Pith. sign in

REVIEW 3 major objections 5 minor 28 references

DUMB and DUMBer: Is Adversarial Training Worth It in the Real World?

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Under a deliberately heterogeneous population of models, adversarial training strongly mitigates high-severity transfer attacks when source and target align, but it measurably hurts robustness in about one in five evaluated settings…

desk verdict A genuinely useful large-scale empirical map of adversarial training under transfer, but the headline 'not universally beneficial' number is undercut by the paper's own severity-filtering logic. read the letter →

arxiv 2506.18516 v1 pith:DW544CVB submitted 2025-06-23 cs.CR

Francesco Marchiori , Marco Alecci , Luca Pajola , Mauro Conti This is my paper
classification cs.CR
keywords adversarialattackstrainingtransferabilityevasionDUMBframeworkcomputervisionrobustnessattackmitigationratedeepneuralnetworks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial training is the standard defense against adversarial examples, but it is usually tested on narrow, homogeneous model populations. This paper asks whether the defense still pays off when attacker and victim differ in dataset source, model architecture, and class balance—conditions that reflect real deployments. Building on the DUMB attacker model, the authors add nine adversarial training strategies and run more than 130,000 attack evaluations across 240 uniquely trained models, three vision tasks, and thirteen attacks. Their answer is conditional: adversarial training sharply reduces attack success for high-severity transfer attacks when source and target models are well matched, but 20.53% of all assessments make the model less robust than an undefended baseline, with failures concentrated under model and data mismatches and weak attacks. They conclude that when the threat model is unknown, adaptive and curriculum strategies offer the highest average robustness.

What carries the argument

The machinery is the DUMBer evaluation framework, which extends the DUMB attacker model—eight combinations of matched or mismatched dataset source, model architecture, and class balance—to adversarially trained defenders. The analysis is carried by two metrics: Attack Success Rate (ASR), the fraction of initially correct samples flipped by an attack, and Attack Mitigation Rate (AMR), the relative reduction in ASR that adversarial training achieves over a baseline trained on clean data. A five-level severity scale partitions ASR so that weak and strong attacks are analyzed separately. The framework's population, in which every model is uniquely trained across two dataset sources, three architectures, four class-balance levels, and ten training strategies, is what lets the authors attribute differences in AMR to the DUMB dimensions rather than to a single model configuration.

What would settle it

Hold out the test set completely, tune every attack's strength parameters on validation data only, and recompute ASR and AMR on the untouched test set; if the 20.53% negative-AMR rate and the adaptive/curriculum ranking do not persist, the conclusions rest on test-set leakage.

Watch

Extended reading notes

Core claim

The central discovery is that adversarial training is effective but not universally beneficial under the DUMB population. The authors define Attack Mitigation Rate (AMR) as the normalized drop in attack success produced by adversarial training relative to a clean-data baseline, and evaluate it across eight DUMB scenarios that vary dataset source, architecture, and class-balance match. Adaptive training achieves the highest average AMR, reaching 96.69% on the Bikes vs. Motorbikes task at high severity, and curriculum and surrogate strategies also rank high. Yet 20.53% of all assessments yield negative AMR, meaning the adversarially trained model is more vulnerable than the baseline; these failures concentrate in the mismatch scenarios C4 (32.00%) and C8 (28.70%) and in severity-1 attacks, which account for 72.53% of all negative outcomes. The paper's practical conclusion is that adversarial training should be reserved for significant high-severity threats and that its benefit depends on how well the attack conditions match the defense's assumptions.

Load-bearing premise

The reported comparisons assume that attack-strength parameters were tuned on held-out validation data rather than on the test set from which ASR and AMR are reported; if test data influenced parameter selection, every reported value and ranking in Sections 5.3-5.7 would shift.

Editorial extensions

If this is right

  • If the threat model is unknown, adaptive and curriculum adversarial training give the highest average AMR across the DUMB population, so they are the recommended default strategies.
  • Adversarial training delivers its largest robustness gains when the surrogate and target models share the same architecture; mismatched models and datasets (C4 and C8) are where the defense is most likely to backfire.
  • A meaningful minority of deployments—20.53% of all assessments—would see reduced robustness after adversarial training, with an average failure of -35.89% in AMR.
  • Low-severity attacks drive most failures (72.53% of negative-AMR cases), so adversarial training is best reserved for scenarios where the attacker is capable of high-impact perturbations.
  • Clean-data accuracy is largely unaffected by adversarial training, except for ensemble training, which loses on average 4.26% F1.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same data suggest a conservative deployment rule: organizations that expect significant model or data drift between attacker and victim should prefer simple noise-based or model-agnostic training, despite its lower average AMR, because it has fewer and milder negative failures.
  • Because AMR divides by the baseline's attack success rate, a large AMR can partly reflect a weak undefended model rather than a strong defense; comparing absolute defended ASR values would give decision-makers a different ordering.
  • The severity-1 failures may be inflated by the metric itself, since tiny absolute ASR changes become large relative AMR swings, so the 20.53% headline rate likely overstates the practical risk from weak attacks.
  • A natural next experiment is to test whether the defense ranking changes when the attacker adapts to the defense (e.g., by tuning attacks against the adversarially trained model), since the current pipeline fixes transfer attacks generated from source models without adversarial training.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper extends the DUMB framework to adversarial training, introducing DUMBer, an evaluation testbed that measures the resilience of adversarially trained models to transferable evasion attacks across three vision tasks, three architectures, four class-balance levels, ten training strategies, and thirteen attacks, totaling roughly 130k evaluations. The authors define Attack Success Rate (ASR) and Attack Mitigation Rate (AMR), assess attacks and training strategies across eight DUMB scenarios, and answer five research questions. Their headline conclusions are that adaptive and curriculum training generally yield the highest AMRs, that adversarial training is most effective when source and target models align, and that adversarial training is 'not universally beneficial' because 20.53% of assessments yield negative AMR, especially under low-severity attacks and model/data mismatches.

Significance. If the reported results are robust, this is a useful contribution to the empirical literature on adversarial training, providing a broad and heterogeneous testbed that is far more diverse than typical evaluations. The release of the full codebase and over 130k evaluations is a concrete asset for reproducibility and for practitioners choosing among training strategies under uncertain threat models. The paper also formulates a clear research-question structure that makes its claims disconfirmable. However, the strength of the central quantitative claims is currently compromised by an internal inconsistency in how severity-1 attacks are treated and by an unresolved question about attack-parameter tuning, so the practical guidance that can be responsibly drawn from the paper is weaker than the text suggests.

major comments (3)
  1. [Section 5.7 and Table 3d vs. Sections 5.4–5.5] The paper's headline claim that adversarial training is 'not universally beneficial' (20.53% negative AMR) is driven by the severity-1 regime that the paper itself excludes as distorting. Section 5.4 states that severity-1 attacks 'have negligible ASR and would distort AMR interpretation by exaggerating insignificant changes,' and Section 5.5 restricts analysis to severity >= 3 to avoid 'negative AMR values reflect[ing] negligible performance changes.' Yet Section 5.7 reports the 20.53% figure over all assessments, and Table 3d shows that 72.53% of negative-AMR instances occur at severity 1. Since AMR (Eq. 2) divides by the baseline ASR, a small absolute drop at low baseline ASR can produce a large negative normalized value. The claim in Answer A5 that adversarial training is 'less effective against lower severity attacks' is therefore not supported by the quantitative evidence as presented; at most it shows that adversarial training can hurt on attacks that barely succeed against the baseline. Please recompute the negative-AMR statistics under the same filtering used elsewhere in the paper (at least excluding severity 1), and report both filtered and unfiltered results with explicit caveats.
  2. [Section 4.2, Parameter Tuning] The manuscript does not state whether the attack parameters that are 'tun[ed] ... to maximize attack success' under the SSIM >= 0.4 constraint are selected on a held-out validation split or on the test split. The text says only that 'For testing, we select optimal parameters' and that validation examples are generated 'across multiple parameter values' for adversarial training. If the test set is used for parameter selection, the reported ASR and AMR values are inflated, and every comparative conclusion in Sections 5.3–5.7 could shift. Please clarify the split used for parameter selection; if test data were used, the experiments need to be re-run with proper validation-based selection, or the paper must transparently discuss the bias.
  3. [Section 5.1, Eq. (2)] The definition of AMR as (ASR_original - ASR_adv) / ASR_original makes the metric numerically unstable when ASR_original is near zero. The paper acknowledges this in Section 5.4 when it excludes severity 1, but the same instability also affects comparisons at higher severities where baseline ASR varies widely across tasks and DUMB cases. For example, Table 3 shows that the average negative AMR is much more extreme for severity 1 (-43.13) than for severity 3 (-5.87), which is exactly the pattern one would expect from normalization rather than from a genuine training-induced robustness collapse. Please include, at least for the main RQ2 and RQ5 analyses, a complementary unnormalized metric (e.g., absolute ASR differences) or a stratified analysis by baseline-ASR bins, so that conclusions about 'failures' are not artifacts of the metric choice.
minor comments (5)
  1. [Section 2, heading] The heading 'Adversarial Attacks and transfearbility' contains a typo: 'transfearbility' should be 'transferability'.
  2. [Section 4.4] The total number of evaluations is computed as 120,960 + 8,640 = 129,600, which is slightly below the 'over 130k' stated in the Abstract and Section 1. Please adjust the wording or the arithmetic.
  3. [Table 3 caption] The caption defines '% Neg.' as 'the percentage of negative samples relative to the total number of negative samples across all dimensions,' but the table appears to show the percentage within each dimension. Clarify the denominator (total negative samples overall vs. per dimension) and ensure the caption matches the numbers.
  4. [Appendix A.1] The sentence 'We now provide more details on the results shown in Section A' should refer to 'Appendix A' or to the relevant section of the main text, not 'Section A.'
  5. [Figure 3] The bracket labels under the severity scores ([L], [M], [S]) are not explained in the caption or in the surrounding text; please define them in the caption for readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's conclusions are empirical measurements, with only benign self-citation of the DUMB framework.

full rationale

The paper is an empirical evaluation study, not a derivation. AMR (Eq. 2) is an operational normalization of measured attack success rates, not a fitted parameter that is later relabeled as a prediction. The attack parameters are tuned to maximize ASR under an SSIM constraint, and while the paper does not state explicitly whether tuning is done on a held-out split, that is a data-leakage/correctness concern rather than a circularity: no conclusion is forced by the definition of a fitted input. The DUMBer framework inherits scenario definitions, tasks, and some experimental details from the authors' prior DUMB paper [1], and the adaptive training strategy cites the authors' own CANEDERLI work [19]; however, these citations supply methodology or a training procedure, not the paper's substantive results. The claim that 'adaptive and curriculum generally yield the highest AMRs' is computed from 130k attack evaluations and is not entailed by the cited works. No uniqueness theorem is imported, no ansatz is smuggled in via citation, and no known result is merely renamed. The one notable issue is internal consistency of severity filtering: Sections 5.4 and 5.5 exclude severity-1 attacks because they 'have negligible ASR and would distort AMR interpretation by exaggerating insignificant changes,' yet Section 5.7 reports the 20.53% negative-AMR headline over all assessments, with Table 3d showing 72.53% of negative AMR instances at severity 1. That is an inconsistency in evidence interpretation, not circularity, and does not change the circularity score.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claims are empirical and rest on the design choices of the DUMB population, the AMR metric, and the attack-tuning protocol; no physical entities are introduced.

free parameters (4)
  • epsilon for FGSM/PGD adversarial training = 0.2
    Hand-selected in Section 4.3 ('fixed ϵ = 0.2, selected to balance perturbation visibility and attack strength').
  • Test attack parameters (epsilon, noise level, radius, etc.) = not reported
    Section 4.2 states parameters are tuned to maximize ASR while preserving SSIM >= 0.4; exact values are not listed, and it is unclear whether tuning uses validation or test data.
  • Curriculum/Adaptive epsilon schedule = not specified
    Section 4.3 says epsilon increases over epochs (offline for Curriculum, online for Adaptive) but the schedule is not defined in the paper.
  • SSIM threshold = 0.4
    Hand-set in Section 4.2 to bound perturbation visibility; affects which parameter values are selected.
assumptions (5)
  • domain assumption The DUMB population (2 datasets, 3 architectures, 4 balance levels, 10 training strategies) is representative of real-world deployment variability.
    Section 4 builds the testbed on this premise and the conclusions generalize from it to 'real-world' practice.
  • domain assumption ASR and AMR as defined in Eqs. (1)-(2) measure defense benefit.
    AMR normalizes by baseline ASR; with low baseline ASR, small absolute changes become large AMR values, and negative AMR is capped at -100%.
  • domain assumption Attack parameters can be tuned to maximize ASR while SSIM >= 0.4 without biasing evaluation.
    Section 4.2 does not specify whether tuning is performed on a held-out split.
  • ad hoc to paper Severity 1 attacks can be excluded from the main AMR analysis because they have negligible ASR and would distort interpretation.
    Sections 5.4-5.5 exclude severity 1 and restrict to severity >=3; this shapes the central claims about where adversarial training helps.
  • standard math Standard math for F1/ASR/AMR definitions.
    No derivation beyond definitions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DUMB and DUMBer: Is Adversarial Training Worth It in the Real World?." pith.science (2026). https://pith.science/paper/DW544CVB

@misc{pith2026250618516,
  author       = {Pith},
  title        = {Pith review of: DUMB and DUMBer: Is Adversarial Training Worth It in the Real World?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DW544CVB}},
  note         = {Machine review of arXiv:2506.18516}
}
read the original abstract

Adversarial examples are small and often imperceptible perturbations crafted to fool machine learning models. These attacks seriously threaten the reliability of deep neural networks, especially in security-sensitive domains. Evasion attacks, a form of adversarial attack where input is modified at test time to cause misclassification, are particularly insidious due to their transferability: adversarial examples crafted against one model often fool other models as well. This property, known as adversarial transferability, complicates defense strategies since it enables black-box attacks to succeed without direct access to the victim model. While adversarial training is one of the most widely adopted defense mechanisms, its effectiveness is typically evaluated on a narrow and homogeneous population of models. This limitation hinders the generalizability of empirical findings and restricts practical adoption. In this work, we introduce DUMBer, an attack framework built on the foundation of the DUMB (Dataset soUrces, Model architecture, and Balance) methodology, to systematically evaluate the resilience of adversarially trained models. Our testbed spans multiple adversarial training techniques evaluated across three diverse computer vision tasks, using a heterogeneous population of uniquely trained models to reflect real-world deployment variability. Our experimental pipeline comprises over 130k evaluations spanning 13 state-of-the-art attack algorithms, allowing us to capture nuanced behaviors of adversarial training under varying threat models and dataset conditions. Our findings offer practical, actionable insights for AI practitioners, identifying which defenses are most effective based on the model, dataset, and attacker setup.

Figures

Figures reproduced from arXiv: 2506.18516 by the authors.

Figure 1
Figure 1. Model combinations during the training phase. [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Severity score distribution of each attack. [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Training strategies’ AMR at different attack severity scores. Labels below [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Training strategies’ AMR at different DUMB cases. Labels below scores [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Adaptive training strategy AMR under different attacks. C1 C2 C3 C4 C5 C6 C7 C8 Case Square TIFGSM DeepFool RFGSM PGD BIM FGSM Attack Adversarial Training Strategy: nonMath Bubble Size 1 Count < 10 10 Count < 50 Count 50 100 75 50 25 0 25 50 75 100 AMR (a) DUMB cases a…
Figure 6
Figure 6. Figure 6: Non-Math training strategy AMR under different attacks. 5.7 Adversarial Training Failiures Understanding when adversarial training harms rather than helps is critical for practitioners considering its adoption. A negative AMR signals that the model has become more vuln…
Figure 7
Figure 7. Figure 7: Negative AMR distribution To better understand where adversarial training most often fails, we analyze the distribution of negative AMR across different experimental dimensions ( [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: Severity score distribution of each attack on each task. [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Adaptive training strategy AMR under different attacks. C1 C2 C3 C4 C5 C6 C7 C8 DUMB Case BIM DeepFool FGSM PGD RFGSM Square TIFGSM Attacks 20.54 14.87 9.55 10.06 12.24 10.22 8.57 8.18 3.91 -7.68 -4.74 -3.42 -4.10 -2.98 -5.90 -2.56 26.81 23.66 37.14 37.11 22.14 21.64 2…
Figure 10
Figure 10. Figure 10: Non-Math training strategy AMR under different attacks [PITH_FULL_IMAGE:figures/full_fig_p020_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

28 extracted references · 17 canonical work pages

  1. [1]

    In: DUMB and DUMBer 17 Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses

    Alecci, M., Conti, M., Marchiori, F., Martinelli, L., Pajola, L.: Your attack is too dumb: Formalizing attacker scenarios for adversarial transferability. In: DUMB and DUMBer 17 Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses. p. 315–329. RAID ’23, Association for Computing Machinery, New York, NY, USA (2023...

    arXiv 2023

  2. [2]

    In: European conference on computer vision

    Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query-efficient black-box adversarial attack via random search. In: European conference on computer vision. pp. 484–501. Springer (2020)

    work page 2020

  3. [3]

    Andriushchenko, M., Flammarion, N.: Understanding and improving fast adversarial training.AdvancesinNeuralInformationProcessingSystems 33,16048–16059(2020)

    work page 2020

  4. [4]

    Curriculum Adversarial Training

    Cai, Q.Z., Du, M., Liu, C., Song, D.: Curriculum adversarial training. arXiv preprint arXiv:1805.04807 (2018)

    work page Pith review arXiv 2018

  5. [5]

    Journal of artificial intelligence research16, 321–357 (2002)

    Chawla,N.V.,Bowyer,K.W.,Hall,L.O.,Kegelmeyer,W.P.:Smote:syntheticminority over-sampling technique. Journal of artificial intelligence research16, 321–357 (2002)

    work page 2002

  6. [6]

    In: 28th USENIX security symposium (USENIX security 19)

    Demontis,A.,Melis,M.,Pintor,M.,Jagielski,M.,Biggio,B.,Oprea,A.,Nita-Rotaru, C., Roli, F.: Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In: 28th USENIX security symposium (USENIX security 19). pp. 321–338 (2019)

    work page 2019

  7. [7]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Dong, Y., Pang, T., Su, H., Zhu, J.: Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 4312–4321 (2019)

    work page 2019

  8. [8]

    Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., Song, D.: Robust physical-world attacks on deep learning visual classification.In:ProceedingsoftheIEEEconferenceoncomputervisionandpattern recognition. pp. 1625–1634 (2018)

    work page 2018

Show all 28 references
  1. [9]

    Frid-Adar, M., Klang, E., Amitai, M., Goldberger, J., Greenspan, H.: Synthetic data augmentationusingganforimprovedliverlesionclassification.In:2018IEEE15thin- ternationalsymposiumonbiomedicalimaging(ISBI2018).pp.289–293.IEEE(2018)

    2018

  2. [10]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  3. [11]

    In: Proceedings of the 11th ACM workshop on artificial intelligence and security

    Gröndahl, T., Pajola, L., Juuti, M., Conti, M., Asokan, N.: All you need is" love" evading hate speech detection. In: Proceedings of the 11th ACM workshop on artificial intelligence and security. pp. 2–12 (2018)

    2018

  4. [12]

    IEEE Transactions on Information Forensics and Security18, 1749–1762 (2023)

    Grosse, K., Bieringer, L., Besold, T.R., Biggio, B., Krombholz, K.: Machine learning security in industry: A quantitative survey. IEEE Transactions on Information Forensics and Security18, 1749–1762 (2023)

    2023

  5. [13]

    arXiv preprint arXiv:2310.17626 (2023)

    Gu, J., Jia, X., de Jorge, P., Yu, W., Liu, X., Ma, A., Xun, Y., Hu, A., Khakzar, A., Li, Z., et al.: A survey on transferability of adversarial examples across deep neural networks. arXiv preprint arXiv:2310.17626 (2023)

    2023 arXiv

  6. [14]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

    2016

  7. [15]

    arXiv preprint arXiv:1404.5997 (2014)

    Krizhevsky, A.: One weird trick for parallelizing convolutional neural networks. arXiv preprint arXiv:1404.5997 (2014)

    2014 arXiv

  8. [16]

    In: Artificial intelligence safety and security, pp

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. In: Artificial intelligence safety and security, pp. 99–112. Chapman and Hall/CRC (2018)

    2018

  9. [17]

    Computers & Security128, 103134 (2023)

    Ling, X., Wu, L., Zhang, J., Qu, Z., Deng, W., Chen, X., Qian, Y., Wu, C., Ji, S., Luo, T., et al.: Adversarial attacks against windows pe malware detection: A survey of the state-of-the-art. Computers & Security128, 103134 (2023)

    2023

  10. [18]

    arXiv preprint arXiv:1706.06083 (2017)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    2017 arXiv

  11. [19]

    In: Proceedings of the 2024 ACM Workshop on Wireless Security and Machine Learning

    Marchiori, F., Conti, M.: Canederli: On the impact of adversarial training and transferability on can intrusion detection systems. In: Proceedings of the 2024 ACM Workshop on Wireless Security and Machine Learning. pp. 8–13 (2024) 18 F. Marchiori et al

    2024

  12. [20]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 2574–2582 (2016)

    2016

  13. [21]

    In: Proceedings of the 2016 acm sigsac conference on computer and communications security

    Sharif, M., Bhagavatula, S., Bauer, L., Reiter, M.K.: Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In: Proceedings of the 2016 acm sigsac conference on computer and communications security. pp. 1528–1540 (2016)

    2016

  14. [22]

    arXiv preprint arXiv:1409.1556 (2014)

    Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)

    2014 arXiv

  15. [23]

    Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P.: Ensembleadversarialtraining:Attacksanddefenses.arXivpreprintarXiv:1705.07204 (2017)

    2017 arXiv

  16. [24]

    arXiv preprint arXiv:1805.12152 (2018)

    Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., Madry, A.: Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 (2018)

    2018 arXiv

  17. [25]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Wang, X., He, X., Wang, J., He, K.: Admix: Enhancing the transferability of adversarial attacks. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 16158–16167 (2021)

    2021

  18. [26]

    In: International conference on learning representations (2019)

    Wang,Y.,Zou,D.,Yi,J.,Bailey,J.,Ma,X.,Gu,Q.:Improvingadversarialrobustness requires revisiting misclassified examples. In: International conference on learning representations (2019)

    2019

  19. [27]

    arXiv preprint arXiv:2306.08565 (2023)

    Yu, W., Gu, J., Li, Z., Torr, P.: Reliable evaluation of adversarial transferability. arXiv preprint arXiv:2306.08565 (2023)

    2023 arXiv

  20. [28]

    In: International conference on machine learning

    Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., Jordan, M.: Theoretically principled trade-off between robustness and accuracy. In: International conference on machine learning. pp. 7472–7482. PMLR (2019) A Additional Results We now provide more details on the results sh...

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.