Pith. sign in

REVIEW 4 major objections 4 minor 2 cited by

Adversarial Examples Are Not Bugs, They Are Superposition

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Superposition, not bugs, may drive adversarial examples

desk verdict Strong hypothesis, promising experiments, but the causal claim is not yet supported; the paper deserves refereeing but with an expectation of tightening. read the letter →

arxiv 2508.17456 v2 pith:N22MO2SY submitted 2025-08-24 cs.LG

Liv Gorton , Owen Lewis This is my paper
classification cs.LG
keywords adversarialexamplessuperpositionneuralnetworkrobustnessmechanisticinterpretabilitytrainingfeatureinterferencetoymodelsResNet18
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that adversarial examples—small input perturbations that fool neural networks—arise not from a fixable flaw but from how networks store multiple features in the same neurons, a phenomenon called superposition. It claims this storage overlap is a major contributing factor and possibly the primary cause of adversarial vulnerability. To support this, it offers four lines of evidence: a theoretical account of why superposition should create adversarial directions, toy-model experiments showing that altering superposition changes robustness, toy-model experiments showing that altering robustness changes superposition, and a ResNet18 experiment where adversarial training reduces superposition. If right, adversarial examples are an expected consequence of neural network efficiency, not an accidental bug.

What carries the argument

Superposition: a trained network represents more features than it has neurons by storing features in non-orthogonal directions, so a weight vector often activates several features at once. In this paper it is the mechanism that couples input perturbations to prediction changes: a small input change that aligns with one feature's direction can accidentally activate an overlapping feature and flip the output. The experiments use interventions on this overlap to show the coupling is causal rather than merely correlated.

What would settle it

Train a network with enough capacity that it does not use superposition (verified by neuron activation analysis) and show it is still vulnerable to adversarial examples; that would falsify the claim. Alternatively, find a network that adversarial training makes robust without any measurable decrease in superposition.

Watch

Extended reading notes

Core claim

The central claim is that superposition—when a network encodes several features along overlapping directions in a layer to save capacity—creates regions in input space where small changes flip the network's prediction. The paper presents a causal argument in toy models: steering superposition in one direction moves robustness in the other, and adversarial training, which improves robustness, measurably reduces superposition. The same reduction in superposition is observed in ResNet18 after adversarial training. The conclusion is that adversarial examples are a direct byproduct of the network's efficient feature packing, meaning they cannot be fully eliminated without changing that packing it

Load-bearing premise

The toy models capture the same superposition dynamics as real trained networks, so that intervening on superposition in these models shows what actually happens in networks like ResNet18.

Editorial extensions

If this is right

  • Adversarial vulnerability and feature overlap are two sides of the same coin; measuring superposition in a layer should predict how attackable the network is.
  • Adversarial training works, in part, by reducing superposition, which means it is making the network less efficient rather than just patching a vulnerability.
  • Defenses that do not change superposition may not generalize to new attack types.
  • Wider networks, with more capacity to store features separately, should show fewer adversarial examples for the same task.
  • Robustness can be viewed as a capacity tradeoff: buying robustness means paying in feature storage efficiency.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct testable extension: adversarially robust variants of the same model should show lower measured superposition in every layer, not just the final one; a clear failure here would localize where the claim breaks.
  • If superposition is the primary cause, then models with identical accuracy but different superposition levels should differ in robustness; this could be tested by training with different capacity budgets.
  • The same mechanism may explain why adversarial examples transfer between models: if different models learn similar feature packing in superposition, a perturbation tuned on one will activate overlapping features in another.
  • The claim implies a hard limit: any network forced to be efficient enough to use superposition will remain adversarially vulnerable in some form, so research should shift to quantifying and managing the tradeoff rather than expecting elimination.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript argues that superposition—the encoding of multiple features in overlapping neural directions—is a major contributing factor, and possibly the primary cause, of adversarial examples. It cites four evidence lines: a theoretical account of adversarial phenomena, toy-model interventions that change superposition and allegedly change robustness, toy-model adversarial training that allegedly changes superposition, and a ResNet18 experiment in which adversarial training reduces a superposition proxy. The abstract hedges ('may be a major contributing factor'), but the title states a categorical identity: 'Adversarial Examples Are Not Bugs, They Are Superposition.' The central claim is causal and broad, and the strength of the evidence is the key question.

Significance. If the causal claim were established, this would be an important mechanistic unification of adversarial examples and superposition, with implications for defenses: adversarial vulnerability would be partly unavoidable rather than fully patchable. The proposed bidirectional toy-model intervention strategy is a promising way to test such a hypothesis, and the paper is commendable for making a falsifiable claim. However, the version under review does not provide the quantitative or controlled evidence needed to support the causal title. The toy-model interventions appear confounded, the ResNet18 evidence is only correlational, and the submitted text contains large unreadable passages with no accessible numeric results. The paper would be valuable as a hypothesis paper or with substantially stronger intervention evidence.

major comments (4)
  1. [§4 (toy-model interventions)] The abstract's second evidence line, 'intervening on superposition controls robustness,' is load-bearing. In standard superposition toy models, superposition is induced by varying feature sparsity, the feature-to-embedding ratio, or regularization strength. Each of these interventions also changes the input distribution, model capacity, or both. If the paper's intervention changes sparsity or capacity, the observed robustness shift could be caused by those confounds rather than by superposition. The paper needs matched baseline conditions that keep input statistics and capacity fixed while modulating only the weight-sharing/superposition structure, and it should report the separate effect sizes.
  2. [§6 (ResNet18 evidence)] The ResNet18 result is correlational: adversarial training changes many network properties, including feature geometry, loss landscape, and sensitivity to other perturbations. Observing that a superposition proxy decreases after adversarial training does not establish that superposition is the 'primary cause' of adversarial vulnerability. A third factor could drive both. To support the causal title, the authors need a causal intervention on superposition in a real network, or an explicit comparison with alternative mechanisms. Without this, 'primary cause' is unsupported.
  3. [Results table / Appendix] The abstract reports no numbers, and the results table in the appendix shows no visible numeric entries or error bars. This makes it impossible to assess whether the claimed relationships are strong, consistent, or statistically reliable. The paper should report the superposition metric, robustness metric, and adversarial-training condition for each experiment, with means, standard deviations, and sample sizes, at minimum.
  4. [Theoretical argument] The first evidence line is only a qualitative 'can theoretically explain' narrative. It is not a theorem, and it does not yield a falsifiable prediction that distinguishes superposition from other mechanisms. If the empirical evidence is completed, the theoretical section should derive a quantitative signature—for example, a specific predicted relationship between a superposition measure and adversarial vulnerability—that the experiments then test.
minor comments (4)
  1. [Title] The title 'Adversarial Examples Are Not Bugs, They Are Superposition' is much stronger than the abstract's 'may be a major contributing factor.' A title such as 'Superposition as a Major Cause of Adversarial Examples' would match the actual evidence level.
  2. [Abstract] The abstract should quantify the evidence: give effect sizes, directions, and confidence intervals for each of the four lines. 'Controls robustness' is too vague.
  3. [Notation / equations] The superposition metric appears in an unnumbered equation without a clear formal definition. Please define all variables and state whether the metric is measured on activations, weights, or both.
  4. [Limitations appendix] The limitations appendix is a positive feature, but it does not appear to temper the title or abstract. The authors should align the framing with the admitted limitations, especially regarding transfer from toy models to real networks.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central claim rests on empirical interventions, not definitional reductions or self-citations.

full rationale

The paper's stated evidence chain is empirical rather than definitional. The abstract lists four lines of support: (1) a theoretical account of adversarial phenomena via superposition, (2) toy-model interventions changing superposition and measuring robustness, (3) toy-model interventions changing robustness via adversarial training and measuring superposition, and (4) a ResNet18 correlation between adversarial training and a superposition proxy. Superposition is introduced as a pre-existing mechanistic-interpretability concept from Elhage et al. (2022), not defined in terms of adversarial robustness, so manipulating one and observing the other is a genuine intervention rather than a tautology. The adversarial-training experiments are also external manipulations whose effect on a superposition measure is recorded. No parameter is fitted to the target conclusion and then relabeled a prediction, no uniqueness theorem from the present authors is invoked, and Elhage et al. is not self-citation by Gorton and Lewis. The weaknesses identified in the reader's take—possible confounds in toy-model sparsity manipulations and the correlational nature of the ResNet18 result—are threats to causal validity and external validity, not circularity. Under the hard rule that circularity must be exhibited as a specific reduction in the paper's own equations or a fitted-input-renamed-as-prediction, no such step can be identified from the available text. Therefore the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

Based on the abstract alone, no free parameters, axioms, or invented entities can be identified. The full text is unreadable, so the ledger cannot be populated. This is a limitation of the available information, not a statement that none exist.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Examples Are Not Bugs, They Are Superposition." pith.science (2026). https://pith.science/paper/N22MO2SY

@misc{pith2026250817456,
  author       = {Pith},
  title        = {Pith review of: Adversarial Examples Are Not Bugs, They Are Superposition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N22MO2SY}},
  note         = {Machine review of arXiv:2508.17456}
}
read the original abstract

Adversarial examples -- inputs with imperceptible perturbations that fool neural networks -- remain one of deep learning's most perplexing phenomena despite nearly a decade of research. While numerous defenses and explanations have been proposed, there is no consensus on the fundamental mechanism. One underexplored hypothesis is that superposition, a concept from mechanistic interpretability, may be a major contributing factor, or even the primary cause. We present four lines of evidence in support of this hypothesis, greatly extending prior arguments by Elhage et al. (2022): (1) superposition can theoretically explain a range of adversarial phenomena, (2) in toy models, intervening on superposition controls robustness, (3) in toy models, intervening on robustness (via adversarial training) controls superposition, and (4) in ResNet18, intervening on robustness (via adversarial training) controls superposition.

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Superposition Without Interference? Towards Isolated Interventions via Almost Orthogonal Features in Language Models

    cs.LG 2026-02 conditional novelty 5.0 of 10

    Orthogonality-regularizing a language model's sparse-autoencoder features modestly improves the model's ability to swap a named entity during generation, without hurting math-reasoning accuracy.

  2. Superposition Without Interference? Towards Isolated Interventions via Almost Orthogonal Features in Language Models

    cs.LG 2026-02 conditional novelty 5.0 of 10

    Enforcing near-orthogonality on sparse-autoencoder features in a fine-tuned language model improves the isolation of concept interventions while keeping math performance roughly unchanged.

Reference graph

Works this paper leans on

52 extracted references · 18 canonical work pages · cited by 1 Pith paper

  1. [1]

    On the complexity of neural computation in superposition, 2025

    Micah Adler and Nir Shavit. On the complexity of neural computation in superposition, 2025. URL https://arxiv.org/abs/2409.15318

    arXiv 2025

  2. [2]

    Towards monosemanticity: Decomposing language models with dictionary learning

    Trenton Bricken, Adly Templeton, Joshua Batson, Brian Chen, Adam Jermyn, Tom Conerly, Nick Turner, Cem Anil, Carson Denison, Amanda Askell, Robert Lasenby, Yifan Wu, Shauna Kravec, Nicholas Schiefer, Tim Maxwell, Nicholas Joseph, Zac Hatfield-Dodds, Alex Tamkin, Karina Nguyen, Brayden McLean, Josiah E Burke, Tristan Hume, Shan Carter, Tom Henighan, and Ch...

    2023

  3. [3]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. CoRR, abs/1608.04644, 2016. URL http://arxiv.org/abs/1608.04644

    arXiv 2016

  4. [4]

    Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C. Duchi. Unlabeled data improves adversarial robustness, 2022. URL https://arxiv.org/abs/1905.13736

    arXiv 2022

  5. [5]

    Zico Kolter

    Jeremy M Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing, 2019. URL https://arxiv.org/abs/1902.02918

    arXiv 2019

  6. [6]

    Update on how we train saes, 2024

    Tom Conerly, Adly Templeton, Trenton Bricken, Jonathon Marcus, and Tom Henighan. Update on how we train saes, 2024. https://transformer-circuits.pub/2024/april-update/index.html

    work page 2024

  7. [7]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. CoRR, abs/2003.01690, 2020. URL https://arxiv.org/abs/2003.01690

    arXiv 2003

  8. [8]

    Sparse autoencoders find highly interpretable features in language models, 2023

    Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey. Sparse autoencoders find highly interpretable features in language models, 2023. URL https://arxiv.org/abs/2309.08600

    arXiv 2023

Show all 52 references
  1. [9]

    Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks

    Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In 28th USENIX Security Symposium (USENIX Securit...

    2019

  2. [10]

    Toy models of superposition

    Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, Roger Grosse, Sam McCandlish, Jared Kaplan, Dario Amodei, Martin Wattenberg, and Christopher Olah. Toy models of superposi...

    2022

  3. [11]

    Adversarial robustness as a prior for learned representations, 2019

    Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry. Adversarial robustness as a prior for learned representations, 2019. URL https://arxiv.org/abs/1906.00945

    2019 arXiv

  4. [12]

    Do perceptually aligned gradients imply adversarial robustness?, 2023

    Roy Ganz, Bahjat Kawar, and Michael Elad. Do perceptually aligned gradients imply adversarial robustness?, 2023. URL https://arxiv.org/abs/2207.11378

    2023 arXiv

  5. [13]

    Scaling and evaluating sparse autoencoders, 2024

    Leo Gao, Tom Dupré la Tour, Henk Tillman, Gabriel Goh, Rajan Troll, Alec Radford, Ilya Sutskever, Jan Leike, and Jeffrey Wu. Scaling and evaluating sparse autoencoders, 2024. URL https://arxiv.org/abs/2406.04093

    2024 arXiv

  6. [14]

    Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow

    Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S. Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow. Adversarial spheres, 2018. URL https://arxiv.org/abs/1801.02774

    2018 arXiv

  7. [15]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2015. URL https://arxiv.org/abs/1412.6572

    2015 arXiv

  8. [16]

    On the effectiveness of interval bound propagation for training verifiably robust models, 2019

    Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models, 2019. URL https://arxiv.org/abs/1810.12715

    2019 arXiv

  9. [17]

    Exploring the interplay of interpretability and robustness in deep neural networks: A saliency-guided approach, 2024

    Amira Guesmi, Nishant Suresh Aswani, and Muhammad Shafique. Exploring the interplay of interpretability and robustness in deep neural networks: A saliency-guided approach, 2024. URL https://arxiv.org/abs/2405.06278

    2024 arXiv

  10. [18]

    Model compression with adversarial robustness: A unified optimization framework, 2019

    Shupeng Gui, Haotao Wang, Chen Yu, Haichuan Yang, Zhangyang Wang, and Ji Liu. Model compression with adversarial robustness: A unified optimization framework, 2019. URL https://arxiv.org/abs/1902.03538

    2019 arXiv

  11. [19]

    Adversarial examples are not bugs, they are features, 2019

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features, 2019. URL https://arxiv.org/abs/1905.02175

    2019 arXiv

  12. [20]

    Precise tradeoffs in adversarial training for linear regression, 2020

    Adel Javanmard, Mahdi Soltanolkotabi, and Hamed Hassani. Precise tradeoffs in adversarial training for linear regression, 2020. URL https://arxiv.org/abs/2002.10477

    2020 arXiv

  13. [21]

    On the geometry of adversarial examples, 2019

    Marc Khoury and Dylan Hadfield-Menell. On the geometry of adversarial examples, 2019. URL https://openreview.net/forum?id=H1lug3R5FX

    2019

  14. [22]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. CoRR, abs/1607.02533, 2016. URL http://arxiv.org/abs/1607.02533

    2016 arXiv

  15. [23]

    Certified robustness to adversarial examples with differential privacy, 2019

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy, 2019. URL https://arxiv.org/abs/1802.03471

    2019 arXiv

  16. [24]

    Delving into transferable adversarial examples and black-box attacks, 2017

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks, 2017. URL https://arxiv.org/abs/1611.02770

    2017 arXiv

  17. [25]

    Towards deep learning models resistant to adversarial attacks, 2019

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019. URL https://arxiv.org/abs/1706.06083

    2019 arXiv

  18. [26]

    Diochnos, and Mohammad Mahmoody

    Saeed Mahloujifar, Dimitrios I. Diochnos, and Mohammad Mahmoody. The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure, 2018. URL https://arxiv.org/abs/1809.03063

    2018 arXiv

  19. [27]

    Empirically measuring concentration: Fundamental limits on intrinsic robustness, 2019

    Saeed Mahloujifar, Xiao Zhang, Mohammad Mahmoody, and David Evans. Empirically measuring concentration: Fundamental limits on intrinsic robustness, 2019. URL https://arxiv.org/abs/1905.12202

    2019 arXiv

  20. [28]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed - Mohsen Moosavi - Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. CoRR, abs/1511.04599, 2015. URL http://arxiv.org/abs/1511.04599

    2015 arXiv

  21. [29]

    Universal adversarial perturbations, 2017

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations, 2017. URL https://arxiv.org/abs/1610.08401

    2017 arXiv

  22. [30]

    Understanding and mitigating the tradeoff between robustness and accuracy, 2020

    Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy, 2020. URL https://arxiv.org/abs/2002.10716

    2020 arXiv

  23. [31]

    Zico Kolter

    Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning, 2020. URL https://arxiv.org/abs/2002.11569

    2020 arXiv

  24. [32]

    Berg, and Li Fei-Fei

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge . International Journal of Computer Vision (IJ...

    2015 doi

  25. [33]

    Do adversarially robust imagenet models transfer better?, 2020

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better?, 2020. URL https://arxiv.org/abs/2007.08489

    2020 arXiv

  26. [34]

    Adversarially robust generalization requires more data, 2018

    Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Mądry. Adversarially robust generalization requires more data, 2018. URL https://arxiv.org/abs/1804.11285

    2018 arXiv

  27. [35]

    Davis, Gavin Taylor, and Tom Goldstein

    Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free!, 2019. URL https://arxiv.org/abs/1904.12843

    2019 arXiv

  28. [36]

    Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein

    Ali Shafahi, W. Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. Are adversarial examples inevitable?, 2020. URL https://arxiv.org/abs/1809.02104

    2020 arXiv

  29. [37]

    The dimpled manifold model of adversarial examples in machine learning, 2022

    Adi Shamir, Odelia Melamed, and Oriel BenShmuel. The dimpled manifold model of adversarial examples in machine learning, 2022. URL https://arxiv.org/abs/2106.10151

    2022 arXiv

  30. [38]

    On the effectiveness of low frequency perturbations, 2019

    Yash Sharma, Gavin Weiguang Ding, and Marcus Brubaker. On the effectiveness of low frequency perturbations, 2019. URL https://arxiv.org/abs/1903.00073

    2019 arXiv

  31. [39]

    Which models have perceptually-aligned gradients? an explanation via off-manifold robustness, 2024

    Suraj Srinivas, Sebastian Bordt, and Hima Lakkaraju. Which models have perceptually-aligned gradients? an explanation via off-manifold robustness, 2024. URL https://arxiv.org/abs/2305.19101

    2024 arXiv

  32. [40]

    Intriguing properties of neural networks, 2014

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2014. URL https://arxiv.org/abs/1312.6199

    2014 arXiv

  33. [41]

    A high dimensional statistical model for adversarial training: Geometry and trade-offs, 2024

    Kasimir Tanner, Matteo Vilucchio, Bruno Loureiro, and Florent Krzakala. A high dimensional statistical model for adversarial training: Geometry and trade-offs, 2024. URL https://arxiv.org/abs/2402.05674

    2024

  34. [42]

    Daniel Freeman, Theodore R

    Adly Templeton, Tom Conerly, Jonathan Marcus, Jack Lindsey, Trenton Bricken, Brian Chen, Adam Pearce, Craig Citro, Emmanuel Ameisen, Andy Jones, Hoagy Cunningham, Nicholas L Turner, Callum McDougall, Monte MacDiarmid, C. Daniel Freeman, Theodore R. Sumers, Edward Rees, Joshua ...

    2024

  35. [43]

    Robustness may be at odds with accuracy, 2019

    Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy, 2019. URL https://arxiv.org/abs/1805.12152

    2019 arXiv

  36. [44]

    Zico Kolter

    Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsieh, and J. Zico Kolter. Beta-crown: Efficient bound propagation with per-neuron split constraints for complete and incomplete neural network robustness verification, 2021. URL https://arxiv.org/abs/2103.06624

    2021 arXiv

  37. [45]

    Understanding and enhancing the transferability of adversarial examples, 2018

    Lei Wu, Zhanxing Zhu, Cheng Tai, and Weinan E. Understanding and enhancing the transferability of adversarial examples, 2018. URL https://arxiv.org/abs/1802.09707

    2018 arXiv

  38. [46]

    Understanding adversarial robustness against on-manifold adversarial examples, 2022

    Jiancong Xiao, Liusha Yang, Yanbo Fan, Jue Wang, and Zhi-Quan Luo. Understanding adversarial robustness against on-manifold adversarial examples, 2022. URL https://arxiv.org/abs/2210.00430

    2022 arXiv

  39. [47]

    An information-theoretic explanation for the adversarial fragility of ai classifiers, 2019

    Hui Xie, Jirong Yi, Weiyu Xu, and Raghu Mudumbai. An information-theoretic explanation for the adversarial fragility of ai classifiers, 2019. URL https://arxiv.org/abs/1901.09413

    2019 arXiv

  40. [48]

    Adversarial robustness through disentangled representations

    Shuo Yang, Tianyu Guo, Yunhe Wang, and Chang Xu. Adversarial robustness through disentangled representations. Proceedings of the AAAI Conference on Artificial Intelligence, 35 0 (4): 0 3145--3153, May 2021. doi:10.1609/aaai.v35i4.16424. URL https://ojs.aaai.org/index.php/AAAI/...

    2021 doi

  41. [49]

    Adversarial robustness vs model compression, or both?, 2021

    Shaokai Ye, Kaidi Xu, Sijia Liu, Jan-Henrik Lambrechts, Huan Zhang, Aojun Zhou, Kaisheng Ma, Yanzhi Wang, and Xue Lin. Adversarial robustness vs model compression, or both?, 2021. URL https://arxiv.org/abs/1903.12561

    2021 arXiv

  42. [50]

    Derivation of information-theoretically optimal adversarial attacks with applications to robust machine learning, 2020

    Jirong Yi, Raghu Mudumbai, and Weiyu Xu. Derivation of information-theoretically optimal adversarial attacks with applications to robust machine learning, 2020. URL https://arxiv.org/abs/2007.14042

    2020 arXiv

  43. [51]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy, 2019. URL https://arxiv.org/abs/1901.08573

    2019 arXiv

  44. [52]

    Efficient neural network robustness certification with general activation functions, 2018

    Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions, 2018. URL https://arxiv.org/abs/1811.00866

    2018 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.