Enhancing Adversarial Robustness with Signed Distance Fields for Harmonizing Geometric Invariance and Texture

Bernhard Kainz; Zhe Li

REVIEW 4 major objections 4 minor 22 references

Enhancing Adversarial Robustness with Signed Distance Fields for Harmonizing Geometric Invariance and Texture

T0 review · 4 major / 4 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A train-time defense using signed distance fields achieves 81.64% AutoAttack robustness on ImageNet, first to pass 80%.

desk verdict The headline 81.64% AutoAttack number is in-sample: they train and evaluate on the same attack ensemble, and the SOTA comparison uses a bigger architecture, so the central claim rests on a circular protocol rather than demonstrated robustness. read the letter →

arxiv 2602.05175 v2 pith:MFD5ERQB submitted 2026-02-05 cs.CV

Zhe Li , Bernhard Kainz This is my paper · ORCID

classification cs.CV

keywords adversarialrobustnesspurificationsigneddistancefieldsgeometricinvarianceappearancedebiasingAutoAttackImageNetshapebias

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ShapePuri claims that a deterministic, train-time-only purification framework can make an ImageNet classifier robust to adversarial attacks by anchoring it to geometric invariants rather than appearance. The framework fuses adversarial images with a signed distance field of the object shape and, in parallel, trains the classifier on stochastically appearance-debiased versions of both clean and adversarial images. Under the AutoAttack benchmark, the method reports 81.64% robust accuracy on ImageNet with a ConvNeXt-L backbone, a 7.45% gain over the previous diffusion-based state of the art, and claims to be the first defense to exceed 80% robust accuracy. If these numbers hold, the result would show that expensive diffusion purification is unnecessary for high robustness, since the model itself can internalize structure-consistent representations at training time and run as a standard classifier at inference.

What carries the argument

The key mechanism is the signed distance function (SDF) — a continuous scalar field representing the signed Euclidean distance from each pixel to the nearest object boundary, computed from a binary mask via inner and outer distance transforms. Because adversarial perturbations alter pixel intensities but leave the geometric skeleton intact, the SDF provides a stable structural anchor. The framework fuses it with adversarial inputs as I_fusion = I_adv ⊙ (1 + β·I_SDF), amplifying interior regions and attenuating background. The supporting mechanism is Global Appearance Debiasing (GAD), a family of shallow stochastic convolutional networks with weights sampled from N(0,1), whose outputs are int

What would settle it

Run the final ConvNeXt-L model against a different attack family not present in training — for example PGD-100 with a ResNet-50 surrogate, a transfer attack from a held-out model, or an adaptive attack that backpropagates through the SDF fusion step — and compare robust accuracy. If accuracy drops steeply (e.g., below 60%), the AutoAttack result is likely due to training on the same ensemble. Also check whether clean accuracy on the full ImageNet train/test split matches the 84.06% reported on the 10k validation split.

Watch

Extended reading notes

Core claim

The central claim is that training a classifier with a multi-stream objective that includes (1) a shape-guided stream where adversarial images are multiplied by (1 + β·SDF) for β=0.5, and (2) an appearance-debiased stream where images are passed through a random two-layer convolutional network with Gaussian weights, forces the model to rely on stable geometric structure rather than fragile texture. The paper reports that this yields 84.06% clean accuracy and 81.64% robust accuracy against AutoAttack on ImageNet, surpassing all previous defenses and, for the first time, crossing the 80% robust-accuracy threshold. The method requires no auxiliary modules or extra compute at inference; the clas

Load-bearing premise

The paper's headline robustness numbers are measured under the same AutoAttack attack ensemble that was used to generate training adversarial examples (Section 4.1), so the reported 81.64% may reflect overfitting to that specific attack set rather than generalizable robustness.

Editorial extensions

If this is right

If the result is correct, robust inference no longer requires generative purification; a standard classifier trained this way is as fast as an undefended model.
The 80% AutoAttack milestone suggests robust accuracy on ImageNet is not bounded far below clean accuracy; a gap of only ~2.4% (84.06 clean vs 81.64 robust) is claimed.
The approach is architecture-agnostic: the paper reports gains on ResNet variants, ConvNeXt-L, and Swin-B, suggesting geometric anchoring transfers across backbones.
The use of SDF as a dense prior could extend to other tasks where object boundaries are meaningful, such as medical image segmentation or video object tracking, though the paper does not explore these.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The manuscript's abstract reports different headline numbers (84.79% clean, 83.52% robust) than the body and main table (84.06% clean, 81.64% robust); the paper should be read with this internal inconsistency in mind.
Because the same AutoAttack family is used for both training and evaluation, the robustness claim may not transfer to unseen attack families; an independent evaluation against PGD, momentum-based attacks, or adaptive attacks that differentiate through the SDF fusion would test generalization.
The training split uses 40,000 images from the ImageNet validation set, not the standard 1.2M-image training set; scaling to full data or testing on the official test set could change the clean/robust balance.
The SDF's mask-refinement heuristic (inverting the mask when the mean intensity exceeds threshold τ) assumes background dominance; for close-up or large-object images the geometric anchor may be less reliable, which might limit performance on fine-grained classes.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core idea is worth a look: using SDFs as dense geometric guidance and a stochastic appearance-debiasing module inside a multi-stream adversarial training objective is a legitimate new combination of known components. The inference-time story is attractive—deterministic, zero overhead, no diffusion sampling. The intuition that shape bias helps robustness is well-grounded in prior work, and the ablations on SDF vs. edges/contours/skeletons show the authors are thinking about what the shape prior should be.

But the empirical claim does not hold as stated. Section 4.1 says they use the same attack families for training and evaluation, and that the attack models are identical to the training models. So the 81.64% AutoAttack number is measured on the exact ensemble they trained against. That is an in-sample result; it says nothing about robustness to unseen attacks. There is no held-out attack, no adaptive attack, no cross-family evaluation. Table 6 only varies the attack architecture within the same AutoAttack loss family, which does not break the circularity.

The SOTA comparison is also confounded. The headline 81.64% comes from ConvNeXt-L, while the diffusion baselines are on ResNet-50. The paper's own ResNet-50 AutoAttack result is 73.68%, below OSCP's 74.19%. So the 'first to surpass 80%' claim is an artifact of using a bigger backbone. Clean accuracy also jumps by 6% relative to baselines, which is suspicious if the protocol is otherwise identical. No error bars, no code or checkpoints, no reproducibility artifacts—this cannot be evaluated as a benchmark contribution.

There are also internal inconsistencies that should have been caught before submission. The abstract in the metadata describes a different framework, GeoTexPuri, with different numbers (84.79/83.52), while the full text is ShapePuri with 84.06/81.64. The ablation Table 2 uses a term 'GIR' that is never defined in the method or figure. These are not fatal to the underlying idea, but they signal the draft is not ready.

The citation pattern is fine—the references are relevant and not self-promotional. The method itself is coherent, and the problem being addressed (diffusion purification is slow and lossy) is real. But as presented, the paper overclaims. The right move in peer review is to send it back for major revision: retrain with a clean attack protocol, report matched-architecture baselines, add held-out attacks, and release code. I would not cite the current numbers, but I would engage with the idea if it were supported by an honest evaluation.

Referee Report

4 major / 4 minor

Summary. The paper proposes ShapePuri, a training-time defense that combines a Signed Distance Function (SDF) shape encoding module (SEM) and a stochastic Global Appearance De-biasing (GAD) module. During training the classifier is supervised on five input streams: clean, adversarial, SDF-fused adversarial, and GAD-transformed clean and adversarial images. At inference the auxiliary modules are discarded (§3.4, Algorithm 1). On a 40k/10k split of the ImageNet validation set (§4.1), the paper claims 84.06% clean and 81.64% AutoAttack robust accuracy with ConvNeXt-L, and presents this as "the first defense framework to surpass the 80% threshold on ImageNet" (§4.2). The paper is essentially an empirical robustness study; no theory, code, or checkpoints are provided.

Significance. The underlying idea—using dense distance fields as structural anchors and stochastic appearance augmentation to reduce texture bias—is potentially interesting, and the deterministic-inference property is practically attractive. If the empirical claims were established, this would be a notable contribution. However, the claims are not established: the evaluation uses the same attack family for training and testing, the headline comparison is confounded by architecture, and the provided ablations do not supply a matched-protocol baseline. The manuscript also contains multiple internal inconsistencies (title/abstract/numbers, module names). I therefore cannot regard the central result as supported.

major comments (4)

[§4.1, Tables 1 and 6] The evaluation protocol is in-sample. Section 4.1 states "We adopt the same attack families for training and evaluation to ensure consistency" and "In all experiments, the attack models are same to the training models." Thus the reported 81.64% AutoAttack accuracy is measured on the exact AutoAttack ensemble (APGD-CE, APGD-DLR, FAB, Square) used to generate training examples. No held-out attack family, loss function, perturbation budget, or adaptive attack is evaluated; Table 6 varies only the attack architecture, not the attack algorithm. The headline "unprecedented 81.64%" is therefore an in-sample fit to a specific attack ensemble, not evidence of general adversarial robustness.
[Table 1 vs. Table 5] The state-of-the-art comparison is confounded by architecture. ShapePuri's 81.64% AutoAttack result is achieved with ConvNeXt-L, while the diffusion-based baselines (DiffPure, OSCP) use ResNet-50. Table 5 shows ShapePuri with ResNet-50 under AutoAttack at 73.68%, below OSCP's 74.19%. The 7.45% margin claimed in §4.2 therefore cannot be attributed to the method without a matched-architecture comparison. In addition, training on a 40k-image split of the validation set (§4.1) is not shown to be comparable to the baselines' training protocols; this is another source of mismatch.
[§3.1, Eqs. (1)–(3)] The SDF definition is internally inconsistent. Eq. (1) defines φ(x) but the right-hand side uses I rather than x, and assigns positive distances inside Ω. Eqs. (2)–(3) compute I_SDF = DT(I_mask) − DT(1 − I_mask), which is typically negative inside the foreground under the standard distance-transform convention. The sign convention and variable dependence must be corrected for the method to be reproducible. The foreground-consistency refinement (τ, δ, flood-fill) is also underspecified.
[§4.3, Tables 2, 4, 5] Reproducibility and ablation reporting are incomplete. Hyperparameters β, τ, δ, the Gaussian blur σ, and the GAD first-layer channel count are not reported; no error bars or multiple seeds are given; and no code or checkpoints are provided. Table 5 reports a ConvNeXt-L targeted-attack accuracy of 82.87/81.36, which is not the number used in the main Table 1 targeted row (80.73/79.02 on ResNet-152), and Table 2's prose refers to "GIR" although the module is named GAD. These omissions make it impossible to verify the claimed margin.

minor comments (4)

[Title/abstract vs. full text] The front matter gives a different title, method name (GeoTexPuri), and numbers (84.79% clean / 83.52% robust) from the full text (ShapePuri, 84.06% / 81.64%). This inconsistency must be harmonized.
[Eq. (4)] The geometric score S_k = A_k \bar{D}_k^2 is introduced without justification and its units are unclear. Please define the rationale or remove it.
[§4.3, Table 3] The alternative shape encodings (Canny edges, contours, skeletons) are not given with their own hyperparameters (e.g., Canny thresholds), so the comparison in Table 3 is not fully reproducible.
[Fig. 2] The five-stream diagram is hard to parse at the current resolution. Annotating each stream with its corresponding loss term would improve clarity.

Circularity Check

1 steps flagged · score 6.0 of 10

Headline AutoAttack robustness is in-sample: training and evaluation use the same attack family, and the SOTA margin is architecture-confounded.

fitted input called prediction [Section 4.1, Attack setup (and Algorithm 1)]
"We adopt the same attack families for training and evaluation to ensure consistency. ... In all experiments, the attack models are same to the training models."

Algorithm 1 generates adversarial examples I_adv ← A(I) during training and optimizes L_base = L_CE(fθ(I_adv), y) against them. Section 4.1 confirms AutoAttack is among the training attack families and that the same attack families and models are used for evaluation. Therefore the reported 81.64% AutoAttack robust accuracy (Table 1) is measured on the same attack ensemble used to fit the model; it is an in-sample fit to AutoAttack rather than a held-out robustness estimate. The SOTA comparison is further confounded: the 81.64% result uses ConvNeXt-L, while DiffPure/OSCP baselines use ResNet-50, and Table 5 shows ShapePuri on ResNet-50 under AutoAttack gives 73.68%, below OSCP's 74.19%. No cross-family attack evaluation is reported, so the 'unprecedented' margin is partly an artifact of tra

full rationale

The core method is not circular: SDF is computed from the input mask by an explicit distance transform, the fusion rule is a well-defined element-wise operation, and the training objective is a sum of cross-entropy losses on five input variants. No load-bearing self-citation or imported uniqueness theorem appears. However, the central quantitative claim (81.64% AutoAttack robust accuracy, first defense above 80%) rests on an evaluation in which the same AutoAttack ensemble used to create training adversaries is also used as the test attack. Section 4.1 states this explicitly, and Algorithm 1 optimizes the model against the same attack operator A(·). The headline number is therefore an in-sample fit, not a generalization measure; no held-out attack family is tested to show transfer. The comparison with diffusion-based SOTA is also architecture-confounded: the ShapePuri AutoAttack row uses ConvNeXt-L while the cited baselines use ResNet-50, and Table 5 shows that on ResNet-50 ShapePuri (73.68%) is below OSCP (74.19%). These factors make the headline robustness claim partially circular by construction, though the proposed framework itself is not a tautology. The abstract/full-text name and number mismatch (GeoTexPuri vs. ShapePuri; 83.52 vs. 81.64) is a consistency issue, not a circularity issue.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The central claim depends on several hand-chosen preprocessing and training hyperparameters, most of which are not reported. The paper also assumes that same-family attack training/eval is valid and that the validation split is comparable to full ImageNet training.

free parameters (5)

β = 0.5
Shape-control strength in Eq. (5); fixed without sensitivity analysis.
τ
Foreground prior threshold in Section 3.2 for mask inversion; not reported.
δ
Euclidean margin for merging connected components in Section 3.2; not reported.
Gaussian blur σ
Smoothing kernel before Otsu in Section 3.2; not reported.
GAD first-layer channels = 2
Default GAD architecture in Section 3.3; chosen by hand.

assumptions (6)

domain assumption SDF computed from Otsu thresholding of a smoothed image captures object geometry.
Section 3.2: 'An adaptive Otsu thresholding is then utilized to generate a binary mask...' The method assumes the resulting mask is a faithful shape prior; if the mask is wrong, the geometric anchor is wrong.
domain assumption Adversarial perturbations leave the geometric skeleton and global structure intact.
Section 1: 'adversarial perturbations significantly alter pixel-level intensities, they typically leave the underlying geometric skeleton and global structure of the object intact.' This premise motivates the whole SDF approach.
ad hoc to paper Training on AutoAttack and evaluating on AutoAttack measures adversarial robustness rather than memorization.
Section 4.1: 'We adopt the same attack families for training and evaluation to ensure consistency.' No cross-family evaluation is provided.
ad hoc to paper A 40k train / 10k test split of the ImageNet validation set is comparable to prior methods trained on the full ImageNet training set.
Section 4.1: 'We split the ImageNet validation set into 40,000 images for training and 10,000 for testing, following OSCP.' This assumption underwrites all SOTA comparisons.
domain assumption Randomized shallow convolutions with Frobenius normalization preserve object semantics while removing appearance bias.
Section 3.3, Eq. (6). No evidence shows semantic preservation beyond accuracy on ImageNet.
standard math Standard properties of Euclidean distance transforms (e.g., gradient unit norm) hold for discrete images.
Section 3.1 uses classical level-set properties; mostly benign.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Enhancing Adversarial Robustness with Signed Distance Fields for Harmonizing Geometric Invariance and Texture." pith.science (2026). https://pith.science/paper/MFD5ERQB

@misc{pith2026260205175,
  author       = {Pith},
  title        = {Pith review of: Enhancing Adversarial Robustness with Signed Distance Fields for Harmonizing Geometric Invariance and Texture},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MFD5ERQB}},
  note         = {Machine review of arXiv:2602.05175}
}

read the original abstract

Deep neural networks demonstrate impressive performance in visual recognition but remain highly vulnerable to imperceptible adversarial attacks. Existing defense strategies such as adversarial training and diffusion-based purification have achieved significant progress but are frequently constrained by high computational cost, information loss, and inference latency. To address these challenges, we propose a Geometric and Texture balancing Purification (GeoTexPuri) framework that enhances adversarial robustness by harmonizing invariant geometric structures with textural features. Specifically, the framework integrates dense geometric guidance into the training phase by transforming discrete image masks into continuous spatial fields via Signed Distance Fields (SDF). This process establishes stable structural anchors that shield the model from local pixel noise. Through a multi-stream training objective, the model learns to internalize purified representations that effectively align semantic textural cues with these underlying geometric invariants. Extensive experiments on ImageNet demonstrate the efficacy of our approach. GeoTexPuri achieves 84.79\% clean accuracy and 83.52\% robust accuracy under the AutoAttack. Crucially, GeoTexPuri functions as a deterministic classifier during inference, requiring only the input image without any auxiliary geometric modules or additional computational costs, thereby ensuring a scalable and efficient solution for real-time applications.

Figures

Figures reproduced from arXiv: 2602.05175 by the authors.

**Figure 2.** Overview of the proposed Shape-Guided Purification framework. For each clean image, the input consists of five distinct variants [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Illustration of the SDF computation steps. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Examples of clean images, adversarial images, their differences, and the corresponding clean and adversarial images after [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: Visualization of diverse shape encodings, highlighting [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 3 linked inside Pith

[1]

Meansparse: Post-training robust- ness enhancement through mean-centered feature sparsifica- tion.CoRR, 2024

Sajjad Amini, Mohammadreza Teymoorianfard, Shiqing Ma, and Amir Houmansadr. Meansparse: Post-training robust- ness enhancement through mean-centered feature sparsifica- tion.CoRR, 2024. 2, 6

2024
[2]

Diffusion models demand contrastive guidance for adversarial purification to advance

Mingyuan Bai, Wei Huang, Tenghui Li, Andong Wang, Jun- bin Gao, Cesar F Caiafa, and Qibin Zhao. Diffusion models demand contrastive guidance for adversarial purification to advance. InForty-first International Conference on Machine Learning (ICML), 2024. 2

2024
[3]

Robust one-class classification with signed distance function using 1-Lipschitz neural networks

Louis B ´ethune, Paul Novello, Guillaume Coiffier, Thibaut Boissin, Mathieu Serrurier, Quentin Vincenot, and Andres Troya-Galvis. Robust one-class classification with signed distance function using 1-Lipschitz neural networks. InPro- ceedings of the 40th International Conference on Machine Learning (ICML), pages 2245–2271. PMLR, 2023. 2

2023
[4]

Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. InInternational conference on ma- chine learning, pages 2206–2216. ICML, 2020. 2, 6

2020
[5]

Wichmann, and Wieland Bren- del

Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Bren- del. Imagenet-trained CNNs are biased towards texture; in- creasing shape bias improves accuracy and robustness. InIn- ternational Conference on Learning Representations (ICLR),
[6]

Im- proving robustness using generated data.Advances in neural information processing systems, 34:4218–4233, 2021

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Im- proving robustness using generated data.Advances in neural information processing systems, 34:4218–4233, 2021. 2

2021
[7]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016. 8

2016
[8]

Adversar- ial examples are not bugs, they are features

Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversar- ial examples are not bugs, they are features. InAdvances in Neural Information Processing Systems (NeurIPS), 2019. 2

2019

Show all 22 references

[9]

Jackson, Amir Atapour-Abarghouei, Stephen Bon- ner, Toby P

Philip T. Jackson, Amir Atapour-Abarghouei, Stephen Bon- ner, Toby P. Breckon, and Boguslaw Obara. Style augmen- tation: Data augmentation via style randomization. InPro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pages 83–92,
[10]

Interpolated joint space adversarial training for robust and generalizable defenses

Chun Pong Lau, Jiang Liu, Hossein Souri, Wei-An Lin, So- heil Feizi, and Rama Chellappa. Interpolated joint space adversarial training for robust and generalizable defenses. IEEE Transactions on Pattern Analysis and Machine Intel- ligence, 45(11):13054–13067, 2023. 2

2023
[11]

Instant adversarial purification with adversarial consistency distillation

Chun Tong Lei, Hon Ming Yam, Zhongliang Guo, Yifei Qian, and Chun Pong Lau. Instant adversarial purification with adversarial consistency distillation. InProceedings of the Computer Vision and Pattern Recognition Conference (CVPR), pages 24331–24340, 2025. 1, 2, 5, 6

2025
[12]

Swin transformer: Hierarchical vision transformer using shifted windows

Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 10012–10022, 2021. 8

2021
[13]

A convnet for the 2020s

Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feicht- enhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. InProceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 11976– 11986, 2022. 8

2022
[14]

Towards deep learn- ing models resistant to adversarial attacks.The International Conference on Learning Representations (ICLR), 2018

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks.The International Conference on Learning Representations (ICLR), 2018. 2, 6

2018
[15]

Diffusion models for adversarial purification.arXiv preprint arXiv:2205.07460,

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification.arXiv preprint arXiv:2205.07460,

arXiv
[16]

Fronts propagating with curvature-dependent speed: Algorithms based on hamilton- jacobi formulations.Journal of Computational Physics, 79 (1):12–49, 1988

Stanley Osher and James A Sethian. Fronts propagating with curvature-dependent speed: Algorithms based on hamilton- jacobi formulations.Journal of Computational Physics, 79 (1):12–49, 1988. 3

1988
[17]

Causality-inspired single- source domain generalization for medical image segmenta- tion.IEEE Transactions on Medical Imaging, 42(4):1095– 1106, 2022

Cheng Ouyang, Chen Chen, Surui Li, Zeju Li, Chen Qin, Wenjia Bai, and Daniel Rueckert. Causality-inspired single- source domain generalization for medical image segmenta- tion.IEEE Transactions on Medical Imaging, 42(4):1095– 1106, 2022. 2, 5

2022
[18]

Deepsdf: Learning con- tinuous signed distance functions for shape representation

Jeong Joon Park, Peter Florence, Julian Straub, Richard Newcombe, and Steven Lovegrove. Deepsdf: Learning con- tinuous signed distance functions for shape representation. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pages 165–1...

2019
[19]

Defense-gan: Protecting classifiers against adver- sarial attacks using generative models.arXiv preprint arXiv:1805.06605, 2018

Pouya Samangouei, Maya Kabkab, and Rama Chel- lappa. Defense-gan: Protecting classifiers against adver- sarial attacks using generative models.arXiv preprint arXiv:1805.06605, 2018. 2

2018 arXiv
[20]

Towards the first adversarially robust neural net- work model on MNIST

Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards the first adversarially robust neural net- work model on MNIST. InInternational Conference on Learning Representations (ICLR), 2019. 2

2019
[21]

Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models.Advances in Neural Information Processing Systems, 36:13931–13955,

Naman Deep Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models.Advances in Neural Information Processing Systems, 36:13931–13955,
[22]

Guided diffusion model for adversarial purification

Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification. arXiv preprint arXiv:2205.14969, 2022. 1, 2, 6

2022 arXiv

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.

[1] [1]

Meansparse: Post-training robust- ness enhancement through mean-centered feature sparsifica- tion.CoRR, 2024

Sajjad Amini, Mohammadreza Teymoorianfard, Shiqing Ma, and Amir Houmansadr. Meansparse: Post-training robust- ness enhancement through mean-centered feature sparsifica- tion.CoRR, 2024. 2, 6

2024

[2] [2]

Diffusion models demand contrastive guidance for adversarial purification to advance

Mingyuan Bai, Wei Huang, Tenghui Li, Andong Wang, Jun- bin Gao, Cesar F Caiafa, and Qibin Zhao. Diffusion models demand contrastive guidance for adversarial purification to advance. InForty-first International Conference on Machine Learning (ICML), 2024. 2

2024

[3] [3]

Robust one-class classification with signed distance function using 1-Lipschitz neural networks

Louis B ´ethune, Paul Novello, Guillaume Coiffier, Thibaut Boissin, Mathieu Serrurier, Quentin Vincenot, and Andres Troya-Galvis. Robust one-class classification with signed distance function using 1-Lipschitz neural networks. InPro- ceedings of the 40th International Conference on Machine Learning (ICML), pages 2245–2271. PMLR, 2023. 2

2023

[4] [4]

Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. InInternational conference on ma- chine learning, pages 2206–2216. ICML, 2020. 2, 6

2020

[5] [5]

Wichmann, and Wieland Bren- del

Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Bren- del. Imagenet-trained CNNs are biased towards texture; in- creasing shape bias improves accuracy and robustness. InIn- ternational Conference on Learning Representations (ICLR),

[6] [6]

Im- proving robustness using generated data.Advances in neural information processing systems, 34:4218–4233, 2021

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Im- proving robustness using generated data.Advances in neural information processing systems, 34:4218–4233, 2021. 2

2021

[7] [7]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016. 8

2016

[8] [8]

Adversar- ial examples are not bugs, they are features

Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversar- ial examples are not bugs, they are features. InAdvances in Neural Information Processing Systems (NeurIPS), 2019. 2

2019