Pith. sign in

REVIEW 4 major objections 4 minor 41 references

Privacy-preserving Robotic-based Multi-factor Authentication Scheme for Secure Automated Delivery System

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes a privacy-preserving multi-factor authentication protocol for robotic delivery in which a user is verified by a secret subkey plus face and voice embeddings, backed by a transformer-based audio-visual fusion defender…

desk verdict An unfinished draft: the promised ProVerif/Scyther validation and formal analysis are absent, so the central claim is unsupported, though the audio-visual fusion defender idea is reasonable and the implementation is real. read the letter →

arxiv 2411.18027 v1 pith:ELVWOCIA submitted 2024-11-27 cs.CR

Yang Yang , Aryan Mohammadi Pasikhani , Prosanta Gope , Biplab Sikdar This is my paper · ORCID
classification cs.CR
keywords roboticdeliveryauthenticationmulti-factorprivacy-preservingbiometricsfaceandvoiceembeddingtransformerfusiondefenderadversarialsamplesellipticcurvecryptography
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper seeks to make robotic last-mile delivery authentication secure and private by asking the robot to check three things at once: a subkey derived from a server-issued secret key, the user's face, and the user's voice. It argues that combining elliptic-curve cryptography with deep-learning biometric verification closes impersonation, replay, man-in-the-middle, unlinkability, and identity-theft risks, while protecting biometric data by storing only encrypted embeddings rather than raw face or voice recordings. To harden the biometric factor against machine-learning attacks such as FGSM and PGD, the authors introduce a fusion transformer that reconstructs denoised face and audio inputs before verification. If the protocol and the defender work as described, a robot could authenticate a package recipient offline and privately in a single interaction, even in noisy real-world settings.

What carries the argument

The carrying mechanism is a three-factor verification pipeline. The crypto factor uses ECDH key agreement and ECDSA-signed messages to exchange a one-time key, a random index, and rotating UID/KEY values updated by XOR with fresh random values, letting client and server establish a shared secret and a chosen subkey. The biometric factor captures a face image and a voice sample, passes both through the fusion defender, a transformer encoder operating on flattened image patches and mel-spectrogram patches with separate linear projections and two MSE reconstruction losses, then extracts embeddings with ResNet for the face and ECAPA-TDNN for the voice under an AAM-Softmax loss, and compares them against the server-provided encrypted embeddings. The fusion defender is load-bearing for the AI-resilience claim because it reconstructs cleaned inputs before any verification model sees them.

What would settle it

Capture a deployed robot and read its flash storage, or eavesdrop on the security-channel transmission during the MAU4 step, to extract the one-time key, chosen-index subkey, and stored face and voice embeddings; then present those values to a fresh robot at a delivery point. If that robot accepts the package, the three-factor authentication guarantee is false.

Watch

Extended reading notes

Core claim

The central claim is that a robotic delivery system can authenticate a receiving user with three independent factors in a single interaction: something the user knows (a six-character subkey selected from a server-generated key via a random index), something the user is (a face embedding), and something the user says (a voice embedding), with all biometrics stored only as encrypted embeddings. The protocol uses ECDH-derived shared keys and ECDSA signatures for mutual authentication between client and server, while the robot receives the key, index, and embeddings over a security channel and runs the biometric checks locally. The paper further claims that its transformer-based audio-visual fusion denoise defender, trained with face and audio reconstruction losses, reduces the effectiveness of adversarial perturbations on both face and voice verification, reporting lower equal error rates under FGSM, PGD, BIM, FFGSM, and Jitter attacks.

Load-bearing premise

The protocol assumes the channel between server and robot is secure and that the robot's stored key, index, and embeddings cannot be read or altered by an attacker; if an attacker can learn or modify those values, the multi-factor authentication can be bypassed.

Editorial extensions

If this is right

  • If the protocol is secure, a delivery robot can authenticate a recipient with one interaction, without requiring the user to remember a long password or carry a separate token.
  • If the defender generalizes as reported, face and voice verification on the robot would withstand common white-box adversarial perturbations, with the paper's numbers showing EER falling from 35.42% to 13.45% under PGD and from 20.16% to 12.86% under FGSM.
  • If the biometric storage design is sound, raw face images and voice recordings never reside on the robot; only encrypted, server-derived embeddings do, so a physical robot capture does not directly leak biometrics.
  • If the channel assumptions hold, the scheme's offline verification capability means authentication can proceed after a single secure provisioning step, which is useful where internet connectivity is unreliable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An unstated consequence is that the same three-factor template could migrate to other unattended delivery contexts, such as medicine, documents, or keys, where the recipient must be verified without a human courier.
  • A testable extension is to evaluate the fusion defender against adaptive attackers who know its weights or against physical-domain attacks such as printed glasses and replayed recordings, since the reported evaluations use a fixed set of gradient-based perturbations.
  • Editorial observation: the abstract and introduction promise a formal reduction proof and ProVerif/Scyther symbolic verification, but the visible full text contains no theorem statement, proof, or tool transcript, so the formal-security claims are asserted rather than demonstrated in this version.
  • Another consequence not developed in the paper is that the security-channel assumption between server and robot means real-world security depends on physical and network protection of the robot during provisioning, not only on cryptography.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a privacy-preserving multi-factor authentication scheme for robotic delivery systems, combining ECC-based cryptographic key exchange and digital signatures with face and voice biometric verification. It also introduces a transformer-based audio-visual fusion 'defender' intended to reconstruct inputs before verification, thereby mitigating adversarial examples, and reports a real-world implementation on a Turtlebot3 with Raspberry Pi 3, including computational cost and power consumption measurements. The abstract and introduction claim a rigorous formal security analysis using ProVerif and Scyther, along with resistance to impersonation, replay, man-in-the-middle, and linkability attacks.

Significance. If fully substantiated, the proposed system would address a real gap: robotic last-mile delivery currently lacks an integrated multi-factor authentication protocol that combines cryptographic security with biometric verification and defends against ML-based adversarial inputs. The paper gives credit for a concrete hardware implementation, energy consumption measurements, and a defender architecture that is evaluated against five attack types. However, the central verification claims are not supported by the manuscript: the promised formal analysis and symbolic verification results are absent, the protocol description contains garbled and duplicated text, and the security argument depends on unmodeled assumptions about a secure channel and robot trustworthiness. The defender evaluation also lacks baselines and statistical detail, so the claim of being the 'first' effective audio-visual fusion defender is not established.

major comments (4)
  1. [Abstract and Section VI, first paragraph] The abstract and Section VI explicitly promise validation using ProVerif and Scyther, and Section I.B promises a 'comprehensive security analysis (Using Reduction Proof and Symbolic Tool)'. The manuscript contains no reduction proof, no ProVerif or Scyther model, no trace output, and no security-analysis subsection or appendix. Section III.C.3 even leaves the unlinkability proof as 'details are provided in Section ??'. The claimed properties of key indistinguishability, unlinkability, perfect forward secrecy, and resistance to impersonation/replay/MITM therefore rest entirely on an unverified message sequence, directly contradicting the paper's central claim of rigorous formal analysis.
  2. [Figure 4 (Step C^Crypto_5 / MAU4) and Section VI.B.4] In the authentication phase, the server sends the session key, the chosen index, and the user's biometric embeddings to the robot over a 'Security Channel', and the robot stores them for later verification. The adversary model in Section III.B does not include physical robot capture or compromise of this channel, yet Section VI.B.4 concedes that if the one-time key is broken, only previous sessions are protected, leaving the current session's subkey and embeddings recoverable from the robot. The multi-factor and privacy claims are thus load-bearing on a trusted-robot/secure-channel assumption that is neither formally modeled nor experimentally challenged; this must be addressed or explicitly scoped out.
  3. [Section IV.B and Figure 4] The protocol description is internally inconsistent and partially duplicated, making it impossible to verify the message flow. Section IV.B repeats the 'Registration Phase' and 'Robot Registration' text nearly verbatim on pages 6-7, and Figure 3 contains duplicated flow fragments. More seriously, Step B2 in Section IV.B states 'key = dc ∗ QS' while Figure 3 and the preceding text require key = KDF(ds * Qc), and the MC1 construction in Step C^Crypto_2 (text: Enc{KEY[UID], UID||µ}) differs from Figure 4 (MC1 = {Qc || Enc{key, UID||µ} || TID}). These discrepancies preclude a reader from verifying even the basic cryptographic operations, let alone the claimed security properties.
  4. [Section VI.B, Table II and Figures 8-9] The defender evaluation compares the defended model only against the undefended model. There are no comparisons with existing defense mechanisms such as adversarial training baselines, autoencoder-based defenders, or other transformer/denoising methods, and no confidence intervals, standard deviations, or number of runs are reported. Given the paper's claim of introducing the 'first' transformer-based audio-visual fusion defender, the results as presented do not establish superiority over prior art, and the EER improvements alone are insufficient to support the resilience claim.
minor comments (4)
  1. [Throughout] The manuscript contains numerous typos and unresolved cross-references, including 'Tradiaional' (Section I.B), 'Cilp' in Equation (5), 'Hign-level' (Section IV.A), and 'Section ??' in Section III.C.3.
  2. [Section VI.A and Figure 3] The computational cost text reports '0.1.419 s' for ECDSA, which appears to be a typo, and the caption text in Figure 3 contains garbled fragments such as 'Dif f ieHellman'. These should be corrected.
  3. [Section IV.D.2] The text refers to 'Following Algorithm 16' when the actual algorithm is labeled 'Algorithm 1: Verification Process with Defender'; the reference should be updated.
  4. [Equation (2)] The AAM-Softmax loss formula is typeset with an unclear summation index ('ΣN j=i,j̸=yi'), and the variables s and m are not fully defined; the notation should be cleaned up for reproducibility.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the protocol and defender are evaluated against external benchmarks and standard attacks, and the paper's self-citations are contextual rather than load-bearing.

full rationale

The paper's central claims are a multi-factor authentication protocol and a transformer-based audio-visual fusion defender. I checked the derivation chain for reductions to inputs. The defender is trained with a reconstruction loss (MSE, Eq. 6-7) and evaluated against externally defined adversarial attacks (FGSM, PGD, BIM, FFGSM, Jitter) on the public VoxCeleb dataset, with accuracy, ROC/AUC, and EER metrics; there is no fitted parameter later renamed as a prediction. The cryptographic protocol is presented as a message sequence, and its claimed security properties are asserted rather than derived from a fitted quantity. Self-citations [14] and [15] appear in the related-work survey and are used to motivate the need for a new scheme, not to justify the correctness of the proposed protocol or the defender; they are therefore not load-bearing. The manuscript promises a rigorous formal analysis and ProVerif/Scyther validation, but the full text contains neither the reduction proofs nor the symbolic-tool outputs. This is an evidentiary absence, not a circular argument: the absent material cannot make the derivation equivalent to its inputs. The secure-channel and trusted-robot assumptions are load-bearing premises, but they are stated assumptions rather than conclusions derived from themselves. Accordingly, no circular step meeting the quote-and-reduction standard is present. The main risks are unsupported claims and missing artifacts, which are correctness concerns, not circularity.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The protocol relies on standard cryptographic assumptions and an assumed secure server-robot link. The main unspecified choices are the defender loss weights and the verification thresholds, which directly affect the reported performance. No new physical or mathematical entities are introduced.

free parameters (2)
  • lambda_face and lambda_voice in the defender loss function = Not specified
    The overall loss is L = lambda_face * L_face + lambda_voice * L_voice (Eq. 7). The values of the two weights are not given, yet they determine the defender's behavior and any reported performance.
  • Face and voice verification thresholds = Not specified
    The system decides accept or reject by comparing similarity scores to thresholds, but the thresholds used in the experiments are not reported; changing them changes false accept and false reject rates.
assumptions (5)
  • domain assumption The server-robot communication channel is secure.
    The protocol sends the secret key, chosen index, and user embeddings to the robot over a 'Security Channel' (Section III.A, Figure 4). If an adversary can intercept or modify this channel, the authentication can be bypassed.
  • domain assumption Client and server know each other's public keys before registration.
    Section IV.B.2 states 'It is assumed that both the Client and Server possess knowledge of each other's public keys beforehand.' This is required for signature verification during registration.
  • standard math Hardness of the elliptic curve discrete logarithm problem.
    The ECDH key exchange and ECDSA signatures in Section II.A rely on the standard cryptographic hardness assumption, which the paper does not prove.
  • domain assumption The adversary model excludes server and robot software compromise.
    Section III.B defines Type 1 adversaries that only intercept public channel messages and Type 2 AI adversaries; it does not include an adversary who controls the server or the robot's software, only physical capture of the robot (Section VI.B.4).
  • domain assumption The face and voice verification models are fixed and accurate on clean inputs.
    The evaluation in Section VI.B assumes ResNet and ECAPA-TDNN embeddings are reliable on clean data; the defender only tries to preserve that reliability under attack.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy-preserving Robotic-based Multi-factor Authentication Scheme for Secure Automated Delivery System." pith.science (2026). https://pith.science/paper/ELVWOCIA

@misc{pith2026241118027,
  author       = {Pith},
  title        = {Pith review of: Privacy-preserving Robotic-based Multi-factor Authentication Scheme for Secure Automated Delivery System},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ELVWOCIA}},
  note         = {Machine review of arXiv:2411.18027}
}
read the original abstract

Package delivery is a critical aspect of various industries, but it often incurs high financial costs and inefficiencies when relying solely on human resources. The last-mile transport problem, in particular, contributes significantly to the expenditure of human resources in major companies. Robot-based delivery systems have emerged as a potential solution for last-mile delivery to address this challenge. However, robotic delivery systems still face security and privacy issues, like impersonation, replay, man-in-the-middle attacks (MITM), unlinkability, and identity theft. In this context, we propose a privacy-preserving multi-factor authentication scheme specifically designed for robot delivery systems. Additionally, AI-assisted robotic delivery systems are susceptible to machine learning-based attacks (e.g. FGSM, PGD, etc.). We introduce the \emph{first} transformer-based audio-visual fusion defender to tackle this issue, which effectively provides resilience against adversarial samples. Furthermore, we provide a rigorous formal analysis of the proposed protocol and also analyse the protocol security using a popular symbolic proof tool called ProVerif and Scyther. Finally, we present a real-world implementation of the proposed robotic system with the computation cost and energy consumption analysis. Code and pre-trained models are available at: https://drive.google.com/drive/folders/18B2YbxtV0Pyj5RSFX-ZzCGtFOyorBHil

Figures

Figures reproduced from arXiv: 2411.18027 by the authors.

Figure 2
Figure 2. Registration 1 1 Client Robot Server Signature, {(DH Key Exchange)kEnc{KEY [UID],Nonce } Signature, {Diff ie ￾ HellmankEnc{key, UIDkNonce}kTID} Enc{key, T IDk chosen ￾ index(CI)} [ key, chosen ￾ index] Security Channel [ f ace and voice embeddings ] Security Channel CI CI CI CI Subkey 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Present :[ subkey, f acial image, voice ] Check? subkey, chosen ￾ index (Recface,Recvoice)= Def… view at source ↗
Figure 4
Figure 4. Authentication Phase of the Proposed Scheme [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 1
Figure 1. Authentication Client Server Signature, {(DH Key Exchange)kTIDc} Signature, {(DH Key Exchange)kTIDskTIDcEnc kEnc{UIDkKEY, key} Signature, {Enc{f ace, voice} k Enc{TIDs}, hash(MC2)} [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figures from the paper (8 more)
Figure 2
Figure 2. Figure 2: Robot Registration. for both the new Robot and new Client, which encompass the information of unique identifiers such as PID and TID. Simultaneously, the Client is responsible for collecting the user’s face and voice information, which will be used for deep learning-ba…
Figure 3
Figure 3. Figure 3: Client Registration After receiving the message, the Server first computes the hash value of the message MC1 and then computes P = S −1 C1 ∗ z ∗ G + S −1 C1 ∗ RC1 ∗ pkc. If the Server receives a valid digital signature, it generates a secret key ds for key exchange. Af…
Figure 4
Figure 4. Figure 4: Authentication Phase of the Proposed Scheme. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Proposed Audio-Visual Fusion Denoise Transformer. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Power Consumption 3) Evaluation Metrics: To ensure a comprehensive eval￾uation of the defence model’s performance, we utilized three metrics: accuracy, the Receiver Operating Characteristic (ROC) with the Area Under the Curve (AUC) value, and the Equal Error Rate (EER)…
Figure 7
Figure 7. Figure 7: Implemention Setup and PyTorch 1.12.0 [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Accuracy of ML-based Attack for Original and Defense Models [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: ROC of ML-based Attack for Original and Defense Models [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 29 canonical work pages

  1. [1]

    financial statements,

    S. express, “financial statements,” 2022, https://www.sf-express.com/, Last accessed on 2022-09-11

    work page 2022

  2. [2]

    financenews,

    yto express, “financenews,” 2022, https://www.yto.net.cn/, Last accessed on 2022-09-11

    work page 2022

  3. [3]

    annual-reports,

    Amazon, “annual-reports,” 2022, https://ir.aboutamazon.com/, Last accessed on 2022-09-11

    work page 2022

  4. [4]

    last-mile-delivery,

    optimoroute, “last-mile-delivery,” 2022, https://optimoroute.com/last-m ile-delivery/, Last accessed on 2022-09-11

    work page 2022

  5. [5]

    meet-scout,

    Amazon, “meet-scout,” 2022, https://www.aboutamazon.com/, Last accessed on 2022-09-11

    work page 2022

  6. [6]

    Jd robot,

    Sohu, “Jd robot,” 2022, https://www.sohu.com/, Last accessed on 2022- 09-11

    work page 2022

  7. [7]

    Terminus robot,

    Terminus, “Terminus robot,” 2022, https://www.terminusgroup.com/pr oducts/smart-devices/, Last accessed on 2022-09-11

    work page 2022

  8. [8]

    Starship robot,

    Starship, “Starship robot,” 2022, https://www.starship.xyz/, Last accessed on 2022-09-11

    work page 2022

Show all 41 references
  1. [9]

    Tusimple robot,

    Tusimple, “Tusimple robot,” 2022, https://www.tusimple.com/, Last accessed on 2022-09-11

    2022

  2. [10]

    A two-tier urban delivery network with robot-based deliveries,

    I. Bakach, A. Campbell, and J. Ehmke, “A two-tier urban delivery network with robot-based deliveries,” Networks, vol. 78, 02 2021

    2021

  3. [11]

    Cost-optimal truck-and- robot routing for last-mile delivery,

    M. Ostermeier, A. Heimfarth, and A. H ¨ubner, “Cost-optimal truck-and- robot routing for last-mile delivery,” Networks, vol. 79, 03 2021

    2021

  4. [12]

    Medrobo medicine delivering and patient parameter monitoring robot,

    A. Joy, R. Varghese, A. Varghese, A. M. Sajeev, J. Raveendran, A. Thomas, and K. B. Saran, “Medrobo medicine delivering and patient parameter monitoring robot,” in 2021 7th International Conference on Advanced Computing and Communication Systems (ICACCS) , vol. 1, 2021, pp. 1808–1812

    2021

  5. [13]

    Smart nursing robot for covid-19 patients,

    P. e. a. Manikandan, “Smart nursing robot for covid-19 patients,” in 2021 International Conference on Advance Computing and Innovative Technologies in Engineering (ICACITE) , 2021, pp. 839–842

    2021

  6. [14]

    Design, analysis and implementation of a smart next generation secure shipping infrastructure using autonomous robot,

    J. Yang, P. Gope, Y . Cheng, and L. Sun, “Design, analysis and implementation of a smart next generation secure shipping infrastructure using autonomous robot,” Computer Networks , vol. 187, p. 107779,

  7. [15]

    An ai-driven secure and intelligent robotic delivery system,

    W. Wang, P. Gope, and Y . Cheng, “An ai-driven secure and intelligent robotic delivery system,” IEEE Transactions on Engineering Manage- ment, pp. 1–16, 2022

    2022

  8. [16]

    Two-factor authentication resilient to server compromise using mix-bandwidth de- vices

    M. Shirvanian, S. Jarecki, N. Saxena, and N. Nathan, “Two-factor authentication resilient to server compromise using mix-bandwidth de- vices.” in NDSS, 2014

    2014

  9. [17]

    Mpcauth: Multi-factor authentication for distributed-trust systems,

    S. Tan, W. Chen, R. Deng, and R. A. Popa, “Mpcauth: Multi-factor authentication for distributed-trust systems,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2023, pp. 829–847

    2023

  10. [18]

    Efficient multi-factor au- thenticated key exchange scheme for mobile communications,

    R. Zhang, Y . Xiao, S. Sun, and H. Ma, “Efficient multi-factor au- thenticated key exchange scheme for mobile communications,” IEEE Transactions on Dependable and Secure Computing , vol. 16, no. 4, pp. 625–634, 2017

    2017

  11. [19]

    Practical threshold multi- factor authentication,

    W. Li, H. Cheng, P. Wang, and K. Liang, “Practical threshold multi- factor authentication,” IEEE transactions on information forensics and security, vol. 16, pp. 3573–3588, 2021

    2021

  12. [20]

    A design of provably secure multi-factor ecc- based authentication protocol in multi-server cloud architecture,

    S. Shukla and S. J. Patel, “A design of provably secure multi-factor ecc- based authentication protocol in multi-server cloud architecture,” Cluster Computing, pp. 1–22, 2023

    2023

  13. [21]

    An open-source framework for last mile delivery with heterogeneous robots,

    A. Jain, M. Svetlik, N. Machak, and K. S. Sikand, “An open-source framework for last mile delivery with heterogeneous robots,” Good Systems-Published Research, 2021

    2021

  14. [22]

    Secure fusion approach for the internet of things in smart autonomous multi-robot systems,

    W. Liang, Z. Ning, S. Xie, Y . Hu, S. Lu, and D. Zhang, “Secure fusion approach for the internet of things in smart autonomous multi-robot systems,” Information Sciences, vol. 579, pp. 468–482, 2021

    2021

  15. [23]

    Elliptic curve cryptosystems,

    N. Koblitz, “Elliptic curve cryptosystems,” Mathematics of computation, vol. 48, no. 177, pp. 203–209, 1987

    1987

  16. [24]

    Use of elliptic curves in cryptography,

    V . S. Miller, “Use of elliptic curves in cryptography,” in Conference on the theory and application of cryptographic techniques. Springer, 1985, pp. 417–426

    1985

  17. [25]

    ” new directions in cryptography

    W. Diffie and M. Hellman, “” new directions in cryptography” ieee transactions on information theory, v. it-22, n. 6,” 1976

    1976

  18. [26]

    The elliptic curve digital sig- nature algorithm (ecdsa),

    D. Johnson, A. Menezes, and S. Vanstone, “The elliptic curve digital sig- nature algorithm (ecdsa),” International journal of information security , vol. 1, pp. 36–63, 2001

    2001

  19. [27]

    Arcface: Additive angular margin loss for deep face recognition,

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4690– 4699

    2019

  20. [28]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  21. [29]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  22. [30]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  23. [31]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security . Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  24. [32]

    Fast is better than free: Revisiting adversarial training,

    E. Wong, L. Rice, and J. Z. Kolter, “Fast is better than free: Revisiting adversarial training,” arXiv preprint arXiv:2001.03994 , 2020

    2001 arXiv

  25. [33]

    Exploring misclassifications of robust neural networks to enhance adversarial attacks,

    L. Schwinn, R. Raab, A. Nguyen, D. Zanca, and B. Eskofier, “Exploring misclassifications of robust neural networks to enhance adversarial attacks,” Applied Intelligence, pp. 1–17, 2023

    2023

  26. [34]

    Privacy-aware secure region- based handover for small cell networks in 5g-enabled mobile commu- nication,

    R. Alnashwan, P. Gope, and B. Dowling, “Privacy-aware secure region- based handover for small cell networks in 5g-enabled mobile commu- nication,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 1898–1913, 2023

    1913

  27. [35]

    Towards deep neural network architectures robust to adversarial examples,

    S. Gu and L. Rigazio, “Towards deep neural network architectures robust to adversarial examples,” arXiv preprint arXiv:1412.5068 , 2014

    2014 arXiv

  28. [36]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  29. [37]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020

    2010 arXiv

  30. [38]

    Face transformer for recognition,

    Y . Zhong and W. Deng, “Face transformer for recognition,” arXiv preprint arXiv:2103.14803, 2021

    2021 arXiv

  31. [39]

    V oxceleb: Large- scale speaker verification in the wild,

    A. Nagrani, J. S. Chung, W. Xie, and A. Zisserman, “V oxceleb: Large- scale speaker verification in the wild,” Computer Science and Language, 2019

    2019

  32. [40]

    Ecapa-tdnn: Em- phasized channel attention, propagation and aggregation in tdnn based speaker verification,

    B. Desplanques, J. Thienpondt, and K. Demuynck, “Ecapa-tdnn: Em- phasized channel attention, propagation and aggregation in tdnn based speaker verification,” arXiv preprint arXiv:2005.07143 , 2020

    2005 arXiv

  33. [2021]

    Available: https://www.sciencedirect.com/science/articl e/pii/S1389128620313554

    [Online]. Available: https://www.sciencedirect.com/science/articl e/pii/S1389128620313554

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.