Pith. sign in

REVIEW 4 major objections 6 minor 32 references

Adversarially Robust Abductive Fusion of Pre-trained Transformer-based Perception Models

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Error-detection rules for fusing pretrained detectors can be learned from each model's own embedding geometry, matching hand-built rules within 0.002 F1 and keeping F1 high when majority voting collapses under coordinated label-flip…

desk verdict Real result, narrower than the abstract claims: ghost detections are removed from the benchmark, and clean-data F1 appears selected on test data. read the letter →

arxiv 2608.04190 v1 pith:4CHYJBJH submitted 2026-08-04 cs.AI cs.CVcs.LGcs.LO

Mario Leiva , Yue Ma , Qinru Qiu , Gerardo Simari , Paulo Shakarian This is my paper · ORCID
classification cs.AIcs.CVcs.LGcs.LO
keywords abductivereasoningmetacognitiveerrordetectionlabelvectorpoolconsistency-basedfusionadversarialrobustnessdistributionshiftobjectneuro-symbolic
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Several pretrained object detectors deployed in a new environment make errors that no single model can flag by itself, and combining them by majority vote trades recall for precision and is easily destabilized. This paper tries to show that the missing error-detection layer can be learned without any domain knowledge: for each detector and class, it clusters the detector's own training embeddings into a small pool of prototypes, and uses distances to those prototypes as the sole cue for whether a new detection is an error. Wrapped in a logic-based combiner that accepts predictions by cross-model consistency rather than vote count, this layer matches the best majority-vote baseline on clean data and keeps its F1 when a coordinated minority of models is forced to agree on wrong labels, while majority voting degrades. The concrete claim is that on 15 weather-shifted aerial test sets, the consistency-based combiner reaches the highest F1 on every set once the flip rate exceeds 0.4, and averages 0.42 versus 0.35 for plurality voting at a 90% flip rate.

What carries the argument

The load-bearing object is the per-(model, class) Label Vector Pool (LVP). For a detector $i$ and class $c$, training-detection embeddings are clustered with $k$-means into three prototype vectors, and a new detection with embedding $e$ is mapped to the distance vector $\phi(e)\in\mathbb{R}^{3m}$ (12 features for 4 classes); a per-(model, class) Random Forest turns $\phi(e)$ into an error probability, and the rule learner thresholds it into the logical predicate $error(i,c,\omega)$. The second half of the machinery is the abduction layer: a hypothesis $H$ of accepted (model, class) atoms is scored by the number of object-class assignments it entails, $\mathrm{Pred}(H)$, subject to an inconsistency budget $\mathrm{Inc}(H)\le\delta$, solved exactly by an Integer Program or greedily by a polynomial Heuristic Search, with an optional confidence tie-breaker. The defining property is that acceptance depends on cross-model consistency, not on raw vote counts.

What would settle it

Run the full pipeline on a benchmark where ghost detections are kept in the F1 computation and the coordinated attack can flip labels of both matched and unmatched detections; if the consistency-based combiner's F1 at a 90 percent flip rate drops to the level of majority voting, or the LVP error detector's precision on ghost boxes is near chance, the robustness result is confined to the cleaned benchmark.

Watch

Extended reading notes

Core claim

The central claim is that the metacognitive layer of a multi-model perception system can be learned with no domain knowledge, and that combining the learned rules with consistency-based abduction makes the ensemble robust to a coordinated attack that defeats majority voting. For each detector and each class, the paper builds a Label Vector Pool: the detector's own training embeddings are clustered with k-means into three prototypes, a new detection is represented by its Euclidean distances to all prototypes, and a per-(model, class) Random Forest converts those distances into an error probability. Thresholding that probability yields an error-detection rule in the same logical form used by prior hand-authored rules, and the paper reports that this geometric signal reaches the same downstream F1 as domain-knowledge rules to within 0.002 on the test sets. The remaining machinery is a consistency-based abduction problem: choose a subset of accepted predictions maximizing coverage subject to a bounded number of logical conflicts; an exact integer program and a polynomial heuristic solve it. On 15 weather-shifted aerial test sets the combiner matches the best majority-vote variant on clean data, then takes the highest F1 on every set once the coordinated label-flip probability exceeds 0.4.

Load-bearing premise

The load-bearing premise is that F1 is computed after deleting ghost detections, so the LVP error detector is trained and evaluated only on label mismatches of detections that already match ground-truth objects; hallucinated boxes, and attacks on them, lie outside the evidence.

Editorial extensions

If this is right

  • A metacognitive error-detection layer can be built for a new scene from each model's own training embeddings alone, matching hand-authored domain rules within 0.002 F1 and needing no segmentation masks, size priors, or other scene artifacts.
  • Consistency-based acceptance instead of vote counting changes the adversarial profile of an ensemble: at flip rates of 0.4 and above the combiner is best or tied on every one of the 15 test sets, and the F1 gap over plurality voting grows monotonically with attack rate.
  • The approach stays practical: the polynomial heuristic solves full scenarios in 1.9-19.7 seconds with 1.4-3.0 ms per object on CPU, while the exact integer program remains solvable at the tested scale despite being NP-hard in general.
  • The same pipeline transfers to a two-detector RGB plus infrared ensemble, where clean data leaves nothing to abduce and degenerates to majority vote, but under the coordinated attack the abductive combiner stays above every baseline for all attack rates at or above 0.1.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's scoring protocol removes ghost detections before computing F1, so the reported robustness is specifically about label errors on objects that exist; a benchmark that counts hallucinated boxes, or an attack that flips labels of unmatched detections, would test a failure mode the LVP detector was not trained on.
  • LVP and domain-knowledge rules flag nearly disjoint errors (about 4.7 percent overlap in one reported scenario); a combination that lets one signal veto rather than add to the other might capture both failure modes without the over-filtering the authors observed when taking unions or intersections.
  • The attack model flips labels but leaves embedding vectors intact; an adversary that also perturbs embeddings toward the correct prototype pool could evade the LVP detector, which would bound the robustness guarantee more sharply.
  • The LVP distance vector is a per-detection out-of-distribution score; the paper uses it only inside the ensemble, but the same score could serve as a single-model novelty alarm in a deployment setting.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a domain-knowledge-free metacognitive layer for fusing several pre-trained ViT-based object detectors. The layer builds per-(model,class) Label Vector Pools from each model's training embeddings, trains a Random Forest to predict an error probability from distances to these prototypes, and converts the scores into logical error-detection rules via a rule learner. The rules are embedded in a consistency-based abduction framework, solved at test time by an exact Integer Program or a polynomial-time heuristic, with an optional confidence tie-breaker. The authors report that the LVP-based rules match hand-authored domain-knowledge rules to within 0.002 F1, that the abductive combiner matches majority voting on clean data, and that it degrades far more gracefully than majority-vote baselines under a coordinated label-flip attack, attaining 0.42 F1 vs 0.35 for MV-Plurality at a 90% flip rate. Experiments are on a 15-test-set aerial benchmark (MDS-A) with six weather-specialized detectors and on the multimodal DroneVehicle dataset.

Significance. If the central claims hold at the detection level, the contribution would be significant: a metacognitive error-detection layer that transfers to novel scenes without scene-specific artifacts, combined with a principled consistency-based combiner that is robust to coordinated attacks against the voting process. The formalization of the fusion problem as abductive hypothesis selection and the availability of both an exact IP and a fast heuristic are strengths, as are the runtime analysis and the complementary-error analysis between LVP and domain-knowledge rules. However, the main experimental protocol removes ghost detections with an oracle before scoring, so the reported F1 values and the robustness numbers apply to label-error classification on ground-truth-matched objects rather than to the full detection outputs implied by the title and abstract. The significance of the contribution would be substantially higher if the evaluation were re-run on unfiltered detection outputs with a combiner that can reject detections.

major comments (4)
  1. [Experimental Setup (main text) and Supp. Sec. A] The benchmark removes all detections that do not match any ground-truth object before computing F1, yet Supp. Sec. A states that unmatched detections are 'kept as their own object identifiers (FP-detections)'. These statements are inconsistent, and under the main-text protocol every reported MDS-A F1 is computed on ground-truth-matched boxes only. This converts the evaluation from detection to label-error classification on known objects, and the abstract and title claim a perception-level result without this caveat. Please either re-run the evaluation on the full detection output, including ghost detections, or explicitly scope all claims to label-error classification.
  2. [Consistency-based Abduction, IP formulation] The IP constraint Σ_c A_{c,ω} ≥ 1 forces every object ω to receive at least one class label, so the combiner cannot reject a ghost detection outright. In the current benchmark ghosts are removed before scoring, so this constraint is consistent with the filtered protocol; however, it means the method has no mechanism for false-positive rejection, which the Conclusions confirm by listing 'automatic FP-detection without an oracle' as future work. The advertised robustness and parity claims therefore do not yet cover hallucinated detections. The authors should either remove this constraint and re-evaluate with ghosts included, or state that false-positive rejection is outside the scope of the current method.
  3. [LVP vs. DK results, Table 2 and Supp. Fig. 10] The parity claim is presented as a property of the LVP layer, but Supp. Fig. 10 shows that the reported values are maximum F1 over the ε operating-point grid per test set. With the operating point selected on test data, the 'within 0.002 F1' comparison is an upper envelope over hyperparameters rather than a fixed-configuration result. Please report the performance of a single configuration selected without test labels, for example by validation, or state explicitly that the comparison is the per-test-set best over the ε grid.
  4. [Supp. Table 5 and Results] The LVP error detector itself has mean recall 0.19 and F1 0.31 averaged over the 15 test scenarios, yet the downstream combiner reportedly matches the DK rules to within 0.002 F1. The paper does not provide an ablation with the LVP rules removed from the abduction stage, so it is unclear how much of the parity is attributable to the learned metacognitive layer rather than to the consistency-based combiner itself. Please add this ablation and discuss how such a weak per-detector signal can still produce the reported downstream performance.
minor comments (6)
  1. [Abstract] The phrase 'within 0.002 every F1 on test set' is ungrammatical and should be 'within 0.002 F1 on every test set' or similar.
  2. [Table 2] The caption and text refer to five test sets, but the table lists only four rows; the fifth test set appears in Supp. Fig. 10.
  3. [Results, Clean-data performance] The text says the methods are 'statistically on par' with MV-Plurality, but no statistical test is reported; either add significance testing or rephrase.
  4. [Algorithm 1 description] The description contains the typo 'greedly' instead of 'greedily'.
  5. [Supp. Table 5] The column labeled 'Backbone model' actually lists weather conditions (dust, fog, maple, rain, snow, normal); use a label that matches the content.
  6. [Heuristic Search complexity] The stated O(|F|·|C|·|E_set|) bound for HS treats CalcIncon as O(1); if the inconsistency computation depends on the number of accepted predictions, the stated polynomial-time bound should be qualified.

Circularity Check

1 steps flagged · score 5.0 of 10

Clean-data parity claim is a test-set-selected maximum; adversarial-robustness core is independent.

  1. fitted input called prediction [Main text Table 2 and Supplementary Material Sec. G (Figure 10 caption)]
    "Figure 10: Comparison of maximum F1 scores across five clean test sets for individual detection methods (LVP-alone and DK-alone) versus their logical combinations (Union, LVP∪DK, and Intersection, LVP∩DK). Results are shown for both HS+TB and IP+TB abductive steps."

    The main-text Table 2 'headline' parity values (e.g., AM_1: IP+TB (LVP)=0.3420 vs IP+TB (DK)=0.3438) are the same numbers the supplement reports as 'maximum F1 scores' obtained by sweeping the rule-learner strictness/epsilon grid on each test set. The reported F1 is therefore the upper envelope of a test-set-selected operating point, not the output of a fixed configuration learned from training data. Stating that LVP 'reaches parity ... within 0.002' on this basis presents a selection result as an achieved prediction; the parity is relative to the maximum over the same test sets, so the claim does not establish out-of-sample parity for a single learned rule set.

full rationale

The core LVP pipeline is not circular: pools and Random Forest detectors are built from each model's own training detections, and the paper states rules are learned independently per model from training data only, with no test-time leakage and no cross-model coupling. The adversarial label-flip evaluation reuses LVP classifiers and EDR rules learned on clean data with no retraining per attack, so the 0.42 vs 0.35 margin is an external empirical result. The main circularity is confined to the clean-data LVP-vs-DK parity: Table 2's numbers are 'maximum F1 scores' from a per-test-set sweep, so the 0.002 gap is between test-set-selected maxima rather than fixed out-of-sample configurations. This does not infect the attack-robustness contribution, which is why the score is moderate rather than high. Separately, the benchmark eliminates ghost detections before scoring, and the constraints force at least one class per object; the conclusions explicitly list 'automatic FP-detection without an oracle' as future work. This is a scope limitation on the detection-level claim, not a circular derivation, and I do not count it as a circular step. Self-citations to Leiva et al. 2026 and Ma et al. 2025 supply the baseline and the LVP idea respectively; they are not load-bearing unverified theorems.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The pipeline introduces no new physical entities. The main burden is the untested hypothesis that LVP distance features generalize as error signals, plus undisclosed operating points (epsilon, delta) that materially affect all reported F1 numbers.

free parameters (7)
  • k (k-means cluster count per class pool) = 3
    Number of sub-prototypes per class in LVP; no sensitivity analysis reported.
  • Random Forest hyperparameters = not reported (selected by 3-fold CV)
    Selected per (model, class) on training data.
  • LVP error-probability threshold grid tau = not reported
    Grid of thresholds used to generate monotone rule conditions.
  • Rule-learner strictness epsilon = not reported; swept
    Controls filtering aggressiveness; results may be max over epsilon per test set.
  • Inconsistency budget delta = not reported; swept/heuristic
    Bounds allowed logical inconsistency; selection not disclosed.
  • Detection confidence threshold = 0.7
    Fixed detector output threshold inherited from ViTDet config.
  • IoU matching threshold = 0.5
    Standard matching threshold; basis of unique-name assumption.
assumptions (5)
  • domain assumption Unique-name assumption: each detection maps to at most one ground-truth object via highest-IoU matching at IoU>=0.5.
    Defines object identity in the perception framework; ghost detections kept as own objects in logic but removed in evaluation.
  • standard math Integrity constraint: an object cannot receive two different class labels.
    Task-inherent mutual exclusivity; the only domain knowledge retained in the consistency layer.
  • domain assumption Euclidean distances to per-class prototype pools are predictive of label errors.
    Core hypothesis of the LVP error detector; evaluated only on the filtered (label-error) task.
  • standard math Stratification and limited negation make logical inference monotonic and tractable (PyReason).
    Justifies computability of entailment in the abduction problem.
  • ad hoc to paper Inc(H) as normalized count of violated integrity constraints.
    Modeling choice for the abduction objective; the delta budget semantics depends on it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarially Robust Abductive Fusion of Pre-trained Transformer-based Perception Models." pith.science (2026). https://pith.science/paper/4CHYJBJH

@misc{pith2026260804190,
  author       = {Pith},
  title        = {Pith review of: Adversarially Robust Abductive Fusion of Pre-trained Transformer-based Perception Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4CHYJBJH}},
  note         = {Machine review of arXiv:2608.04190}
}
abstract

Deploying pre-trained perception models in novel environments degrades their accuracy under distributional shift, and assembling them alone does not recover it: combiners such as majority voting trade recall for precision and are brittle to coordinated failures. Prior metacognitive methods learn logical rules that flag a model's errors, but rely on hand-authored domain-knowledge cues (object-size priors, segmentation masks) that do not transfer to genuinely novel scenes. We show that this metacognitive layer can be learned without any domain knowledge by exploiting vector-space geometry: per-model Label Vector Pools (LVP), built from each model's own training embeddings, yield error-detection rules from the geometry of detections relative to training-determined prototypes, reaching parity with domain-knowledge rules to within $0.002$ every F1 on test set. Because the approach remains neurosymbolic, these geometric rules share a single logical framework and can still be complemented by domain knowledge when available. We frame the fusion of multiple imperfect ViT-based detectors as a consistency-based abduction problem solved at test time by an exact Integer Program (IP) and a polynomial-time heuristic. On an aerial-imagery benchmark of 15 weather-shifted test sets and six ViT detectors, our domain-knowledge-free layer matches the strongest majority-vote variant on clean data (within $0.005$ F1) and, unlike every majority-vote baseline, retains its performance under a coordinated label-flipping attack: at a $90\%$ flip rate it averages $0.42$ F1 versus $0.35$ for MV-Plurality (a $22\%$ relative gain) and attains the highest F1 on \emph{every} test set once the flip rate exceeds $0.4$

Figures

Figures reproduced from arXiv: 2608.04190 by the authors.

Figure 1
Figure 1. Overview. (Top) Offline, each of the η pre-trained models builds a Label Vector Pool by clustering its training￾detection embeddings with k-means into per-class prototype pools Pi,c = {µ 1 i,c, µ2 i,c, µ3 i,c} (⋆ = centroids). A new detection with embedding e is mapped to ϕ(e) ∈ R 3m and a per-(model, class) Random Forest yields an error probability s ∈ [0, 1]; thresholding s ≥ τ via the EDR rule learner (strictness… view at source ↗
Figure 2
Figure 2. DroneVehicle sample scene from the same physi [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. F1 of each method per test set with the oracle-recall [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Detections where the LVP and DK rules disagree. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Adversarial coordinated label-flip: gap to the F1 [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Example AirSim views under different weather conditions and the weather-intensity distribution of the corresponding [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 9
Figure 9. Figure 9: Empirical runtime of IP and HS as a function of [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Comparison of maximum F1 scores across five [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: Detection overlap between LVP-EDR and DK [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 13
Figure 13. Figure 13: (Left:) Adversarial coordinated label-flip ( [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 19 canonical work pages

  1. [1]

    Leiva and Noel Ngu and Joshua Shay Kricheli and Aditya Taparia and Ransalu Senanayake and Paulo Shakarian and Nathaniel D

    Mario A. Leiva and Noel Ngu and Joshua Shay Kricheli and Aditya Taparia and Ransalu Senanayake and Paulo Shakarian and Nathaniel D. Bastian and John Corcoran and Gerardo I. Simari , editor =. Consistency-based Abductive Reasoning over Perceptual Errors of Multiple Pre-trained Models in Novel Environments , booktitle =. 2026 , url =. doi:10.1609/AAAI.V40I2...

    work page doi:10.1609/aaai.v40i23.38996 2026

  2. [2]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops , month =

    Ma, Yue and Ren, Huantao and Wang, Boyu and Jin, Jingang and Velipasalar, Senem and Qiu, Qinru , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops , month =. 2025 , pages =

    work page 2025

  3. [3]

    Abductive inference models for diagnostic problem-solving , author =

    work page

  4. [4]

    Eiter, Thomas and Gottlob, Georg , title =. J. ACM , month = jan, pages =. 1995 , issue_date =. doi:10.1145/200836.200838 , abstract =

    work page arXiv 1995

  5. [5]

    2024 , eprint=

    Rule-Based Error Detection and Correction to Operationalize Movement Trajectory Classification , author=. 2024 , eprint=

    work page 2024

  6. [6]

    Proceedings

    Error detection and constraint recovery in hierarchical multi-label classification without prior knowledge , author=. Proceedings

    work page

  7. [7]

    2025 , eprint=

    Multiple Distribution Shift -- Aerial (MDS-A): A Dataset for Test-Time Error Detection and Model Adaptation , author=. 2025 , eprint=

    work page 2025

  8. [8]

    2017 , booktitle =

    Shital Shah and Debadeepta Dey and Chris Lovett and Ashish Kapoor , title =. 2017 , booktitle =. arXiv:1705.05065 , url =

    arXiv 2017

Show all 32 references
  1. [9]

    arXiv preprint arXiv:2010.11929 , year=

    An image is worth 16x16 words: Transformers for image recognition at scale , author=. arXiv preprint arXiv:2010.11929 , year=

    2010 arXiv

  2. [10]

    Proceedings of

    Exploring plain vision transformer backbones for object detection , author=. Proceedings of. 2022 , organization=

    2022

  3. [11]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Masked autoencoders are scalable vision learners , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  4. [12]

    Ren, Shaoqing and He, Kaiming and Girshick, Ross and Sun, Jian , journal=. Faster

  5. [13]

    Yuxin Wu and Alexander Kirillov and Francisco Massa and Wan-Yen Lo and Ross Girshick , title =

  6. [14]

    arXiv preprint arXiv:2302.13482 , year=

    PyReason: Software for Open World Temporal Logic , author=. arXiv preprint arXiv:2302.13482 , year=

    arXiv

  7. [15]

    AI open , volume=

    Pre-trained models: Past, present and future , author=. AI open , volume=. 2021 , publisher=

    2021

  8. [16]

    International conference on machine learning , pages=

    Learning transferable visual models from natural language supervision , author=. International conference on machine learning , pages=. 2021 , organization=

    2021

  9. [17]

    Perspectives on psychological science , volume=

    Dual-process theories of higher cognition: Advancing the debate , author=. Perspectives on psychological science , volume=. 2013 , publisher=

    2013

  10. [18]

    International Conference on Neural-Symbolic Learning and Reasoning , pages=

    Metacognitive AI: Framework and the case for a neurosymbolic approach , author=. International Conference on Neural-Symbolic Learning and Reasoning , pages=. 2024 , organization=

    2024

  11. [19]

    Trends in Cognitive Sciences , year=

    Imagining and building wise machines: The centrality of AI metacognition , author=. Trends in Cognitive Sciences , year=

  12. [20]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    Bridging Machine Learning and Logical Reasoning by Abductive Learning , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  13. [21]

    Proceedings of

    Abductive Learning with Ground Knowledge Base , author =. Proceedings of. 2021 , month =. doi:10.24963/ijcai.2021/250 , url =

    2021 doi

  14. [22]

    Proceedings of the 11th International Joint Conference on Artificial Intelligence - Volume 2 , pages =

    Poole, David , title =. Proceedings of the 11th International Joint Conference on Artificial Intelligence - Volume 2 , pages =. 1989 , publisher =

    1989

  15. [23]

    A theory of diagnosis from first principles , journal =

    Raymond Reiter , abstract =. A theory of diagnosis from first principles , journal =. 1987 , issn =. doi:https://doi.org/10.1016/0004-3702(87)90062-2 , url =

    1987 doi

  16. [24]

    Advances in neural information processing systems , volume=

    Prototypical networks for few-shot learning , author=. Advances in neural information processing systems , volume=

  17. [25]

    International conference on machine learning , pages=

    Test-time training with self-supervision for generalization under distribution shifts , author=. International conference on machine learning , pages=. 2020 , organization=

    2020

  18. [26]

    arXiv preprint arXiv:1412.6572 , year=

    Explaining and harnessing adversarial examples , author=. arXiv preprint arXiv:1412.6572 , year=

    arXiv

  19. [27]

    arXiv preprint arXiv:1706.06083 , year=

    Towards deep learning models resistant to adversarial attacks , author=. arXiv preprint arXiv:1706.06083 , year=

    arXiv

  20. [28]

    arXiv preprint arXiv:1206.6389 , year=

    Poisoning attacks against support vector machines , author=. arXiv preprint arXiv:1206.6389 , year=

    arXiv

  21. [29]

    Proceedings of the 2018 ACM SIGSAC conference on computer and communications security , pages=

    Wild patterns: Ten years after the rise of adversarial machine learning , author=. Proceedings of the 2018 ACM SIGSAC conference on computer and communications security , pages=

    2018

  22. [30]

    The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

    Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning , author=. The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

  23. [31]

    arXiv preprint arXiv:1705.07204 , year=

    Ensemble adversarial training: Attacks and defenses , author=. arXiv preprint arXiv:1705.07204 , year=

    arXiv

  24. [32]

    IEEE Transactions on Circuits and Systems for Video Technology , year=

    Drone-based RGB-Infrared Cross-Modality Vehicle Detection via Uncertainty-Aware Learning , author=. IEEE Transactions on Circuits and Systems for Video Technology , year=

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.