification module is needed. On CIFAR-10 with a naturally trained ResNet18, AutoAttack accuracy rises from 0.61% with C-AVP to 37.34% with PAP, and the prompts transfer to other architectures. The paper acknowledges that this gain costs some natural accuracy on naturally pre-trained models, and it reports no ImageNet evaluation.

What carries the argument

The machinery is the phase/amplitude Fourier prompting scheme together with the robustness-based weighting rule. For each class $y$, a phase prompt $p_{\phi, y}$ and an amplitude prompt $p_{\xi, y}$ are initialized from the spectra of a random natural example, and a prompted image is formed by $x^p = \mathcal{F}^{-1}(\phi_x + p_{\phi, y_{pred}}, \xi_x + w^* p_{\xi, y_{pred}})$. The amplitude weight is updated every few epochs as $w_t = w_{t-1} \times A_{\xi}/A_{\phi}$, where $A_{\xi}$ and $A_{\phi}$ are the robust accuracies on adversarial training examples obtained with amplitude-only and phase-only prompting. This ratio is the load-bearing mechanism: it converts the relative usefulness of the two spectral prompt types into a scalar that controls how strongly amplitude information is added. A data-prompt mismatching loss ensures that even when the predicted label is wrong, the selected prompt does not cause a confident misclassification.

What would settle it

Run an adaptive attack that at each optimization step uses the model's actual predicted label to choose the phase and amplitude prompts (Equation 9 instead of Equation 10) and check whether the reported AutoAttack accuracy on CIFAR-10 NAT+PAP stays above 30%; if it collapses to the C-AVP level, the predicted-label selection is the weak link.

Watch

Extended reading notes

Core claim

The central claim is that disentangling prompts into the phase and amplitude spectra of the Fourier transform is the key to prompt-based defenses. Phase spectra carry structure and amplitude spectra carry texture, and the paper argues that previous prompting on mixed pixel or frequency patterns fails to focus on these semantics. PAP learns per-class prompts $p_{\phi}$ and $p_{\xi}$, forms the prompted image $x^p = \mathcal{F}^{-1}(\phi_{\tilde{x}} + p_{\phi, y_{pred}}, \xi_{\tilde{x}} + w^* p_{\xi, y_{pred}})$, and during training adjusts the amplitude weight $w_t$ by the ratio of robust accuracies obtained when only the amplitude prompt or only the phase prompt is applied. At test time the prompt is selected by the model's own predicted label, and a data-prompt mismatching loss is trained so that prompts from wrong classes do not wreck predictions. The discovery is that this scheme yields large robustness gains on both naturally and adversarially pre-trained models, with the learned weight automatically diminishing amplitude prompting when it is not helpful.

Load-bearing premise

The method assumes a wrong predicted label at test time will still select a helpful prompt rather than a harmful one, because the data-prompt mismatching loss only trains against randomly sampled wrong labels.

Editorial extensions

If this is right

  • Because the target model's weights stay frozen, PAP can be layered on both naturally and adversarially pre-trained models, improving AutoAttack robustness over the base model in every reported setting.
  • Prompts trained on ResNet18 transfer to VGG19, WRN28-10, and Swin Transformer, so the defense can be trained once and applied across architectures.
  • The predicted-label selection rule needs only one prompt pair per test image instead of traversing all classes, making the method practical on datasets with many classes such as Tiny-ImageNet.
  • The learned amplitude weight drops to zero on naturally pre-trained CIFAR-10 models, showing the defense can automatically discover that phase-only prompting is the useful component in that regime.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A finer-grained weighting, per class or per image instead of one global scalar updated every five epochs, could recover some of the natural accuracy that the paper reports losing on naturally pre-trained models; the paper does not test this.
  • The adaptive attack in Section 4.4 optimizes against prompts taken from the ground-truth label, whereas test-time prompts are chosen from the predicted label; an adaptive adversary that targets the actual selection rule would be a sharper test that the paper does not report.
  • Because phase spectra carry structure, the same prompting-plus-weighting design could be plugged into other structure-preserving decompositions such as wavelets, which the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a prompt-based adversarial defense called Phase and Amplitude-aware Prompting (PAP). For each class, the method learns a phase-level prompt and an amplitude-level prompt in the Fourier domain; at test time, prompts are selected by the model's predicted label and added to the input's phase and amplitude spectra before reclassification. The amplitude-prompt weight is updated during training according to the ratio of robust accuracies obtained under amplitude-only and phase-only prompting. A data-prompt mismatching loss is introduced to tolerate the mismatch between a test image and the prompt selected by its predicted label. Experiments on CIFAR-10 and Tiny-ImageNet with NAT, AT, TRADES, and MART pre-trained models report large gains over C-AVP and Freq baseline defenses under AutoAttack, C&W, and DDN, plus transferability results and an adaptive-attack evaluation.

Significance. If the results hold, the paper offers a novel and efficient prompt-based defense direction by explicitly separating phase and amplitude semantic patterns, and it provides unusually large robustness improvements (e.g., 37.34% vs 0.61% AutoAttack accuracy on naturally pre-trained ResNet18 CIFAR-10). The experimental scope is broad: three attack types, two datasets, four training regimes, and cross-model transfer including a vision transformer. The paper is also honest about limitations such as natural-accuracy loss and lack of ImageNet-scale evaluation. However, the central robustness claim rests on an adaptive-attack evaluation that does not target the actual deployed classifier, and for naturally pre-trained models the learned amplitude weight collapses to zero, so the 'amplitude-aware' component is not operational in a major portion of the experiments. The contribution is therefore promising but needs essential revisions.

major comments (4)
  1. [§4.4, Eq. (10)] The adaptive attack maximizes the cross-entropy loss against a prompted image formed with the ground-truth class prompts p_phi^y and p_xi^y. This does not match the deployed test-time procedure in Eq. (9), which selects prompts according to the model's predicted label y_pred. A fully informed adversary can instead attempt to drive y_pred to a class whose prompts are harmful, or differentiate through a soft relaxation of the argmax selection. As written, Eq. (10) evaluates a fixed-prompt classifier, not the proposed two-stage defense, so Table 7 does not establish robustness under a fully adaptive attacker. The claimed margins in Tables 3 and 7 may be substantially overstated.
  2. [§3.3.4 and Eq. (5)] The data-prompt mismatching loss trains on randomly sampled wrong-class prompts, but at test time the selected prompt class is the model's predicted label, which an adversary can manipulate. Random negative classes provide no worst-case guarantee against an attacker who explicitly forces y_pred to a class with a harmful prompt. The paper should either train mismatching loss on adversarial predicted-label mismatches or provide a rigorous argument that random mismatches cover the adversarial case. This gap is load-bearing because the practical robustness of the defense depends on the assumption that mismatching is benign.
  3. [§4.2 and Table 3] The 'white-box' results in Table 3 are apparently obtained by crafting adversarial perturbations on the original, unprompted model and then applying the prompt afterward. This is a non-adaptive attack setup: the attacker does not have access to the prompting module or the learned prompts. The paper should state this explicitly and clearly differentiate these numbers from the adaptive-attack results in Table 7. The very large margins over baselines (e.g., 80.27% vs 1.93% on C&W for NAT ResNet18) are expected under non-adaptive attacks and do not by themselves support white-box robustness in the standard sense.
  4. [Table 5 and §3.3.2] Table 5 reports w* = 0 for all naturally pre-trained models on both datasets. With w=0, Eq. (7) reduces to phase-only prompting, so the amplitude-level prompts are completely suppressed for NAT models. This contradicts the paper's title and the motivation that amplitude-aware prompting is beneficial. The paper needs to discuss this behavior explicitly, provide a phase-only baseline in the ablations, and either justify the collapse to zero or impose a floor on w. Without this, the claim that both phase and amplitude components contribute is unsupported for a large part of the evaluation.
minor comments (5)
  1. [§3.3.4] The symbol y_pred is used in Eq. (9) but never formally defined; please state that it is the output of the target model h_theta on the clean test image (or on the original input before prompting).
  2. [Eq. (5)] The notation h^{y'_i}_theta and h^{y_i}_theta is used without defining that these denote the output logits for the corresponding classes; please clarify in the text.
  3. [§3.3.2] The text says 'The weight strategy is specified as' but should read 'The weighting strategy'; also, the update in Eq. (6) depends on the initial weight w_0, which is not specified in the experimental settings. Please report the initialization and its sensitivity.
  4. [§4.4] The phrase 'we retrain our PAP on this attack' is ambiguous: it should clarify whether the prompts, the weight w*, or both are retrained under the adaptive objective, and whether baselines are retrained with the same number of iterations.
  5. [Appendix D, Table 12] The black-box results use transfer-based attacks from a VGG19 surrogate; the paper should state whether the surrogate was trained independently on the same dataset and whether the prompting defense is included in the surrogate's gradient computation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defense's robustness numbers come from held-out evaluation of a trained prompting scheme; the metric-based weight update is standard hyperparameter tuning, not a constructed equivalence.

full rationale

The paper is an empirical defense and does not contain a derivation chain in which a predicted quantity reduces to its own input by construction. The phase-level and amplitude-level prompts are trained on CIFAR-10 and Tiny-ImageNet training data and evaluated on held-out test images under AutoAttack, C&W, and DDN, so the reported robust accuracies are genuine generalization measurements rather than restatements of the training objective. The adaptive weight in Eq. 6 is updated using the ratio of robust accuracies of amplitude-prompted and phase-prompted adversarial training examples, and Eq. 9 later uses the final learned weight at test time; no equation forces the held-out robust accuracy to equal that training-time ratio, and the test set used for the headline numbers is disjoint from the data used for the update. This is ordinary metric-based hyperparameter adaptation, not a fitted input renamed as a prediction. The adaptive attack in Eq. 10 optimizes against the ground-truth-label prompted classifier rather than the predicted-label prompt selection of Eq. 9, so the deployed two-stage procedure may not be fully attacked; this is a threat-model or evaluation-gap concern, not a circularity. The few self-citations in the paper, e.g., references [10] and [17], appear as background motivation and are not load-bearing for the claimed robustness improvements; no uniqueness theorem or ansatz is imported from the authors' own prior work. Consequently, no circular step can be exhibited with the required specificity, and the correct finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The defense rests on several fitted components: per-class phase and amplitude prompts, a scalar amplitude weight, and four hyperparameters. The motivating claims about phase and amplitude semantics are inherited from prior work, and the weight-update rule is an ad hoc ratio of training-set accuracies. No new entities are introduced.

free parameters (5)
  • phase-level prompts {p_phi_i} = learned per-class, not listed numerically
    Equation 1, initialized from a natural example's phase and optimized via Eq. 8; central to the defense.
  • amplitude-level prompts {p_xi_i} = learned per-class, not listed numerically
    Equation 1, initialized from a natural example's amplitude and optimized via Eq. 8.
  • amplitude weight w_t = NAT CIFAR-10: 0; AT: 0.3054; TRADES: 0.2572; MART: 0.3258 (ResNet18); Tiny-ImageNet WRN: 0, 0.2702, 0.3022, 0.2848
    Equation 6, updated every 5 epochs by ratio of robust accuracies; a free scalar tuned to the training robust accuracy.
  • loss weights lambda1, lambda2, lambda3 = NAT: 3, 400, 4; AT: 1, 5000, 4
    Section 4.1 and Eq. 8; chosen per model type.
  • margin tau = 0.1
    Section 4.1 and Eq. 5; hand-set.
assumptions (4)
  • domain assumption The phase spectrum reflects object structure and the amplitude spectrum reflects texture, so prompting them can improve robustness.
    Sections 1 and 3.2; taken from prior work [18-24], not verified here.
  • ad hoc to paper Robust accuracy under separate amplitude-only and phase-only prompts on the training set is a reliable signal for the scalar prompting weight.
    Equation 6; no theoretical or empirical justification beyond Tables 1-2.
  • ad hoc to paper A mismatching loss on randomly paired wrong-class prompts generalizes to the actual predicted-label mismatches at test time.
    Equation 5 and Section 3.3.4; test-time mismatches are systematic (adversarially chosen), not random as in training.
  • domain assumption Adversarial examples generated against the frozen model are representative for training prompts.
    Algorithm 1, line 5; the attack is PGD on the clean model, not adaptive to the defense during training.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving Adversarial Robustness via Phase and Amplitude-aware Prompting." pith.science (2026). https://pith.science/paper/T7R6BCI2

@misc{pith2026250203758,
  author       = {Pith},
  title        = {Pith review of: Improving Adversarial Robustness via Phase and Amplitude-aware Prompting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T7R6BCI2}},
  note         = {Machine review of arXiv:2502.03758}
}
read the original abstract

Deep neural networks are found to be vulnerable to adversarial perturbations. The prompt-based defense has been increasingly studied due to its high efficiency. However, existing prompt-based defenses mainly exploited mixed prompt patterns, where critical patterns closely related to object semantics lack sufficient focus. The phase and amplitude spectra have been proven to be highly related to specific semantic patterns and crucial for robustness. To this end, in this paper, we propose a Phase and Amplitude-aware Prompting (PAP) defense. Specifically, we construct phase-level and amplitude-level prompts for each class, and adjust weights for prompting according to the model's robust performance under these prompts during training. During testing, we select prompts for each image using its predicted label to obtain the prompted image, which is inputted to the model to get the final prediction. Experimental results demonstrate the effectiveness of our method.

Figures

Figures reproduced from arXiv: 2502.03758 by the authors.

Figure 1
Figure 1. Differences between previous defenses and our defense. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. The weighting method for amplitude-level prompts. We use amplitude-level and phase-level prompts [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Visualizations of prompted images for input examples. For each pair of images, the left part denotes the [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: The impact of losses with different hyper-parameters on naturally pre-trained ResNet18 in CIFAR-10. For [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]
Figure 6
Figure 6. Figure 6: The impact of losses with different hyper-parameters on adversarially pre-trained ResNet18 in CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Visualizations of prompted images for input examples on CIFAR-10. The target model is naturally pre-trained [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Visualizations of prompted images for input examples on Tiny-ImageNet. The target model is naturally [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 30 canonical work pages

  1. [24]

    Amplitude-phase recombination: Rethinking robustness of convolutional neural networks in frequency domain

    Guangyao Chen, Peixi Peng, Li Ma, Jia Li, Lin Du, and Yonghong Tian. Amplitude-phase recombination: Rethinking robustness of convolutional neural networks in frequency domain. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 458–467, 2021

    work page 2021

  2. [1]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014

    2014

  3. [2]

    Spatially transformed adversarial examples

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In 6th International Conference on Learning Representations, 2018

    work page 2018

  4. [3]

    Semantic-preserving adversarial text attacks

    Xinghao Yang, Yongshun Gong, Weifeng Liu, James Bailey, Dacheng Tao, and Wei Liu. Semantic-preserving adversarial text attacks. IEEE Transactions on Sustainable Computing, 8(4):583–595, 2023

    work page 2023

  5. [4]

    Two-face: Adversarial audit of commercial face recognition systems

    Siddharth Jaiswal, Karthikeya Duggirala, Abhisek Dash, and Animesh Mukherjee. Two-face: Adversarial audit of commercial face recognition systems. In Proceedings of the International AAAI Conference on Web and Social Media, volume 16, pages 381–392, 2022

    work page 2022

  6. [5]

    Adversarial examples based on object detection tasks: A survey

    Jian-Xun Mi, Xu-Dong Wang, Li-Fang Zhou, and Kun Cheng. Adversarial examples based on object detection tasks: A survey. Neurocomputing, 519:114–126, 2023

    work page 2023

  7. [6]

    Exploring the feasibility of adversarial attacks on medical image segmentation

    Sneha Shukla, Anup Kumar Gupta, and Puneet Gupta. Exploring the feasibility of adversarial attacks on medical image segmentation. Multimedia Tools and Applications, 83(4):11745–11768, 2024

    work page 2024

  8. [7]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, 2018

    work page 2018

Show all 47 references
  1. [8]

    Adversarial training with complementary labels: on the benefit of gradually informative attacks

    Jianan Zhou, Jianing Zhu, Jingfeng Zhang, Tongliang Liu, Gang Niu, Bo Han, and Masashi Sugiyama. Adversarial training with complementary labels: on the benefit of gradually informative attacks. Advances in Neural Information Processing Systems, 35:23621–23633, 2022

    2022

  2. [9]

    Adversarial robustness in graph neural networks: A hamiltonian approach

    Kai Zhao, Qiyu Kang, Yang Song, Rui She, Sijie Wang, and Wee Peng Tay. Adversarial robustness in graph neural networks: A hamiltonian approach. Advances in Neural Information Processing Systems, 36, 2024

    2024

  3. [10]

    Inspector for face forgery detection: Defending against adversarial attacks from coarse to fine

    Ruiyang Xia, Dawei Zhou, Decheng Liu, Jie Li, Lin Yuan, Nannan Wang, and Xinbo Gao. Inspector for face forgery detection: Defending against adversarial attacks from coarse to fine. IEEE Transactions on Image Processing, 2024

    2024

  4. [11]

    Improving adversarial robustness of masked autoencoders via test-time frequency-domain prompting

    Qidong Huang, Xiaoyi Dong, Dongdong Chen, Yinpeng Chen, Lu Yuan, Gang Hua, Weiming Zhang, and Nenghai Yu. Improving adversarial robustness of masked autoencoders via test-time frequency-domain prompting. In Proceedings of the IEEE/CVF International Conference on Computer Visio...

    2023

  5. [12]

    Visual prompting for adversarial robustness

    Aochuan Chen, Peter Lorenz, Yuguang Yao, Pin-Yu Chen, and Sijia Liu. Visual prompting for adversarial robustness. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE, 2023

    2023

  6. [13]

    Adversarial weight perturbation helps robust generalization

    Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in neural information processing systems, 33:2958–2969, 2020

    2020

  7. [14]

    Cfa: Class-wise calibrated fair adversarial training

    Zeming Wei, Yifei Wang, Yiwen Guo, and Yisen Wang. Cfa: Class-wise calibrated fair adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8193–8201, 2023

    2023

  8. [15]

    Revisiting adversarial training for imagenet: Architec- tures, training and generalization across threat models

    Naman Deep Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architec- tures, training and generalization across threat models. Advances in Neural Information Processing Systems, 36, 2024

    2024

  9. [16]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460, 2022

    2022 arXiv

  10. [17]

    Eliminating adversarial noise via information discard and robust representation restoration

    Dawei Zhou, Yukun Chen, Nannan Wang, Decheng Liu, Xinbo Gao, and Tongliang Liu. Eliminating adversarial noise via information discard and robust representation restoration. In International Conference on Machine Learning, pages 42517–42530. PMLR, 2023. 11 Preprint

    2023

  11. [18]

    Filtering for texture classification: A comparative study

    Trygve Randen and John Hakon Husoy. Filtering for texture classification: A comparative study. IEEE Transac- tions on pattern analysis and machine intelligence, 21(4):291–310, 1999

    1999

  12. [19]

    Texture classification using wavelet transform and support vector machines

    Samsher Sidhu and Kaamran Raahemifar. Texture classification using wavelet transform and support vector machines. In Canadian Conference on Electrical and Computer Engineering, 2005., pages 941–944. IEEE, 2005

    2005

  13. [20]

    Phase congruency: A low-level image invariant

    Peter Kovesi. Phase congruency: A low-level image invariant. Psychological research, 64(2):136–148, 2000

    2000

  14. [21]

    Fsim: A feature similarity index for image quality assessment

    Lin Zhang, Lei Zhang, Xuanqin Mou, and David Zhang. Fsim: A feature similarity index for image quality assessment. IEEE transactions on Image Processing, 20(8):2378–2386, 2011

    2011

  15. [22]

    Metamers of the ventral stream

    Jeremy Freeman and Eero P Simoncelli. Metamers of the ventral stream. Nature neuroscience, 14(9):1195–1201, 2011

    2011

  16. [23]

    On the role of spatial phase and phase correlation in vision, illusion, and cognition

    Evgeny Gladilin and Roland Eils. On the role of spatial phase and phase correlation in vision, illusion, and cognition. Frontiers in Computational Neuroscience, 9:45, 2015

    2015

  17. [25]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pages 2206–2216. PMLR, 2020

    2020

  18. [26]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017

    2017

  19. [27]

    Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses

    Jérôme Rony, Luiz G Hafemann, Luiz S Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger. Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses. InProceedings of the IEEE/CVF conference on computer vision and pattern recognitio...

    2019

  20. [28]

    Square attack: a query- efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query- efficient black-box adversarial attack via random search. In European conference on computer vision, pages 484–501. Springer, 2020

    2020

  21. [29]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR, 2019

    2019

  22. [30]

    Improving adversarial robustness requires revisiting misclassified examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International conference on learning representations, 2019

    2019

  23. [31]

    Ape-gan: Adversarial perturbation elimination with gan

    Guoqing Jin, Shiwei Shen, Dongming Zhang, Feng Dai, and Yongdong Zhang. Ape-gan: Adversarial perturbation elimination with gan. In ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3842–3846. IEEE, 2019

    2019

  24. [32]

    Texture and shape synthesis on surfaces

    Lexing Ying, Aaron Hertzmann, Henning Biermann, and Denis Zorin. Texture and shape synthesis on surfaces. In Rendering Techniques 2001: Proceedings of the Eurographics Workshop in London, United Kingdom, June 25–27, 2001 12, pages 301–312. Springer, 2001

    2001

  25. [33]

    Learning lbp structure by maximizing the conditional mutual information

    Jianfeng Ren, Xudong Jiang, and Junsong Yuan. Learning lbp structure by maximizing the conditional mutual information. Pattern Recognition, 48(10):3180–3190, 2015

    2015

  26. [34]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  27. [35]

    Tiny imagenet visual recognition challenge

    Yann Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015

    2015

  28. [36]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  29. [37]

    Wide residual networks

    Sergey Zagoruyko. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016

    2016 arXiv

  30. [38]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  31. [39]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. InProceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021

    2021

  32. [40]

    Scalable training of l 1-regularized log-linear models

    Galen Andrew and Jianfeng Gao. Scalable training of l 1-regularized log-linear models. In Proceedings of the 24th international conference on Machine learning, pages 33–40, 2007. 12 Preprint

    2007

  33. [41]

    Adversarial self-supervised contrastive learning

    Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in neural information processing systems, 33:2983–2994, 2020

    2020

  34. [42]

    Robust pre-training by adversarial contrastive learning

    Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. Advances in neural information processing systems, 33:16199–16210, 2020

    2020

  35. [43]

    Enhancing adversarial contrastive learning via adversarial invariant regularization

    Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan S Kankanhalli. Enhancing adversarial contrastive learning via adversarial invariant regularization. Advances in Neural Information Processing Systems, 36, 2024

    2024

  36. [44]

    Exploring the relationship between architectural design and adversarially robust generalization

    Aishan Liu, Shiyu Tang, Siyuan Liang, Ruihao Gong, Boxi Wu, Xianglong Liu, and Dacheng Tao. Exploring the relationship between architectural design and adversarially robust generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pa...

    2023

  37. [45]

    Adversarial reprogramming of neural networks

    Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial reprogramming of neural networks. arXiv preprint arXiv:1806.11146, 2018

    2018 arXiv

  38. [46]

    Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources

    Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho. Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources. In International Conference on Machine Learning, pages 9614–9624. PMLR, 2020

    2020

  39. [47]

    Fairness repro- gramming

    Guanhua Zhang, Yihua Zhang, Yang Zhang, Wenqi Fan, Qing Li, Sijia Liu, and Shiyu Chang. Fairness repro- gramming. Advances in neural information processing systems, 35:34347–34362, 2022. 13 Preprint. A Preliminary Notation. We use capital letters likeX and Y to represent rando...

    2022

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.