Pith. sign in

REVIEW 4 major objections 6 minor 40 references

Exploring the Robustness and Transferability of Patch-Based Adversarial Attacks in Quantized Neural Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Quantization fails to neutralize patch-based adversarial attacks, which keep high success rates across bitwidths and architectures; quantized-patch training cuts them sharply.

desk verdict Useful empirical sweep showing patch attacks transfer to quantized models, but the mechanistic story and defense evaluation need tighter controls before the conclusions are taken at face value. read the letter →

arxiv 2411.15246 v2 pith:EFHXSG2P submitted 2024-11-22 cs.CR

Amira Guesmi , Bassem Ouni , Muhammad Shafique This is my paper · ORCID
classification cs.CR
keywords quantizedneuralnetworksadversarialpatchespatch-basedattackstransferabilityquantization-awaredefensetrainingrobustnesslow-bitwidthquantizationfeaturemapanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether reducing a neural network to low-precision arithmetic, a step called quantization that is widely used to make models small enough for phones and edge devices, also makes the model safer against adversarial attacks. The answer it argues is no for patch-based attacks: localized, highly visible adversarial patches keep high attack success rates at 32-bit, 8-bit, 4-bit, and even 2-bit precision, and they transfer across very different architectures. The paper identifies what it believes is the mechanism behind this persistence: quantized models still produce distinct, localized feature activations at the patch's location, and patch gradients remain better aligned with full-precision gradients than pixel-level perturbations do. It also proposes a defense, Quantization-Aware Defense Training (QADT), which embeds adversarial patches into training under simulated quantization and reports cutting attack success rates from 87.29% to 21.3% at 32-bit and from 57.51% to 10.65% at 8-bit. If right, this means quantization should not be trusted as a security measure against physically realizable patch threats, and defenses need to be quantization-aware.

What carries the argument

The load-bearing mechanism is the persistence of distinct, localized feature activations: when a patch is placed on an input, the quantized network's early convolutional layers continue to light up in exactly the patch's region, at every bitwidth from 32-bit down to 2-bit. The paper pairs this qualitative observation with a quantitative measure, gradient alignment, computed as cosine similarity between full-precision and quantized model gradients plus mean squared error, which stays markedly higher for patch-based attacks than for pixel-level PGD as bitwidth falls. The defense, QADT, is a training procedure that injects adversarial patches, generated with varying size, position, rotation, intensity, and simulated quantization, into quantization-aware training so the model learns to suppress these localized high-activation signals before deployment.

What would settle it

Run LAVAN on a 2-bit model while zeroing out or down-weighting the feature-map channels at the patch location across the first three convolutional layers; if the attack success rate stays high, the persistence of localized features is not the causal driver the paper claims.

Watch

Extended reading notes

Core claim

The paper's central claim is that quantized neural networks remain as vulnerable as full-precision networks to patch-based adversarial attacks, and nearly as vulnerable even at 2-bit precision. Across CIFAR-10 and ImageNet, with LAVAN, GAP, and DPR patches, on ResNet, VGG, AlexNet, Inception-v3, and Swin-S, mean attack success rates stay above roughly 50-70% at the lowest bitwidths tested. The paper attributes this to the persistence of distinct, localized features: feature maps of patched inputs show prominent high-activation regions at the patch location in early convolutional layers at every bitwidth, and patch-based attacks retain higher gradient cosine similarity and lower MSE relative to full precision than pixel-level PGD attacks as precision drops. On top of this, the authors propose Quantization-Aware Defense Training (QADT), which augments quantization-aware training with adversarial patches generated under simulated quantized conditions and varied size, position, rotation, and intensity, and report that it reduces LAVAN attack success from 87.29% to 21.3% at 32-bit and from 57.51% to 10.65% at 8-bit on ResNet-20/CIFAR-10.

Load-bearing premise

The paper assumes that the prominent patch-shaped activations visible in feature maps of three convolutional layers are actually what causes the attacks to succeed, rather than merely accompanying them.

Editorial extensions

If this is right

  • Quantization should not be treated as a security mechanism for edge or mobile deployments: at 2-bit precision, LAVAN still achieves 73-77% success on CIFAR-10 models and DPR reaches 49.87% on ImageNet.
  • Patch attacks that succeed on one architecture and bitwidth will likely succeed on other architectures and bitwidths, so defenses built for a single model or a single precision will be insufficient.
  • Defenses that only look for a patch at a fixed location will fail, since shifting the patch by up to 18 pixels or rotating it up to 30 degrees barely changes success rates.
  • Defenses must be quantization-aware: QADT reduces LAVAN success below standard adversarial training, reaching 21.3% versus 44.01% at 32-bit and 10.65% versus 39.69% at 8-bit on ResNet-20.
  • Larger, more visible patches are harder to stop in QNNs, consistent with the claim that patch attacks exploit high-visibility localized features rather than subtle perturbations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the persistence mechanism is right, then quantization schemes that add noise to or aggressively round early-layer feature maps specifically where high-contrast localized patterns appear should break the attack; the paper does not directly test that prediction.
  • The gradient-alignment asymmetry suggests a cheap detector: compare the cosine similarity of a candidate perturbation's gradient between a full-precision and a 2-bit copy of the same network, with high similarity flagging patch-like threats; the paper reports the asymmetry but does not propose using it for detection.
  • The QADT results cover only ResNet-20 on CIFAR-10 with the LAVAN attack, so whether the defense transfers to ImageNet-scale models or to GAP and DPR patches remains an open extension.
  • The paper's feature-map evidence spans three convolutional layers of one network, so a causal test that suppresses exactly those localized activations and measures the resulting drop in attack success would convert the visual persistence story into a demonstrated mechanism.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper empirically studies whether patch-based adversarial attacks (LAVAN, GAP, DPR) transfer to quantized neural networks across bitwidths (32, 8, 5, 4, 2-bit), architectures (ResNets, VGGs, AlexNet, Inception-v3, Swin-S), and quantization schemes (QAT, PTQ, dynamic quantization). It reports that attack success rates (ASR) remain high after quantization on CIFAR-10 and ImageNet, and attributes this to the persistence of distinct, localized patch-induced features in quantized representations, supported by feature-map visualizations, gradient-alignment measurements, spatial-sensitivity tests, and patch-size experiments. It then proposes Quantization-Aware Defense Training (QADT), which augments QAT with diverse adversarial patches under simulated quantized conditions, and reports that QADT reduces LAVAN ASR on ResNet-20/CIFAR-10 from 87.29% (standard training, 32-bit) to 21.3% (32-bit) and from 57.51% to 10.65% (8-bit).

Significance. If the main empirical claim holds, the paper provides a useful data point: quantization alone does not neutralize patch-based attacks across a range of practical settings, and quantization-aware defenses can substantially reduce patch-attack success. The study covers multiple attack types, architectures, bitwidths, and quantization techniques, and the transferability results are clearly tabulated. However, the paper's central mechanistic conclusion—that patch attacks persist because of localized feature retention—is not backed by a control condition (random patches of equal size/position), and the headline tables lack error bars. The proposed QADT defense is a concrete contribution but is evaluated only in a narrow setting. The paper is suitable for a major revision: the empirical ASR tables are valuable, but the causal interpretation and the statistical rigor need strengthening.

major comments (4)
  1. [Sections 4.2–4.7, Tables 1, 6, 8] The central claim that patch attacks remain effective in QNNs 'due to the persistence of distinct, localized features' is not supported without a random-patch control. No experiment compares the optimized patches against randomly generated or non-optimized patches of the same size, position, and visibility. Table 8 shows ASR increasing monotonically with patch size (86.43% at 6×6 to 95.56% at 12×12 at 32-bit), which is a hallmark of a visibility/occlusion effect rather than an adversarial-signal effect. The authors should add a random-patch baseline (e.g., uniform noise or random image crops) across the same architectures and bitwidths. If random patches achieve comparable ASR, then the claimed quantization-specific vulnerability is an artifact of the patch's high visibility, and the causal story in Section 4.2 is unsupported.
  2. [Tables 1, 3, 4, 5, 6, 7, 8, 9] The headline ASR values are reported as single numbers without standard deviations, confidence intervals, or number of runs. For example, Table 1 reports ResNet-20 ASR dropping from 87.22% to 74.18% between 32-bit and 2-bit, but without run-to-run variability it is unclear whether this decline is statistically meaningful. The supplementary material (Tables 10 and 11) provides mean and std for the targeted GAP attack, but the main tables do not. The authors should add error bars or at least multiple-run statistics for the central transferability tables, or explicitly state the variance if the experiments were run once.
  3. [Section 4.2, Figure 2] The mechanistic explanation that patches persist 'due to the persistence of distinct, localized features' rests entirely on qualitative visual inspection of feature maps from three convolutional layers. No quantitative measure is provided, such as the magnitude of activation at the patch location relative to other regions, or an ablation that removes the high-activation region and measures the resulting ASR. The visual evidence is equally consistent with the model attending to any high-contrast object in the patch area. The authors should quantify the feature-map persistence (e.g., peak-to-background activation ratio, or gradient-weighted localization metrics) and, if possible, provide a causal link between the localized activations and the reported ASRs.
  4. [Section 6, Table 9] The QADT defense is evaluated only on ResNet-20/CIFAR-10 with the LAVAN attack and a single patch size (10×10). Since the defense is trained with LAVAN-style patches under simulated quantized conditions, its success against the same attack family is partly circular. The paper should evaluate QADT against held-out attacks (GAP, DPR, or LAVAN with different patch sizes/positions) and on at least one additional architecture or bitwidth (e.g., ResNet-56 at 4-bit) to demonstrate that the defense generalizes rather than overfits to the augmentation distribution.
minor comments (6)
  1. [Abstract] The phrase 'Contrary to the expectation that quantization might enhance adversarial defenses' is misleading because prior work (e.g., Bernhard et al. and Fu et al., cited in Section 2) already shows that quantization's effect on robustness is attack-dependent; the paper itself, in the supplementary, confirms that quantization gives partial robustness to PGD. The abstract should be phrased as a more nuanced claim.
  2. [Table 3] The 32-bit ImageNet ASR values (99.31% and 99.98%) are much higher than the corresponding CIFAR-10 ASRs (~87%) and are reported without explanation. A brief comment on the difference in attack success between datasets (e.g., patch visibility relative to image size, number of classes, or classifier capacity) would help the reader interpret the ImageNet results.
  3. [Section 4.3, Table 2] The dynamic-quantization results show large variation across architectures (e.g., GAP ASR of 82.40% on ResNet-56 vs. 41.78% on VGG-16), but the text does not discuss this non-monotonic behavior. If this reflects a real architectural difference, it should be analyzed; if it is due to experimental variability, the lack of error bars is especially problematic.
  4. [Supplementary, Table 12] In the supplementary patch-size table for VGG-19, the 6×6 and 10×10 rows are identical (88.17, 76.29, 77.59, 88.20, 90.95), which appears to be a copy-paste error. Please verify and correct.
  5. [Algorithm 1] The initialization 'model M with random weights' is ambiguous: QADT is described as integrating adversarial patch augmentation into quantization-aware training, but it is not stated whether training starts from scratch or from a pretrained full-precision model. Since QAT typically starts from a pretrained model, please clarify the initialization and report any performance impact on clean accuracy.
  6. [Throughout] The acronym 'DPR' (Deformable Patch Representation) is introduced in Section 4.1 and used in Table 5, but the supplementary material consistently uses 'DRP'. Unify the acronym.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's central vulnerability and transferability results are independent empirical measurements, and QADT's LAVAN evaluation is a standard in-distribution robustness check rather than a self-deriving prediction.

full rationale

The paper's main claims are empirical: adversarial patches generated on a full-precision model are evaluated on separately quantized QAT/PTQ models (Section 4.3, Tables 1-4; Section 4.6, Table 7). No parameter in these transferability measurements is fitted to the reported attack success rates, and the quantized evaluation models are not constructed from the patch-generation objective, so the high ASRs are externally measured rather than derived from the inputs. The feature-map persistence argument (Section 4.2, Figure 2) is a post-hoc interpretation of the same experiments, not a derivation, so it cannot be circular in the equation-identity sense. The QADT defense (Section 6, Algorithm 1) trains with adversarial patch augmentation under simulated quantization and is then evaluated with LAVAN (Table 9); this is standard adversarial training and evaluation on the same attack family. While this limits generalization claims and is a validity concern, it is not a case where a fitted parameter is renamed as a prediction: the defense's training objective directly optimizes the quantity being reported, and the paper does not present the table as an independent generalization benchmark. The self-citations ([9], [10]) appear only in background descriptions of patch attacks and are not load-bearing for the transferability or QADT results. The absence of a random-patch control is a substantive alternative-explanation threat to the mechanistic 'persistence of features' conclusion, but that is an experimental-control weakness, not circular reasoning. No equation, definition, or citation chain in the paper makes any central result equivalent to its inputs by construction.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new theoretical entities. Its empirical claims rest on standard assumptions about quantization simulation and gradient-based transferability, plus several under-specified experimental settings. The QADT defense depends on training hyperparameters that are not reported.

free parameters (2)
  • QADT hyperparameters (epochs E, learning rate eta, batch size B, patch diversity ranges)
    Algorithm 1 lists these as inputs, but the paper never reports the values used for Table 9, so the defense result cannot be reproduced or checked for sensitivity to these choices.
  • LAVAN noise percentage (NP) on ImageNet = 0.10, 0.08, 0.06
    Table 3 uses NP values without defining them or explaining how they map to patch properties; the reported ASR varies with NP, so NP is an ad hoc experimental knob.
assumptions (4)
  • domain assumption Straight-through estimator (STE) fake quantization during QAT accurately models deployment quantization behavior.
    The paper draws conclusions about QNN vulnerability from QAT models; if fake quantization diverges from true integer inference, the results may not hold in deployment. Invoked throughout Section 4.
  • domain assumption Cosine similarity between full-precision and quantized model gradients is a valid proxy for attack transferability.
    Section 4.5 interprets higher cosine similarity as the mechanism for patch transferability, but no causal link is established; gradient similarity is not generally a reliable predictor of transferability.
  • domain assumption Feature-map visual inspection reliably identifies the cause of attack success.
    Section 4.2 concludes that persistent patch-induced activations explain high ASR based on qualitative inspection of three conv layers, without computing any correlation between activation patterns and attack success.
  • domain assumption The LAVAN 6x6 patch setup is representative of patch-based attacks generally.
    Most headline tables use LAVAN with a single patch size; GAP and DPR appear only in a few tables and QADT is evaluated only with LAVAN, so generalization across patch attack families is assumed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Exploring the Robustness and Transferability of Patch-Based Adversarial Attacks in Quantized Neural Networks." pith.science (2026). https://pith.science/paper/EFHXSG2P

@misc{pith2026241115246,
  author       = {Pith},
  title        = {Pith review of: Exploring the Robustness and Transferability of Patch-Based Adversarial Attacks in Quantized Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EFHXSG2P}},
  note         = {Machine review of arXiv:2411.15246}
}
read the original abstract

Quantized neural networks (QNNs) are increasingly used for efficient deployment of deep learning models on resource-constrained platforms, such as mobile devices and edge computing systems. While quantization reduces model size and computational demands, its impact on adversarial robustness-especially against patch-based attacks-remains inadequately addressed. Patch-based attacks, characterized by localized, high-visibility perturbations, pose significant security risks due to their transferability and resilience. In this study, we systematically evaluate the vulnerability of QNNs to patch-based adversarial attacks across various quantization levels and architectures, focusing on factors that contribute to the robustness of these attacks. Through experiments analyzing feature representations, quantization strength, gradient alignment, and spatial sensitivity, we find that patch attacks consistently achieve high success rates across bitwidths and architectures, demonstrating significant transferability even in heavily quantized models. Contrary to the expectation that quantization might enhance adversarial defenses, our results show that QNNs remain highly susceptible to patch attacks due to the persistence of distinct, localized features within quantized representations. These findings underscore the need for quantization-aware defenses that address the specific challenges posed by patch-based attacks. Our work contributes to a deeper understanding of adversarial robustness in QNNs and aims to guide future research in developing secure, quantization-compatible defenses for real-world applications.

Figures

Figures reproduced from arXiv: 2411.15246 by the authors.

Figure 1
Figure 1. Overview of the experimental framework for evaluating patch-based attacks on QNNs. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Feature maps of the 32-bit, 8-bit, 4-bit, and 2-bit models comparing the clean and patched feature maps for the three first [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Gradient maps for 32-bit, 8-bit, 4-bit, and 2-bit models under patch-based and pixel-level attacks, along with Cosine Similarity [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Accuracy of ResNet-56 under PGD attacks across dif [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 6
Figure 6. Figure 6: Accuracy of VGG-16 under PGD attacks across different [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Model accuracy of ResNet-20 under PGD attacks using [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Feature maps of the 32-bit and 2-bit models comparing the clean and patched feature maps for the three first convolutional layers. [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: Feature maps of the 32-bit and 2-bit models comparing clean, pixel-level perturbed (left), and patch-based perturbed inputs (right) [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: Illustration of a clean sample, an adversarial sample, [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 26 canonical work pages

  1. [1]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Inter- national conference on machine learning , pages 284–293. PMLR, 2018. 2

    work page 2018

  2. [2]

    Impact of low-bitwidth quantization on the ad- versarial robustness for embedded neural networks

    R ´emi Bernhard, Pierre-Alain Moellic, and Jean-Max Dutertre. Impact of low-bitwidth quantization on the ad- versarial robustness for embedded neural networks. In 2019 International Conference on Cyberworlds (CW), pages 308–

    work page 2019

  3. [3]

    Adversarial patch

    Tom Brown. Adversarial patch. 2017. 4, 2

    work page 2017

  4. [4]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 2

    2017

  5. [5]

    Chen Zhaoyu et. al. Shape matters: deformable patch attack. In ECCV, pages 529–548. Springer, 2022. 4, 2

    work page 2022

  6. [6]

    Yang Lin et. al. Fq-vit: Post-training quantization for fully quantized vision transformer. In IJCAI, pages 1173–1179. ijcai.org, 2022. 4

    work page 2022

  7. [7]

    Double-win quant: Aggressively winning ro- bustness of quantized deep neural networks via random pre- cision training and inference

    Yonggan Fu, Qixuan Yu, Meng Li, Vikas Chandra, and Yingyan Lin. Double-win quant: Aggressively winning ro- bustness of quantized deep neural networks via random pre- cision training and inference. InInternational Conference on Machine Learning, pages 3492–3504. PMLR, 2021. 1, 2

    work page 2021

  8. [8]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 2, 1

    arXiv 2014

Show all 40 references
  1. [9]

    Physical adversarial attacks for camera-based smart systems: Current trends, categorization, applications, research challenges, and future outlook

    Amira Guesmi, Muhammad Abdullah Hanif, Bassem Ouni, and Muhammad Shafique. Physical adversarial attacks for camera-based smart systems: Current trends, categorization, applications, research challenges, and future outlook. IEEE Access, 2023. 1, 2

    2023

  2. [10]

    Dap: A dynamic adversarial patch for evading person detectors

    Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. Dap: A dynamic adversarial patch for evading person detectors. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24595–24604, 2024. 2

    2024

  3. [11]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 4

    2016

  4. [12]

    Optimizing convolutional neural networks for iot devices: performance and energy efficiency of quantization tech- niques

    Nicol ´as Hern´andez, Francisco Almeida, and Vicente Blanco. Optimizing convolutional neural networks for iot devices: performance and energy efficiency of quantization tech- niques. The Journal of Supercomputing, pages 1–20, 2024. 1

    2024

  5. [13]

    Binarized neural networks

    Itay Hubara, Matthieu Courbariaux, Daniel Soudry, Ran El- Yaniv, and Yoshua Bengio. Binarized neural networks. Ad- vances in neural information processing systems , 29, 2016. 2, 1

    2016

  6. [14]

    Accurate post training quantization with small calibration sets

    Itay Hubara, Yury Nahshan, Yair Hanani, Ron Banner, and Daniel Soudry. Accurate post training quantization with small calibration sets. In International Conference on Ma- chine Learning, pages 4466–4475. PMLR, 2021. 2, 1

    2021

  7. [15]

    Quantization and training of neural networks for efficient integer-arithmetic-only inference

    Benoit Jacob, Skirmantas Kligys, Bo Chen, Menglong Zhu, Matthew Tang, Andrew Howard, Hartwig Adam, and Dmitry Kalenichenko. Quantization and training of neural networks for efficient integer-arithmetic-only inference. In Proceed- ings of the IEEE conference on computer vision ...

    2018

  8. [16]

    Fedqnn: A computation–communication-efficient federated learn- ing framework for iot with low-bitwidth neural network quantization

    Yu Ji and Lan Chen. Fedqnn: A computation–communication-efficient federated learn- ing framework for iot with low-bitwidth neural network quantization. IEEE Internet of Things Journal , 10(3): 2494–2507, 2023. 1

    2023

  9. [17]

    Lavan: Localized and visible adversarial noise

    Dan Karmon. Lavan: Localized and visible adversarial noise. In International Conference on Machine Learning ,

  10. [18]

    A survey on approx- imate edge ai for energy efficient autonomous driving ser- vices

    Dewant Katare, Diego Perino, Jari Nurmi, Martijn Warnier, Marijn Janssen, and Aaron Yi Ding. A survey on approx- imate edge ai for energy efficient autonomous driving ser- vices. IEEE Communications Surveys & Tutorials, 2023. 1

    2023

  11. [19]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009. 4

    2009

  12. [20]

    Imagenet classification with deep convolutional neural net- works

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural net- works. Communications of the ACM, 60(6):84–90, 2017. 4

    2017

  13. [21]

    Investigating the impact of quantization on adversar- ial robustness

    Qun Li, Yuan Meng, Chen Tang, Jiacheng Jiang, and Zhi Wang. Investigating the impact of quantization on adversar- ial robustness. ArXiv, abs/2404.05639, 2024. 2

    2024 arXiv

  14. [22]

    Generative dynamic patch attack

    Xiang Li and Shihao Ji. Generative dynamic patch attack. arXiv preprint arXiv:2111.04266, 2021. 2

    2021 arXiv

  15. [23]

    Additive powers-of- two quantization: An efficient non-uniform discretization for neural networks

    Yuhang Li, Xin Dong, and Wei Wang. Additive powers-of- two quantization: An efficient non-uniform discretization for neural networks. arXiv preprint arXiv:1909.13144, 2019. 2, 1

    1909 arXiv

  16. [24]

    Brecq: Pushing the limit of post-training quantization by block reconstruc- tion

    Yuhang Li, Ruihao Gong, Xu Tan, Yang Yang, Peng Hu, Qi Zhang, Fengwei Yu, Wei Wang, and Shi Gu. Brecq: Pushing the limit of post-training quantization by block reconstruc- tion. arXiv preprint arXiv:2102.05426, 2021. 2, 1

    2021 arXiv

  17. [25]

    Flexi-compression: a flexible model compression method for autonomous driving

    Hantao Liu, Ying He, F Richard Yu, and Jeremy James. Flexi-compression: a flexible model compression method for autonomous driving. In Proceedings of the 11th ACM Sym- posium on Design and Analysis of Intelligent Vehicular Net- works and Applications, pages 19–26, 2021. 1

    2021

  18. [26]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021. 4

    2021

  19. [27]

    Towards deep learning models resis- tant to adversarial attacks

    Aleksander Madry. Towards deep learning models resis- tant to adversarial attacks. arXiv preprint arXiv:1706.06083,

    arXiv

  20. [28]

    Up or down? adap- tive rounding for post-training quantization

    Markus Nagel, Rana Ali Amjad, Mart Van Baalen, Chris- tos Louizos, and Tijmen Blankevoort. Up or down? adap- tive rounding for post-training quantization. In International Conference on Machine Learning, pages 7197–7206. PMLR,

  21. [29]

    A white paper on neural network quantization

    Markus Nagel, Marios Fournarakis, Rana Ali Amjad, Yely- sei Bondarenko, Mart Van Baalen, and Tijmen Blankevoort. A white paper on neural network quantization. arXiv preprint arXiv:2106.08295, 2021. 1, 2

    2021 arXiv

  22. [30]

    Xnor-net: Imagenet classification using bi- nary convolutional neural networks

    Mohammad Rastegari, Vicente Ordonez, Joseph Redmon, and Ali Farhadi. Xnor-net: Imagenet classification using bi- nary convolutional neural networks. In European conference on computer vision, pages 525–542. Springer, 2016. 2, 1

    2016

  23. [31]

    Empir: Ensembles of mixed precision deep networks for increased robustness against adversarial attacks

    Sanchari Sen, Balaraman Ravindran, and Anand Raghu- nathan. Empir: Ensembles of mixed precision deep networks for increased robustness against adversarial attacks. arXiv preprint arXiv:2004.10162, 2020. 1, 2

    2004 arXiv

  24. [32]

    Very deep convo- lutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convo- lutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. 4

    2014 arXiv

  25. [33]

    Rethinking the inception archi- tecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception archi- tecture for computer vision. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 2818–2826, 2016. 4

    2016

  26. [34]

    Neural network quan- tization in federated learning at the edge

    Nicola Tonellotto, Alberto Gotta, Franco Maria Nardini, Daniele Gadler, and Fabrizio Silvestri. Neural network quan- tization in federated learning at the edge. Information Sci- ences, 575:417–436, 2021. 1

    2021

  27. [35]

    Qdrop: Randomly dropping quantization for extremely low-bit post-training quantization

    Xiuying Wei, Ruihao Gong, Yuhang Li, Xianglong Liu, and Fengwei Yu. Qdrop: Randomly dropping quantization for extremely low-bit post-training quantization. arXiv preprint arXiv:2203.05740, 2022. 2, 1

    2022 arXiv

  28. [36]

    Quantization aware attack: Enhancing transferable ad- versarial attacks by model quantization

    Yulong Yang, Chenhao Lin, Qian Li, Zhengyu Zhao, Haoran Fan, Dawei Zhou, Nannan Wang, Tongliang Liu, and Chao Shen. Quantization aware attack: Enhancing transferable ad- versarial attacks by model quantization. IEEE Transactions on Information Forensics and Security, 2024. 2

    2024

  29. [37]

    Medq: Lossless ultra-low-bit neural network quantization for medical image segmentation

    Rongzhao Zhang and Albert CS Chung. Medq: Lossless ultra-low-bit neural network quantization for medical image segmentation. Medical Image Analysis, 73:102200, 2021. 1, 2

    2021

  30. [38]

    Dorefa-net: Training low bitwidth convo- lutional neural networks with low bitwidth gradients

    Shuchang Zhou, Yuxin Wu, Zekun Ni, Xinyu Zhou, He Wen, and Yuheng Zou. Dorefa-net: Training low bitwidth convo- lutional neural networks with low bitwidth gradients. arXiv preprint arXiv:1606.06160, 2016. 2, 1 10 Exploring the Robustness and Transferability of Patch-Based Adve...

    2016 arXiv

  31. [40]

    The main idea is to create deformable and dynamic patches that can adapt their form to exploit the vulnerabilities of neural networks more effectively

    is a type of adversarial attack that focuses on altering the shape and appearance of patches in an image rather than just modifying pixel values. The main idea is to create deformable and dynamic patches that can adapt their form to exploit the vulnerabilities of neural networ...

  32. [255]

    This configuration ensures that the perturba- tions remain imperceptible while effectively challenging the model’s robustness. 7.1.3. Patch-based Adversarial Attacks Patch-based adversarial attacks introduce highly visible, lo- calized perturbations that redirect the model’s f...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.