Pith. sign in

REVIEW 4 major objections 4 minor 57 references

Enhancing generalization in high energy physics using white-box adversarial attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read White-box adversarial training improves out-of-distribution generalization for Higgs jet classifiers by flattening sharp loss minima.

desk verdict Solid engineering study: PGD adversarial training improves cross-simulator jet tagging with a clean sharpness signature, but the fixed 24h budget and unvalidated cross-MC proxy keep the headline claim from being fully settled. read the letter →

arxiv 2411.09296 v3 pith:GPSZMU4V submitted 2024-11-14 hep-ph cs.LG

Franck Rothen , Samuel Klein , Matthew Leigh , Tobias Golling This is my paper · ORCID
classification hep-phcs.LG
keywords adversarialtrainingjettaggingout-of-distributiongeneralizationlosslandscapesharpnessMonteCarlosimulationHiggsbosonprojectedgradientdescentsharpness-awareminimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Supervised classifiers trained on Monte Carlo simulations can latch onto artifacts of the simulation rather than the underlying physics, so they lose performance when applied to a different simulator or to real data. This paper argues that this poor out-of-distribution behavior is tied to the sharpness of the loss minimum the network settles into, and that white-box adversarial training, which perturbs inputs or weights using the model's own gradients, reduces that sharpness. It tests four adversarial strategies on Higgs-to-bottom-quark jet tagging, using cross-evaluation between two different Monte Carlo simulators as the generalization test. All four strategies improve cross-simulator performance, and the projected gradient descent attack gives the largest gains. The authors treat the simulator-to-simulator gap as a proxy for the simulation-to-data gap, so the ultimate claim about real data remains to be verified.

What carries the argument

The load-bearing mechanism is the sharpness of the local minimum in the training loss, defined by comparing loss increases under norm-bounded perturbations, with sharper minima expected to generalize worse. To reduce sharpness, the paper uses four white-box adversarial training methods: fast gradient sign method and projected gradient descent, which maximize the loss over perturbations of the input features, and sharpness-aware minimization and its dynamic sparse variant, which maximize the loss over perturbations of the network weights. To measure sharpness, the paper introduces gradient-ascent path tracing, which plots the loss increase as a projected gradient ascent walks away from the minimum, and reduced Hessian eigenvalue analysis, which estimates the largest Hessian eigenvalue via power iteration as a sharpness proxy. The Hessian is computed on a reduced subspace: the first five jet constituents for feature space and the final classification layer for weight space.

What would settle it

Train the default model and the projected-gradient-descent adversarial model on the resimulation dataset and evaluate both on a real collision-data control sample enriched in the same Higgs decay and background processes at a fixed signal efficiency. If the adversarial model's advantage over default on the other simulator does not appear on the real-data control sample, the central proxy assumption is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that training a jet classifier with norm-bounded adversarial perturbations improves its out-of-distribution generalization because it drives the optimizer toward flatter, wider local minima of the loss landscape. The authors establish this in two steps: they show, with gradient-ascent curves and largest Hessian eigenvalues, that each adversarial strategy measurably flattens the relevant minimum, and they show, by cross-evaluating models trained on one Monte Carlo simulator and tested on another, that every strategy improves the generalization metrics relative to default training. Feature-space attacks flatten feature-space sharpness, weight-space attacks flatten weight-space sharpness, and the two kinds of sharpness are not correlated; projected gradient descent is the strongest method overall. Because the evaluation never uses real collision data, the paper's conclusion is conditional: the observed generalization gains support the sharpness hypothesis only insofar as cross-simulator discrepancy represents the real simulation-to-data discrepancy.

Load-bearing premise

The load-bearing assumption is that differences between two Monte Carlo simulations of the same physics process stand in for the difference between simulation and real detector data; if that proxy is unrepresentative, the reported cross-simulator gains may not transfer to real collision data.

Editorial extensions

If this is right

  • Training with projected gradient descent improves cross-simulator AUC and background rejection relative to default training in both transfer directions, and it outperforms fast gradient sign training in every scenario tested.
  • Feature-space adversarial training systematically reduces the largest Hessian eigenvalue in feature space, while weight-space training reduces it in weight space; the two sharpness measures move independently.
  • All four strategies increase computational cost, and the comparison is run under a fixed 24-hour training budget per model.
  • The ranking of the strategies is stable across the signal-efficiency spectrum, not only at the single operating point used for the headline numbers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the simulator-to-simulator gap is representative of the simulation-to-data gap, the same training recipes should improve performance on real collision data, which is a direct test of the paper's central assumption.
  • Because feature-space and weight-space sharpness appear independent, combining an input-perturbation method with a weight-perturbation method may yield larger gains than either family alone.
  • The mechanism is not specific to Higgs jet tagging, so similar cross-simulator gaps in other collider-classification tasks may be reduced by the same recipes after re-tuning the perturbation radii.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This paper studies whether four white-box adversarial training methods (FGSM, PGD, SAM, and SSAM-D) reduce the sharpness of the loss minimum and improve cross-simulator generalization of a dense jet tagger. The classifiers are trained on the Pythia-based RS3L simulation and evaluated on the Herwig-based RS3L4 simulation, and vice versa, with AUC and background rejection as metrics. The paper proposes gradient-ascent path tracing and a reduced Hessian eigenvalue analysis as sharpness diagnostics, and reports that all four adversarial methods improve cross-evaluation performance, with PGD performing best, at increased computational cost.

Significance. If the central comparison is valid, this is a practically useful result for HEP classification: it suggests that training with norm-constrained perturbations of inputs or weights can reduce sensitivity to Monte Carlo showering details and improve OOD transfer between simulators. The paper has genuine strengths: the data and code are public, adversarial hyperparameters are tuned on the training distribution only, results are averaged over five seeds, and the sharpness diagnostics are computed independently of the generalization scores. The authors also explicitly flag that validation on real collision data remains future work. However, the fixed 24-hour wall-clock protocol and the noise-level of some raw-score gains need to be addressed before the headline claim can be accepted.

major comments (4)
  1. [Sec. V, fixed 24 h limit; Sec. VI C, Table V] The fixed wall-clock budget is a treatment confound. The per-batch cost differs substantially across methods: default AdamW requires one forward-backward pass, FGSM two backward passes, PGD five additional forward-backward iterations, SAM two full backward passes, and SSAM-D one full plus one partial backward pass. Under a fixed 24-hour budget each method therefore receives a different number of optimizer updates, and the paper does not report epoch counts or total update counts per method. The Table V cross-evaluation gains could be due to a form of implicit early stopping (fewer gradient updates for the more expensive methods) rather than to flat minima induced by adversarial training. Please report the number of epochs/update steps per method and add at least one matched-update control (for example, the same number of optimizer steps for default and PGD), or otherwise show that the cross-evaluation improvement survives when update counts are held fixed.
  2. [Sec. VI C, Tables V and IX] The conclusion that "all implemented adversarial strategies resulted in a significant increase in generalization performance" is not supported by the raw scores for FGSM in the Pythia-to-Herwig direction: the raw AUC is 0.957 +/- 0.004 versus 0.953 +/- 0.004 for default, and the rejection is 11.5 +/- 0.1 versus 11.3 +/- 0.2. These differences are within the reported seed standard deviations. The normalized Delta-S value of 0.21 +/- 0.01 in Table V appears much more significant than the raw comparison; the error propagation for Delta-S should be explained, including whether the five seeds were paired between methods. Please provide per-seed paired differences or a significance test on the raw scores for each method and direction.
  3. [Sec. IV C, Appendix A, Table IV] The Hessian analysis is performed on a reduced subspace: only the first five jet constituents are considered in feature space, and only the final classification layer is considered in weight space. The text draws conclusions such as "FGSM and PGD significantly reduce feature-space sharpness" and "SAM and SSAM-D reduce weight-space sharpness." Those statements are strictly supported only for the reduced subspaces, not for the full loss landscape. The claim in Appendix A that the first five constituents are a "reasonable" approximation is not quantified. Please either soften the sharpness claims to refer to the reduced subspaces or provide evidence (for example, sensitivity to the number of constituents and layers) that the conclusions are stable under the truncation.
  4. [Sec. II, Eq. (3); Sec. VII] The empirical evaluation rests on the assumption that discrepancies between Pythia and Herwig for the same process proxy the simulation-to-data shift that matters in ATLAS analyses. The authors acknowledge this point and correctly place real-data validation in future work, so the assumption is not hidden. Nevertheless, the abstract and conclusion should be worded so that cross-simulator improvement is not read as demonstrated improvement on real collision data; the current phrasing "generalize well to real data" in the abstract is stronger than the evidence presented.
minor comments (4)
  1. [Sec. VI B] In the paragraph after Fig. 3, "PDG" appears twice where the intended abbreviation is "PGD" (projected gradient descent); please correct the typo.
  2. [Sec. VI C and Appendix D1] The text says "Sharpness-aware methods, especially SSAMD, results in a slightly improved performance average" in Appendix D1; the subject-verb agreement should be fixed, and the sentence should specify whether the improvement is relative to default and over which efficiency range.
  3. [Appendix A, Eq. (A3)] The power iteration is called the "von Mises iteration algorithm" and Ref. [41] is cited; this is correct, but the Rayleigh quotient expression in Eq. (A4) is missing a normalizing denominator and should read lambda_k = (b_k^T H_L b_k)/(b_k^T b_k) for clarity.
  4. [Sec. II, Eq. (3)] The notation R_OOD(f) is introduced as the maximum risk over all environments, then approximated by the maximum over training environments; this is an unusual use of "OOD" and deserves a sentence clarifying that the maximum over training environments is only a proxy for the unknown OOD maximum.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the cross-simulator generalization gains are measured on held-out data with hyperparameters tuned only on the training distribution; self-citations are contextual.

full rationale

The paper's headline result is empirical: adversarial training strategies improve AUC and background rejection when moving from Pythia to Herwig and vice versa (Table V). The generalization scores are computed on a held-out simulator not seen during training; the adversarial hyperparameters are selected by grid search on the training distribution only (Sec. V and Appendix C2), so no parameter is fitted to the cross-evaluation numbers that constitute the claim. The sharpness diagnostics (gradient ascent, Sec. IV B; reduced Hessian eigenvalues, Table IV) are independent measurements, and the paper does not use them as training targets; the connection between flat minima and generalization is imported from external prior work as a hypothesis-testing frame, not derived from the same data. The fractional improvement metric Delta S (Eq. 14) normalizes by the default baseline and the same-simulator target; it can be negative and does not encode the conclusion. The author self-citations (Refs. [1], [15], [16]) are contextual references to the same group's other HEP-ML work and are not load-bearing for the central generalization claim. The fixed 24-hour training-budget protocol is a potential confound, because methods have different per-batch cost and therefore receive different numbers of optimizer updates, but a confound about treatment fairness is not circularity: it does not reduce the reported result to an input by definition. The paper's caveat that real-data verification is future work is a limitation on external validity, not a circular step. No circular step was found.

Assumptions & free parameters 8 free parameters · 4 assumptions · 0 invented entities

The central results depend on tuned adversarial hyperparameters and on the proxy assumption that cross-simulator performance approximates real-data generalization. No new physical entities are introduced; the sharpness evaluation parameters are analytic approximations rather than fitted values.

free parameters (8)
  • FGSM/PGD epsilon = 0.007
    Perturbation bound for feature-space adversarial samples; chosen by grid search on the training set (Appendix C2).
  • PGD number of steps = 5
    Number of iterations for the PGD attack; chosen by grid search.
  • PGD step size = 0.01
    Step size for each PGD iteration; chosen by grid search.
  • SAM rho = 0.7
    Radius of the weight-space perturbation ball for SAM; chosen by grid search.
  • SSAM-D rho = 0.1
    Radius of the weight-space perturbation ball for SSAM-D; chosen by grid search.
  • SSAM-D sparsity = 0.5
    Fraction of weights included in the sparse mask; chosen by grid search.
  • SSAM-D mask update frequency = 5
    Interval (in epochs) at which the mask is regenerated; chosen by grid search.
  • SSAM-D drop/grow rate = 0.5
    Fraction of masked weights dropped and regrown at each update; chosen by grid search.
assumptions (4)
  • domain assumption Discrepancies between different Monte Carlo simulators of the same process are a valid proxy for the simulation-to-real-data generalization gap.
    Invoked in Sec. II to justify using Pythia vs Herwig cross-evaluation as the testbed. If this proxy does not reflect real-data shifts, the improvements may not transfer to ATLAS or CMS data.
  • domain assumption Flatter local minima generalize better than sharp local minima.
    Borrowed in Sec. II from Refs. [24-27]. The paper's sharpness results are interpreted through this lens, but no causal proof is given; the observed correlation could have another cause.
  • domain assumption The sharpness of the full loss landscape can be inferred from a reduced Hessian (first 5 constituents, last layer) and from gradient-ascent loss curves.
    Stated in Sec. IV and Appendix A. If the omitted weight/feature directions dominate the sharpness, the ranking of methods could change.
  • standard math The loss function is twice differentiable, so the Taylor expansion and Schwarz's theorem apply.
    Used in Sec. IV C and Appendix A to justify the Hessian approximation. The loss is a smooth function of the inputs and weights for the architecture used.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing generalization in high energy physics using white-box adversarial attacks." pith.science (2026). https://pith.science/paper/GPSZMU4V

@misc{pith2026241109296,
  author       = {Pith},
  title        = {Pith review of: Enhancing generalization in high energy physics using white-box adversarial attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GPSZMU4V}},
  note         = {Machine review of arXiv:2411.09296}
}
read the original abstract

Machine learning is becoming increasingly popular in the context of particle physics. Supervised learning, which uses labeled Monte Carlo (MC) simulations, remains one of the most widely used methods for discriminating signals beyond the Standard Model. However, this paper suggests that supervised models may depend excessively on artifacts and approximations from Monte Carlo simulations, potentially limiting their ability to generalize well to real data. This study aims to enhance the generalization properties of supervised models by reducing the sharpness of local minima. It reviews the application of four distinct white-box adversarial attacks in the context of classifying Higgs boson decay signals. The attacks are divided into weight-space attacks and feature-space attacks. To study and quantify the sharpness of different local minima, this paper presents two analysis methods: gradient ascent and reduced Hessian eigenvalue analysis. The results show that white-box adversarial attacks significantly improve generalization performance, albeit with increased computational complexity.

Figures

Figures reproduced from arXiv: 2411.09296 by the authors.

Figure 1
Figure 1. FIG. 1. Distribution of the number of constituents in a jet for the [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. FIG. 2. Distribution of the jet mass for the [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. FIG. 3. Comparison of gradient ascent on the [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: FIG. 4. Rejection in function of signal efficiency for the different training methods and cross-evaluation scenarios. (Training set [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: FIG. 5. Rejection in function of signal efficiency for the different methods trained and evaluated on the same simulator. (Training set [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: FIG. 6. Mass correlation (Jenson-Shannon divergence) between the signal and background rejection for the different training methods [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: FIG. 7. Comparison of gradient ascent for default and adversarial trained dense networks for the different evaluation scenarios. [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 43 canonical work pages

  1. [19]

    S. Gong, Q. Meng, J. Zhang, H. Qu, C. Li, S. Qian, W. Du, Z.-M. Ma, and T.-Y . Liu, An efficient Lorentz equivariant graph neural network for jet tagging, J. High Energy Phys. 07 (2022) 030

    work page 2022

  2. [1]

    In this context, N is the number of steps; Πx;ϵ is the ball- projection operator, centered around x with radius ϵ; and α is the step size

    Fast gradient method and projected gradient descent A possible implementation of adversarial training using the FGSM and PGD method is found in Algorithm 1. In this context, N is the number of steps; Πx;ϵ is the ball- projection operator, centered around x with radius ϵ; and α is the step size. This last parameter is comparable to a learning rate. To allo...

    work page

  3. [2]

    While the optimal pertur- bation ϵ SAM on the weight space is obtained through Eq

    Sharpness-aware minimization (SAM) Compared to the FGSM attack, an additional step is required for the SAM approach. While the optimal pertur- bation ϵ SAM on the weight space is obtained through Eq. (8), it is not evident how to use it during a learning step. Following the original paper ’s [37] derivation, the gradient induced by the SAM loss function, ...

    work page 2025

  4. [3]

    The challenge lies in determining an optimal mask

    Dynamic sparse sharpness-aware minimization (SSAM-D) Dynamic sparse sharpness-aware minimization aims to reduce the disruption caused by the adversarial training by applying an adversarial attack only on a masked selection of weights. The challenge lies in determining an optimal mask. Fisher information and dynamic sparse masking are two common options fo...

    work page

  5. [4]

    Therefore, a tradi- tional dense model is chosen and consists of three hidden layers of sizes 128, 64, and 32, respectively

    Model architecture The final network was deliberately kept simple to ensure that complex behaviors do not interfere with the fair comparison of the training strategies. Therefore, a tradi- tional dense model is chosen and consists of three hidden layers of sizes 128, 64, and 32, respectively. Given 40 constituents with fifteen features each and two jet fe...

    work page

  6. [5]

    The adversarial hyper- parameters for the different methods are listed in TableVIII

    Hyperparameters In addition to the underlying model architecture given in Appendix C1 , the general hyperparameters used for all models are listed in Table VII. The adversarial hyper- parameters for the different methods are listed in TableVIII. APPENDIX D: COMPLEMENTARY RESULTS

    work page

  7. [6]

    The results presented in Sec

    Raw performance score The non-normalized performance score S for the differ- ent adversarial training methods is shown in Table IX. The results presented in Sec. VI C are reported at a fixed signal efficiency of ϵ S ¼ 0.85. In order to verify if similar results are obtained across the entire signal efficiency spectrum, the rejection in function of signal ...

    work page 2025

  8. [7]

    VI C, where feature- space attack methods generalize better from Herwig to Pythia than from Pythia to Herwig, whereas weight-space attacks show the opposite trend

    Mass correlation An asymmetry is observed in Sec. VI C, where feature- space attack methods generalize better from Herwig to Pythia than from Pythia to Herwig, whereas weight-space attacks show the opposite trend. This behavior can be partially attributed to the impact of the different learning strategies on mass correlation. The mass sculpting is quantif...

    work page 2025

Show all 57 references
  1. [8]

    VI B, only considers models trained on Pythia and evaluated on Pythia for brevity

    Sharpness reduction analysis The sharpness reduction analysis, presented in Sec. VI B, only considers models trained on Pythia and evaluated on Pythia for brevity. However, in order to verify if the assumption of sharpness reduction holds, this needs to be verified for all cro...

    2025

  2. [9]

    J. A. Raine, S. Klein, D. Sengupta, and T. Golling, CUR- TAINs for your sliding window: Constructing unobserved regions by transforming adjacent intervals, Front. Big Data 6, 899345 (2023)

    2023

  3. [10]

    Hallin, J

    A. Hallin, J. Isaacson, G. Kasieczka, C. Krause, B. Nachman, T. Quadfasel, M. Schlaffer, D. Shih, and M. Sommerhalder, Classifying anomalies through outer density estimation, Phys. Rev. D 106, 055006 (2022)

    2022

  4. [11]

    Kasieczka et al., The machine learning landscape of top taggers, SciPost Phys

    G. Kasieczka et al., The machine learning landscape of top taggers, SciPost Phys. 7, 014 (2019)

    2019

  5. [12]

    Kasieczka and D

    G. Kasieczka and D. Shih, Robust jet classifiers through distance correlation, Phys. Rev. Lett. 125, 122001 (2020)

    2020

  6. [13]

    Li et al

    C. Li et al. , Accelerating resonance searches via signature- oriented pre-training, arXiv:2405.12972

    arXiv

  7. [14]

    Kitouni, B

    O. Kitouni, B. Nachman, C. Weisser, and M. Williams, Enhancing searches for resonances with machine learning and moment decomposition, J. High Energy Phys. 04 (2021) 007

    2021

  8. [15]

    Bogatskiy, T

    A. Bogatskiy, T. Hoffman, D. W. Miller, J. T. Offermann, and X. Liu, Explainable equivariant neural networks for particle physics: PELICAN, J. High Energy Phys. 03 (2024) 113

    2024

  9. [16]

    Feickert and B

    M. Feickert and B. Nachman, A living review of machine learning for particle physics, arXiv:2102.02770

    arXiv

  10. [17]

    Bogatskiy, B

    A. Bogatskiy, B. Anderson, J. Offermann, M. Roussi, D. Miller, and R. Kondor, Lorentz group equivariant neural network for particle physics, in Proceedings of the 37th International Conference on Machine Learning (Curran Associates, Inc.,, Red Hook, NY , 2020), pp. 992 –1002

    2020

  11. [18]

    P . T. Komiske, E. M. Metodiev, and J. Thaler, Energy flow networks: Deep sets for particle jets, J. High Energy Phys. 01 (2019) 121

    2019

  12. [20]

    H. Qu, C. Li, and S. Qian, Particle transformer for jet tagging, arXiv:2202.03772

    arXiv

  13. [21]

    A TLAS Collaboration, Accuracy versus precision in boosted top tagging with the A TLAS detector, J. Instrum. 19, P08018 (2024)

    2024

  14. [22]

    Huetsch, J

    N. Huetsch, J. M. Villadamigo, A. Shmakov, S. Diefenbacher, V . Mikuni, T. Heimel, M. Fenton, K. Greif, B. Nachman, D. Whiteson, A. Butter, and T. Plehn, The landscape of unfolding with machine learning, SciPost Phys. 18, 070 (2025)

    2025

  15. [23]

    Leigh, D

    M. Leigh, D. Sengupta, G. Qu´ etant, J. A. Raine, K. Zoch, and T. Golling, PC-JeDi: Diffusion for particle cloud generation in high energy physics, SciPost Phys. 16, 018 (2024)

    2024

  16. [24]

    J. A. Raine, M. Leigh, K. Zoch, and T. Golling, Fast and improved neutrino reconstruction in multineutrino final states with conditional normalizing flows, Phys. Rev. D 109, 012005 (2024)

    2024

  17. [25]

    Ghosh and B

    A. Ghosh and B. Nachman, A cautionary tale of decorrelat- ing theory uncertainties, Eur. Phys. J. C 82, 46 (2022)

    2022

  18. [26]

    High Energy Phys

    The A TLAS Collaboration, A search for R-parity-violating supersymmetry in final states containing many jets in pp collisions at ffiffi ffisp ¼ 13 TeV with the A TLAS detector, J. High Energy Phys. 05 (2024) 003

    2024

  19. [27]

    Stein, X

    A. Stein, X. Coubez, S. Mondal, A. Novak, and A. Schmidt, Improving robustness of jet tagging algorithms with adversarial training, Comput. Software Big Sci. 6,1 5 (2022). TABLE X. Largest Hessian eigenvalues for the different evaluation scenarios, training methods and perturb...

    2022

  20. [28]

    Arjovsky, L

    M. Arjovsky, L. Bottou, I. Gulrajani, and D. Lopez-Paz, Invariant risk minimization, arXiv:1907.02893

    1907 arXiv

  21. [29]

    Ganin and V

    Y . Ganin and V . Lempitsky, Unsupervised domain adapta- tion by backpropagation, arXiv:1409.7495

    arXiv

  22. [30]

    Chaudhari, A

    P . Chaudhari, A. Choromanska, S. Soatto, Y . LeCun, C. Baldassi, C. Borgs, J. Chayes, L. Sagun, and R. Zecchina, Entropy-SGD: Biasing gradient descent into wide valleys, J. Stat. Mech. (2019) P124018

    2019

  23. [31]

    Moosavi-Dezfooli, A

    S.-M. Moosavi-Dezfooli, A. Fawzi, J. Uesato, and P . Frossard, Robustness via curvature regularization, and vice versa, in 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (IEEE, Long Beach, CA, USA, 2019), pp. 9070 –9078

    2019

  24. [32]

    N. S. Keskar, D. Mudigere, J. Nocedal, M. Smelyanskiy, and P . T. P . Tang, On large-batch training for deep learning: Generalization gap and sharp minima, arXiv:1609.04836

    arXiv

  25. [33]

    Jiang, B

    Y . Jiang, B. Neyshabur, H. Mobahi, D. Krishnan, and S. Bengio, Fantastic generalization measures and where to find them, arXiv:1912.02178

    1912 arXiv

  26. [34]

    H. Li, Z. Xu, G. Taylor, C. Studer, and T. Goldstein, Visualizing the loss landscape of neural nets, in NIPS’18: Proceedings of the 32nd International Conference on Neural Information Processing Systems (2018), pp. 6391 –6401, 10.3929/ETHZ-B-000461393

    2018 doi

  27. [35]

    Hochreiter and J

    S. Hochreiter and J. Schmidhuber, Flat minima, Neural Comput. 9, 1 (1997)

    1997

  28. [36]

    Izmailov, D

    P . Izmailov, D. Podoprikhin, T. Garipov, D. V etrov, and A. G. Wilson, Averaging weights leads to wider optima and better generalization, arXiv:1803.05407

    arXiv

  29. [37]

    W. J. Maddox, P . Izmailov, T. Garipov, D. P . V etrov, and A. G. Wilson, A simple baseline for Bayesian uncertainty in deep learning, in Advances in Neural Information Process- ing Systems (Curran Associates, Inc.,, Red Hook, NY , 2019), V ol. 32

    2019

  30. [38]

    A. G. Wilson and P . Izmailov, Bayesian deep learning and a probabilistic perspective of generalization, in Advances in Neural Information Processing Systems (Curran Associates, Inc.,, Red Hook, NY , 2020), V ol. 33, pp. 4697 –4708

    2020

  31. [39]

    Zhang, D

    B. Zhang, D. Jiang, D. He, and L. Wang, Rethinking Lipschitz neural networks and certified robustness: A Bool- ean function perspective, Adv. Neural Inf. Process. Syst. 35, 19398 (2022), https://proceedings.neurips.cc/paper_files/ paper/2022/file/7b04ec5f2b89d7f601382c422dfe07...

    2022 arXiv

  32. [40]

    Kitouni, N

    O. Kitouni, N. Nolte, and M. Williams, Expressive mon- otonic neural networks, arXiv:2307.07512

    arXiv

  33. [41]

    I. J. Goodfellow, J. Shlens, and C. Szegedy, Explaining and harnessing adversarial examples, in 3rd International Conference on Learning Representations, ICLR 2015, Conference Track Proceedings , edited by Y . Bengio and Y . LeCun (2015), arXiv:1412.6572

    2015 arXiv

  34. [42]

    Zhang, Y

    H. Zhang, Y . Y u, J. Jiao, E. Xing, L. E. Ghaoui, and M. Jordan, Theoretically principled trade-off between ro- bustness and accuracy, in Proceedings of the 36th International Conference on Machine Learning (Curran Associates, Inc.,, Red Hook, NY , 2019), pp. 7472 –7482

    2019

  35. [43]

    Andriushchenko and N

    M. Andriushchenko and N. Flammarion, Understanding and improving fast adversarial training, in Advances in Neural Information Processing Systems (Curran Associates, Inc.,, Red Hook, NY , 2020), V ol. 33, pp. 16048 –16059

    2020

  36. [44]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, Towards deep learning models resistant to adversa- rial attacks, arXiv:1706.06083

    arXiv

  37. [45]

    Foret, A

    P . Foret, A. Kleiner, H. Mobahi, and B. Neyshabur, Sharp- ness-aware minimization for efficiently improving gener- alization, arXiv:2010.01412

    2010 arXiv

  38. [46]

    K. Wen, T. Ma, and Z. Li, How does sharpness-aware minimization minimize sharpness?, arXiv:2211.05729

    arXiv

  39. [47]

    Andriushchenko and N

    M. Andriushchenko and N. Flammarion, Towards under- standing sharpness-aware minimization, in Proceedings of the 39th International Conference on Machine Learning (Curran Associates, Inc.,, Red Hook, NY , 2022), pp. 639 –668

    2022

  40. [48]

    P . Mi, L. Shen, T. Ren, Y . Zhou, X. Sun, R. Ji, and D. Tao, Make sharpness-aware minimization stronger: A sparsified perturbation approach, arXiv:2210.05177

    arXiv

  41. [49]

    R. V . Mises and H. Pollaczek-Geiringer, Praktische V erfah- ren der Gleichungsauflösung, ZAMM 9, 152 (1929)

    1929

  42. [50]

    P . C. Harris, M. Kagan, J. Krupa, B. Maier, and N. Woodward, RS3L: A jet tagging dataset for self-supervised learning based on re-simulation, 10.5281/zenodo.10633815 (2024)

    2024 doi

  43. [51]

    Harris, M

    P . Harris, M. Kagan, J. Krupa, B. Maier, and N. Woodward, Re-simulation-based self-supervised learning for pre- training foundation models, Phys. Rev. D 111, 032010 (2025)

    2025

  44. [52]

    Sjöstrand, S

    T. Sjöstrand, S. Ask, J. R. Christiansen, R. Corke, N. Desai, P . Ilten, S. Mrenna, S. Prestel, C. O. Rasmussen, and P . Z. Skands, An introduction to PYTHIA 8.2, Comput. Phys. Commun. 191, 159 (2015)

    2015

  45. [53]

    Bahr et al., Herwig++ physics and manual, Eur

    M. Bahr et al., Herwig++ physics and manual, Eur. Phys. J. C 58, 639 (2008)

    2008

  46. [54]

    Bellm et al

    J. Bellm et al. , Herwig 7.0/ Herwig++ 3.0 release note, Eur. Phys. J. C 76, 196 (2016)

    2016

  47. [55]

    https://github.com/rodem-hep/adversarialGeneralization

  48. [56]

    Kirichenko, P

    P . Kirichenko, P . Izmailov, and A. G. Wilson, Last layer re- training is sufficient for robustness to spurious correlations, arXiv:2204.02937

    arXiv

  49. [57]

    Z. Wei, J. Zhu, and Y . Zhang, Sharpness-aware minimiza- tion alone can improve adversarial robustness, arXiv:2305 .05392. ROTHEN, KLEIN, LEIGH, and GOLLING PHYS. REV . D 112, 016004 (2025) 016004-14

    2025

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.