Pith. sign in

REVIEW 4 major objections 4 minor 50 references

Exploring Visual Prompting: Robustness Inheritance and Beyond

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Visual prompts trained on adversarially robust source models inherit adversarial robustness, and a simple output-partitioning trick (PBL) recovers much of the lost clean accuracy.

desk verdict A novel empirical study of visual prompting from robust source models with an honest but flawed evaluation; the PBL trick is plausible, but the robustness claims are not yet supported. read the letter →

arxiv 2506.06823 v1 pith:XGHX3KYK submitted 2025-06-07 cs.CV cs.AI

Qi Li , Liangzhi Li , Zhouqiang Jiang , Bowen Wang , Keke Tang This is my paper
classification cs.CVcs.AI
keywords visualpromptingadversarialrobustnessinheritancepromptboundarylooseningtransferlearninglabelmappingtraininggeneralization-robustnesstrade-off
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is about whether visual prompting — adding a small learnable patch to input images while keeping the source model frozen — can transfer adversarial robustness from an adversarially trained source model to downstream tasks. It answers that it can: prompts learned on robust models inherit a large share of the source model's robustness, but they also inherit its generalization weakness, reproducing the familiar robustness-accuracy trade-off. To fix that, the paper introduces Prompt Boundary Loosening (PBL), which partitions the source model's output into blocks, takes the maximum score within each block, and then applies the downstream label mapping, loosening the decision boundary the prompt must learn against. Across eight datasets, four robust source architectures, and two label-mapping strategies, PBL raises standard accuracy while keeping or improving adversarial accuracy, with no extra training cost. A reader should care because it turns robust transfer into a nearly free operation: no adversarial training of the prompt is needed.

What carries the argument

Prompt Boundary Loosening (PBL) — the operation $Q(\cdot)$ that partitions the source model's output logits $V=(v_1,\dots,v_n)$ into $T$ equal blocks $V_i$ and forms the intermediate vector $I=(\max(V_1),\dots,\max(V_T))$, on which the downstream label mapping $M(\cdot)$ is applied. It loosens the frozen source model's decision boundary during visual-prompt training without touching the model, which is what allows the prompt to learn faster and generalize better while the inherited robustness is retained; the loosening factor $T$ is the only new hyper-parameter and the operation is compatible with any label mapping.

What would settle it

Re-run the RSVP experiments with PGD or AutoAttack instead of FGSM, and compute adversarial accuracy also on the samples that are initially misclassified; if the robust-source prompts lose their adversarial-accuracy advantage over standard-source prompts, the paper's robustness-inheritance claim is an artifact of the weak attack and conditional metric.

Watch

Extended reading notes

Core claim

Visual prompts trained on adversarially robust ImageNet models (RSVP) inherit the source model's robustness against FGSM (Fast Gradient Sign Method) perturbations on downstream datasets while also inheriting its reduced standard accuracy; the learned prompt images are visually human-aligned and contain texture and object patterns, unlike the noise-like prompts from standard models, which the paper ties to prior findings that robust models rely on more human-perceptible features. Because the frozen source model's decision boundary is complex, RSVP learns more slowly and less accurately, so the paper proposes Prompt Boundary Loosening (PBL): split the $n$-dimensional output logits into $T$ contiguous blocks and replace each block by its maximum to produce a $T$-dimensional intermediate vector, then apply the downstream label mapping. PBL relaxes the effective decision boundary, lowers the initial training loss, and consistently improves standard accuracy across all eight datasets and both label-mapping strategies while preserving or increasing adversarial accuracy.

Load-bearing premise

The robustness-inheritance conclusion rests entirely on FGSM adversarial accuracy measured only on samples the model already classifies correctly; if stronger attacks or unconditional accuracy show no robust-source advantage, the central claim fails.

Editorial extensions

If this is right

  • Visual prompting from a robust source model can serve as a lightweight robustness-transfer method: downstream tasks get adversarial robustness without adversarial training.
  • PBL improves RSVP standard accuracy on all eight tested datasets under both Random and Iterative label mapping, with adversarial accuracy preserved or improved in most cases.
  • PBL also slightly improves standard accuracy for standard-source VP, so it is a safe plug-in beyond its intended robust-source setting.
  • Adversarial training of the prompt is not a good alternative: it costs roughly 6x time and 1.5x memory and often lowers standard accuracy, whereas PBL adds no overhead.
  • The human-aligned prompt visualizations suggest that robust models encode features closer to human perception, giving a new way to inspect what adversarial training learns.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because PBL acts only on the output logits of a frozen model, it should apply to any frozen classifier, not only adversarially trained ImageNet models; testing it on self-supervised or CLIP-like backbones would show whether the loosening effect is specific to robust models or general.
  • The same partition-max operation could be viewed as a form of logit pooling; it may interact with temperature scaling or calibrated confidence, which the paper does not explore.
  • If robustness inheritance holds under stronger attacks, robust-source VP could become a cheap baseline for robust transfer, potentially competing with expensive robust fine-tuning on small downstream datasets.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This paper studies visual prompting (VP) when the source model is adversarially robust, a setting the authors call RSVP. The authors report that RSVP inherits the robustness of the source model but also inherits degraded standard accuracy, that the learned prompts become visually more structured and human-aligned, and they propose Prompt Boundary Loosening (PBL), a method that max-pools blocks of source logits before label mapping to improve standard accuracy while retaining robustness. Experiments across eight downstream datasets, four source models, and two label-mapping strategies are reported for standard accuracy and FGSM-based adversarial accuracy, with and without PBL.

Significance. If the findings hold, the paper would provide the first systematic study of robustness transfer through visual prompting and a cheap, model-agnostic way to mitigate the accuracy-robustness trade-off in this setting. The paper's strengths include the breadth of the experiment matrix (4 models × 8 datasets × 2 mappings), the plug-and-play nature of PBL, and the qualitative observation that RSVP prompts exhibit human-aligned structure. However, the central 'robustness inheritance' claim rests on FGSM-only attacks and a conditional accuracy metric, and several Table 1 entries contradict the claim that PBL always maintains robustness, so the current evidence does not fully support the conclusions as stated.

major comments (4)
  1. [§6.1, Table 1] The robustness evaluation uses only FGSM attacks. FGSM is a single-step attack and is known to overestimate the robustness of adversarially trained models; the robustness-inheritance claim in the abstract and Section 4 should be verified with iterative attacks such as PGD or AutoAttack. As reported, the evidence does not establish that RSVP inherits robustness under stronger attacks.
  2. [§6.1, Table 1] Adversarial accuracy is computed only on samples that the prompted model classifies correctly before the attack (Adv. Acc = #Adv. Correct / #Ori. Correct). Because standard accuracy is very low for several settings (e.g., StanfordCars with ResNet18 under RLM: Std. Acc = 0.57%, Adv. Acc = 13.04% without PBL), the unconditional robust accuracy is only about 0.07%, and with PBL it is 0.76% × 13.11% ≈ 0.10%. The claim that the source model's robustness is successfully inherited is therefore not supported for such settings; the paper should report unconditional robust accuracy or explicitly discuss the conditioning.
  3. [Table 1] Several entries contradict the claim that PBL 'maintains or even enhances' robustness. For example, ViT-S on Flowers102 under RLM shows Adv. Acc dropping from 39.17% to 31.55%, ResNet50 on SVHN under RLM from 67.50% to 59.08%, and ResNet18 on GTSRB under ILM from 68.96% to 67.92%. Since no error bars or multiple seeds are provided, it is also unclear which differences are significant. The paper should report variance and soften the universal-improvement claim.
  4. [§5 and Table 1] The paper does not state the values of the loosening factor T used to produce the main results in Table 1. Figure 4 shows sensitivity to T for three datasets, but without the actual T choices (and the selection criterion, e.g., validation-based tuning) the reported numbers are not reproducible. Please specify T per dataset and label mapping method, or describe the hyperparameter selection protocol.
minor comments (4)
  1. [Throughout] There are several typos: 'Boundry' in Figure 1, 'Without lose of generality' in §6.1, and 'temporeture' in the Figure 9 caption.
  2. [§6.2] The sentence 'Moreover, our findings indicate thatsuperior label mapping methods...' is missing a space after 'that'.
  3. [§4 and Appendix B] The visual-representation analysis is qualitative; providing a quantitative measure (e.g., alignment with saliency maps or segmentation) would strengthen the claim that RSVP prompts are more human-aligned.
  4. [§6.1] The paper does not provide training hyperparameters (prompt size, learning rate, epochs, batch size) in the main text or appendix; please include them for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's robustness-inheritance and PBL claims are empirical comparisons on external benchmarks, with no load-bearing step that reduces to its own inputs.

full rationale

The paper's central claims are that RSVP inherits robustness from robust source models, that RSVP suffers a generalization trade-off, and that PBL improves standard accuracy while maintaining robustness. These claims are established by experiments on external RobustBench models (S20, E19, W20) and eight downstream datasets, not by definitional construction. Equations (3) through (6) define the VP objective and the PBL transform, but the reported inheritance and trade-off results are measured outcomes rather than analytic consequences of those definitions. PBL itself is a heuristic max-over-partition operation on source logits, and its benefits are evaluated empirically; no fitted parameter is renamed as a prediction. The loosening factor T is swept as a hyperparameter in Figure 4 and Table 1 reports the resulting comparisons, which is a standard tuning procedure rather than a circular prediction. The paper contains no load-bearing self-citation and invokes no uniqueness theorem from the authors' own prior work; all references are to independent prior literature. The conditional definition of Adv. Acc in Section 6.1, where attacks are only applied to initially correctly classified samples, and the FGSM-only attack choice are legitimate validity concerns, but they are not circularity: the metric is explicitly defined, the paper even acknowledges in Section 6.2 that PBL changes the set of attacked samples, and the robustness-inheritance conclusion is not true by construction under that metric. Those concerns belong on a correctness or evaluation axis, not on the circularity axis. Therefore the derivation chain is self-contained with respect to circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper adds no new conceptual entities. Its claims rest on standard VP assumptions, the prior result that robust models have complex boundaries, and the unproven design assumption that max-pooling over logit blocks preserves robustness. The main user-supplied numbers are the loosening factor T (per dataset) and the unreported FGSM budget.

free parameters (2)
  • Loosening factor T = Not reported for Table 1; Figure 4 sweeps T in {1,5,10,15,20}, appendix uses values up to 40
    PBL's partition count T controls the core mechanism and appears to be chosen per dataset; without a fixed rule or held-out selection, improvements may reflect tuning.
  • FGSM perturbation budget epsilon = Not stated
    Adversarial accuracy numbers depend on an unreported attack radius; different epsilons could change the robustness-inheritance conclusion.
assumptions (4)
  • domain assumption Adversarially trained models have more complex decision boundaries than standard models.
    Used to motivate PBL in Section 5; taken from prior work (Madry et al., Croce and Hein), cited in Section 2.
  • domain assumption Robust models' human-aligned feature representations explain the visual appearance and behavior of RSVP.
    Section 4 invokes feature purification (Allen-Zhu and Li) to interpret the qualitative visualization; no independent measurement is provided.
  • domain assumption A one-to-one mapping between a subset of source classes and downstream classes is a valid way to transfer the frozen model to the downstream task.
    This is the standard VP assumption, formalized in Eq. 3 with M(·), and inherited from Bahng et al. and Chen et al.
  • ad hoc to paper Max-pooling over source logit blocks preserves adversarial robustness while loosening the decision boundary.
    This is the load-bearing design assumption of PBL (Eq. 6-8); it is supported only by the experiments in Section 6.2, not by a derivation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Exploring Visual Prompting: Robustness Inheritance and Beyond." pith.science (2026). https://pith.science/paper/XGHX3KYK

@misc{pith2026250606823,
  author       = {Pith},
  title        = {Pith review of: Exploring Visual Prompting: Robustness Inheritance and Beyond},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XGHX3KYK}},
  note         = {Machine review of arXiv:2506.06823}
}
read the original abstract

Visual Prompting (VP), an efficient method for transfer learning, has shown its potential in vision tasks. However, previous works focus exclusively on VP from standard source models, it is still unknown how it performs under the scenario of a robust source model: Can the robustness of the source model be successfully inherited? Does VP also encounter the same trade-off between robustness and generalization ability as the source model during this process? If such a trade-off exists, is there a strategy specifically tailored to VP to mitigate this limitation? In this paper, we thoroughly explore these three questions for the first time and provide affirmative answers to them. To mitigate the trade-off faced by VP, we propose a strategy called Prompt Boundary Loosening (PBL). As a lightweight, plug-and-play strategy naturally compatible with VP, PBL effectively ensures the successful inheritance of robustness when the source model is a robust model, while significantly enhancing VP's generalization ability across various downstream datasets. Extensive experiments across various datasets show that our findings are universal and demonstrate the significant benefits of the proposed strategy.

Figures

Figures reproduced from arXiv: 2506.06823 by the authors.

Figure 1
Figure 1. RSVP can inherit the robustness from the source model [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The performance of VP on standard accuracy (histogram) [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Visual representation of SSVP (columns 1 & 5) and RSVP [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: The performance improvement of PBL in EuroSAT, DTD [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: The training dynamics for the EuroSat and GTSRB [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Time usage and resource consumption under different [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: and [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 7
Figure 7. Figure 7: Visualization of RSVP obtained when different robust models are used as source models. Each row from left to right: the first three [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Visualization of RSVP obtained when different robust models are used as source models. Each row from left to right: the first three [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: Visualization of RSVP obtained when utilizing the proposed PBL method. Each row from left to right: the first four are the results [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

50 extracted references · 28 canonical work pages

  1. [1]

    Feature purification: How adversarial training performs robust deep learning

    Zeyuan Allen-Zhu and Yuanzhi Li. Feature purification: How adversarial training performs robust deep learning. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS) , pages 977--988. IEEE, 2022

    work page 2021

  2. [2]

    Exploring visual prompts for adapting large-scale models

    Hyojin Bahng, Ali Jahanian, Swami Sankaranarayanan, and Phillip Isola. Exploring visual prompts for adapting large-scale models. arXiv preprint arXiv:2203.17274 , 2022

    arXiv 2022

  3. [3]

    Beit: Bert pre-training of image transformers

    Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. Beit: Bert pre-training of image transformers. arXiv preprint arXiv:2106.08254 , 2021

    arXiv 2021

  4. [4]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems , 33:1877--1901, 2020

    1901

  5. [5]

    Adversarial attacks and defences: A survey

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. Adversarial attacks and defences: A survey. arXiv preprint arXiv:1810.00069 , 2018

    arXiv 2018

  6. [6]

    Jacobian adversarially regularized networks for robustness

    Alvin Chan, Yi Tay, Yew Soon Ong, and Jie Fu. Jacobian adversarially regularized networks for robustness. arXiv preprint arXiv:1912.10185 , 2019

    arXiv 1912

  7. [7]

    Exploring simple siamese representation learning

    Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 15750--15758, 2021

    work page 2021

  8. [8]

    Adaptformer: Adapting vision transformers for scalable visual recognition

    Shoufa Chen, Chongjian Ge, Zhan Tong, Jiangliu Wang, Yibing Song, Jue Wang, and Ping Luo. Adaptformer: Adapting vision transformers for scalable visual recognition. Advances in Neural Information Processing Systems , 35:16664--16678, 2022

    work page 2022

Show all 50 references
  1. [9]

    Visual prompting for adversarial robustness

    Aochuan Chen, Peter Lorenz, Yuguang Yao, Pin-Yu Chen, and Sijia Liu. Visual prompting for adversarial robustness. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 1--5. IEEE, 2023

    2023

  2. [10]

    Understanding and improving visual prompting: A label-mapping perspective

    Aochuan Chen, Yuguang Yao, Pin-Yu Chen, Yihua Zhang, and Sijia Liu. Understanding and improving visual prompting: A label-mapping perspective. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 19133--19143, 2023

    2023

  3. [11]

    Describing textures in the wild

    Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 3606--3613, 2014

    2014

  4. [12]

    Minimally distorted adversarial examples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In International Conference on Machine Learning , pages 2196--2205. PMLR, 2020

    2020

  5. [13]

    Robustbench: a standardized adversarial robustness benchmark

    Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Dat...

    2021

  6. [14]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition , pages 248--255. Ieee, 2009

    2009

  7. [15]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 , 2018

    2018 arXiv

  8. [16]

    Adversarial reprogramming of neural networks

    Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial reprogramming of neural networks. arXiv preprint arXiv:1806.11146 , 2018

    2018 arXiv

  9. [17]

    Robustness (python library), 2019

    Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library), 2019

    2019

  10. [18]

    Domain-adversarial training of neural networks

    Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain, Hugo Larochelle, Fran c ois Laviolette, Mario Marchand, and Victor Lempitsky. Domain-adversarial training of neural networks. The journal of machine learning research , 17(1):2096--2030, 2016

    2016

  11. [19]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  12. [20]

    Uncovering the limits of adversarial training against norm-bounded adversarial examples

    Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 , 2020

    2010 arXiv

  13. [21]

    Introducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification

    Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Introducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. In IGARSS 2018-2018 IEEE International Geoscience and Remote Sensing Symposium , pages 204--207. IEEE, 2018

    2018

  14. [22]

    Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification

    Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing , 2019

    2019

  15. [23]

    Universal language model fine-tuning for text classification

    Jeremy Howard and Sebastian Ruder. Universal language model fine-tuning for text classification. arXiv preprint arXiv:1801.06146 , 2018

    2018 arXiv

  16. [24]

    Black-box adversarial attacks with limited queries and information

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International conference on machine learning , pages 2137--2146. PMLR, 2018

    2018

  17. [25]

    Visual prompt tuning

    Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning. In European Conference on Computer Vision , pages 709--727. Springer, 2022

    2022

  18. [26]

    3d object representations for fine-grained categorization

    Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for fine-grained categorization. In Proceedings of the IEEE international conference on computer vision workshops , pages 554--561, 2013

    2013

  19. [27]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  20. [28]

    Fine-tuning can distort pretrained features and underperform out-of-distribution

    Ananya Kumar, Aditi Raghunathan, Robbie Jones, Tengyu Ma, and Percy Liang. Fine-tuning can distort pretrained features and underperform out-of-distribution. arXiv preprint arXiv:2202.10054 , 2022

    2022 arXiv

  21. [29]

    Prefix-tuning: Optimizing continuous prompts for generation

    Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:2101.00190 , 2021

    2021 arXiv

  22. [30]

    Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing

    Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig. Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing. ACM Computing Surveys , 55(9):1--35, 2023

    2023

  23. [31]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018

    2018

  24. [32]

    Reading digits in natural images with unsupervised feature learning

    Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011

    2011

  25. [33]

    Automated flower classification over a large number of classes

    Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In 2008 Sixth Indian conference on computer vision, graphics & image processing , pages 722--729. IEEE, 2008

    2008

  26. [34]

    Blackvip: Black-box visual prompting for robust transfer learning

    Changdae Oh, Hyeji Hwang, Hee-young Lee, YongTaek Lim, Geunyoung Jung, Jiyoung Jung, Hosik Choi, and Kyungwoo Song. Blackvip: Black-box visual prompting for robust transfer learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 2...

    2023

  27. [35]

    A survey on transfer learning

    Sinno Jialin Pan and Qiang Yang. A survey on transfer learning. IEEE Transactions on knowledge and data engineering , 22(10):1345--1359, 2009

    2009

  28. [36]

    Robustness and accuracy could be reconcilable by (proper) definition

    Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning , pages 17258--17277. PMLR, 2022

    2022

  29. [37]

    Cats and dogs

    Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, and CV Jawahar. Cats and dogs. In 2012 IEEE conference on computer vision and pattern recognition , pages 3498--3505. IEEE, 2012

    2012

  30. [38]

    Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems , 33:3533--3545, 2020

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems , 33:3533--3545, 2020

    2020

  31. [39]

    Adversarial training for free! Advances in Neural Information Processing Systems , 32, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems , 32, 2019

    2019

  32. [40]

    The german traffic sign recognition benchmark: a multi-class classification competition

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: a multi-class classification competition. In The 2011 international joint conference on neural networks , pages 1453--1460. IEEE, 2011

    2011

  33. [41]

    Adversarial training and robustness for multiple perturbations

    Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations. Advances in neural information processing systems , 32, 2019

    2019

  34. [42]

    Ensemble adversarial training: Attacks and defenses

    Florian Tram \`e r, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204 , 2017

    2017 arXiv

  35. [43]

    Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources

    Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho. Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources. In International Conference on Machine Learning , pages 9614--9624. PMLR, 2020

    2020

  36. [44]

    Robustness may be at odds with accuracy

    Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 , 2018

    2018 arXiv

  37. [45]

    Bilateral adversarial training: Towards fast training of more robust models against adversarial attacks

    Jianyu Wang and Haichao Zhang. Bilateral adversarial training: Towards fast training of more robust models against adversarial attacks. In Proceedings of the IEEE/CVF international conference on computer vision , pages 6629--6638, 2019

    2019

  38. [46]

    Pytorch image models

    Ross Wightman. Pytorch image models. https://github.com/rwightman/pytorch-image-models, 2019

    2019

  39. [47]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994 , 2020

    2001 arXiv

  40. [48]

    Conditional prompt learning for vision-language models

    Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Conditional prompt learning for vision-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 16816--16825, 2022

    2022

  41. [49]

    Learning to prompt for vision-language models

    Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Learning to prompt for vision-language models. International Journal of Computer Vision , 130(9):2337--2348, 2022

    2022

  42. [50]

    write newline

    " write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence '...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.