Pith. sign in

REVIEW 4 major objections 5 minor 37 references

InkShield shows that perturbing the ink edges of a handwriting reference before release prevents one-shot generators from reproducing the writer's style.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 01:18 UTC pith:TMA6RM3Z

load-bearing objection First serious reference-side defense against handwriting mimicry, with strong on-surrogate results and honest but modest transfer evidence. the 4 major comments →

arxiv 2607.26976 v2 pith:TMA6RM3Z submitted 2026-07-29 cs.CR cs.CV

InkShield: Writing Style Protection Against Unauthorized Handwriting Mimicry

Jian Xiong , Wenbo Jiang , Zihan Wang , Rui Zhang , Wenshu Fan , Hongwei Li , Guowen Xu This is my paper
classification cs.CR cs.CV
keywords handwriting style mimicryproactive defenseadversarial perturbationstyle displacementone-shot generationstroke-edge maskdecoy writerIAM dataset
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

InkShield is a proactive defense that alters a handwriting image before it is posted online, so that a one-shot handwriting generator given that image can no longer reproduce the writer's style. The paper argues that protecting the reference itself, rather than detecting forgeries after the fact, is feasible and effective: on the IAM dataset, the rate at which generated samples are attributed to the target writer drops from about 12% to 2% (top-1) and from about 37% to 9% (top-5), averaged over two independent writer recognizers, while the protected image stays visually close to the original (LPIPS 0.0078) and generated text remains readable (CER 17.40%). The defense also transfers to generators other than the one used to optimize the perturbation. If true, this gives ordinary users a practical way to share handwritten notes, signatures, and scanned documents without handing over a reusable style key.

Core claim

The central claim is that writer-specific style in a handwriting reference can be displaced in style space by a perturbation confined to ink-stroke boundaries and guided by a decoy writer's style plus a frozen surrogate generation objective. This pushes downstream one-shot generation away from the target writer's style rather than merely adding noise, preserving legibility and visual fidelity. On the IAM benchmark, target-writer Top-1/Top-5 retrieval averages 2.03%/8.79% across two writer evaluators, versus 11.94%/36.52% for clean references; LPIPS is 0.0078 and CER 17.40%. The same protected references also suppress mimicry, though less strongly, on two other generators with different condi

What carries the argument

The mechanism is a three-stage optimization. First, a decoy writer is selected from a pool of known writers as a style-displacement direction, taken as the 95th percentile in cosine distance from the target writer's style prototype. Second, a handwriting-aware mask built from morphological stroke boundaries and Sobel edge responses confines the perturbation to ink edges, avoiding the blank background. Third, a frozen surrogate one-shot handwriting generator evaluates the protected reference against cached pseudo-content words, maximizing a style-displacement objective (attraction to the decoy, repulsion from the target) plus a generative-disruption term that makes the reference incompatible

Load-bearing premise

The defense assumes the defender has a large pool of other writers' handwriting samples to pick a decoy, and that a frozen surrogate generator's style representation and generation objective faithfully transfer to whatever generator the attacker actually uses; if either fails, the perturbation cannot be constructed or will not suppress mimicry.

What would settle it

Measure target-writer Top-5 retrieval when the decoy pool is restricted to the five writers closest to the target; the paper's P95 result should degrade noticeably if decoy distance is load-bearing.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A single protected reference suffices to suppress one-shot mimicry, so the defense fits the strictest exposure scenario the paper considers.
  • Protecting each reference independently also works for multi-shot generators that condition on several samples, extending the defense beyond one-shot pipelines.
  • The zero background perturbation and low LPIPS mean the released image remains a normal-looking handwriting sample rather than an obviously corrupted one.
  • Because the defense transfers to generators the defender did not optimize against, it does not require knowing the attacker's exact model.
  • The paper's results imply that generic image-protection methods—which perturb the whole image and degrade sparse handwriting—are not necessary; a stroke-localized perturbation is enough.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • An adaptive attacker who fine-tunes the generator on protected references would likely erode the defense, since it relies on a frozen surrogate; this is testable by an adversary-in-the-loop experiment.
  • The defense's reliance on a decoy pool suggests that a writer whose style has no nearby candidates in the pool may be hard to protect; a practical deployment would need style-coverage curation.
  • The evaluation is on isolated word images; extending to full text lines and signatures would test whether stroke-edge perturbations capture the style cues present in layout and connections.
  • A promising pairing is reference-side perturbation with embedding-based watermarking, so that if a forgery is generated, the protected reference can still be traced.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes InkShield, a proactive reference-side defense against unauthorized handwriting style mimicry. Before a handwriting image is released, InkShield selects a stylistically distant decoy writer, constructs a stroke-edge mask to localize perturbations, and optimizes an ℓ∞-bounded perturbation through a frozen One-DM surrogate generator. The optimization combines a decoy-attraction/target-repulsion style objective, a denoising-error disruption term over cached pseudo-content generations, and an LPIPS-based perceptual penalty. On the IAM dataset, the authors report that target-writer Top-1/Top-5 retrieval rates drop from about 11.9%/36.5% to 2.0%/8.8% under the One-DM generator, with LPIPS 0.0078 and CER 17.40%. They also report cross-generator transfer to CONSTANT and DiffusionPen, with chance-adjusted suppression of roughly 28–39%.

Significance. If the claims are fully supported, InkShield would be the first reference-side protection method specifically designed for handwriting style mimicry, and the stroke-edge-constrained perturbation idea is a sensible response to the sparsity of handwriting images. The paper includes several strengths: two independently trained writer evaluators, a chance-adjusted suppression metric for cross-generator comparison, ablations isolating the contributions of decoy attraction, target repulsion, and surrogate generation, and explicit sensitivity studies for the main hyperparameters. The core mechanism is plausible and the method is not merely an off-the-shelf image perturbation. However, the paper's central practical-protection claim rests on transfer to unknown generators, and that evidence is currently the weakest part of the paper: the primary evaluation is white-box with respect to the surrogate, and the cross-generator numbers are substantially lower and lack quality/readability reporting.

major comments (4)
  1. [Threat Model / Methodology / Eq. (8)] The threat model states that the defender does not know the downstream generator, yet the primary evaluation in Table 1 uses One-DM, which is also the frozen surrogate used in the optimization ('In our implementation, this surrogate is instantiated with One-DM'; Eq. 8 maximizes the surrogate's denoising error on cached pseudo-generations). The Table 1 suppression is therefore partly expected from the optimization target and is a white-box upper bound, not evidence for the black-box scenario in the threat model. The transfer experiments are the load-bearing evidence, and they need to be strengthened.
  2. [Appendix B, Table 4] The chance-adjusted suppression on CONSTANT and DiffusionPen is only 27.5–38.8% for Top-1/Top-5 across the two evaluators, compared with 82.9–88.1% on One-DM. This means that roughly 60–70% of above-chance target-writer retrievability remains for non-surrogate generators. Moreover, no LPIPS/PSNR/SSIM, CER, HWD, or FID are reported for protected CONSTANT/DiffusionPen generations, so the modest transfer could partly reflect quality/readability degradation rather than genuine style protection. The paper should report these metrics for the transferred settings, or substantially temper the 'practical protection' claim.
  3. [Implementation Details and Sensitivity Studies] The default hyperparameters (ρ=0.95, ε=16/255, τ=0.005, K=4, λ_gen=3.0) are selected from sensitivity sweeps on the same IAM test writers used for the final evaluation (Figs. 5–9 and Appendix C). This is test-set tuning, and no confidence intervals, per-writer variance, or a separate validation protocol are reported. The headline numbers are point estimates over 12,880 generated images; without uncertainty quantification it is difficult to judge whether the reported differences are robust. The authors should either provide a principled validation split for hyperparameter selection or report confidence intervals and per-writer variability.
  4. [Algorithm 1 / Decoy Writer Selection] Algorithm 1 requires a pool of authorized candidate writers W with reference samples, and the decoy selection (Eq. 2) assumes this pool is available to the defender. The threat model's 'Defender's Capability' only mentions access to the clean image and the ability to use a surrogate generator and style representations; it does not mention the need for a decoy pool. If such a pool is not available in a deployment scenario, the proposed decoy-guided displacement cannot be constructed. The paper should explicitly state this prerequisite and discuss how the defense degrades when the pool is small or unavailable.
minor comments (5)
  1. [Eq. (11)] The suppression formula is written as a ratio; the table labels it as a percentage. Add an explicit ×100% or state that Supp is reported as a percentage.
  2. [Experimental Setup] The abbreviation 'OOV-U' is used without definition. Please spell out the protocol (out-of-vocabulary words and unseen writers) at first use.
  3. [Appendix A] The gallery construction is described as five images per writer (805 total). The chance-level rates K/N used in Eq. (11) assume retrieval over 161 writers; clarify how the five gallery images per writer are handled in retrieval so the chance baseline is unambiguous.
  4. [Figure 3 / Figure 4] The qualitative figures are useful, but the caption of Figure 4 says 'one representative reference is shown' for DiffusionPen while the text says all five references are independently protected. It may help to show either all five or state that the remaining four behave similarly.
  5. [Appendix C.3] In Figure 8, the color legend says 'lower' and 'higher', but it is not immediately clear which rows are lower-is-better and which are higher-is-better. A one-sentence note would improve readability.

Circularity Check

2 steps flagged

Primary suppression numbers are measured on the same One-DM model used as the optimization surrogate, making the headline an in-sample effect; cross-generator transfer is the real out-of-surrogate test.

specific steps
  1. fitted input called prediction [Eq. (8) and 'Generation Models' (Experimental Setup); Table 1 and Abstract]
    "Generation Models. We use One-DM (Dai et al. 2024) as the surrogate model and primary evaluation generator. ... We define the surrogate generation objective as Jgen = 1/K Σ_{c∈C} Lden (eyc, c, xpro).(8) ... Maximizing J_gen makes the protected reference less compatible with the clean-reference generation behavior of the target writer."

    InkShield optimizes the perturbation δ to maximize One-DM's denoising error Lden(ẽ_c, c, x_pro) on cached clean pseudo-generations ẽ_c = G_θ(c,x) of the target writer. The headline suppression (Table 1/abstract) is then measured by generating with this same frozen One-DM model. Thus the reported Top-1/Top-5 drop on One-DM is an in-sample effect of the optimization objective, not independent evidence about an unknown downstream generator. The paper's threat model says the defender 'does not know the downstream generator'; the actual out-of-surrogate evidence is Appendix B/Table 4, where above-chance suppression drops to roughly 28–39% on CONSTANT/DiffusionPen versus about 83–88% on One-DM. The 'practical protection' claim therefore rests mainly on transferability, not on the primary One-DM

  2. other [Eq. (6) and 'Reference stealth' metrics; Table 1]
    "We measure perceptual distortion using LPIPS (Zhang et al. 2018): Pperc = max (0,LPIPS(xpro, x)−τ) ... InkShield also achieves strong reference stealth. ... It further achieves the lowest LPIPS (0.0078) and the highest SSIM (0.9856) among all compared methods."

    The headline stealth metric LPIPS is also the quantity being penalized inside the optimization objective (Eq. 6). Reporting LPIPS = 0.0078 as evidence of stealth is partly reporting the value of the optimized loss rather than an independent measurement. The method's stealth claim is more convincingly supported by the non-optimized metrics (PSNR, SSIM, BgAbs, BgE), which are not directly in the objective. This is a minor in-sample reporting overlap, not the central mimicry claim.

full rationale

The central mimicry-suppression claim is not a formal derivation, so the circularity test hinges on whether evaluation metrics reduce to optimization inputs. The strongest circularity concern is real but partial: the primary evaluation generator (One-DM) is identical to the frozen surrogate used in Eq. (8), so the Table 1/abstract suppression is partly forced by the optimization target. However, the paper explicitly discloses this overlap and separately reports transfer to CONSTANT and DiffusionPen (Table 4), which have different conditioning architectures and were not used in optimization. Those transfer results are external, non-circular evidence, even though they are much weaker than the One-DM numbers. The LPIPS stealth metric is also optimized and then reported, but additional unoptimized stealth metrics (PSNR, SSIM, BgAbs, BgE) provide independent support. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled via citation. The main unresolved issue is whether 28–39% above-chance suppression on unseen generators is enough to substantiate 'practical protection' — that is an effectiveness/threat-model concern, not a circularity of definition. Overall, there is partial in-sample evaluation overlap, but the paper contains independent grounding, so a moderate score of 4 is appropriate rather than a higher forced-by-construction score.

Axiom & Free-Parameter Ledger

10 free parameters · 5 axioms · 0 invented entities

The ledger shows the method relies on a surrogate-based optimization with many hand-chosen hyperparameters and domain-specific assumptions. No invented physical or conceptual entities are introduced; the 'decoy' is a selected existing writer. The main contribution is a combination of established techniques with a new edge-mask constraint.

free parameters (10)
  • rho (decoy percentile) = 0.95
    Chosen from sensitivity sweep (Figure 5) to balance suppression and stealth; higher percentiles give stronger suppression but higher LPIPS.
  • epsilon (perturbation budget) = 16/255
    Selected as favorable knee in LPIPS vs. retrieval trade-off (Figure 6).
  • alpha (PGD step size) = 2/255
    Set manually; not swept in main text.
  • K (number of pseudo content texts) = 4
    Chosen for efficiency/effectiveness trade-off (Figure 8).
  • lambda_gen = 3.0
    Selected manually; no sensitivity shown in main text.
  • lambda_perc = 1
    Selected from sensitivity plot (Figure 9b).
  • tau (LPIPS threshold) = 0.005
    Selected from sensitivity plot (Figure 9a).
  • eta_fg = 0.92
    Threshold for ink foreground mask; set by hand.
  • eta_sob = 0.12
    Threshold for Sobel edge support; set by hand.
  • lambda_r_dec / lambda_r_tar (style weights) = unspecified (Appendix)
    Weights for low/high-level decoy/target style terms in Eq. 7; values not given in main text.
axioms (5)
  • domain assumption One-DM style embeddings encode writer identity such that cosine distance (Eq. 1) is a valid style metric.
    Decoy selection and Jstyle both rely on this representation.
  • domain assumption A frozen One-DM generator is a representative proxy for unknown downstream handwriting generators (transferability assumption).
    The whole defense optimizes against One-DM, yet the threat model assumes the defender does not know the attacker's generator.
  • ad hoc to paper The defender has access to a pool of authorized candidate writers' reference samples (W in Algorithm 1).
    Without a decoy pool, decoy-guided displacement cannot be computed.
  • standard math PGD projected gradient ascent reliably finds a perturbation satisfying the perceptual and suppression objectives.
    Standard iterative optimization step (Eq. 10).
  • domain assumption LPIPS is a valid proxy for human perceptual similarity on handwriting images.
    Used as soft penalty in Eq. 6.

pith-pipeline@v1.3.0-alltime-deepseek · 14989 in / 12798 out tokens · 119122 ms · 2026-08-03T01:18:06.555979+00:00 · methodology

0 comments
read the original abstract

Recent handwritten text generators can reproduce a writer's style from publicly available references, posing risks of document forgery and identity misuse. An attacker may use a publicly available handwritten note or signature sample to generate forged recommendation letters or authorization forms, leading to document fraud, identity misuse, and misleading decisions. However, existing protections against unauthorized image editing or synthesis transfer poorly to handwriting style mimicry. Designed for natural images with complex backgrounds, they often optimize perturbations over the whole image. For sparse handwriting images, such global perturbations become conspicuous in blank background regions and largely degrade the visual quality. In this work, we propose InkShield, a proactive writing-style defense that protects reference images before release. InkShield selects a decoy writer to define a style-displacement direction, optimizes perturbations with a frozen handwriting-generation surrogate, and confines them to ink-stroke edges to avoid conspicuous background artifacts. On IAM, the average Top-1/Top-5 rates at which generated samples are retrieved as the target writer by two independent writer evaluators decrease from 11.94%/36.52% to 2.03%/8.79%. Meanwhile, the protected references remain visually close to the originals (LPIPS 0.0078), and the generated text remains readable. InkShield also exhibits transferability to other handwriting generators. Overall, InkShield provides practical protection against unauthorized handwriting style mimicry.

Figures

Figures reproduced from arXiv: 2607.26976 by Guowen Xu, Hongwei Li, Jian Xiong, Rui Zhang, Wenbo Jiang, Wenshu Fan, Zihan Wang.

Figure 1
Figure 1. Figure 1: Security risk of one-shot handwriting style mimicry: A public handwritten word enables an attacker to generate and submit a forged recommendation letter in the professor’s style. multiple pseudo-content words during optimization, allow￾ing the learned perturbation to generalize across different target texts rather than overfitting to a particular word. In our experiments, we evaluate InkShield on the IAM d… view at source ↗
Figure 2
Figure 2. Figure 2: Overview of InkShield. Given a clean reference from a target writer, InkShield selects a distant decoy writer to define a style-displacement direction, confines low-visibility perturbations to stroke-edge regions, and optimizes them through a frozen surrogate generation chain over multiple pseudo-content words. The protected reference reduces downstream target-writer mimicry while preserving content readab… view at source ↗
Figure 3
Figure 3. Figure 3: Qualitative comparison of reference protection methods on One-DM. All methods use the same clean reference from one target writer and generate the requested word planets. The first column shows the shared clean reference, InkShield edge mask, and clean generation; the remaining columns show the corresponding protected references, perturbations, and mimicry results. Comparison Methods. For the primary One-D… view at source ↗
Figure 4
Figure 4. Figure 4: Cross-model transferability. Qualitative gener￾ations from One-DM, CONSTANT, and DiffusionPen for the requested word planets. DiffusionPen uses five indepen￾dently InkShield-protected references; one representative reference is shown. Cross-model Transferability [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: evaluates the decoy percentile while keeping all other settings fixed. Increasing the percentile generally low￾ers target-writer Top-1 and Top-5 retrieval rates under both [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 7
Figure 7. Figure 7: studies the number of projected-gradient optimiza￾tion steps. At low step counts, the perturbation has insuffi￾cient opportunity to jointly optimize the decoy-guided style objective and the generation-aware surrogate objective. As the step count increases, target-writer retrieval decreases for both ResNet50 and DeepWriter, showing that additional op￾timization improves suppression during the early stage. 2… view at source ↗
Figure 6
Figure 6. Figure 6: analyzes how the perturbation budget ϵ controls the available capacity for defense-side style displacement. Small budgets preserve a reference that is extremely close to the clean input, but they constrain InkShield’s ability to modify the style-sensitive stroke-boundary regions used by downstream generators. Consequently, target-writer retrieval remains relatively high at the smallest tested budgets. 0.00… view at source ↗
Figure 9
Figure 9. Figure 9: Sensitivity to perceptual-constraint parameters. (a) Effect of the LPIPS threshold τ ; smaller τ activates the hinge-style perceptual penalty at smaller perceptual devia￾tions. (b) Effect of the LPIPS penalty weight λperc; setting λperc = 0 removes the perceptual regularization. The hor￾izontal axis is LPIPS and the vertical axis is mean Top-5 target-writer retrieval; both are lower-is-better. Orange dia￾m… view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

37 extracted references · 2 linked inside Pith

  1. [1]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Fogel, Sharon and Averbuch-Elor, Hadar and Cohen, Sarel and Mazor, Shai and Litman, Roee , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  2. [2]

    Proceedings of the European Conference on Computer Vision , year =

    Dai, Gang and Zhang, Yifan and Ke, Quhui and Guo, Qiangya and Huang, Shuangping , title =. Proceedings of the European Conference on Computer Vision , year =

  3. [3]

    Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , year =

    Le, Anh-Duy and Pham, Van-Linh and Vo, Thanh-Nam and Mai, Xuan Toan and Tran, Tuan-Anh , title =. Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , year =

  4. [4]

    Proceedings of the European Conference on Computer Vision Workshops , year =

    Nikolaidou, Konstantina and Retsinas, George and Sfikas, Giorgos and Liwicki, Marcus , title =. Proceedings of the European Conference on Computer Vision Workshops , year =

  5. [5]

    , title =

    Shan, Shawn and Cryan, Jenna and Wenger, Emily and Zheng, Haitao and Hanocka, Rana and Zhao, Ben Y. , title =. Proceedings of the USENIX Security Symposium , year =

  6. [6]

    2023 , eprint =

    Liang, Chumeng and Wu, Xiaoyu , title =. 2023 , eprint =

    2023

  7. [7]

    , title =

    Shan, Shawn and Ding, Wenxin and Passananti, Josephine and Wu, Stanley and Zheng, Haitao and Zhao, Ben Y. , title =. Proceedings of the IEEE Symposium on Security and Privacy , year =

  8. [8]

    Proceedings of the International Conference on Machine Learning , pages =

    Salman, Hadi and Khaddaj, Alaa and Leclerc, Guillaume and Ilyas, Andrew and Madry, Aleksander , title =. Proceedings of the International Conference on Machine Learning , pages =

  9. [9]

    Proceedings of the International Conference on Learning Representations , year =

    Choi, June Suk and Lee, Kyungmin and Jeong, Jongheon and Xie, Saining and Shin, Jinwoo and Lee, Kimin , title =. Proceedings of the International Conference on Learning Representations , year =

  10. [10]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

    Van Le, Thanh and Phung, Hao and Nguyen, Thuan Hoang and Dao, Quan and Tran, Ngoc and Tran, Anh , title =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  11. [11]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Liu, Yixin and Fan, Chenrui and Dai, Yutong and Chen, Xun and Zhou, Pan and Sun, Lichao , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  12. [12]

    Advances in Neural Information Processing Systems , year =

    Li, Yanjie and Zhang, Wenxuan and Lyu, Xinqi and Liu, Yihao and Xiao, Bin , title =. Advances in Neural Information Processing Systems , year =

  13. [13]

    Proceedings of the European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases , year =

    Chen, Lu and Sun, Jiao and Xu, Wei , title =. Proceedings of the European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases , year =

  14. [14]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Xu, Xing and Zhang, Jiefu and Yang, Jinhui and Wu, Zhenjun and Guo, Guodong , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  15. [15]

    2023 , eprint =

    Beerens, Loran and Kalker, Ton and Teuwen, Jonas , title =. 2023 , eprint =

    2023

  16. [16]

    and Sabourin, Robert and Oliveira, Luiz S

    Hafemann, Luiz G. and Sabourin, Robert and Oliveira, Luiz S. , title =. IEEE Transactions on Information Forensics and Security , volume =

  17. [17]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

    Bhunia, Ankan Kumar and Khan, Salman and Cholakkal, Hisham and Anwer, Rao Muhammad and Khan, Fahad Shahbaz and Shah, Mubarak , title =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  18. [18]

    Proceedings of the European Conference on Computer Vision , pages =

    Kang, Lei and Riba, Pau and Wang, Yaxing and Rusi. Proceedings of the European Conference on Computer Vision , pages =

  19. [19]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Pippi, Vittorio and Cascianelli, Silvia and Cucchiara, Rita , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  20. [20]

    International journal on document analysis and recognition , volume=

    The IAM-database: an English sentence database for offline handwriting recognition , author=. International journal on document analysis and recognition , volume=. 2002 , publisher=

    2002

  21. [21]

    and Shechtman, Eli and Wang, Oliver , title =

    Zhang, Richard and Isola, Phillip and Efros, Alexei A. and Shechtman, Eli and Wang, Oliver , title =. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages =

  22. [22]

    and Sheikh, Hamid R

    Wang, Zhou and Bovik, Alan C. and Sheikh, Hamid R. and Simoncelli, Eero P. , title =. IEEE Transactions on Image Processing , volume =

  23. [23]

    Electronics letters , volume=

    Scope of validity of PSNR in image/video quality assessment , author=. Electronics letters , volume=. 2008 , publisher=

    2008

  24. [24]

    Proceedings of the AAAI conference on artificial intelligence , volume=

    Trocr: Transformer-based optical character recognition with pre-trained models , author=. Proceedings of the AAAI conference on artificial intelligence , volume=

  25. [25]

    arXiv preprint arXiv:2310.20316 , year=

    HWD: A novel evaluation score for styled handwritten text generation , author=. arXiv preprint arXiv:2310.20316 , year=

    Pith/arXiv arXiv

  26. [26]

    Advances in neural information processing systems , volume=

    Gans trained by a two time-scale update rule converge to a local nash equilibrium , author=. Advances in neural information processing systems , volume=

  27. [27]

    IEEE Transactions on Pattern Analysis and Machine Intelligence , volume=

    Vatr++: Choose your words wisely for handwritten text generation , author=. IEEE Transactions on Pattern Analysis and Machine Intelligence , volume=. 2024 , publisher=

    2024

  28. [28]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    Zero-shot styled text image generation, but make it autoregressive , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  29. [29]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume =

    Gan, Ji and Wang, Weiqiang , title =. Proceedings of the AAAI Conference on Artificial Intelligence , volume =. 2021 , doi =

    2021

  30. [30]

    Document Analysis and Recognition -- ICDAR 2023 , series =

    Nikolaidou, Konstantina and Retsinas, George and Christlein, Vincent and Seuret, Mathias and Sfikas, Giorgos and Barney Smith, Elisa and Mokayed, Hamam and Liwicki, Marcus , title =. Document Analysis and Recognition -- ICDAR 2023 , series =. 2023 , doi =

    2023

  31. [31]

    Computer Vision -- ECCV 2024 , series =

    Chen, Ruoxi and Jin, Haibo and Liu, Yixin and Chen, Jinyin and Wang, Haohan and Sun, Lichao , title =. Computer Vision -- ECCV 2024 , series =

    2024

  32. [32]

    Advances in Neural Information Processing Systems , volume =

    Wan, Cong and He, Yuhang and Song, Xiang and Gong, Yihong , title =. Advances in Neural Information Processing Systems , volume =

  33. [33]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

    Dai, Gang and Zhang, Yifan and Qin, Yutao and Guo, Qiangya and Huang, Shuangping and Yan, Shuicheng , title =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  34. [34]

    International Conference on Learning Representations , year=

    Towards Deep Learning Models Resistant to Adversarial Attacks , author=. International Conference on Learning Representations , year=

  35. [35]

    1968 , howpublished =

    Irwin Sobel and Gary Feldman , title =. 1968 , howpublished =

    1968

  36. [36]

    Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages=

    Deep Residual Learning for Image Recognition , author=. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages=

  37. [37]

    arXiv preprint arXiv:1606.06472 , year=

    DeepWriter: A Multi-Stream Deep CNN for Text-Independent Writer Identification , author=. arXiv preprint arXiv:1606.06472 , year=

    Pith/arXiv arXiv