Pith. sign in

REVIEW 2 major objections 6 minor 113 references

Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics

T0 review · 2 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial training, aimed at attacks, also raises clean accuracy under real-world audio distribution shifts.

desk verdict Solid empirical result on adversarial training for bioacoustics, but the recipe's active ingredient is unidentified—worth refereeing with requests for ablations and code. read the letter →

arxiv 2507.13727 v1 pith:X4WPKYAO submitted 2025-07-18 cs.LG

René Heinrich , Lukas Rauch , Bernhard Sick , Christoph Scholz This is my paper
classification cs.LG
keywords adversarialtrainingbirdsoundclassificationbioacousticsdistributionshiftmulti-labelaudioprototype-basedmodelsrobustnessgeneralization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that adversarial training, a technique usually aimed at defending against malicious input perturbations, also improves ordinary generalization when a model faces the large distribution shifts typical of real-world audio. Using bird sound classification as a test bed, the authors compare ordinary training with two adversarial variants on a convolutional network (ConvNeXt) and a prototype-based model (AudioProtoPNet). They report that training with single-step output-space FGSM perturbations under the TRADES-AWP recipe raises the average class-mean average precision on seven held-out soundscape datasets from 0.38 to 0.42 for AudioProtoPNet and to 0.41 for ConvNeXt. The same training also strengthens resistance to untargeted and targeted attacks and stabilizes the learned prototypes. If correct, this means adversarial training can serve as a data-augmentation strategy for bioacoustic classification without architectural changes.

What carries the argument

The load-bearing mechanism is the TRADES-AWP training objective, a minimax loss in which the model is trained against worst-case input perturbations and adversarial weight perturbations. The objective combines a classification loss on clean inputs, a TRADES consistency term penalizing divergence between outputs on clean and perturbed inputs, and Adversarial Weight Perturbation that flattens the loss landscape; the authors adapt it to multi-label bird sound classification with an asymmetric loss. During training the input perturbation is generated with single-step FGSM attacks, either output-space attacks that maximize the classification loss or embedding-space attacks that maximize average spatial cosine distance between embeddings, with weight randomization applied during perturbation generation. The central comparison is between these two variants (AT-O and AT-E) and ordinary training, evaluated by class-mean average precision and by robustness scores that separate performance degradation from embedding deformation.

What would settle it

Train the same two architectures with random input noise of the same magnitude in place of FGSM perturbations, keeping the TRADES-AWP weight perturbation and weight randomization identical; if the cmAP gains over ordinary training persist or shrink only slightly, then the paper's attribution of the gains to adversarial input perturbation is not supported.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that output-space adversarial training (AT-O) improves clean-data performance under distribution shifts while simultaneously improving adversarial robustness. In the ablation on the POW validation set, AT-O raises ConvNeXt cmAP from 0.47 to 0.56 and AudioProtoPNet from 0.49 to 0.59 at perturbation strength $\epsilon=0.1$. Across seven soundscape test datasets the mean cmAP rises from 0.38 to 0.41 for ConvNeXt and from 0.38 to 0.42 for AudioProtoPNet, a relative gain of up to 10.5 percent. For robustness, AT-O lifts AudioProtoPNet's Performance Robustness Score from 0.74 to 0.89 against untargeted embedding-space attacks at $\epsilon=0.01$ and from 0.02 to 0.56 at $\epsilon=0.05$, and raises the Total Adversarial Robustness Score against targeted prototype attacks from 0.27 to 0.65 at $\epsilon=0.1$. The authors conclude that the accuracy-robustness trade-off is not necessarily induced by adversarial training in this setting.

Load-bearing premise

The load-bearing premise is that the clean-data improvements are caused by the adversarial input perturbations themselves, but the training recipe bundles those perturbations with weight perturbation, a TRADES consistency term, and weight randomization, and the paper does not run a control that isolates the input perturbation.

Editorial extensions

If this is right

  • Output-space adversarial training raises average clean-data cmAP from 0.38 to 0.42 for AudioProtoPNet and to 0.41 for ConvNeXt across seven soundscape test sets.
  • The largest clean-data gains appear where the distribution shift is strongest: on the PER dataset, AT-O improves cmAP by about 28 percent for AudioProtoPNet and 24 percent for ConvNeXt.
  • AT-O improves robustness to untargeted embedding-space attacks, with AudioProtoPNet's PRS rising from 0.74 to 0.89 at $\epsilon=0.01$ and from 0.02 to 0.56 at $\epsilon=0.05$.
  • AT-O stabilizes AudioProtoPNet prototypes against targeted embedding attacks, raising TARS from 0.27 with ordinary training to 0.65 at $\epsilon=0.1$.
  • These benefits come without architectural modifications or extra inference cost, so adversarial training can be added to existing audio classifiers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper attributes the clean-data gain to the worst-case input perturbation, but its AT recipe also contains layer-wise weight perturbation, TRADES consistency, and weight randomization; a control experiment with random or fixed perturbations of equal magnitude would show whether the input perturbation is the active ingredient.
  • If the active mechanism is a flatter loss landscape rather than the specific adversarial objective, similar clean-data gains should appear on other audio tasks with strong domain shift, such as acoustic scene classification or industrial anomaly detection, whenever baselines are low.
  • Embedding-space adversarial training, despite smaller clean-data gains here, may be most useful for retrieval-oriented models and self-supervised pretraining, where embedding integrity rather than classification accuracy is the primary goal.
  • A natural extension is to test AT-O against natural corruptions such as reverberation and device mismatch, since the robustness it confers appears to be against worst-case bounded perturbations rather than those specific distortions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper adapts the TRADES-AWP adversarial training framework to multi-label bird sound classification and compares ordinary training (OT), embedding-space adversarial training (AT-E), and output-space adversarial training (AT-O) on two architectures, ConvNeXt and AudioProtoPNet. On seven BirdSet soundscape test sets, the authors report that AT-O improves mean clean-data cmAP from 0.38 to 0.42 for AudioProtoPNet and to 0.41 for ConvNeXt, while also improving PRS against untargeted PGD attacks and TARS for targeted embedding-space attacks on prototypes. The paper interprets these results as evidence that adversarial training, particularly with output-space attacks, improves generalization under distribution shifts while preserving prototype stability.

Significance. If the reported effects are causal, the paper would provide practically useful evidence that adversarial training can serve as an augmentation strategy in bioacoustics, where distribution shifts are severe, and that it can stabilize prototype-based explanations. The evaluation is grounded in an external benchmark (BirdSet), spans seven geographically diverse test sets, covers two architectures, and uses five seeds per configuration. The PRS/DRS/TARS metrics are restated from prior work, and the core measurements appear internally consistent: AT-O improves most datasets and both architectures, with only UHH regressing marginally for ConvNeXt. The main gap is that the training recipe is not ablated, so the attribution of the gains to adversarial input perturbations is not established.

major comments (2)
  1. [Section 2.2, Eq. (9); Section 3.2] The central attribution of the clean-data gains to adversarial input perturbations is not supported by the experimental design. The AT-O recipe bundles the TRADES consistency term, the AWP weight perturbation (gamma=0.005, warm-up 8 epochs), and weight randomization (1e-4) together with the FGSM input perturbation, and the OT/AT-E/AT-O comparisons vary all of these ingredients at once. A control with AWP and weight randomization but no input perturbation, or with random/fixed-direction input perturbations of the same magnitude, is needed to identify which ingredient drives the improvements. If such a control reproduces the clean-data gains, the headline claim that output-space adversarial training improves generalization is misattributed, even though the measured numbers in Table 2 would stand. The paper's own Discussion leaves 'why AT-O confers broader performance enhancements than AT-E' as an open question, which further indicates that the mechanism is not established by the presented experiments.
  2. [Section 3.2; Tables 2, 3, and 5] The paper states that training was repeated five times with different seeds, but all tables report single point estimates without variance, confidence intervals, or per-seed breakdowns. As a result, small observed differences such as the ConvNeXt AT-E mean cmAP improvement from 0.38 to 0.39 in Table 2 and the UHH decrease from 0.24 to 0.23 cannot be distinguished from seed-to-seed noise. Given that the average improvements of 2.6-10.5% are the quantitative basis of C2, please report mean and standard deviation (or equivalent) for at least the main performance and robustness tables, and state whether the AT-O over OT ordering is consistent across seeds.
minor comments (6)
  1. [Section 4.1; Table 2] The epsilon=0.1 setting was selected on the POW validation set, yet POW is displayed in Table 2 alongside the seven test sets; since POW was used for hyperparameter selection, its column is not an independent estimate, and the table should label it as validation or omit it from the headline mean.
  2. [Section 2.2, Eq. (9)] The objective in Eq. (9) shows a maximization over the weight perturbation v but does not explicitly show the maximization over the input perturbation delta; the surrounding text describes this, but the equation should be completed for clarity.
  3. [Equations (4) and (7)] The cosine-similarity expressions use a dot product notation without bold vector symbols for z(hz,wz), which makes the local spatial vectors hard to distinguish from tensors; please introduce explicit vector notation.
  4. [Section 3.2] The 'weight randomization with a strength of 1e-4' is not formalized; please specify the distribution and whether the randomization is applied only during adversarial input generation or also during the outer minimization.
  5. [References] Reference [12] is cited as an arXiv preprint without a version identifier or access date; since BirdSet is the backbone of the experimental protocol, a citable version with a DOI would be preferable.
  6. [Figures 3 and 5] The UMAP visualizations are qualitative; please state the number of instances projected and whether all test segments are used, and consider adding a quantitative cluster-separation measure to support the visual claims.

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: the central claims are held-out benchmark measurements, and the self-citations provide data, model, and metric scaffolding rather than forcing the reported gains.

full rationale

The central claims (C2-C4) are empirical comparisons on seven BirdSet soundscape test sets (PER, NES, UHH, HSN, NBP, SSW, SNE) that are external to the training procedure. The AT-O/AT-E/OT comparisons are direct training-strategy comparisons; the 10.5% relative cmAP gain is a measured result, not a quantity derived from the definition of AT-O. The only hyperparameter selection is epsilon chosen on the POW validation set (Section 4.1), and the headline average is computed over the held-out test datasets, so no fitted parameter is renamed as a prediction. Self-citations to BirdSet [12], AudioProtoPNet [33], and the PRS/DRS/TARS framework [71] are present, but the relevant definitions and protocols are restated in Sections 2.1, 3.1, and 3.4, and the benchmark data themselves come from external Xeno-Canto and soundscape collections; these citations are therefore not load-bearing in the sense of forcing the result. The bundled TRADES-AWP recipe (FGSM + AWP weight perturbation + weight randomization) means the clean-data gain cannot be attributed specifically to the adversarial input perturbation without ablations, but that is an experimental confound or attribution limitation, not a circularity: the measured numbers do not reduce by construction to the method's definition. No equation in the paper defines the reported improvement in terms of the model or the attack objective, so no self-definitional or fitted-input prediction step is present. The robustness and prototype-stability results are likewise evaluations against standard PGD attacks and explicitly restated metrics, not conclusions that assume what they set out to show.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or architectural entities. Its central claim rests on the BirdSet benchmark faithfully representing distribution shifts, on the l-infinity spectrogram threat model being a meaningful training signal, on the TRADES-AWP recipe with hand-set hyperparameters, and on an unstated best-of-5 checkpoint selection assumption. The main fitted hyperparameter is epsilon=0.1, selected on POW; lambda, gamma, and the weight-randomization strength are chosen by hand following prior work.

free parameters (4)
  • epsilon (FGSM perturbation strength) = 0.1
    Selected via ablation on the POW validation set from {0.001, 0.01, 0.05, 0.1, 0.2} and applied to both AT-E and AT-O (Section 4.1).
  • lambda (TRADES regularization weight) = 1.0
    Set by hand to weight the classification loss and robustness term equally (Section 3.2); no ablation is reported.
  • gamma (AWP weight perturbation budget) = 0.005
    Layer-wise relative perturbation budget taken from [38] (Section 3.2).
  • weight randomization strength = 1e-4
    Strength of Gaussian weight perturbation during adversarial input generation, taken from [38] (Section 3.2).
assumptions (4)
  • domain assumption The BirdSet soundscape test sets (HSN, NBP, NES, PER, SNE, SSW, UHH) represent challenging real-world distribution shifts and are independent of the curated training subsets.
    The central evaluation interprets measured cmAP gains as generalization improvements under distribution shift (Section 3.1, Table 2).
  • domain assumption White-box l-infinity bounded perturbations of log-Mel spectrograms are a meaningful training proxy for robustness-relevant input variation, and single-step FGSM is a sufficient approximation of PGD for training.
    This justifies the attack and training design in Sections 2.1 and 2.2; it is standard in the adversarial robustness literature but an untested modeling choice for the audio domain.
  • domain assumption The asymmetric loss [82] remains a valid objective inside both terms of the TRADES robustness formulation when the clean output serves as the target for the perturbed output in multi-label classification.
    The multi-label adaptation of TRADES-AWP (Contribution C1) uses Lasym in both terms of Eq. 9; no derivation or ablation isolates this choice.
  • ad hoc to paper Selecting the lowest-validation-loss checkpoint across five seeds yields a fair estimator of configuration performance.
    Section 3.2 states the best-of-5 selection without reporting variance, an unstated statistical assumption that affects all reported comparisons.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics." pith.science (2026). https://pith.science/paper/X4WPKYAO

@misc{pith2026250713727,
  author       = {Pith},
  title        = {Pith review of: Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X4WPKYAO}},
  note         = {Machine review of arXiv:2507.13727}
}
read the original abstract

Adversarial training is a promising strategy for enhancing model robustness against adversarial attacks. However, its impact on generalization under substantial data distribution shifts in audio classification remains largely unexplored. To address this gap, this work investigates how different adversarial training strategies improve generalization performance and adversarial robustness in audio classification. The study focuses on two model architectures: a conventional convolutional neural network (ConvNeXt) and an inherently interpretable prototype-based model (AudioProtoPNet). The approach is evaluated using a challenging bird sound classification benchmark. This benchmark is characterized by pronounced distribution shifts between training and test data due to varying environmental conditions and recording methods, a common real-world challenge. The investigation explores two adversarial training strategies: one based on output-space attacks that maximize the classification loss function, and another based on embedding-space attacks designed to maximize embedding dissimilarity. These attack types are also used for robustness evaluation. Additionally, for AudioProtoPNet, the study assesses the stability of its learned prototypes under targeted embedding-space attacks. Results show that adversarial training, particularly using output-space attacks, improves clean test data performance by an average of 10.5% relative and simultaneously strengthens the adversarial robustness of the models. These findings, although derived from the bird sound domain, suggest that adversarial training holds potential to enhance robustness against both strong distribution shifts and adversarial attacks in challenging audio classification settings.

Figures

Figures reproduced from arXiv: 2507.13727 by the authors.

Figure 1
Figure 1. Conceptual illustration of employing adversarial training to mitigate the effects of data distribution shifts [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Embedding-space attacks perturb model inputs to manipulate the resulting embeddings, either by disrupting [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. UMAP visualization of global average pooled embeddings from ordinarily trained ConvNeXt (top row) and [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Clean and adversarially perturbed spectrograms with difference maps (i.e., perturbed minus clean) for [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: UMAP visualization of embeddings from ordinarily trained ConvNeXt (top row) and AudioProtoPNet [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: PRS, DRS, and TARS scores for AudioProtoPNet against targeted embedding-space attacks, visually [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

113 extracted references · 48 canonical work pages

  1. [1]

    A review of deep learning based methods for acoustic scene classification

    Jakob Abeßer. A review of deep learning based methods for acoustic scene classification. Applied Sciences, 10(6):2020, 2020

    2020

  2. [2]

    Towards Audio Domain Adaptation for Acoustic Scene Classification using Disentanglement Learning

    Jakob Abeßer and Meinard Müller. Towards audio domain adaptation for acoustic scene classification using disentanglement learning. arXiv preprint arXiv:2110.13586, 2021

    work page Pith review arXiv 2021

  3. [3]

    Mitigating real-world distribution shifts in the fourier domain

    Kiran Krishnamachari, See-Kiong Ng, and Chuan-Sheng Foo. Mitigating real-world distribution shifts in the fourier domain. Transactions on Machine Learning Research, 2023

    2023

  4. [4]

    Spectrum Correction: Acoustic Scene Classification with Mismatched Recording Devices

    Michał Ko´smider. Spectrum correction: Acoustic scene classification with mismatched recording devices. arXiv preprint arXiv:2105.11856, 2021

    work page Pith review arXiv 2021

  5. [5]

    Measuring the impact of domain factors in self-supervised pre-training

    Ramon Sanabria, Wei-Ning Hsu, Alexei Baevski, and Michael Auli. Measuring the impact of domain factors in self-supervised pre-training. In 2023 IEEE International Conference on Acoustics, Speech, and Signal Processing Workshops (ICASSPW), pages 1–5. IEEE, 2023. 17 Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics

    2023

  6. [6]

    Imad-ds: A dataset for industrial multi-sensor anomaly detection under domain shift conditions

    Davide Albertini, Filippo Augusti, Kudret Esmer, Alberto Bernardini, and Roberto Sannino. Imad-ds: A dataset for industrial multi-sensor anomaly detection under domain shift conditions. InProc. Detection and Classification of Acoustic Scenes and Events 2024 Workshop, pages 1–5, 2024

    2024

  7. [7]

    Automatic speech recognition using advanced deep learning approaches: A survey

    Hamza Kheddar, Mustapha Hemis, and Yassine Himeur. Automatic speech recognition using advanced deep learning approaches: A survey. Information Fusion, page 102422, 2024

    2024

  8. [8]

    Birds, bats and beyond: Evaluating generalization in bioacoustics models

    Bart Van Merriënboer, Jenny Hamer, Vincent Dumoulin, Eleni Triantafillou, and Tom Denton. Birds, bats and beyond: Evaluating generalization in bioacoustics models. Frontiers in Bird Science, 3:1369756, 2024

    2024

Show all 113 references
  1. [9]

    Robust sound event detection in bioacoustic sensor networks

    Vincent Lostanlen, Justin Salamon, Andrew Farnsworth, Steve Kelling, and Juan Pablo Bello. Robust sound event detection in bioacoustic sensor networks. PloS one, 14(10):e0214168, 2019

    2019

  2. [10]

    Weather conditions determine attenuation and speed of sound: Environmental limitations for monitoring and analyzing bat echolocation

    Holger R Goerlitz. Weather conditions determine attenuation and speed of sound: Environmental limitations for monitoring and analyzing bat echolocation. Ecology and evolution, 8(10):5090–5100, 2018

    2018

  3. [11]

    Global birdsong embeddings enable superior transfer learning for bioacoustic classification

    Burooj Ghani, Tom Denton, Stefan Kahl, and Holger Klinck. Global birdsong embeddings enable superior transfer learning for bioacoustic classification. Scientific Reports, 13(1):22876, 2023

    2023

  4. [12]

    Birdset: A large-scale dataset for audio classification in avian bioacoustics

    Lukas Rauch, Raphael Schwinger, Moritz Wirth, René Heinrich, Denis Huseljic, Marek Herde, Jonas Lange, Stefan Kahl, Bernhard Sick, Sven Tomforde, et al. Birdset: A large-scale dataset for audio classification in avian bioacoustics. arXiv preprint arXiv:2403.10380, 2024

    2024 arXiv

  5. [13]

    Improving predictive inference under covariate shift by weighting the log-likelihood function

    Hidetoshi Shimodaira. Improving predictive inference under covariate shift by weighting the log-likelihood function. Journal of statistical planning and inference, 90(2):227–244, 2000

    2000

  6. [14]

    Machine learning in non-stationary environments: Introduction to covariate shift adaptation

    Masashi Sugiyama and Motoaki Kawanabe. Machine learning in non-stationary environments: Introduction to covariate shift adaptation. MIT press, 2012

    2012

  7. [15]

    A theory of learning from different domains

    Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. A theory of learning from different domains. Machine learning, 79:151–175, 2010

    2010

  8. [16]

    Unsupervised domain adaptation by backpropagation

    Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference on machine learning, pages 1180–1189. PMLR, 2015

    2015

  9. [17]

    Meta-learning under task shift

    Lei Sun, Yusuke Tanaka, and Tomoharu Iwata. Meta-learning under task shift. Transactions on Machine Learning Research, 2024

    2024

  10. [18]

    Plex: Towards reliability using pretrained large model extensions

    Dustin Tran, Jeremiah Liu, Michael W Dusenberry, Du Phan, Mark Collier, Jie Ren, Kehang Han, Zi Wang, Zelda Mariet, Huiyi Hu, et al. Plex: Towards reliability using pretrained large model extensions. arXiv preprint arXiv:2207.07411, 2022

    2022 arXiv

  11. [19]

    Change is hard: A closer look at subpopulation shift

    Yuzhe Yang, Haoran Zhang, Dina Katabi, and Marzyeh Ghassemi. Change is hard: A closer look at subpopulation shift. arXiv preprint arXiv:2302.12254, 2023

    2023 arXiv

  12. [20]

    Classification in the presence of label noise: a survey

    Benoît Frénay and Michel Verleysen. Classification in the presence of label noise: a survey. IEEE transactions on neural networks and learning systems, 25(5):845–869, 2013

    2013

  13. [21]

    Learning with noisy labels

    Nagarajan Natarajan, Inderjit S Dhillon, Pradeep K Ravikumar, and Ambuj Tewari. Learning with noisy labels. Advances in neural information processing systems, 26, 2013

    2013

  14. [22]

    Fsd50k: an open dataset of human-labeled sound events

    Eduardo Fonseca, Xavier Favory, Jordi Pons, Frederic Font, and Xavier Serra. Fsd50k: an open dataset of human-labeled sound events. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 30:829–852, 2021

    2021

  15. [23]

    Smote: synthetic minority over-sampling technique

    V Chawla Nitesh. Smote: synthetic minority over-sampling technique. J Artif Intell Res, 16(1):321, 2002

    2002

  16. [24]

    Learning from imbalanced data

    Haibo He and Edwardo A Garcia. Learning from imbalanced data. IEEE Transactions on knowledge and data engineering, 21(9):1263–1284, 2009

    2009

  17. [25]

    mixup: Beyond empirical risk minimization

    Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint arXiv:1710.09412, 2017

    2017 arXiv

  18. [26]

    Augmix: A simple data processing method to improve robustness and uncertainty

    Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. arXiv preprint arXiv:1912.02781, 2019

    1912 arXiv

  19. [27]

    Data augmentation and deep learning methods in sound classification: A systematic review

    Olusola O Abayomi-Alli, Robertas Damaševiˇcius, Atika Qazi, Mariam Adedoyin-Olowe, and Sanjay Misra. Data augmentation and deep learning methods in sound classification: A systematic review. Electronics, 11(22):3795, 2022

    2022

  20. [28]

    Improving learning-based birdsong classification by utilizing combined audio augmentation strategies

    Arunodhayan Sampath Kumar, Tobias Schlosser, Stefan Kahl, and Danny Kowerko. Improving learning-based birdsong classification by utilizing combined audio augmentation strategies. Ecological Informatics, 82:102699, 2024. 18 Adversarial Training Improves Generalization Under Dis...

    2024

  21. [29]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018

    2018

  22. [30]

    An interpretable deep learning model for automatic sound classification

    Pablo Zinemanas, Martín Rocamora, Marius Miron, Frederic Font, and Xavier Serra. An interpretable deep learning model for automatic sound classification. Electronics, 10(7):850, 2021

    2021

  23. [31]

    Prototype learning for interpretable respiratory sound analysis

    Zhao Ren, Thanh Tam Nguyen, and Wolfgang Nejdl. Prototype learning for interpretable respiratory sound analysis. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 9087–9091. IEEE, 2022

    2022

  24. [32]

    The interpretability of the activity signal detection model for wood-boring pests semanotus bifasciatus in the larval stage

    Xuanxin Liu, Zhibo Chen, Haiyan Zhang, Juhu Li, Qi Jiang, Lili Ren, and Youqing Luo. The interpretability of the activity signal detection model for wood-boring pests semanotus bifasciatus in the larval stage. Pest Management Science, 79(10):3830–3842, 2023

    2023

  25. [33]

    Audioprotopnet: An interpretable deep learning model for bird sound classification

    René Heinrich, Lukas Rauch, Bernhard Sick, and Christoph Scholz. Audioprotopnet: An interpretable deep learning model for bird sound classification. Ecological Informatics, 87:103081, 2025

    2025

  26. [34]

    Can masked autoencoders also listen to birds? arXiv preprint arXiv:2504.12880, 2025

    Lukas Rauch, Ilyass Moummad, René Heinrich, Alexis Joly, Bernhard Sick, and Christoph Scholz. Can masked autoencoders also listen to birds? arXiv preprint arXiv:2504.12880, 2025

    2025 arXiv

  27. [35]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  28. [36]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR, 2019

    2019

  29. [37]

    Adversarial weight perturbation helps robust generalization

    Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in neural information processing systems, 33:2958–2969, 2020

    2020

  30. [38]

    Randomized adversarial training via taylor expansion

    Gaojie Jin, Xinping Yi, Dengyu Wu, Ronghui Mu, and Xiaowei Huang. Randomized adversarial training via taylor expansion. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16447–16457, 2023

    2023

  31. [39]

    A thorough comparison study on adversarial attacks and defenses for common thorax disease classification in chest x-rays

    Chendi Rao, Jiezhang Cao, Runhao Zeng, Qi Chen, Huazhu Fu, Yanwu Xu, and Mingkui Tan. A thorough comparison study on adversarial attacks and defenses for common thorax disease classification in chest x-rays. arXiv preprint arXiv:2003.13969, 2020

    2003 arXiv

  32. [40]

    Towards evaluating the robustness of deep diagnostic models by adversarial attack

    Mengting Xu, Tao Zhang, Zhongnian Li, Mingxia Liu, and Daoqiang Zhang. Towards evaluating the robustness of deep diagnostic models by adversarial attack. Medical Image Analysis, 69:101977, 2021

    2021

  33. [41]

    Survey on adversarial attack and defense for medical image analysis: Methods and challenges

    Junhao Dong, Junxi Chen, Xiaohua Xie, Jianhuang Lai, and Hao Chen. Survey on adversarial attack and defense for medical image analysis: Methods and challenges. ACM Computing Surveys, 57(3):1–38, 2024

    2024

  34. [42]

    Freelb: Enhanced adversarial training for natural language understanding

    Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adversarial training for natural language understanding. arXiv preprint arXiv:1909.11764, 2019

    1909 arXiv

  35. [43]

    Towards feature space adversarial attack by style perturbation

    Qiuling Xu, Guanhong Tao, Siyuan Cheng, and Xiangyu Zhang. Towards feature space adversarial attack by style perturbation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 10523–10531, 2021

    2021

  36. [44]

    Impact of adversarial training on robustness and generalizability of language models

    Enes Altinisik, Hassan Sajjad, Husrev Taha Sencar, Safa Messaoud, and Sanjay Chawla. Impact of adversarial training on robustness and generalizability of language models. arXiv preprint arXiv:2211.05523, 2022

    2022 arXiv

  37. [45]

    Robust automatic speech recognition via wavaugment guided phoneme adversarial training

    Gege Qi, Yuefeng Chen, Xiaofeng Mao, Xiaojun Jia, Ranjie Duan, Rong Zhang, and Hui Xue. Robust automatic speech recognition via wavaugment guided phoneme adversarial training. arXiv preprint arXiv:2307.12498, 2023

    2023 arXiv

  38. [46]

    Adversarial supervised contrastive learning

    Zhuorong Li, Daiwei Yu, Minghui Wu, Canghong Jin, and Hongchuan Yu. Adversarial supervised contrastive learning. Machine Learning, 112(6):2105–2130, 2023

    2023

  39. [47]

    Defense against adversarial attacks using feature scattering-based adversarial training

    Haichao Zhang and Jianyu Wang. Defense against adversarial attacks using feature scattering-based adversarial training. Advances in neural information processing systems, 32, 2019

    2019

  40. [48]

    Adversarial self-supervised contrastive learning

    Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. Advances in neural information processing systems, 33:2983–2994, 2020

    2020

  41. [49]

    Self-supervised adversarial training

    Kejiang Chen, Yuefeng Chen, Hang Zhou, Xiaofeng Mao, Yuhong Li, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Self-supervised adversarial training. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2218–2222. IEEE, ...

    2020

  42. [50]

    Contrastive learning with adversarial examples

    Chih-Hui Ho and Nuno Nvasconcelos. Contrastive learning with adversarial examples. Advances in Neural Information Processing Systems, 33:17081–17093, 2020

    2020

  43. [51]

    Robust pre-training by adversarial contrastive learning

    Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. Advances in neural information processing systems, 33:16199–16210, 2020

    2020

  44. [52]

    Self-supervised adversarial training via diverse augmented queries and self-supervised double perturbation

    Ruize Zhang, Sheng Tang, and Juan Cao. Self-supervised adversarial training via diverse augmented queries and self-supervised double perturbation. Advances in Neural Information Processing Systems, 37:43788–43808, 2024

    2024

  45. [53]

    Adversarial attacks and robust defenses in speaker embedding based zero-shot text-to-speech system

    Ze Li, Yao Shi, Yunfei Xu, and Ming Li. Adversarial attacks and robust defenses in speaker embedding based zero-shot text-to-speech system. arXiv preprint arXiv:2410.04017, 2024

    2024

  46. [54]

    Robustness may be at odds with accuracy

    Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152, 2018

    2018 arXiv

  47. [55]

    Precise tradeoffs in adversarial training for linear regression

    Adel Javanmard, Mahdi Soltanolkotabi, and Hamed Hassani. Precise tradeoffs in adversarial training for linear regression. In Conference on Learning Theory, pages 2034–2078. PMLR, 2020

    2020

  48. [56]

    Understanding and mitigating the tradeoff between robustness and accuracy

    Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. arXiv preprint arXiv:2002.10716, 2020

    2002 arXiv

  49. [57]

    A closer look at accuracy vs

    Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in neural information processing systems, 33:8588–8601, 2020

    2020

  50. [58]

    Generalizing to unseen domains via adversarial data augmentation

    Riccardo V olpi, Hongseok Namkoong, Ozan Sener, John C Duchi, Vittorio Murino, and Silvio Savarese. Generalizing to unseen domains via adversarial data augmentation. Advances in neural information processing systems, 31, 2018

    2018

  51. [59]

    Improving out-of-distribution generalization by adversarial training with structured priors

    Qixun Wang, Yifei Wang, Hong Zhu, and Yisen Wang. Improving out-of-distribution generalization by adversarial training with structured priors. Advances in Neural Information Processing Systems, 35:27140–27152, 2022

    2022

  52. [60]

    On the connection between invariant learning and adversarial training for out-of-distribution generalization

    Shiji Xin, Yifei Wang, Jingtong Su, and Yisen Wang. On the connection between invariant learning and adversarial training for out-of-distribution generalization. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 10519–10527, 2023

    2023

  53. [61]

    Attribute-guided adversarial training for robustness to natural perturbations

    Tejas Gokhale, Rushil Anirudh, Bhavya Kailkhura, Jayaraman J Thiagarajan, Chitta Baral, and Yezhou Yang. Attribute-guided adversarial training for robustness to natural perturbations. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 7574–7582, 2021

    2021

  54. [62]

    Improved ood generalization via adversarial training and pretraing

    Mingyang Yi, Lu Hou, Jiacheng Sun, Lifeng Shang, Xin Jiang, Qun Liu, and Zhiming Ma. Improved ood generalization via adversarial training and pretraing. In International Conference on Machine Learning, pages 11987–11997. PMLR, 2021

    2021

  55. [63]

    Generalizability of adversarial robustness under distribution shifts

    Kumail Alhamoud, Hasan Abed Al Kader Hammoud, Motasem Alfarra, and Bernard Ghanem. Generalizability of adversarial robustness under distribution shifts. arXiv preprint arXiv:2209.15042, 2022

    2022 arXiv

  56. [64]

    Protopshare: Prototype sharing for interpretable image classification and similarity discovery

    Dawid Rymarczyk, Łukasz Struski, Jacek Tabor, and Bartosz Zieli ´nski. Protopshare: Prototype sharing for interpretable image classification and similarity discovery. arXiv preprint arXiv:2011.14340, 2020

    2011 arXiv

  57. [65]

    Multi-grained interpre table network for image recognition

    Peiyu Yang, Zeyi Wen, and Ajmal Mian. Multi-grained interpre table network for image recognition. In 2022 26th International Conference on Pattern Recognition (ICPR), pages 3815–3821. IEEE, 2022

    2022

  58. [66]

    Towards robust fine-grained recognition by maximal separation of discriminative features

    Krishna Kanth Nakka and Mathieu Salzmann. Towards robust fine-grained recognition by maximal separation of discriminative features. In Proceedings of the Asian Conference on Computer Vision, 2020

    2020

  59. [67]

    Inter- pretability benchmark for evaluating spatial misalignment of prototypical parts explanations

    Mikołaj Sacha, Bartosz Jura, Dawid Rymarczyk, Łukasz Struski, Jacek Tabor, and Bartosz Zieli ´nski. Inter- pretability benchmark for evaluating spatial misalignment of prototypical parts explanations. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38,...

    2024

  60. [68]

    This looks like that

    Adrian Hoffmann, Claudio Fanconi, Rahul Rade, and Jonas Kohler. This looks like that... does it? shortcomings of latent space prototype interpretability in deep networks. arXiv preprint arXiv:2105.02968, 2021

    2021 arXiv

  61. [69]

    Evaluation and improvement of interpretability for self-explainable part-prototype networks

    Qihan Huang, Mengqi Xue, Wenqi Huang, Haofei Zhang, Jie Song, Yongcheng Jing, and Mingli Song. Evaluation and improvement of interpretability for self-explainable part-prototype networks. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 2011–2020, 2023

    2011

  62. [70]

    Adversarial attacks and defenses in images, graphs and text: A review

    Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain. Adversarial attacks and defenses in images, graphs and text: A review. International Journal of Automation and Computing , 17(2):151–178, 2020

    2020

  63. [71]

    Targeted adversarial attacks on wind power forecasts

    René Heinrich, Christoph Scholz, Stephan V ogt, and Malte Lehna. Targeted adversarial attacks on wind power forecasts. Machine Learning, 113(2):863–889, 2024. 20 Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics

    2024

  64. [72]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019

    1902 arXiv

  65. [73]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99–112. Chapman and Hall/CRC, 2018

    2018

  66. [74]

    The search for squawk: Agile modeling in bioacoustics

    Vincent Dumoulin, Otilia Stretcu, Jenny Hamer, Lauren Harrell, Rob Laber, Hugo Larochelle, Bart van Merriën- boer, Amanda Navine, Patrick Hart, Ben Williams, et al. The search for squawk: Agile modeling in bioacoustics. arXiv preprint arXiv:2505.03071, 2025

    2025 arXiv

  67. [75]

    Cosine normalization: Using cosine similarity instead of dot product in neural networks

    Chunjie Luo, Jianfeng Zhan, Xiaohe Xue, Lei Wang, Rui Ren, and Qiang Yang. Cosine normalization: Using cosine similarity instead of dot product in neural networks. In Artificial Neural Networks and Machine Learning– ICANN 2018: 27th International Conference on Artificial Neura...

    2018

  68. [76]

    Semantics at an angle: When cosine similarity works until it doesn’t

    Kisung You. Semantics at an angle: When cosine similarity works until it doesn’t. arXiv preprint arXiv:2504.16318, 2025

    2025 arXiv

  69. [77]

    Rectified linear units improve restricted boltzmann machines

    Vinod Nair and Geoffrey E Hinton. Rectified linear units improve restricted boltzmann machines. InProceedings of the 27th international conference on machine learning (ICML-10), pages 807–814, 2010

    2010

  70. [78]

    Review of artificial intelligence adversarial attack and defense technologies

    Shilin Qiu, Qihe Liu, Shijie Zhou, and Chunjiang Wu. Review of artificial intelligence adversarial attack and defense technologies. Applied Sciences, 9(5):909, 2019

    2019

  71. [79]

    Advances in adversarial attacks and defenses in computer vision: A survey

    Naveed Akhtar, Ajmal Mian, Navid Kardan, and Mubarak Shah. Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access, 9:155161–155196, 2021

    2021

  72. [80]

    On detecting adversarial perturbations

    Jan Hendrik Metzen, Tim Genewein, V olker Fischer, and Bastian Bischoff. On detecting adversarial perturbations. arXiv preprint arXiv:1702.04267, 2017

    2017 arXiv

  73. [81]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  74. [82]

    Asymmetric loss for multi-label classification

    Tal Ridnik, Emanuel Ben-Baruch, Nadav Zamir, Asaf Noy, Itamar Friedman, Matan Protter, and Lihi Zelnik- Manor. Asymmetric loss for multi-label classification. In Proceedings of the IEEE/CVF international conference on computer vision, pages 82–91, 2021

    2021

  75. [83]

    Zerograd: Mitigating and explaining catastrophic overfitting in fgsm adversarial training

    Zeinab Golgooni, Mehrdad Saberi, Masih Eskandar, and Mohammad Hossein Rohban. Zerograd: Mitigating and explaining catastrophic overfitting in fgsm adversarial training. arXiv preprint arXiv:2103.15476, 2021

    2021 arXiv

  76. [84]

    Understanding and increasing efficiency of frank-wolfe adversarial training

    Theodoros Tsiligkaridis and Jay Roberts. Understanding and increasing efficiency of frank-wolfe adversarial training. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 50–59, 2022

    2022

  77. [85]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994, 2020

    2001 arXiv

  78. [86]

    Understanding and improving fast adversarial training

    Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances in Neural Information Processing Systems, 33:16048–16059, 2020

    2020

  79. [87]

    The xeno-canto collection and its relation to sound recognition and classification

    Willem-Pier Vellinga and Robert Planqué. The xeno-canto collection and its relation to sound recognition and classification. In CLEF (Working Notes), 2015

    2015

  80. [88]

    Chronister, Tessa A

    Lauren M. Chronister, Tessa A. Rhinehart, Aidan Place, and Justin Kitzes. An annotated set of audio recordings of Eastern North American birds containing frequency, time, and species information, April 2021

    2021

  81. [89]

    A collection of fully-annotated soundscape recordings from the southern sierra nevada mountain range, 2023

    Mary Clapp, Stefan Kahl, Erik Meyer, Megan McKenna, Holger Klinck, and Gail Patricelli. A collection of fully-annotated soundscape recordings from the southern sierra nevada mountain range, 2023

    2023

  82. [90]

    Nips4bplus: a richly annotated birdsong audio dataset

    Veronica Morfi, Yves Bas, Hanna Pamuła, Hervé Glotin, and Dan Stowell. Nips4bplus: a richly annotated birdsong audio dataset. PeerJ Computer Science, 5:e223, 2019

    2019

  83. [91]

    Symes, Viviana Ruiz-Gutiérrez, Ingrid Molina-Mora, Fernando Cediel, Luis Sandoval, and Holger Klinck

    Álvaro Vega-Hidalgo, Stefan Kahl, Laurel B. Symes, Viviana Ruiz-Gutiérrez, Ingrid Molina-Mora, Fernando Cediel, Luis Sandoval, and Holger Klinck. A collection of fully-annotated soundscape recordings from neotropi- cal coffee farms in colombia and costa rica, 2023

    2023

  84. [92]

    Alexander Hopping, Stefan Kahl, and Holger Klinck

    W. Alexander Hopping, Stefan Kahl, and Holger Klinck. A collection of fully-annotated soundscape recordings from the southwestern amazon basin, 2022

    2022

  85. [93]

    Wood, Philip Chaon, M

    Stefan Kahl, Connor M. Wood, Philip Chaon, M. Zachariah Peery, and Holger Klinck. A collection of fully- annotated soundscape recordings from the western united states, 2022. 21 Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics

    2022

  86. [94]

    A collection of fully-annotated soundscape recordings from the northeastern united states, 2022

    Stefan Kahl, Russell Charif, and Holger Klinck. A collection of fully-annotated soundscape recordings from the northeastern united states, 2022

    2022

  87. [95]

    A collection of fully-annotated soundscape recordings from the island of hawai’i, 2022

    Amanda Navine, Stefan Kahl, Ann Tanimoto-Johnson, Holger Klinck, and Patrick Hart. A collection of fully-annotated soundscape recordings from the island of hawai’i, 2022

    2022

  88. [96]

    Unsupervised classification to improve the quality of a bird song recording dataset

    Félix Michaud, Jérôme Sueur, Maxime Le Cesne, and Sylvain Haupert. Unsupervised classification to improve the quality of a bird song recording dataset. Ecological Informatics, 74:101952, 2023

    2023

  89. [97]

    Improving bird classification with unsupervised sound separation

    Tom Denton, Scott Wisdom, and John R Hershey. Improving bird classification with unsupervised sound separation. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 636–640. IEEE, 2022

    2022

  90. [98]

    BirdV ox-DCASE- 20k: A dataset for bird audio detection in 10-second clips, 2018

    Vincent Lostanlen, Justin Salamon, Andrew Farnsworth, Steve Kelling, and Juan Pablo Bello. BirdV ox-DCASE- 20k: A dataset for bird audio detection in 10-second clips, 2018

    2018

  91. [99]

    Specaugment: A simple data augmentation method for automatic speech recognition

    Daniel S Park, William Chan, Yu Zhang, Chung-Cheng Chiu, Barret Zoph, Ekin D Cubuk, and Quoc V Le. Specaugment: A simple data augmentation method for automatic speech recognition. arXiv preprint arXiv:1904.08779, 2019

    1904 arXiv

  92. [100]

    A convnet for the 2020s

    Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11976–11986, 2022

    2022

  93. [101]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  94. [102]

    Decoupled weight decay regularization

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017

    2017 arXiv

  95. [103]

    Sgdr: Stochastic gradient descent with warm restarts

    Ilya Loshchilov and Frank Hutter. Sgdr: Stochastic gradient descent with warm restarts. arXiv preprint arXiv:1608.03983, 2016

    2016 arXiv

  96. [104]

    Overview of birdclef 2023: Automated bird species identification in eastern africa

    Stefan Kahl, Tom Denton, Holger Klinck, Hendrik Reers, Francis Cherutich, Hervé Glotin, Hervé Goëau, Willem-Pier Vellinga, Robert Planqué, and Alexis Joly. Overview of birdclef 2023: Automated bird species identification in eastern africa. Working Notes of CLEF, 2023

    2023

  97. [105]

    Umap: Uniform manifold approximation and projection for dimension reduction

    Leland McInnes, John Healy, and James Melville. Umap: Uniform manifold approximation and projection for dimension reduction. arXiv preprint arXiv:1802.03426, 2018

    2018 arXiv

  98. [106]

    Quantus: An explainable ai toolkit for responsible evaluation of neural network explanations and beyond

    Anna Hedström, Leander Weber, Daniel Krakowczyk, Dilyara Bareeva, Franz Motzkus, Wojciech Samek, Sebastian Lapuschkin, and Marina M-C Höhne. Quantus: An explainable ai toolkit for responsible evaluation of neural network explanations and beyond. Journal of Machine Learning Res...

    2023

  99. [107]

    Navigating the maze of explainable ai: A systematic approach to evaluating methods and metrics

    Lukas Klein, Carsten Lüth, Udo Schlegel, Till Bungert, Mennatallah El-Assady, and Paul Jäger. Navigating the maze of explainable ai: A systematic approach to evaluating methods and metrics. Advances in Neural Information Processing Systems, 37:67106–67146, 2024

    2024

  100. [108]

    What i cannot predict, i do not understand: A human-centered evaluation framework for explainability methods

    Julien Colin, Thomas Fel, Rémi Cadène, and Thomas Serre. What i cannot predict, i do not understand: A human-centered evaluation framework for explainability methods. Advances in neural information processing systems, 35:2832–2845, 2022

    2022

  101. [109]

    shapiq: Shapley interactions for machine learning

    Maximilian Muschalik, Hubert Baniecki, Fabian Fumagalli, Patrick Kolpaczki, Barbara Hammer, and Eyke Hüllermeier. shapiq: Shapley interactions for machine learning. Advances in Neural Information Processing Systems, 37:130324–130357, 2024

    2024

  102. [110]

    A unified approach to interpreting model predictions

    Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions. Advances in neural information processing systems, 30, 2017

    2017

  103. [111]

    why should i trust you?

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. " why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135–1144, 2016

    2016

  104. [112]

    Visualizing and understanding convolutional networks

    Matthew D Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part I 13, pages 818–833. Springer, 2014

    2014

  105. [113]

    Birb: A generalization benchmark for information retrieval in bioacoustics

    Jenny Hamer, Eleni Triantafillou, Bart van Merrienboer, Stefan Kahl, Holger Klinck, Tom Denton, and Vin- cent Dumoulin. Birb: A generalization benchmark for information retrieval in bioacoustics. arXiv preprint arXiv:2312.07439, 2023. 22 Adversarial Training Improves Generaliz...

    2023 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.