Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

By tying each input perturbation to its measurement uncertainty, MiniFool makes the minimum perturbation needed to flip a classification a physical robustness measure that separates correctly from incorrectly classified events.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 00:21 UTC pith:6AYNDG2R

load-bearing objection A useful, clearly presented methods paper for physics-aware adversarial attacks; the central qualitative finding holds up, but the robustness measure is calibrated to ad hoc uncertainty models rather than true experimental uncertainties, so the quantitative claims need work. the 4 major comments →

arxiv 2511.01352 v2 pith:6AYNDG2R submitted 2025-11-03 cs.LG astro-ph.HEastro-ph.IMhep-exphysics.data-an

MiniFool -- Physics-Constraint-Aware Minimizer-Based Adversarial Attacks in Deep Neural Networks

Lucie Flek , Oliver Janik , Philipp Alexander Jung , Akbar Karimi , Timo Saala , Alexander Schmidt , Matthias Schott , Philipp Soldin
show 3 more authors
Matthias Thiesmeyer Christopher Wiebusch Ulrich Willemsen
This is my paper
classification cs.LG astro-ph.HEastro-ph.IMhep-exphysics.data-an
keywords Adversarial attacksUncertainty-aware robustnessChi-square metricNeural network robustnessIceCube tau neutrinosCMS b-jet taggingPhysics-constrained perturbationsLabel-free diagnostics
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

MiniFool is an adversarial-attack algorithm that perturbs a network's input only along directions allowed by the measurement uncertainties of each feature. Instead of just minimizing the size of the perturbation, it minimizes a cost that combines a chi-squared-style penalty (how many sigma the perturbed event moved) with the distance to a target output score. By scaling all assumed uncertainties with a single attack parameter s and scanning it, the algorithm produces a per-event robustness curve: events whose classification flips only for s well above 1 are robust, while events that flip at s ≤ 1 are fragile. Across MNIST, IceCube tau-neutrino events, and CMS b-jet tagging, the paper finds that initially misclassified events consistently flip at smaller s than correctly classified ones, so the scan acts as a label-free diagnostic. The authors argue this allows testing the robustness of classifications of unlabeled experimental data and can serve as an independent check on physics analyses.

Core claim

The central claim is that an adversarial attack constrained by per-feature experimental uncertainties turns a network's decision boundary into a measurable physical quantity: the minimum uncertainty-scaled perturbation needed to flip the classification. MiniFool computes this by minimizing λ = α·η + β·(f_{i*}(x_a;θ) − g)², where η averages (x_i⁰ − x_i^a)²/σ_i² over all features and the second term pushes the network output for the originally winning class toward a target score (usually 0). Scanning the global scale s of the uncertainties—Eq. (7)—then yields, for each event, the threshold at which the classification changes. In all three studied applications, the threshold separates initially

What carries the argument

The core object is the uncertainty-normalized distance η (Eq. 4), a chi-squared-like metric (x_i⁰ − x_i^a)²/σ_i² summed over all input features, which generalizes to a covariance-matrix form for correlated inputs. Combining η with the squared deviation of the target output score gives the MiniFool cost λ (Eq. 5); the attack parameter s (Eq. 7) scales all σ_i by a common factor. The workhorse is the s-scan: minimizing λ for a grid of s values traces out a robustness curve per event, and the position of the classification flip along this curve is the proposed robustness measure.

Load-bearing premise

The entire robustness interpretation rests on the assumption that the true measurement uncertainties are known, independent, and Gaussian, and that scaling them by a single factor s faithfully represents the range of plausible experimental variations; if the assumed σ_i are wrong, the scan measures robustness under an imagined error model, not under physics.

What would settle it

Take a labeled test set from a full detector simulation with known true uncertainties per feature, compute for each event the smallest s that flips its classification, and check whether the distribution of these flip thresholds for correctly vs incorrectly classified events separates. If the two distributions overlap substantially—or if a network with high accuracy shows the opposite ordering, with correct events flipping at smaller s than misclassified ones—the claimed universal separation is falsified.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A network decision can be assigned a quantitative robustness score: the smallest uncertainty scaling at which a perturbation changes the classification.
  • Unlabeled experimental events can be tested directly: an event that flips under s ≤ 1 is statistically indistinguishable from background under the assumed uncertainties and should be treated with caution.
  • The method can be applied to different domains and network architectures, requiring only per-feature uncertainty estimates.
  • For the IceCube tau-neutrino candidates, the scan reproduces the expected background-sensitivity: one of seven events is attackable at small s, matching the expected 0.5 background events.
  • For the CMS jet tagger, the scan quantifies how perturbation strength degrades performance, showing near immunity to sub-0.02% input changes and a floor at high s.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A direct extension would use this robustness score as a training signal: adversarially hardening the network against perturbations within the nominal uncertainties could improve generalization to real data where simulation mismatch is a known problem.
  • If the uncertainty model is accurate, the s-threshold could serve as an event-quality or data-selection variable in physics analyses, complementing the network score itself.
  • The covariance-matrix version of η would let the attack respect correlations between features (e.g., charge-energy relations), turning MiniFool into a probe of whether a network's decision changes under physically correlated shifts.
  • The same cost function could be adapted to regression tasks, replacing the target-score term with a deviation metric on the continuous output.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. MiniFool is a new adversarial attack algorithm for physics classification tasks. It minimizes a cost function combining a χ²-style metric on input perturbations, normalized by assumed per-feature uncertainties (Eq. 4), with a term penalizing deviation from a target output score (Eq. 5). An attack parameter s scales the assumed uncertainties (Eq. 7), so that scanning s gives a per-event robustness curve. The paper demonstrates the method on MNIST, on IceCube's ν_τ-vs-ν_e classification of the seven tau-neutrino candidates from Ref. [2], and on CMS b-jet tagging with DeepJet. The central claim is that MiniFool quantifies the robustness of individual network decisions and can separate initially correctly from initially incorrectly classified events, as seen in Figures 3, 6, and 8.

Significance. If the claims hold, MiniFool offers a physics-aware robustness diagnostic that goes beyond conventional norm-based attacks, with potential value for validating neural-network-based physics analyses. The paper includes open-source implementations in TensorFlow and PyTorch and applies the idea across three distinct domains, which strengthens the generality argument. However, the current evidence is suggestive rather than conclusive; several quantitative claims lack baselines, convergence checks, and error bars, so the strength of the contributions is not yet demonstrated at the level required for a definitive publication.

major comments (4)
  1. [§3, Eq. (4)–(7) and §§4–6] The 'experimental uncertainties' σ_i that define the core metric η are chosen ad hoc in all applications: IceCube σ_i^0 = 0.1·x_i^0 (Sec. 5), CMS σ_i = a_i·s with a_i only described as 'normalizes the inputs' (Sec. 6, Eq. 9), and MNIST σ_i^0 = x_i^0 with no range constraint (Sec. 4). Consequently, the attack parameter s is not calibrated to true experimental uncertainty, and the robustness separation in Figs. 6 and 8 may reflect the assumed error model rather than classifier fragility. The abstract's claim that the test statistic quantifies probability based on experimental uncertainties is therefore over-stated. Please either estimate σ from documented detector/experimental information (including correlations) or explicitly reinterpret all results as robustness under a generic L2-style perturbation scale.
  2. [§6, Figure 7] The full CMS dataset is attacked with only ten optimizer iterations, stated as 'Given the large size of the event samples,' without any convergence check. If the minimization has not converged, the ROC curves and the conclusion 'DeepJet is nearly very robust against perturbations of its inputs that are smaller than 0.02% of the normalized inputs' may be unreliable. For a given s, a non-converged attack underestimates the achievable degradation and confounds the comparison across s. Provide convergence diagnostics (e.g., loss histories or per-iteration AUC curves) for the 10-iteration runs, or validate at least a subsample with the 1000-iteration protocol used for Fig. 8.
  3. [§§4–6] No baseline comparison against standard adversarial attacks such as FGSM, PGD, or DeepFool, nor against random perturbations, is provided. Without such baselines, it is unclear whether MiniFool's robustness measure adds information beyond existing norm-based distances, and whether the observed correct/incorrect separation is specific to the proposed cost function. At minimum, compare the perturbation magnitudes required for label flips against PGD/DeepFool on the same networks, and report bootstrap confidence intervals for the group differences shown in Figs. 3, 6, and 8.
  4. [§5] The IceCube conclusion that one of the seven ν_τ candidates is attackable at s<1 and that this is 'consistent with the background estimation in [2] of 0.5 events' is not statistically quantified. The claim rests on the 10% independent-Gaussian uncertainty assumption; the per-pixel p-value calculation in Fig. 5(d) uses a double-sided Gaussian and Fisher's combination, but does not address correlated or non-Gaussian uncertainties that could make the attack exploit unphysical directions. Please provide a quantitative comparison, e.g., the distribution of minimal attack s for simulated ν_e and ν_τ events passing the final selection, and a p-value for Event 1 under the background hypothesis.
minor comments (5)
  1. [§4] The statement that 'approximately 80% of initially incorrectly classified images receive the correct label after the attack' lacks the sample size or a statistical uncertainty. Please specify how this fraction is computed and its bootstrap error.
  2. [Figure 3] The y-axis is labeled 'Mean Prediction Score' but is on a logarithmic scale; the shaded band is ±1 standard deviation of the mean, not a confidence interval. Please state this explicitly in the caption.
  3. [§6, Eq. (9)] The definition of a_i in σ_i = a_i·s is too vague. State explicitly whether a_i is the inverse of the training-set feature standard deviation, a per-feature scaling, or something else, so that s has a clear meaning.
  4. [§5] The paper relies on Ref. [22] (a Master's thesis) for details of the IceCube implementation and for Fig. 5. To ensure reproducibility, please include a more self-contained description of the attacked network, input representation, and minimization procedure, or make the exact code and network weights available on GitHub.
  5. [General] There are minor typographical issues (e.g., 'withoug' in §3, inconsistent spacing in 'ν τ' and 'ν e'), and the covariance extension of η mentioned after Eq. (4) is never used; consider either using it or briefly explaining why it is omitted in the applications.

Circularity Check

0 steps flagged

No significant circularity: MiniFool's robustness measure is definitional in a benign sense, but the class-separation results are empirical and self-citations are not load-bearing.

full rationale

The derivation chain is Eq. (4) -> Eq. (5) -> Eq. (7): eta is a chi2-like perturbation cost, lambda balances it against the score deviation, and s scales the assumed uncertainties. Nothing in this chain is fitted to the outcome it later reports. The attack parameter is scanned, not tuned; alpha=beta=1 are fixed by hand; and the sigma models are stated assumptions (IceCube sigma0_i = 0.1*x0_i, CMS sigma_i = a_i*s with a_i normalizing the inputs, MNIST sigma0_i = x0_i). The paper itself flags these as simplifications: 'For simplicity of this test case, it is generally set to unity and varied using one global attack parameter' and 'For future applications, more complex uncertainty models need to be applied to achieve a more realistic application of experimental constraints.' The headline results -- initially misclassified MNIST/CMS samples lose score faster, and one IceCube nu_tau candidate flips at s<1 -- are evaluated on held-out, simulated, or real data and compared with simulation expectations, so they are empirical findings rather than identities. The only self-citations are [17] in the related-work survey and [22] for IceCube implementation details ('More details of the implementation are given in [22]'); neither is used to justify the central claim or to forbid alternatives. The robustness measure is definitional only in the innocuous sense that 'robust' is operationalized as the minimal uncertainty scale needed to flip a classification; the distinction between correctly and incorrectly classified events is not true by construction. Concerns about ad hoc uncertainty models are calibration/correctness issues, not circularity.

Axiom & Free-Parameter Ledger

7 free parameters · 6 axioms · 0 invented entities

The central claim depends less on new physics entities and more on the uncertainty model: the choices of σ_i, the scalar rescaling s, and the weights α, β are assumptions chosen by the authors. The only genuinely new input is the particular weighted cost; no new particles, mediators, or conserved quantities are introduced.

free parameters (7)
  • attack parameter s = scanned (IceCube 0.01–100; CMS 1e-4–1; MNIST 0–1)
    Scales all input uncertainties (Eq. 7); the entire robustness claim is a function of this hand-chosen scan variable rather than an empirically determined quantity.
  • cost weights α and β = α=β=1 (CMS; no explicit default elsewhere)
    Chosen weighting of input-distance vs target-score terms in Eq. 5; no sensitivity scan or physical justification is provided.
  • IceCube relative uncertainty σ_i^0 = 0.1·x_i^0
    Arbitrary 10% amplitude uncertainty per pixel stated in §5; the robustness conclusions depend directly on this scale.
  • CMS uncertainty scaling a_i = not specified (σ_i=a_i·s)
    Introduced in Eq. 9 as 'normalizes the inputs', but the concrete value of a_i is never given; the b-tag robustness results depend on it.
  • MNIST pixel uncertainty σ_i^0 = x_i^0
    Uncertainty set equal to pixel value at the default scale (§4); arbitrary and not physically motivated for MNIST.
  • target score g = 0
    Choice to drive the original class score to zero while leaving all other logits unconstrained; this allows any relabeling and shapes the attack difficulty.
  • MiniFool optimizer iterations = 10 for full CMS dataset; up to 1000 for 200-jet subset
    Convergence is not checked; the degree of attack success depends on this algorithmic parameter.
axioms (6)
  • domain assumption Input features have independent, Gaussian uncertainties with known widths σ_i.
    Equation (4) sums squared deviations per feature, and the p-value calculation in Fig. 5d explicitly assumes a double-sided Gaussian of width σ_i. Correlations are acknowledged but not handled.
  • domain assumption A single scalar attack parameter s scales all nominal uncertainties uniformly.
    Equation (7); real detector uncertainties have different scales and correlations, so the scan is an idealized model, not a physical uncertainty propagation.
  • ad hoc to paper Only pixels already containing signal need to be attacked in IceCube.
    Section 5 states 'we have chosen to attack only pixels with a non-zero recorded signal'; this restricts the search space and may miss adversarial directions in empty pixels.
  • standard math The network under attack is differentiable and the optimizer can find a sufficiently good solution of Eq. (6).
    MiniFool relies on gradient-based minimization; no convergence guarantee or global optimum is established, and the full CMS run uses only 10 iterations.
  • domain assumption Softmax outputs can be treated as class probabilities, and driving the original class score to g=0 is a meaningful adversarial target.
    Standard softmax interpretation used in Eq. (5); leaving all other logits unconstrained permits any relabeling, not necessarily a physically meaningful one.
  • domain assumption Fisher's method for combining p-values applies to the per-pixel perturbations.
    Used in Fig. 5d to combine pixel p-values; assumes independent tests, which is not supported for correlated detector pixels.

pith-pipeline@v1.3.0-alltime-deepseek · 13761 in / 14967 out tokens · 161903 ms · 2026-08-04T00:21:56.541730+00:00 · methodology

0 comments
read the original abstract

In this paper, we present a new algorithm, MiniFool, that implements physics-inspired adversarial attacks for testing neural network-based classification tasks in particle and astroparticle physics. While we initially developed the algorithm for the search for astrophysical tau neutrinos with the IceCube Neutrino Observatory, we apply it to further data from other science domains, thus demonstrating its general applicability. Here, we apply the algorithm to the well-known MNIST data set and furthermore, to Open Data data from the CMS experiment at the Large Hadron Collider. The algorithm is based on minimizing a cost function that combines a $\chi^2$ based test-statistic with the deviation from the desired target score. The test statistic quantifies the probability of the perturbations applied to the data based on the experimental uncertainties. For our studied use cases, we find that the likelihood of a flipped classification differs for both the initially correctly and incorrectly classified events. When testing changes of the classifications as a function of an attack parameter that scales the experimental uncertainties, the robustness of the network decision can be quantified. Furthermore, this allows testing the robustness of the classification of unlabeled experimental data.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Shapes are not enough: CONSERVAttack and its use for finding vulnerabilities and uncertainties in machine learning applications

    cs.LG 2026-03 unverdicted novelty 6.0

    CONSERVAttack creates adversarial perturbations in HEP ML models that respect uncertainty bounds but cause misclassifications, revealing gaps in current validation practices.

Reference graph

Works this paper leans on

47 extracted references · 3 canonical work pages · cited by 1 Pith paper

  1. [1]

    https://doi.org/10.1142/12294

    Erdmann, M., Glombitza, J., Kasieczka, G., Klemradt, U.: Deep Learning for Physics Re- search, (2021). https://doi.org/10.1142/12294

    doi:10.1142/12294 2021

  2. [2]

    The IceCube Collaboration: Observation of Seven Astrophysical Tau Neutrino Candidates with IceCube. Phys. Rev. Lett.132(15), 151001 (2024) https://doi.org/10.1103/PhysRevLett.132. 151001 arXiv:2403.02516 [astro-ph.HE]

    arXiv 2024

  3. [3]

    Science 380(6652), 9818 (2023) https://doi.org/10.1126/ science.adc9818 arXiv:2307.04427 [astro-ph.HE]

    The IceCube Collaboration: Observation of high- energy neutrinos from the Galactic plane. Science 380(6652), 9818 (2023) https://doi.org/10.1126/ science.adc9818 arXiv:2307.04427 [astro-ph.HE]

    arXiv 2023

  4. [4]

    Science378(6619), 538–543 (2022) https://doi.org/10.1126/science.abg3395 arXiv:2211.09972 [astro-ph.HE]

    The IceCube Collaboration: Evidence for neutrino emission from the nearby active galaxy NGC 1068. Science378(6619), 538–543 (2022) https://doi.org/10.1126/science.abg3395 arXiv:2211.09972 [astro-ph.HE]

    arXiv 2022

  5. [5]

    Pierre Auger Collaboration: Inference of the Mass Composition of Cosmic Rays with Ener- gies from 10 18.5 to 10 20 eV Using the Pierre Auger Observatory and Deep Learning. Phys. Rev. Lett.134, 021001 (2025) https://doi.org/10. 1103/PhysRevLett.134.021001

    2025

  6. [6]

    Na- ture Communications15(1), 4916 (2024) https://doi.org/10.1038/s41467-024-49104-4

    Hashemi, B., Hartmann, N., Sharifzadeh, S., Kahn, J., Kuhr, T.: Ultra-high-granularity detector simulation with intra-event aware generative adversarial network and self-supervised relational reasoning. Na- ture Communications15(1), 4916 (2024) https://doi.org/10.1038/s41467-024-49104-4

    doi:10.1038/s41467-024-49104-4 2024

  7. [7]

    Physics Letters B829, 137055 (2022) https://doi.org/10

    Lai, Y.S., Neill, D., P losko´ n, M., Ringer, F.: Explainable machine learning of the underlying 9 physics of high-energy particle collisions. Physics Letters B829, 137055 (2022) https://doi.org/10. 1016/j.physletb.2022.137055

    arXiv 2022

  8. [8]

    Computing and Software for Big Science1(1) (2017) https://doi.org/10.1007/ s41781-017-0004-6

    Oliveira, L., Paganini, M., Nachman, B.: Learn- ing Particle Physics by Example: Location- Aware Generative Adversarial Networks for Physics Synthesis. Computing and Software for Big Science1(1) (2017) https://doi.org/10.1007/ s41781-017-0004-6

    2017

  9. [9]

    International journal of automation and comput- ing17, 151–178 (2020) https://doi.org/10.1007/ s11633-019-1211-x

    Xu, H., Ma, Y., Liu, H.-C., Deb, D., Liu, H., Tang, J.-L., Jain, A.K.: Adversarial attacks and defenses in images, graphs and text: A review. International journal of automation and comput- ing17, 151–178 (2020) https://doi.org/10.1007/ s11633-019-1211-x

    2020

  10. [10]

    JHEP02, 057 (2014) https://doi.org/10.1007/ JHEP02(2014)057 arXiv:1307.6346 [hep-ex]

    Favereau, J., Delaere, C., Demin, P., Giammanco, A., Lema ˆ ıtre, V., Mertens, A., Selvaggi, M.: DELPHES 3, A modular framework for fast simulation of a generic collider experiment. JHEP02, 057 (2014) https://doi.org/10.1007/ JHEP02(2014)057 arXiv:1307.6346 [hep-ex]

    Pith/arXiv arXiv 2014

  11. [11]

    In: 2017 IEEE Symposium on Security and Privacy (SP), pp

    Carlini, N., Wagner, D.: Towards Evaluating the Robustness of Neural Networks. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 39– 57 (2017). https://doi.org/10.1109/SP.2017.49

    doi:10.1109/sp.2017.49 2017

  12. [12]

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Ex- plaining and Harnessing Adversarial Examples (2015) https://doi.org/10.48550/arXiv.1412.6572 arXiv:1412.6572 [stat.ML]

    Pith/arXiv arXiv doi:10.48550/arxiv.1412.6572 2015

  13. [13]

    JINST12(03), 03012 (2017) https: //doi.org/10.1088/1748-0221/12/03/P03012 arXiv:1612.05093 [astro-ph.IM]

    The IceCube Collaboration: The IceCube Neu- trino Observatory: Instrumentation and Online Systems. JINST12(03), 03012 (2017) https: //doi.org/10.1088/1748-0221/12/03/P03012 arXiv:1612.05093 [astro-ph.IM]. [Erratum: JINST 19, E05001 (2024)]

    Pith/arXiv arXiv 2017

  14. [14]

    http://yann.lecun

    LeCun, Y., Cortes, C., Burges, C.: MNIST hand- written digit database (2010). http://yann.lecun. com/exdb/mnist

    2010

  15. [15]

    IEEE Signal Processing Mag- azine29(6), 141–142 (2012) https://doi.org/10

    Deng, L.: The MNIST Database of Handwrit- ten Digit Images for Machine Learning Research [Best of the Web]. IEEE Signal Processing Mag- azine29(6), 141–142 (2012) https://doi.org/10. 1109/MSP.2012.2211477

    arXiv 2012

  16. [16]

    CMS.G6CE.1ITV

    The CMS Collaboration: Simulated dataset TT- ToHadronic TuneCP5 13TeV-powheg-pythia8 in MINIAODSIM format for 2016 collision data (2024) https://doi.org/10.7483/OPENDATA. CMS.G6CE.1ITV . [CERN Open Data Portal]

    work page doi:10.7483/opendata 2016

  17. [17]

    2501.05588 arXiv:2501.05588 [cs.LG]

    Saala, T., Flek, L., Jung, A., Karimi, A., Schmidt, A., Schott, M., Soldin, P., Wiebusch, C.: Enforcing Fundamental Relations via Ad- versarial Attacks on Input Parameter Cor- relations (2025) https://doi.org/10.48550/arXiv. 2501.05588 arXiv:2501.05588 [cs.LG]

    Pith/arXiv arXiv doi:10.48550/arxiv.2501.05588 2025

  18. [18]

    Dissertation, R WTH Aachen Univer- sity, Aachen (2024)

    Stein, A.: Novel jet flavour tagging algo- rithms exploiting adversarial deep learning techniques with efficient computing methods and preparation of open data for robustness studies. Dissertation, R WTH Aachen Univer- sity, Aachen (2024). https://doi.org/10.18154/ R WTH-2024-07840 . Ver¨ offentlicht auf dem Pub- likationsserver der R WTH Aachen Universit...

    2024

  19. [19]

    Stein, A., Coubez, X., Mondal, S., Novak, A., Schmidt, A.: Improving Robustness of Jet Tagging Algorithms with Adversarial Train- ing. Comput. Softw. Big Sci.6(1), 15 (2022) https://doi.org/10.1007/s41781-022-00087-1 arXiv:2203.13890 [physics.data-an]

    Pith/arXiv arXiv 2022

  20. [20]

    org/10.48550/arXiv.1706.06083 arXiv:1706.06083 [stat.ML]

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards Deep Learning Models Re- sistant to Adversarial Attacks (2019) https://doi. org/10.48550/arXiv.1706.06083 arXiv:1706.06083 [stat.ML]

    Pith/arXiv arXiv doi:10.48550/arxiv.1706.06083 2019

  21. [21]

    In: 2016 IEEE Confer- ence on Computer Vision and Pattern Recognition (CVPR), pp

    Moosavi-Dezfooli, S.-M., Fawzi, A., Frossard, P.: DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. In: 2016 IEEE Confer- ence on Computer Vision and Pattern Recognition (CVPR), pp. 2574–2582 (2016). https://doi.org/ 10.1109/CVPR.2016.282

    doi:10.1109/cvpr.2016.282 2016

  22. [22]

    Master Thesis, R WTH Aachen University (2023)

    Janik, O.: Using Adversarial Attacks to Fool IceCube’s Deep Neural Networks. Master Thesis, R WTH Aachen University (2023). https://www.institut3b.physik.rwth-aachen.de/ global/show document.asp?id=aaaaaaaacgjxigu

    2023

  23. [23]

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks (2014) https://doi.org/10.48550/arXiv.1312.6199 arXiv:1312.6199 [cs.CV]

    Pith/arXiv arXiv doi:10.48550/arxiv.1312.6199 2014

  24. [24]

    https://doi.org/10

    Abadi, M., Barham, P., Chen, J., Chen, Z., Davis, A., Dean, J., Devin, M., Ghemawat, S., Irving, G., Isard, M., Kudlur, M., Levenberg, J., Monga, R., Moore, S., Murray, D.G., Steiner, B., Tucker, P., Vasudevan, V., Warden, P., Wicke, M., Yu, Y., Zheng, X.: TensorFlow: A system for large- scale machine learning (2016). https://doi.org/10. 48550/arXiv.1605.08695 10

    Pith/arXiv arXiv doi:10.48550/arxiv.1605.08695 2016

  25. [25]

    Soft- ware available from tensorflow.org (2015)

    Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z., Citro, C., Corrado, G.S., Davis, A., Dean, J., Devin, M., Ghemawat, S., Good- fellow, I., Harp, A., Irving, G., Isard, M., Jia, Y., Jozefowicz, R., Kaiser, L., Kudlur, M., Leven- berg, J., Man´ e, D., Monga, R., Moore, S., Murray, D., Olah, C., Schuster, M., Shlens, J., Steiner, B., Sutskever, I., ...

    2015

  26. [26]

    1912.01703 arXiv:1912.01703 [cs.LG]

    Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga, L., Desmaison, A., K¨ opf, A., Yang, E., DeVito, Z., Raison, M., Te- jani, A., Chilamkurthy, S., Steiner, B., Fang, L., Bai, J., Chintala, S.: PyTorch: An Imper- ative Style, High-Performance Deep Learning Library (2019) https://doi.org/10....

    Pith/arXiv arXiv doi:10.48550/arxiv.1912.01703 2019

  27. [27]

    https://openreview.net/pdf?id= BJJsrmfCZ

    Paszke, A., Gross, S., Chintala, S., Chanan, G., Yang, E., DeVito, Z., Lin, Z., Desmaison, A., Antiga, L., Lerer, A.: Automatic differentiation in PyTorch (2017). https://openreview.net/pdf?id= BJJsrmfCZ

    2017

  28. [28]

    GitHub repository (2025)

    Janik, O., et al.: MiniFool. GitHub repository (2025). https://github.com/ojanik/MiniFool

    2025

  29. [29]

    Science342, 1242856 (2013) https:// doi.org/10.1126/science.1242856 arXiv:1311.5238 [astro-ph.HE]

    The IceCube Collaboration: Evidence for High- Energy Extraterrestrial Neutrinos at the IceCube Detector. Science342, 1242856 (2013) https:// doi.org/10.1126/science.1242856 arXiv:1311.5238 [astro-ph.HE]

    Pith/arXiv arXiv 2013

  30. [30]

    The IceCube Collaboration: Detection of astro- physical tau neutrino candidates in IceCube. Eur. Phys. J. C82(11), 1031 (2022) https://doi.org/10. 1140/epjc/s10052-022-10795-y arXiv:2011.03561 [hep-ex]

    arXiv 2022

  31. [31]

    The IceCube Collaboration: Search for As- trophysical Tau Neutrinos in Three Years of IceCube Data. Phys. Rev. D93(2), 022001 (2016) https://doi.org/10.1103/PhysRevD.93.022001 arXiv:1509.06212 [astro-ph.HE]

    Pith/arXiv arXiv 2016

  32. [32]

    Astropart

    Learned, J.G., Pakvasa, S.: Detecting tau- neutrino oscillations at PeV energies. Astropart. Phys.3, 267–274 (1995) https://doi.org/10.1016/ 0927-6505(94)00043-3 arXiv:hep-ph/9405296

    Pith/arXiv arXiv 1995

  33. [33]

    1556 arXiv:1409.1556 [cs.CV]

    Simonyan, K., Zisserman, A.: Very Deep Convo- lutional Networks for Large-Scale Image Recogni- tion (2015) https://doi.org/10.48550/arXiv.1409. 1556 arXiv:1409.1556 [cs.CV]

    Pith/arXiv arXiv doi:10.48550/arxiv.1409 2015

  34. [34]

    The Amer- ican Statistician2(5), 30–31 (1948) https://doi

    Mosteller, F.: Questions and Answers. The Amer- ican Statistician2(5), 30–31 (1948) https://doi. org/10.1080/00031305.1948.10483405

    Pith/arXiv arXiv 1948

  35. [35]

    JINST3, 08004 (2008) https: //doi.org/10.1088/1748-0221/3/08/S08004

    The CMS Collaboration: The CMS Experiment at the CERN LHC. JINST3, 08004 (2008) https: //doi.org/10.1088/1748-0221/3/08/S08004

    doi:10.1088/1748-0221/3/08/s08004 2008

  36. [36]

    JINST19, 05064 (2024) https://doi.org/10.1088/ 1748-0221/19/05/P05064

    The CMS Collaboration: Development of the CMS detector for the CERN LHC Run 3. JINST19, 05064 (2024) https://doi.org/10.1088/ 1748-0221/19/05/P05064

    2024

  37. [38]

    Journal of High Energy Physics2008(04), 063–063 (2008) https://doi

    Cacciari, M., Salam, G.P., Soyez, G.: The anti-k t jet clustering algorithm. Journal of High Energy Physics2008(04), 063–063 (2008) https://doi. org/10.1088/1126-6708/2008/04/063

    doi:10.1088/1126-6708/2008/04/063 2008

  38. [39]

    Physical Re- view D48(7), 3160–3166 (1993) https://doi.org/ 10.1103/physrevd.48.3160

    Ellis, S.D., Soper, D.E.: Successive combination jet algorithm for hadron collisions. Physical Re- view D48(7), 3160–3166 (1993) https://doi.org/ 10.1103/physrevd.48.3160

    doi:10.1103/physrevd.48.3160 1993

  39. [40]

    Nuclear Physics B406(1), 187–224 (1993) https://doi.org/10.1016/0550-3213(93)90166-M

    Catani, S., Dokshitzer, Y.L., Seymour, M.H., Webber, B.R.: Longitudinally-invariant k⊥-clustering algorithms for hadron-hadron colli- sions. Nuclear Physics B406(1), 187–224 (1993) https://doi.org/10.1016/0550-3213(93)90166-M

    doi:10.1016/0550-3213(93)90166-m 1993

  40. [41]

    Springer Tracts in Modern Physics, vol

    Rabbertz, K.: Jet Physics at the LHC: The Strong Force Beyond the TeV Scale. Springer Tracts in Modern Physics, vol

  41. [42]

    Journal of Instrumentation15(12), 12012 (2020) https://doi.org/10.1088/1748-0221/ 15/12/p12012

    Bols, E., Kieseler, J., Verzetti, M., Stoye, M., Stakia, A.: Jet flavour classification us- ing DeepJet. Journal of Instrumentation15(12), 12012 (2020) https://doi.org/10.1088/1748-0221/ 15/12/p12012

    doi:10.1088/1748-0221/ 2020

  42. [43]

    [Accessed: 02.09.2025] (2020)

    DL4Jets: DeepJet: Repository for training and evaluation of deep neural networks for jet iden- tification. [Accessed: 02.09.2025] (2020). https:// github.com/DL4Jets/DeepJet 11

    2025

  43. [44]

    https://doi.org/ 10.48550/arXiv.1502.03167

    Ioffe, S., Szegedy, C.: Batch Normalization: Ac- celerating Deep Network Training by Reducing Internal Covariate Shift (2015). https://doi.org/ 10.48550/arXiv.1502.03167

    Pith/arXiv arXiv doi:10.48550/arxiv.1502.03167 2015

  44. [45]

    Pattern Recognition 30(7), 1145–1159 (1997) https://doi.org/10.1016/ S0031-3203(96)00142-2

    Bradley, A.P.: The use of the area under the ROC curve in the evaluation of ma- chine learning algorithms. Pattern Recognition 30(7), 1145–1159 (1997) https://doi.org/10.1016/ S0031-3203(96)00142-2

    1997

  45. [46]

    Pattern Recognition Letters27(8), 861– 874 (2006) https://doi.org/10.1016/j.patrec.2005

    Fawcett, T.: An introduction to ROC anal- ysis. Pattern Recognition Letters27(8), 861– 874 (2006) https://doi.org/10.1016/j.patrec.2005. 10.010 . ROC Analysis in Pattern Recognition

    work page doi:10.1016/j.patrec.2005 2006

  46. [47]

    Ice- Cube portal for public data releases

    The IceCube Collaboration: Data Releases. Ice- Cube portal for public data releases. https:// icecube.wisc.edu/science/data-releases/ 12

  47. [268]

    https: //doi.org/10.1007/978-3-319-42115-5

    Springer Cham, ??? (2017). https: //doi.org/10.1007/978-3-319-42115-5

    work page doi:10.1007/978-3-319-42115-5 2017