Pith. sign in

REVIEW 4 major objections 5 minor 71 references

Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defense

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial images carry a low-entropy signature, and a two-stage Max-Min entropy rectification exploits it to defend against unseen attacks at test time.

desk verdict A useful plug-in rectifier with a too-broad 'universal' claim; the paper's own CIFAR100 results undercut the headline. read the letter →

arxiv 2507.03427 v1 pith:72MMTYTV submitted 2025-07-04 cs.CV

Lina Ma , Xiaowei Fu , Fuxiang Huang , Xinbo Gao , Lei Zhang This is my paper · ORCID
classification cs.CV
keywords lowentropypriortest-timedefenseadversarialrobustnessrectificationMax-Minoptimizationattack-awareweightingunseenattacksself-supervisedlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial attacks on image classifiers share a statistical tell: their targets are misclassified with high confidence, so the model's prediction entropy is abnormally low, and lower still for stronger attacks. The paper argues that this low-entropy prior holds across many attack families and can be exploited at test time without retraining the classifier. It proposes REAL, a plug-in rectification that first maximizes prediction entropy to strip the sample's adversarial nature and then minimizes entropy to push it back toward a clean, correctly classified image. Applied on top of existing self-supervised or diffusion-based purifyers, REAL raises worst-case accuracy against attacks the defenders were never trained on, including CW, DeepFool, and AutoAttack. The prior is the load-bearing premise: if a future attack misleads with high-entropy predictions, the first rectification stage has nothing to grab onto.

What carries the argument

The low-entropy prior (LE prior) is the central object: the empirical regularity that adversarial samples are misclassified with low predictive entropy and that entropy decreases as attack intensity increases. The machinery that carries the argument is the Max-Min entropy optimization scheme: a reverse rectification step that maximizes prediction entropy, combined with an auxiliary self-supervised loss, to mask the adversarial structure, followed by a forward rectification step that minimizes entropy to restore clean-like confident correct predictions, both under a perturbation budget $\epsilon_{\mathrm{pfy}}$. Around this core sit the attack-aware weighting mechanism, which sets $\beta_{\max} = \alpha(1 - V_{\mathrm{ent}})^2$ and $\beta_{\min} = \alpha V_{\mathrm{ent}}^2$ from the normalized entropy $V_{\mathrm{ent}} = L_{\mathrm{ent}} / \log_2(N)$, and the heuristic selection strategy with detection thresholds $aux^*$ and $ent^*$ derived from clean-sample statistics. This machinery is designed to be orthogonal to existing sample-rectification models, so it can be plugged into them without retraining.

What would settle it

A concrete falsifier: build a PGD-style attack that maximizes classification loss minus prediction entropy, producing high-entropy misclassifications, and run the defended model on those samples. If the rectified samples end up less accurate than the raw adversarial inputs, or if the $aux^{*}$ and $ent^{*}$ thresholds flag them as clean, then the low-entropy prior is violated and REAL's first stage has no signal to work with.

Watch

Extended reading notes

Core claim

The central discovery is that natural and adversarial samples occupy opposite regimes of predictive entropy, not just for one attack but across FGSM, PGD, CW, DeepFool, MIM, STA, and AutoAttack on MNIST, CIFAR10, CIFAR100, and TinyImageNet. Clean samples follow the usual trend—higher entropy correlates with higher error rate—whereas adversarial samples are confidently wrong (low entropy) and their entropy falls as attack loss rises, with correlation coefficients reported in Fig. 2. Exploiting this, the authors build REAL, a two-stage Max-Min entropy optimizer. Stage one (reverse rectification) minimizes the auxiliary self-supervised loss while maximizing classifier entropy, pulling the sample toward the decision boundary and producing a 'mask sample'. Stage two (forward rectification) minimizes both auxiliary loss and entropy to 'enlighten' the mask sample into a purified image that the classifier labels correctly with high confidence. An attack-aware weighting uses normalized entropy to set $\beta_{\max}$ and $\beta_{\min}$, a detection step thresholds auxiliary loss and entropy using clean-sample statistics, and a heuristic selection strategy repeats rounds until purification criteria are met. The claim is that this recipe substantially improves the clean and worst-case accuracy of existing rectification models and generalizes to unseen attacks.

Load-bearing premise

The LE prior is assumed to hold for whatever attacks arrive at test time, and the $aux^{*}$ and $ent^{*}$ thresholds are calibrated from clean-sample statistics; the paper itself reports that on CIFAR100 the clean and CW/DF entropy distributions mix (Sec. IV.E) and that adversarial patches lack low-entropy misclassification (Fig. 11), so a high-entropy or mixed-distribution attack would leave the first rectification stage without a signal.

Editorial extensions

If this is right

  • Plugged into SOAP with label-consistency or reconstruction auxiliary tasks, REAL raises worst-case accuracy: on MNIST with a fully connected network the worst case climbs from 55.62% to 91.63%, and on CIFAR10 with ResNet18 and label consistency it rises from 51.02% to 58.29%.
  • Integrated into the diffusion-based purifier ADP, REAL lifts worst-case accuracy on CIFAR10 from 76.14% to 92.13% (ResNet18), exceeding the compared DiffPure and Defense Transformer results in the same setting.
  • The detection strategy, using only clean-sample statistics and the $aux^*$/$ent^*$ thresholds, exceeds 80% detection accuracy across FGSM, PGD, CW, DF, and AA on CIFAR10 with ResNet18 and shows the strongest worst-case detection when compared methods are trained only on FGSM.
  • Under the BPDA adaptive attack, REAL improves SOAP's accuracy from 3.6% to 18.7% on ResNet18 and from 11.3% to 20.5% on WideResNet28-10, suggesting the Max-Min loop resists white-box tracing better than a single rectification.
  • Ablations show the top-level components carry the gains: on CIFAR10 with the reconstruction auxiliary task, worst-case accuracy is 17.29% with auxiliary loss alone, 12.58% after adding Max-Min entropy optimization, 31.84% after adding the heuristic selection strategy, and 31.52% with the attack-aware weighting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct test of the prior's boundary: an attacker who maximizes prediction entropy while crafting perturbations, as in the paper's Eq. 11 with a large entropy weight, should erode REAL's advantage; the paper already observes that in this regime the attack's own gradient directions conflict, so the prediction is that REAL is most fragile against high-entropy misclassification attacks.
  • The $aux^*$ and $ent^*$ thresholds are calibrated from clean-sample statistics, so a deployment-time distribution shift of legitimate inputs would require recalibration; otherwise the detector will either reject many clean samples or admit adversarial ones.
  • REAL's inference time is roughly five times that of the base purifier (Table VII), so the natural next step is a lightweight predictor of how many rectification rounds each sample needs, replacing the heuristic termination rule.
  • The same Max-Min entropy recipe could transfer to other prediction heads, such as segmentation, detection, or face recognition, wherever a confidently-wrong signature appears, but the prior would first need to be re-verified for each task.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper claims that adversarial examples across many attacks share a low-entropy prior: (1) they are misclassified with low prediction entropy, and (2) stronger attacks produce even lower prediction entropy. On this basis the authors propose REAL, a two-stage test-time rectification method that first maximizes prediction entropy ('reverse rectification') and then minimizes it ('forward rectification'), with an attack-aware weighting scheme, a clean-vs-adversarial detection step, and a heuristic stopping condition. REAL is presented as a training-free plug-in that can be added to existing sample-rectification methods, such as SOAP, and that improves 'universal robustness against unseen attacks.' The experiments cover MNIST, CIFAR-10, CIFAR-100, and TinyImageNet with multiple backbones, auxiliary tasks, attack types, adaptive attacks, and BPDA attacks.

Significance. If the low-entropy prior held broadly and the Max-Min rectification reliably improved existing defense methods, REAL would be a useful training-free plug-in for test-time robustness. The paper has notable strengths: it analyzes entropy statistics over multiple attacks and datasets, provides visual and quantitative ablation results, reports inference-time overhead, and tests adaptive and BPDA attacks. However, the paper's own results undermine the central 'universal robustness' and 'greatly improve' claims: on CIFAR-100, adding REAL to SOAP lowers AutoAttack accuracy in both Table I and Table II and lowers natural accuracy substantially, and the paper's Section IV.L concedes that adversarial patches violate the prior. The contribution is therefore best assessed as a conditional, attack-specific technique rather than a universal plug-in, and the manuscript needs substantial reframing and additional evidence.

major comments (4)
  1. [Sec. IV.E, Tables I and II] The central claim that REAL 'can greatly improve the performance of existing sample rectification models' and provide 'universal robustness against unseen attacks' is contradicted by the paper's own CIFAR-100 results. With the label-consistency auxiliary task, adding REAL to SOAP reduces AutoAttack accuracy from 45.11% to 43.69% on ResNet18 (Table I) and from 51.56% to 47.13% on WideResNet28-10 (Table II), while also dropping natural accuracy from 52.91% to 44.27% and from 61.01% to 56.57%, respectively. The paper's explanation in Section IV.E is that clean and CW/DF adversarial distributions are mixed on CIFAR-100, causing thresholds to misclassify many adversarial samples as clean. That is exactly the unseen-attack regime the paper claims to handle, so the claim of universal improvement cannot stand as stated. I would ask the authors to either restrict the claim to settings where the LE prior provably holds, report performance separately for detected and undetected samples, or provide an attack-agnostic variant that does not rely on threshold statistics.
  2. [Sec. IV.L, Fig. 11 and Table IX] The paper's own limitation subsection shows that adversarial patches do not exhibit low-entropy misclassification and that REAL provides no improvement for large patches: at 50% patch size, SOAP+Ours achieves 16.20% versus SOAP's 17.40% on CIFAR-10 (Table IX). Since the abstract and introduction claim 'universal robustness against unseen attacks,' the existence of a broad attack family that violates the prior is a load-bearing scope limitation. The manuscript should explicitly state in the abstract and conclusion that the method targets perturbation-based attacks satisfying the low-entropy prior, not arbitrary adversarial perturbations.
  3. [Sec. IV.D and Algorithm 1] The detection thresholds aux* and ent* are 'determined based on the statistical means of the auxiliary loss and predicted entropy of clean samples,' which presumes access to a representative clean-sample calibration set at test time. The paper does not report the threshold values, the sensitivity of results to their choice, or what happens when clean-sample statistics are unavailable (e.g., under a fully adaptive attack that also contaminates the calibration stream). Since detection underpins the clean-accuracy preservation in Algorithm 1, this assumption needs to be justified and quantified.
  4. [Sec. IV.D] The paper states that for data reconstruction tasks on CIFAR-10/100 'we choose not to employ threshold detection,' yet Algorithm 1 presents detection as an unconditional component of the method. It is unclear whether the REC rows in Tables I and II use detection, and if not, how clean accuracy is controlled in those configurations. The algorithm description and the experimental settings should be brought into correspondence.
minor comments (5)
  1. [Abstract and Introduction] There are several typos, including 'Re ctify A dversarial sample based on L oE prior' and 'plugged-played'; these should be corrected.
  2. [Fig. 2] The text says the correlation coefficient rho is shown in Fig. 2 and that the negative correlation is 'significant,' but the exact coefficient values are not reported in the text or figure caption, and no error bars or confidence intervals are given. Reporting the numeric rho values with sample sizes would allow readers to assess the strength of Property 2.
  3. [Sec. IV.E] The claim that REAL improves CIFAR-10 ResNet18 by 'nearly 10%' is not uniformly supported by Table I: under the REC auxiliary task, DF accuracy is slightly worse with REAL (65.52 vs. 65.97), and the reported near-10% gain appears to refer only to the LC task under CW. The sentence should cite the specific table cells.
  4. [Sec. III.C and Sec. IV.D] The adaptive weights beta_max and beta_min depend on the hyperparameter alpha, but the ablation study (Fig. 7 and Table IV) only varies the number of rectification rounds R. A sensitivity analysis for alpha, and for the thresholds aux* and ent*, would strengthen the practical guidance for users.
  5. [Table VII] The inference-time table reports a roughly fivefold increase when REAL is added to SOAP, but it does not report the breakdown between the two rectification stages and the repeated rounds, nor does it compare against the cost of the detection stage. A short sentence explaining the dominant cost would help.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the LE prior is an empirical observation and the rectification weights are heuristics, not quantities forced by the method's own outputs.

full rationale

The paper's claimed LE prior is an empirical statistical observation (Figs. 1-2), not a quantity derived from the method. The Max-Min entropy scheme and the attack-aware weighting of Eqs. 3, 5, 7-8 are heuristics whose parameters are not fitted to adversarial data. Detection thresholds aux* and ent* are explicitly calibrated from clean-sample statistics (Sec. IV.D), so the reported detection and rectification results are not forced by construction. The beta weights are self-referential in that beta_max and beta_min are functions of the sample's own normalized entropy Vent, but this is a design choice and does not by itself guarantee the claimed gains; the gains are measured against external baselines such as SOAP and ADP. The paper's own CIFAR100 results show degradation under some attacks (Tables I-II and Sec. IV.E), which undermines the universal-improvement claim empirically but is not circularity. Overlapping-author references [47] and [68] are contextual and do not supply the LE prior or the optimization scheme. Evaluation uses the same attack families that motivated the prior, so the 'unseen attack' generalization claim is under-supported by the experimental design, but this is a test-design limitation rather than a circular reduction. No load-bearing circular step is exhibited.

Assumptions & free parameters 6 free parameters · 3 assumptions · 0 invented entities

REAL is an empirical method built on two asserted entropy properties rather than a derived law. Its free parameters (alpha, gamma, R, T), data-derived detection thresholds, and the unstated rectification budget are set outside any optimization or prediction loop, so the ledger is moderate. The central scientific load is carried by the domain assumptions on entropy behavior.

free parameters (6)
  • alpha (trade-off hyperparameter) = 0.25
    Scales both beta_max and beta_min in Eqs. 7-8; hand-set and applied uniformly across datasets and auxiliary tasks.
  • purification step size gamma = 0.1 (MNIST), 4/255 (CIFAR10/100)
    Per-step gradient update magnitude in Algorithm 1, chosen manually.
  • max rectification rounds R = 5
    Maximum number of Max-Min cycles; ablation in Fig. 7 supports this value, but it is a hyperparameter.
  • iterations per stage T = 3
    Number of gradient steps per rectification stage, set for computational efficiency.
  • detection thresholds aux* and ent* = not numerically reported
    Derived from means of clean-sample auxiliary loss and entropy; critical for separating clean and adversarial inputs.
  • rectification budget epsilon_pfy = not specified
    Constraint in Eqs. 2, 3, and 5; never given a value, so replication requires guessing this bound.
assumptions (3)
  • domain assumption Adversarial samples are typically misclassified with low prediction entropy (Property 1).
    Presented as an empirical discovery (Figs. 1-2) and used to justify the entropy-maximization stage; the paper itself shows patches violate it (Fig. 11).
  • domain assumption Prediction entropy decreases with attack strength (Property 2), so normalized entropy Vent is a usable attack-strength proxy.
    Basis for the attack-aware weights in Eqs. 7-8; the supporting correlation in Fig. 2 is described qualitatively without reported coefficients.
  • domain assumption The auxiliary self-supervised loss correlates with classification accuracy, so minimizing it purifies adversarial samples.
    Inherited from SOAP (ref [43]) as stated in Sec. III.A; REAL combines Laux with entropy terms in both rectification stages.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defense." pith.science (2026). https://pith.science/paper/72MMTYTV

@misc{pith2026250703427,
  author       = {Pith},
  title        = {Pith review of: Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/72MMTYTV}},
  note         = {Machine review of arXiv:2507.03427}
}
read the original abstract

Existing defense methods fail to defend against unknown attacks and thus raise generalization issue of adversarial robustness. To remedy this problem, we attempt to delve into some underlying common characteristics among various attacks for generality. In this work, we reveal the commonly overlooked low entropy prior (LE) implied in various adversarial samples, and shed light on the universal robustness against unseen attacks in inference phase. LE prior is elaborated as two properties across various attacks as shown in Fig. 1 and Fig. 2: 1) low entropy misclassification for adversarial samples and 2) lower entropy prediction for higher attack intensity. This phenomenon stands in stark contrast to the naturally distributed samples. The LE prior can instruct existing test-time defense methods, thus we propose a two-stage REAL approach: Rectify Adversarial sample based on LE prior for test-time adversarial rectification. Specifically, to align adversarial samples more closely with clean samples, we propose to first rectify adversarial samples misclassified with low entropy by reverse maximizing prediction entropy, thereby eliminating their adversarial nature. To ensure the rectified samples can be correctly classified with low entropy, we carry out secondary rectification by forward minimizing prediction entropy, thus creating a Max-Min entropy optimization scheme. Further, based on the second property, we propose an attack-aware weighting mechanism to adaptively adjust the strengths of Max-Min entropy objectives. Experiments on several datasets show that REAL can greatly improve the performance of existing sample rectification models.

Figures

Figures reproduced from arXiv: 2507.03427 by the authors.

Figure 1
Figure 1. The relationship between predicted entropy and error [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Greater attack strength causes larger loss and lower en [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Overall framework of REAL. During testing, images are rectified by optimizing the rectification loss. In stage 1, [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Difference in the basic architecture, where [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: (a) and (b) represent one-stage and two-stage rectifica [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Joint distributions of auxiliary loss and entropy loss. Clean samples (in blue) show different distribution from adversarial [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Hyper-parameters analysis for the number [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Our analysis encompasses the CIFAR10/100 and Tiny [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 8
Figure 8. Figure 8: The relationship between prediction entropy and error [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: The visual results of reverse rectification stage (i.e., mask images) and forward rectification stage (i.e., pfy images) on MNIST and CIFAR10 datasets. Three popular adversarial attacks, such as PGD, FGSM and CW are tested. For better visualization, the images (clean, …
Figure 10
Figure 10. Figure 10: Results for defense-aware (adaptive) attack robustness [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: The relationship between prediction entropy and error rate on physical patch attack samples. TABLE IX: Results of defending against physical patch attack. We test the physical attack and defense effects under the label consistency auxiliary task on CIFAR10 with ResNet…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

71 extracted references · 59 canonical work pages

  1. [50]

    Fighting gradients with gradients: Dynamic defenses against adversarial attacks

    Dequan Wang, An Ju, Evan Shelhamer, David Wagner, and Trevor Darrell. Fighting gradients with gradients: Dynamic defenses against adversarial attacks. arXiv preprint arXiv:2105.08714 , 2021

    arXiv 2021

  2. [1]

    Towards improving robustness of deep neural networks to adversarial perturbations

    Sajjad Amini and Shahrokh Ghaemmaghami. Towards improving robustness of deep neural networks to adversarial perturbations. IEEE Transactions on Multimedia , 22(7):1889–1903, 2020

    work page 1903

  3. [2]

    Square attack: a query-efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In European conference on computer vision , pages 484–501. Springer, 2020

    work page 2020

  4. [3]

    Defense against adversarial attacks using dragan

    Ali ArjomandBigdeli, Maryam Amirmazlaghani, and Mohammad Khalooei. Defense against adversarial attacks using dragan. In 2020 6th Iranian Conference on Signal Processing and Intelligent Systems (ICSPIS), pages 1–5, 2020

    work page 2020

  5. [4]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning , pages 274–283. PMLR, 2018

    work page 2018

  6. [5]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning , pages 284–293. PMLR, 2018

    2018

  7. [6]

    Parameter-free online test-time adaptation

    Malik Boudiaf, Romain Mueller, Ismail Ben Ayed, and Luca Bertinetto. Parameter-free online test-time adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 8344–8353, 2022

    work page 2022

  8. [7]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017

    2017

Show all 71 references
  1. [8]

    Robust classification via a single diffusion model

    Huanran Chen, Yinpeng Dong, Zhengyi Wang, Xiao Yang, Chengqi Duan, Hang Su, and Jun Zhu. Robust classification via a single diffusion model. In International Conference on Machine Learning. PMLR, 2024

    2024

  2. [9]

    Robust overfitting may be mitigated by properly learned smoothening

    Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In ICLR, 2020

    2020

  3. [10]

    A simple framework for contrastive learning of visual representations

    Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning , pages 1597–1607. PMLR, 2020

    2020

  4. [11]

    Evaluating the adversarial robustness of adaptive test-time defenses

    Francesco Croce, Sven Gowal, Thomas Brunner, Evan Shelhamer, Matthias Hein, and Taylan Cemgil. Evaluating the adversarial robustness of adaptive test-time defenses. In International Conference on Machine Learning, pages 4421–4435. PMLR, 2022

    2022

  5. [12]

    Minimally distorted adversarial ex- amples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial ex- amples with a fast adaptive boundary attack. In International Conference on Machine Learning , pages 2196–2205. PMLR, 2020

    2020

  6. [13]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In In- ternational conference on machine learning , pages 2206–2216. PMLR, 2020

    2020

  7. [14]

    Libre: A practical bayesian approach to adversarial detection

    Zhijie Deng, Xiao Yang, Shizhen Xu, Hang Su, and Jun Zhu. Libre: A practical bayesian approach to adversarial detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 972–982, 2021

    2021

  8. [15]

    The enemy of my enemy is my friend: Exploring inverse adversaries for improving adversarial training

    Junhao Dong, Seyed-Mohsen Moosavi-Dezfooli, Jianhuang Lai, and Xiaohua Xie. The enemy of my enemy is my friend: Exploring inverse adversaries for improving adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 24678–...

    2023

  9. [16]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018

    2018

  10. [17]

    Enhancing the robustness of neural collaborative filtering systems under malicious attacks

    Yali Du, Meng Fang, Jinfeng Yi, Chang Xu, Jun Cheng, and Dacheng Tao. Enhancing the robustness of neural collaborative filtering systems under malicious attacks. IEEE Transactions on Multimedia , 21(3):555– 565, 2018

    2018

  11. [18]

    Unsupervised image captioning

    Yang Feng, Lin Ma, Wei Liu, and Jiebo Luo. Unsupervised image captioning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 4125–4134, 2019

    2019

  12. [19]

    Push & pull: Transferable adversarial examples with attentive attack

    Lianli Gao, Zijie Huang, Jingkuan Song, Yang Yang, and Heng Tao Shen. Push & pull: Transferable adversarial examples with attentive attack. IEEE Transactions on Multimedia , 24:2329–2338, 2022

    2022

  13. [20]

    Unsupervised representation learning by predicting image rotations

    Spyros Gidaris, Praveer Singh, and Nikos Komodakis. Unsupervised representation learning by predicting image rotations. In ICLR, 2018

    2018

  14. [21]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015

    2015

  15. [22]

    Momentum contrast for unsupervised visual representation learning

    Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9729–9738, 2020

    2020

  16. [23]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770–778, 2016

    2016

  17. [24]

    Identity mappings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11– 14, 2016, Proceedings, Part IV 14 , pages 630–645. Springer, 2016

    2016

  18. [25]

    Aid-purifier: A light auxiliary network for boosting adversarial defense

    Duhun Hwang, Eunjung Lee, and Wonjong Rhee. Aid-purifier: A light auxiliary network for boosting adversarial defense. Neurocomputing, 541:126251, 2023. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 15

    2023

  19. [26]

    Puvae: A variational autoencoder to purify adversarial examples

    Uiwon Hwang, Jaewoo Park, Hyemi Jang, Sungroh Yoon, and Nam Ik Cho. Puvae: A variational autoencoder to purify adversarial examples. IEEE Access, 7:126582–126593, 2019

    2019

  20. [27]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  21. [28]

    Adversarial machine learning at scale

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In ICLR, 2017

    2017

  22. [29]

    Gradient-based learning applied to document recognition

    Y Lecun and L Bottou. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278–2324, 1998

    1998

  23. [30]

    A simple unified framework for detecting out-of-distribution samples and adversarial attacks

    Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information processing systems , 31, 2018

    2018

  24. [31]

    Robust evaluation of diffusion-based adversarial purification

    Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion-based adversarial purification. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 134–144, 2023

    2023

  25. [32]

    Learn- ing defense transformations for counterattacking adversarial examples

    Jincheng Li, Shuhai Zhang, Jiezhang Cao, and Mingkui Tan. Learn- ing defense transformations for counterattacking adversarial examples. Neural Networks, 164:177–185, 2023

    2023

  26. [33]

    Dual manifold adversarial robustness: Defense against lp and non-lp adversarial attacks

    Wei-An Lin, Chun Pong Lau, Alexander Levine, Rama Chellappa, and Soheil Feizi. Dual manifold adversarial robustness: Defense against lp and non-lp adversarial attacks. Advances in Neural Information Processing Systems, 33:3487–3498, 2020

    2020

  27. [34]

    Characterizing adversarial subspaces using local intrinsic dimensionality

    Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wi- jewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In ICLR, 2018

    2018

  28. [35]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018

    2018

  29. [36]

    Adversarial attacks are reversible with natural supervision

    Chengzhi Mao, Mia Chiquier, Hao Wang, Junfeng Yang, and Carl V ondrick. Adversarial attacks are reversible with natural supervision. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 661–671, 2021

    2021

  30. [37]

    Guessing and entropy

    James L Massey. Guessing and entropy. In Proceedings of 1994 IEEE International Symposium on Information Theory, page 204. IEEE, 1994

    1994

  31. [38]

    Toward robust sensing for autonomous vehicles: An adversarial perspective

    Apostolos Modas, Ricardo Sanchez-Matilla, Pascal Frossard, and An- drea Cavallaro. Toward robust sensing for autonomous vehicles: An adversarial perspective. IEEE Signal Processing Magazine , 37(4):14– 23, 2020

    2020

  32. [39]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2574–2582, 2016

    2016

  33. [40]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning , pages 16805–16827. PMLR, 2022

    2022

  34. [41]

    Overfitting in adversarially robust deep learning

    Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International conference on machine learning , pages 8093–8104. PMLR, 2020

    2020

  35. [42]

    Defense-gan: Protecting classifiers against adversarial attacks using generative models

    Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. In ICLR, 2018

    2018

  36. [43]

    Online adversarial purification based on self-supervised learning

    Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self-supervised learning. In ICLR, 2021

    2021

  37. [44]

    Pixeldefend: Leveraging generative models to understand and defend against adversarial examples

    Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In ICLR, 2018

    2018

  38. [45]

    Test-time training for out-of-distribution generalization

    Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexei A Efros, and Moritz Hardt. Test-time training for out-of-distribution generalization. 2019

    2019

  39. [46]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013

    2013 arXiv

  40. [47]

    Robust overfitting does matter: Test-time adversarial purification with fgsm

    Linyu Tang and Lei Zhang. Robust overfitting does matter: Test-time adversarial purification with fgsm. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24347– 24356, 2024

    2024

  41. [48]

    Test-time defense against adver- sarial attacks: Detection and reconstruction of adversarial examples via masked autoencoder

    Yun-Yun Tsai, Ju-Chin Chao, Albert Wen, Zhaoyuan Yang, Chengzhi Mao, Tapan Shah, and Junfeng Yang. Test-time defense against adver- sarial attacks: Detection and reconstruction of adversarial examples via masked autoencoder. arXiv preprint arXiv:2303.12848 , 2023

    2023 arXiv

  42. [49]

    Average gradient-based adversarial attack

    Chen Wan, Fangjun Huang, and Xianfeng Zhao. Average gradient-based adversarial attack. IEEE Transactions on Multimedia , 25:9572–9585, 2023

    2023

  43. [51]

    Tent: Fully test-time adaptation by entropy minimization

    Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. In ICLR

  44. [52]

    Improving adversarial robustness requires revisiting misclassified examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2019

    2019

  45. [53]

    Better diffusion models further improve adversarial training

    Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In International Conference on Machine Learning , pages 36246–36263. PMLR, 2023

    2023

  46. [54]

    Towards robust person re-identification by adversarial training with dynamic attack strategy

    Jiwei Wei, Chen Pan, Shiyuan He, Guoqing Wang, Yang Yang, and Heng Tao Shen. Towards robust person re-identification by adversarial training with dynamic attack strategy. IEEE Transactions on Multimedia, pages 1–14, 2024

    2024

  47. [55]

    Improving vaes’ robustness to adversarial attack

    Matthew JF Willetts, Alexander Camuto, Tom Rainforth, S Roberts, and Christopher C Holmes. Improving vaes’ robustness to adversarial attack. In ICLR

  48. [56]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. In ICLR

  49. [57]

    Densepure: Understanding diffusion models towards adversarial robustness

    Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anandkumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models towards adversarial robustness. arXiv preprint arXiv:2211.00322, 2022

    2022 arXiv

  50. [58]

    Spatially transformed adversarial examples

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In ICLR, 2018

    2018

  51. [59]

    Adversarial attack against urban scene segmentation for autonomous vehicles

    Xing Xu, Jingran Zhang, Yujie Li, Yichuan Wang, Yang Yang, and Heng Tao Shen. Adversarial attack against urban scene segmentation for autonomous vehicles. IEEE Transactions on Industrial Informatics , 17(6):4117–4126, 2020

    2020

  52. [60]

    Exact adversarial attack to image captioning via structured output learning with latent variables

    Yan Xu, Baoyuan Wu, Fumin Shen, Yanbo Fan, Yong Zhang, Heng Tao Shen, and Wei Liu. Exact adversarial attack to image captioning via structured output learning with latent variables. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 41...

    2019

  53. [61]

    Class-disentanglement and applications in adversarial detection and defense

    Kaiwen Yang, Tianyi Zhou, Yonggang Zhang, Xinmei Tian, and Dacheng Tao. Class-disentanglement and applications in adversarial detection and defense. Advances in Neural Information Processing Systems, 34:16051–16063, 2021

    2021

  54. [62]

    Adversarial purification with the manifold hypothesis

    Zhaoyuan Yang, Zhiwei Xu, Jing Zhang, Richard Hartley, and Peter Tu. Adversarial purification with the manifold hypothesis. 2024

    2024

  55. [63]

    Defending against adversarial attacks using spherical sampling-based variational auto- encoder

    Sheng-lin Yin, Xing-lan Zhang, and Li-yu Zuo. Defending against adversarial attacks using spherical sampling-based variational auto- encoder. Neurocomputing, 478:1–10, 2022

    2022

  56. [64]

    Adversarial purification with score-based generative models

    Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based generative models. In International Conference on Machine Learning, pages 12062–12072. PMLR, 2021

    2021

  57. [65]

    Automa: Towards automatic model augmentation for transferable adversarial attacks

    Haojie Yuan, Qi Chu, Feng Zhu, Rui Zhao, Bin Liu, and Nenghai Yu. Automa: Towards automatic model augmentation for transferable adversarial attacks. IEEE Transactions on Multimedia , 25:203–213, 2023

    2023

  58. [66]

    Wide residual networks

    Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016

    2016 arXiv

  59. [67]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR, 2019

    2019

  60. [68]

    Meta invariance defense towards generalizable robustness to unknown adversarial attacks

    Lei Zhang, Yuhang Zhou, Yi Yang, and Xinbo Gao. Meta invariance defense towards generalizable robustness to unknown adversarial attacks. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2024

    2024

  61. [69]

    Memo: Test time robustness via adaptation and augmentation

    Marvin Zhang, Sergey Levine, and Chelsea Finn. Memo: Test time robustness via adaptation and augmentation. Advances in Neural Information Processing Systems , 35:38629–38642, 2022

    2022

  62. [70]

    Detecting adversarial data by probing mul- tiple perturbations using expected perturbation score

    Shuhai Zhang, Feng Liu, Jiahao Yang, Yifan Yang, Changsheng Li, Bo Han, and Mingkui Tan. Detecting adversarial data by probing mul- tiple perturbations using expected perturbation score. In International conference on machine learning , pages 41429–41451. PMLR, 2023

    2023

  63. [71]

    Robust physical-world attacks on face recognition

    Xin Zheng, Yanbo Fan, Baoyuan Wu, Yong Zhang, Jue Wang, and Shirui Pan. Robust physical-world attacks on face recognition. Pattern Recognition, 133:109009, 2023

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.