arxiv: 2605.07590 · v1 · submitted 2026-05-08 · 💻 cs.CV

Recognition: 2 theorem links

· Lean Theorem

Beyond Defenses: Manifold-Aligned Regularization for Intrinsic 3D Point Cloud Robustness

Pedro Alonso , Chongshou Li , Tianrui Li

Authors on Pith no claims yet

Pith reviewed 2026-05-11 02:02 UTC · model grok-4.3

classification 💻 cs.CV

keywords point cloud robustnessadversarial attacksmanifold alignmentintrinsic geometryconsistency regularization3D deep learningModelNet40ScanObjectNN

0 comments

The pith

By aligning latent features with the intrinsic manifold geometry of point clouds, MAPR improves adversarial robustness without adversarial training or extra data.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that adversarial attacks on 3D point cloud classifiers succeed because the model's learned geometry in feature space drifts away from the actual surface manifold of the object. Small changes that stay on the surface in 3D space can cause large jumps in the model's internal representation. To fix this root misalignment, the authors add local curvature and diffusion features to each point cloud and train the network to keep the same prediction when the input is perturbed along the manifold. This consistency regularization raises average robustness by more than 20 percent on ModelNet40 and 8 percent on ScanObjectNN across several attacks. The method works on top of existing architectures and does not require generating adversarial examples during training.

Core claim

Adversarial vulnerability arises from misalignment between the latent geometry learned by 3D networks and the intrinsic geometry of the point cloud surface; MAPR corrects this by augmenting inputs with intrinsic curvature and diffusion features and enforcing prediction invariance under geometry-preserving perturbations via a consistency loss.

What carries the argument

Manifold-Aligned Point Recognition (MAPR), a regularization framework that augments point clouds with intrinsic features and applies a consistency loss across intrinsic perturbations to align latent and intrinsic geometries.

If this is right

Robustness gains of +20.02% on ModelNet40 and +8.58% on ScanObjectNN hold across multiple adversarial attacks.
Clean accuracy is preserved since the method avoids adversarial training and extra data.
The framework applies to standard point cloud networks without requiring architectural changes.
Intrinsic perturbations expose misalignment that standard Euclidean perturbations overlook.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Similar manifold misalignment may explain fragility in other geometric data such as meshes or graphs.
Extending the consistency loss to additional intrinsic operators could produce further robustness gains.
Models trained with MAPR might generalize better to out-of-distribution shapes that respect the same manifold structure.

Load-bearing premise

Adversarial vulnerability stems mainly from latent-intrinsic geometry misalignment, and enforcing consistency on intrinsic perturbations fixes the root cause without creating new weaknesses or hurting clean performance.

What would settle it

If a model trained with MAPR shows no robustness improvement or loses clean accuracy under the same attacks on ModelNet40 and ScanObjectNN, or if the consistency loss fails to reduce feature-space distortion for manifold-preserving perturbations.

Figures

Figures reproduced from arXiv: 2605.07590 by Chongshou Li, Pedro Alonso, Tianrui Li.

**Figure 2.** Figure 2: Intrinsic–latent alignment analysis on the ModelNet40 [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

read the original abstract

Despite extensive progress in point cloud robustness, existing methods primarily improve performance through augmentation or defense mechanisms, while overlooking the geometric root cause of adversarial fragility. We hypothesize that adversarial vulnerability in 3D networks arises from a manifold misalignment between the latent geometry learned by the model and the intrinsic geometry of the underlying surface. Small, geometry-preserving perturbations along the input manifold often induce disproportionate distortions in feature space, revealing a misalignment between latent and intrinsic geometries. We formalize this phenomenon by developing a geometric interpretation of 3D robustness that links classical adversarial theory to the intrinsic structure of point clouds. Motivated by this analysis, we introduce Manifold-Aligned Point Recognition (MAPR), a framework that regularizes the latent geometry by aligning predictions across intrinsic perturbations. MAPR augments each point cloud with intrinsic features capturing local curvature and diffusion structure, and applies a consistency loss that preserves invariance to intrinsic, geometry-preserving perturbations. Without relying on adversarial training or additional data, MAPR consistently improves robustness across multiple adversarial attacks on both the ModelNet40 and ScanObjectNN datasets, achieving average robustness gains of +20.02% and +8.58% on ModelNet40 and ScanObjectNN, respectively.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper offers a geometric take on point cloud robustness via intrinsic features and consistency loss, but the abstract leaves the mechanism unverified and the experiments too thin to judge.

read the letter

The main thing here is a regularization method called MAPR that adds local curvature and diffusion features to point clouds and then enforces prediction consistency under intrinsic, geometry-preserving perturbations. They claim this fixes a root misalignment between latent and manifold geometry, delivering +20% robustness on ModelNet40 and +8.5% on ScanObjectNN across attacks, all without adversarial training or extra data. That framing is new relative to the usual defense or augmentation papers. It pulls in classical adversarial ideas and tries to ground them in actual surface geometry, which is a cleaner angle than most current work. The practical upside is clear: no need for attack generation during training. The numbers look decent on the surface. The soft spot is that we only have the abstract. No baselines listed, no ablation on whether the curvature/diffusion choice matters versus any added invariance, no clean-accuracy trade-off numbers, and no diagnostic showing that feature-space distortion actually shrinks after the loss. Without those, the gains could just be generic regularization rather than the hypothesized manifold alignment. The hypothesis itself is reasonable and not circular on paper, but it stays untested here. This is for people working on 3D robustness in vision or robotics who want alternatives to adversarial training. It deserves a serious referee round because the direction is coherent and the reported effect size is large enough to check, even if the current write-up needs the missing controls and full methods to hold up.

Referee Report

2 major / 2 minor

Summary. The manuscript introduces Manifold-Aligned Point Recognition (MAPR), a regularization framework for 3D point cloud networks. It hypothesizes that adversarial vulnerability arises from misalignment between the model's latent geometry and the intrinsic geometry of the underlying point cloud surface. The approach augments each point cloud with intrinsic features for local curvature and diffusion structure, then applies a consistency loss to enforce prediction invariance under geometry-preserving intrinsic perturbations. Without adversarial training or additional data, MAPR is reported to improve robustness across multiple attacks, with average gains of +20.02% on ModelNet40 and +8.58% on ScanObjectNN.

Significance. If the robustness gains are shown to stem specifically from manifold alignment (rather than generic regularization or feature augmentation), this work could provide a new geometric perspective on adversarial fragility in point clouds. It offers a potential alternative to adversarial training that is computationally lighter and grounded in classical differential geometry, with possible extensions to other geometric data modalities.

major comments (2)

Abstract: The abstract reports concrete robustness gains of +20.02% and +8.58% but supplies no experimental details, baselines, attack implementations, statistical tests, or ablation studies. Without these, the link between the proposed regularization and the observed gains cannot be verified, which is load-bearing for the central claim.
Hypothesis and method sections: The claim that adversarial fragility is primarily caused by latent-intrinsic geometry misalignment, and that the consistency loss on curvature/diffusion perturbations specifically corrects this root cause, requires supporting evidence. Absent ablations isolating the intrinsic perturbation choice (e.g., vs. random or non-geometric augmentations) or geometric diagnostics such as pre/post feature-space distortion metrics, the gains could arise from any added invariance rather than the hypothesized manifold alignment.

minor comments (2)

Clarify the precise definition of 'intrinsic perturbations' and the alignment metric early in the paper, including whether the metric has independent grounding outside the optimization.
Ensure reproducibility by detailing the exact form of the consistency loss, the feature augmentation procedure, and all hyperparameters in the experimental section.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive feedback on our manuscript. We have prepared point-by-point responses to the major comments and have made revisions to the manuscript to address the concerns raised, particularly by enhancing the abstract and providing additional supporting evidence for our hypothesis.

read point-by-point responses

Referee: Abstract: The abstract reports concrete robustness gains of +20.02% and +8.58% but supplies no experimental details, baselines, attack implementations, statistical tests, or ablation studies. Without these, the link between the proposed regularization and the observed gains cannot be verified, which is load-bearing for the central claim.

Authors: We agree with the referee that the abstract, as currently written, is too concise and does not provide sufficient context for the reported numbers. In the revised manuscript, we have expanded the abstract to include key experimental details such as the datasets (ModelNet40 and ScanObjectNN), the adversarial attacks considered (e.g., PGD, CW), and that the gains are reported as averages over multiple models with standard deviations. We also briefly note the baselines used. Full experimental protocols, implementation details, statistical analysis, and ablation studies are extensively documented in Sections 4 and 5 of the paper. This revision should make the claims more verifiable while adhering to abstract length guidelines. revision: yes
Referee: Hypothesis and method sections: The claim that adversarial fragility is primarily caused by latent-intrinsic geometry misalignment, and that the consistency loss on curvature/diffusion perturbations specifically corrects this root cause, requires supporting evidence. Absent ablations isolating the intrinsic perturbation choice (e.g., vs. random or non-geometric augmentations) or geometric diagnostics such as pre/post feature-space distortion metrics, the gains could arise from any added invariance rather than the hypothesized manifold alignment.

Authors: We appreciate this critique, as it directly targets the core contribution of our work. The manuscript does provide a formal geometric analysis in Section 3 that connects adversarial vulnerability to manifold misalignment, including derivations linking perturbations to feature distortions. However, to more rigorously isolate the effect of our intrinsic perturbations, we have added new ablation studies in the revised manuscript. These compare the full MAPR (with curvature and diffusion features) against variants using random perturbations and standard augmentations like rotation and scaling. The results indicate that only the manifold-aligned perturbations achieve the full robustness gains, with generic methods showing minimal improvement. Additionally, we have incorporated geometric diagnostics in Section 5, including metrics for latent-intrinsic alignment (e.g., Procrustes distance in feature space) before and after applying the consistency loss, showing a clear reduction in distortion attributable to our method. These additions provide direct evidence supporting our hypothesis over alternative explanations. revision: yes

Circularity Check

0 steps flagged

No significant circularity; derivation remains self-contained against external geometric benchmarks.

full rationale

The paper grounds its hypothesis in classical adversarial theory and intrinsic manifold geometry (curvature and diffusion features), then defines MAPR's consistency loss directly over geometry-preserving perturbations of the input surface. No quoted equations or steps reduce the alignment metric, the consistency loss, or the reported robustness gains to a fitted parameter renamed as prediction, a self-citation chain, or a self-definitional loop. The central claim that misalignment causes fragility is presented as a motivating hypothesis whose validity is tested empirically on ModelNet40 and ScanObjectNN rather than assumed by construction; the regularization itself is an independent intervention whose effect is measured against external attack benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim rests on one domain assumption about the geometric origin of vulnerability and introduces one new framework entity without independent external evidence; no free parameters are explicitly listed in the abstract.

axioms (1)

domain assumption Adversarial vulnerability in 3D networks arises from a manifold misalignment between the latent geometry learned by the model and the intrinsic geometry of the underlying surface.
Stated as the motivating hypothesis in the abstract; no proof or external validation is provided.

invented entities (1)

Manifold-Aligned Point Recognition (MAPR) framework no independent evidence
purpose: Regularizes latent geometry by aligning predictions across intrinsic, geometry-preserving perturbations using added curvature and diffusion features plus consistency loss.
Newly introduced regularization approach; no independent falsifiable evidence outside the paper is mentioned.

pith-pipeline@v0.9.0 · 5516 in / 1367 out tokens · 54297 ms · 2026-05-11T02:02:05.555039+00:00 · methodology

discussion (0)

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

IndisputableMonolith/Cost/FunctionalEquation.lean washburn_uniqueness_aczel (J-cost uniqueness) unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

We hypothesize that adversarial vulnerability in 3D networks arises from a manifold misalignment between the latent geometry learned by the model and the intrinsic geometry of the underlying surface... L_cons ≈ E_x [ ||J_fθ(x) J_Φ^{-1}(x) - I||_F^2 ]
IndisputableMonolith/Foundation/AlexanderDuality.lean alexander_duality_circle_linking (D=3 forcing) unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

point clouds lie on a low-dimensional manifold embedded in R^3... intrinsic structure—captured by geodesic distances, curvature, and surface continuity

What do these tags mean?

matches: The paper's claim is directly supported by a theorem in the formal canon.
supports: The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends: The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses: The paper appears to rely on the theorem as machinery.
contradicts: The paper's claim conflicts with a theorem or certificate in the canon.
unclear: Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

34 extracted references · 34 canonical work pages · 2 internal anchors

[1]

Nicholas Carlini and David A. Wagner. Towards eval- uating the robustness of neural networks.2017 IEEE Symposium on Security and Privacy (SP), pages 39– 57, 2016. 1

work page 2017
[2]

Yunlu Chen, Vincent Tao Hu, Efstratios Gavves, Thomas Mensink, Pascal Mettes, Pengwan Yang, and Cees G. M. Snoek. Pointmixup: Augmentation for point clouds. InComputer Vision – ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part III, page 330–345, Berlin, Heidelberg, 2020. Springer-Verlag. 1, 3

work page 2020
[3]

Analysis of classifiers’ robustness to adversarial per- turbations.Machine Learning, 107:481–508, 2015

Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Analysis of classifiers’ robustness to adversarial per- turbations.Machine Learning, 107:481–508, 2015. 2

work page 2015
[4]

Explaining and Harnessing Adversarial Examples

Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial ex- amples, 2014. cite arxiv:1412.6572. 2, 7

work page internal anchor Pith review arXiv 2014
[5]

Advpc: Transferable adversarial pertur- bations on 3d point clouds

Abdullah Hamdi, Sara Rojas, Ali Thabet, and Bernard Ghanem. Advpc: Transferable adversarial pertur- bations on 3d point clouds. InComputer Vision – ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XII, page 241–257, Berlin, Heidelberg, 2020. Springer-Verlag. 3

work page 2020
[6]

Adversarial examples are not bugs, they are features

Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. InAdvances in Neural Information Process- ing Systems. Curran Associates, Inc., 2019. 2

work page 2019
[7]

Minimal adversarial examples for deep learning on 3d point clouds

Jaeyeon Kim, Binh-Son Hua, Duc Thanh Nguyen, and Sai-Kit Yeung. Minimal adversarial examples for deep learning on 3d point clouds. In2021 IEEE/CVF In- ternational Conference on Computer Vision (ICCV), pages 7777–7786, 2021. 3

work page 2021
[8]

Adam: A Method for Stochastic Optimization

Diederik P Kingma. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014. 7

work page internal anchor Pith review Pith/arXiv arXiv 2014
[9]

Adversarial examples in the physical world,

Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world.arXiv e- prints, art. arXiv:1607.02533, 2016. 7

work page arXiv 2016
[10]

Regularization strategy for point cloud via rigidly mixed sample

Dogyoon Lee, Jaeha Lee, Junhyeop Lee, Hyeong- min Lee, Minhyeok Lee, Sungmin Woo, and Sangy- oun Lee. Regularization strategy for point cloud via rigidly mixed sample. In2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15895–15904, 2021. 1, 3

work page 2021
[11]

Adversarial shape perturbations on 3D point clouds.arXiv e-prints, art

Daniel Liu, Ronald Yu, and Hao Su. Adversarial shape perturbations on 3D point clouds.arXiv e-prints, art. arXiv:1908.06062, 2019. 3

work page arXiv 1908
[12]

Extending ad- versarial attacks and defenses to deep 3d point cloud classifiers

Daniel Liu, Ronald Yu, and Hao Su. Extending ad- versarial attacks and defenses to deep 3d point cloud classifiers. In2019 IEEE International Conference on Image Processing (ICIP), pages 2279–2283, 2019. 1, 3

work page 2019
[13]

Rethinking network design and local geometry in point cloud: A simple residual MLP framework

Xu Ma, Can Qin, Haoxuan You, Haoxi Ran, and Yun Fu. Rethinking network design and local geometry in point cloud: A simple residual MLP framework. In The Tenth International Conference on Learning Rep- resentations, ICLR 2022, Virtual Event, April 25-29,

work page 2022
[14]

OpenReview.net, 2022. 3

work page 2022
[15]

arXiv preprint arXiv:2202.07123 , year=

Xu Ma, Can Qin, Haoxuan You, Haoxi Ran, and Yun Raymond Fu. Rethinking network design and lo- cal geometry in point cloud: A simple residual mlp framework.ArXiv, abs/2202.07123, 2022. 6

work page arXiv 2022
[16]

To- wards deep learning models resistant to adversarial at- tacks

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial at- tacks. 2017. 6, 7

work page 2017
[17]

On the number of linear regions of deep neural networks

Guido Mont ´ufar, Razvan Pascanu, Kyunghyun Cho, and Yoshua Bengio. On the number of linear regions of deep neural networks. InProceedings of the 28th International Conference on Neural Information Pro- cessing Systems - V olume 2, page 2924–2932, Cam- bridge, MA, USA, 2014. MIT Press. 2

work page 2014
[18]

Qi, Hao Su, Kaichun Mo, and Leonidas J

Charles R. Qi, Hao Su, Kaichun Mo, and Leonidas J. Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017. 2, 6

work page 2017
[19]

Pointnet++: Deep hierarchical feature learn- ing on point sets in a metric space

Charles Ruizhongtai Qi, Li Yi, Hao Su, and Leonidas J Guibas. Pointnet++: Deep hierarchical feature learn- ing on point sets in a metric space. InAdvances in Neural Information Processing Systems. Curran As- sociates, Inc., 2017. 2, 3, 6

work page 2017
[20]

Intriguing properties of neural networks,

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks,

work page
[21]

Qi, Jean-Emmanuel De- schaud, Beatriz Marcotegui, Franc ¸ois Goulette, and Leonidas Guibas

Hugues Thomas, Charles R. Qi, Jean-Emmanuel De- schaud, Beatriz Marcotegui, Franc ¸ois Goulette, and Leonidas Guibas. Kpconv: Flexible and deformable convolution for point clouds. In2019 IEEE/CVF In- ternational Conference on Computer Vision (ICCV), pages 6410–6419, 2019. 3

work page 2019
[22]

Revisiting point cloud classification: A new benchmark dataset and classification model on real-world data

Mikaela Angelina Uy, Quang-Hieu Pham, Binh-Son Hua, Thanh Nguyen, and Sai-Kit Yeung. Revisiting point cloud classification: A new benchmark dataset and classification model on real-world data. In2019 IEEE/CVF International Conference on Computer Vi- sion (ICCV), pages 1588–1597, 2019. 2

work page 2019
[23]

Sarma, Michael M

Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E. Sarma, Michael M. Bronstein, and Justin M. Solomon. Dy- namic graph cnn for learning on point clouds.ACM Trans. Graph., 38(5), 2019. 2, 3, 6

work page 2019
[24]

Yuxin Wen, Jiehong Lin, Ke Chen, C. L. Philip Chen, and Kui Jia. Geometry-Aware Generation of Adversarial Point Clouds.arXiv e-prints, art. arXiv:1912.11171, 2019. 3

work page arXiv 1912
[25]

Kwiatkowska

Matthew Wicker and M. Kwiatkowska. Robustness of 3d deep learning in an adversarial setting.2019 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 11759–11767, 2019. 3

work page 2019
[26]

3d shapenets: A deep representation for volumetric shapes

Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR),

work page
[27]

Ziyi Wu, Yueqi Duan, He Wang, Qingnan Fan, and Leonidas J. Guibas. IF-Defense: 3D Adversarial Point Cloud Defense via Implicit Function based Restora- tion.arXiv e-prints, art. arXiv:2010.05272, 2020. 3

work page arXiv 2010
[28]

Qi, and Bo Li

Chong Xiang, Charles R. Qi, and Bo Li. Generating 3d adversarial point clouds. In2019 IEEE/CVF Con- ference on Computer Vision and Pattern Recognition (CVPR), pages 9128–9136, 2019. 1, 3

work page 2019
[29]

Walk in the cloud: Learning curves for point clouds shape analysis

Tiange Xiang, Chaoyi Zhang, Yang Song, Jianhui Yu, and Weidong Cai. Walk in the cloud: Learning curves for point clouds shape analysis. pages 895–904, 2021. 3, 6

work page 2021
[30]

Adversarial attack and defense on point sets.ArXiv, abs/1902.10899,

Jiancheng Yang, Qiang Zhang, Rongyao Fang, Bing- bing Ni, Jinxian Liu, and Qi Tian. Adversarial attack and defense on point sets.ArXiv, abs/1902.10899,

work page arXiv 1902
[31]

Defense Against Adversarial Attacks Using Feature Scattering- based Adversarial Training.arXiv e-prints, art

Haichao Zhang and Jianyu Wang. Defense Against Adversarial Attacks Using Feature Scattering- based Adversarial Training.arXiv e-prints, art. arXiv:1907.10764, 2019. 1, 3

work page arXiv 1907
[32]

Pointcloud saliency maps

Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. Pointcloud saliency maps. InPro- ceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019. 3, 6

work page 2019
[33]

DUP-Net: Denoiser and Upsampler Network for 3D Adver- sarial Point Clouds Defense.arXiv e-prints, art

Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. DUP-Net: Denoiser and Upsampler Network for 3D Adver- sarial Point Clouds Defense.arXiv e-prints, art. arXiv:1812.11017, 2018. 1, 3

work page arXiv 2018
[34]

LG-GAN: Label Guided Ad- versarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networks.arXiv e-prints, art

Hang Zhou, Dongdong Chen, Jing Liao, Weiming Zhang, Kejiang Chen, Xiaoyi Dong, Kunlin Liu, Gang Hua, and Nenghai Yu. LG-GAN: Label Guided Ad- versarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networks.arXiv e-prints, art. arXiv:2011.00566, 2020. 3 12

work page arXiv 2011