Pith. sign in

REVIEW 4 major objections 4 minor 83 references

Adversarial Attacks on Hyperbolic Networks

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Hyperbolic networks fail in different ways than Euclidean networks, and geometry-aware attacks cannot close the gap.

desk verdict Useful, clearly-written extension of FGM/PGD to hyperbolic space with an honest empirical comparison, but the causal claim about geometry outruns the evidence and Eq. 24 has a typo that undermines Figure 5 as printed. read the letter →

arxiv 2412.01495 v1 pith:VT6UCDI6 submitted 2024-12-02 cs.LG cs.AI

Max van Spengler , Jan Zahálka , Pascal Mettes This is my paper · ORCID
classification cs.LGcs.AI
keywords hyperbolicdeeplearningadversarialattacksRiemanniangeometryPoincaréballrobustnessFGMPGDgeometric
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Hyperbolic deep learning promises better representation of hierarchical data, but its security properties are unknown. This paper proposes Riemannian generalizations of the FGM and PGD adversarial attacks, which move the input along geodesics of the Poincaré ball instead of along Euclidean straight lines. Using these attacks, the authors compare fully hyperbolic (Poincaré) ResNets with Euclidean ResNets on CIFAR-10 and CIFAR-100, and find the two model families are vulnerable in different ways: they are easily tricked into different specific misclassifications. Notably, attacking the hyperbolic models with the geometry-aware attacks does not remove these differences, leading the authors to conclude that the adversarial robustness gap comes from the geometry of the learned representations themselves, not from a mismatch of attack geometry.

What carries the argument

The carrying object is the Poincaré ball model of hyperbolic space, with Möbius addition, exponential and logarithmic maps, and parallel transport. The paper defines Riemannian FGM as $\tilde{x} = \exp_x(\alpha \nabla_x J(\theta, x, y))$ and Riemannian PGD as a multi-step version with projection onto the constraint set $\mathcal{S}$ using the shortest path in the hyperbolic distance. These reduce to standard FGM and PGD when the manifold is Euclidean space. The comparative misclassification matrix $M^{\mathrm{comp}} = M^P - M^E$ is used to visualize which label confusions each geometry is prone to, averaged over models and perturbation sizes.

What would settle it

Train both a Euclidean and a Poincaré ResNet with the same optimizer, learning rate schedule, and ten different random initializations, then compute the comparative misclassification matrix on the same attack; if the cross-model differences in label confusions shrink to within-seed variance, the claim that geometry drives the distinct vulnerabilities is refuted.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that Euclidean and fully hyperbolic networks do not differ merely in degree of adversarial robustness; they differ in kind. A comparative misclassification matrix shows that, for the same attack, a Poincaré ResNet is relatively easily fooled into confusing, say, dogs with cats, while a Euclidean ResNet is relatively easily fooled into confusing trucks with ships. The proposed hyperbolic versions of FGM and PGD behave almost identically to their Euclidean counterparts when the perturbation is small, because the Poincaré ball is locally approximately Euclidean, and they do not close the vulnerability gap even at larger perturbation sizes. The authors conclude that the different geometries cause the models to learn distinct decision patterns, each with its own weaknesses.

Load-bearing premise

The causal conclusion assumes that the Euclidean and Poincaré ResNets are comparable except for geometry: the paper trains them with different optimizers (Adam vs. Riemannian Adam), does not report seeds or error bars, and only checks that accuracies are similar, leaving open that the vulnerability differences come from training variation rather than from the geometry itself.

Editorial extensions

If this is right

  • The proposed hyperbolic FGM and PGD are genuine generalizations: on Euclidean space they reduce to the standard attacks, so they can serve as geometry-agnostic attack baselines for any manifold with a computable exponential map.
  • Because geometry-aware attacks do not remove the robustness difference, adversarial robustness of hyperbolic models cannot be attributed to the attacks being 'wrong geometry'—the difference is in the learned decision boundary.
  • The specific label confusions revealed by the misclassification matrix give an interpretable diagnostic for where each geometry fails, potentially guiding defense design for each model family.
  • Hyperbolic networks show a small robustness advantage under Euclidean attacks, but the size of the advantage depends on depth, so depth and curvature interact with the geometric effect.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next experiment is to train both model families with the identical optimizer and multiple random seeds; if the vulnerability patterns collapse to noise, the geometry-causal conclusion would need to be weakened to a training-dynamics effect.
  • The synthetic toy experiment suggests the relative power of hyperbolic versus Euclidean attacks depends on whether the gradient points toward or away from the origin; a hybrid attack that switches geometry depending on gradient direction could be stronger than either alone.
  • If geometry is a first-order determinant of failure modes, then robustness certification and adversarial training will likely need to be re-derived for hyperbolic models rather than transferred from Euclidean practice.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Riemannian generalizations of the FGM and PGD adversarial attacks for hyperbolic (Poincaré ball) networks, and uses them to study adversarial robustness of fully hyperbolic versus Euclidean ResNets. On a synthetic disk classification task, the authors compare hyperbolic and Euclidean FGM under several objective functions. On CIFAR-10/100, they train Poincaré and Euclidean ResNets, compare their robustness under FGM, and use a comparative misclassification matrix to argue that the two model families exhibit different class-confusion patterns. They further show that applying their hyperbolic FGM to the Poincaré ResNet does not remove these differences, and conclude that the different geometries cause the models to learn distinct vulnerability patterns.

Significance. The paper addresses a genuinely open problem: adversarial attacks for non-Euclidean networks, where standard Euclidean attacks may be inappropriate. The proposed hyperbolic FGM/PGD are natural and clearly derived as Riemannian gradient steps, and the synthetic experiments provide a useful interpretable demonstration that attack geometry matters. The CIFAR experiments also point to an interesting empirical phenomenon: Euclidean and Poincaré ResNets exhibit different misclassification patterns under the same attack. If the causal conclusion about geometry were established, this would be a notable contribution to geometric deep learning. However, the paper's central causal claim is currently stronger than its evidence: the model comparison confounds geometry with optimizer choice, architecture implementation details, curvature hyperparameters, and training stochasticity, and no error bars or multiple seeds are reported. The paper also contains a definitional error in Eq. (24) that, as written, forces the comparative misclassification matrix to be identically zero. The contribution is promising and likely repairable, but the main conclusion needs substantially more support.

major comments (4)
  1. [§6.2, Eq. (24)] Equation (24) defines M^E_ij using the Poincaré model ϕP in both the numerator and the denominator, rather than the Euclidean model ϕE. Since the denominator is the count of misclassified images and the numerator counts images with y_k = i and ϕP(x_k) = j, this makes M^E = M^P by definition, so M_comp = M^P - M^E is identically zero. This directly contradicts Figure 5, which shows many nonzero entries. This is not a cosmetic typo: the comparative misclassification analysis is central to the paper's empirical claim. Please correct Eq. (24) to use ϕE and rerun/verify the corresponding figures.
  2. [§6.1–§6.3, abstract and conclusion] The statement that 'the shifts in adversarial robustness are due to the models learning distinct patterns resulting from their different geometries' is not supported by the experimental design. In Section 6.1, the Poincaré ResNets are trained with Riemannian Adam while the Euclidean ResNets are trained with Adam; the two model families also differ in layer parameterization, implementation, and the curvature hyperparameter c = 0.1, and no multiple seeds or variance estimates are reported. Table 1 shows clean accuracy differences of 1–2 points, and Figure 5 is qualitative. Any of these confounds, or plain training stochasticity, could explain the observed differences. The data support the weaker statement that these particular trained models exhibit different vulnerability patterns; they do not establish geometry as the cause. Please either add controlled comparisons (e.g., matching optimizers/implementations where possible, multiple seeds with error bars, or an analysis that isolates the geometric component) or weaken the causal claim throughout the paper.
  3. [§6.2–§6.3] The paper proposes hyperbolic PGD in Section 4.2 but never evaluates it on the real network experiments. Section 6.2 only states that Euclidean PGD gives 'nearly identical results as FGM' and therefore only FGM results are shown, and Section 6.3 only applies hyperbolic FGM to the Poincaré ResNets. Since PGD is the standard iterative attack used for robustness evaluation, omitting both Euclidean PGD results and hyperbolic PGD results leaves the central comparison incomplete. At minimum, report the PGD curves (or explicitly quantify the claimed near-identity with FGM) and include hyperbolic PGD in the Section 6.3 comparison.
  4. [§5.4 and Figure 3] The synthetic results are presented as evidence about the relative potency of hyperbolic and Euclidean attacks, but no error bars or repeated runs are provided, and the text acknowledges that the results are 'highly sensitive to the configuration of the dataset and the model parameters' (Section 5.4). Since only a single synthetic model is trained, the reader cannot tell whether the observed ordering of objective functions and attacks is robust or an artifact of one seed and one hyperparameter choice. Please add variance over multiple synthetic data draws and model initializations, or clearly frame Figure 3 as illustrative rather than as a quantitative comparison.
minor comments (4)
  1. [§1 and §6.1] The introduction states that the paper investigates 'identically trained Euclidean and hyperbolic ResNets,' but Section 6.1 reports that the Poincaré ResNets are trained with Riemannian Adam and the Euclidean ResNets with Adam. Please use consistent wording, e.g., 'comparably trained' rather than 'identically trained,' or justify why the optimizer difference is immaterial.
  2. [§5.4] There are typos: 'Futhermore' should be 'Furthermore' and 'oberserve' should be 'observe'.
  3. [§6.2] The phrase 'misclasification matrices' in the text before Eq. (22) should be 'misclassification matrices.'
  4. [§6.3, Eq. (25)] The step-size matching in Eq. (25) constrains the Euclidean norm in image space, not the hyperbolic distance on the preprocessed input. This is a reasonable choice, but the paper should state explicitly that the two attacks are being compared under a Euclidean perturbation budget in the original image space, and that this is not the same as a hyperbolic-distance budget on the manifold.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the proposed attacks are standard Riemannian gradient steps and the central claim is an empirical inference, not an equation-level tautology.

full rationale

The hyperbolic FGM and PGD constructions (Eqs. 12 and 16) are direct Riemannian generalizations of the Euclidean updates, built on the exponential map (Eq. 5) and shortest-path projection; they do not presuppose the paper's conclusions about geometry-dependent vulnerability. The synthetic and CIFAR comparisons are measured experiments, and the causal statement that different geometries lead to different learned patterns is an interpretation of those measurements, not a quantity defined into existence. The paper does cite the authors' own Poincaré ResNet [64] as the hyperbolic testbed and as prior evidence that Euclidean attacks degrade against hyperbolic models, but that citation supplies an architecture and an external, falsifiable empirical result rather than a forbidden uniqueness theorem or a fitted parameter; it is not load-bearing for the attack derivations. Two non-circularity concerns should be flagged for correctness review rather than circularity: (i) the models are described as 'identically trained' in Section 6.1, yet the Poincaré ResNets use Riemannian Adam with curvature c=0.1 while the Euclidean ResNets use Adam, and no seeds are reported, so the geometry-attribution claim is confounded; and (ii) as printed, Eq. 24 defines M^E using the Poincaré model φP in both numerator and denominator, which would make M_comp identically zero and contradict the nonzero matrix described in Figure 5; this appears to be a typo in the evidence definition rather than a circular derivation. Neither issue makes the paper's argument circular.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical entities. The central empirical claims depend on several chosen hyperparameters and on comparability assumptions between Euclidean and hyperbolic models. The attack formulas themselves are standard Riemannian gradient steps.

free parameters (5)
  • Curvature c for Poincaré ResNets = 0.1
    Chosen, not swept; sets the geometry used in all hyperbolic ResNet experiments and could influence the vulnerability comparison.
  • Curvature c for synthetic disk = 1.0
    Chosen for the synthetic experiment; the paper notes results are highly sensitive to configuration.
  • Synthetic data spread and radius = sigma^2 = 0.25, r = 1.5
    Chosen data-generation parameters; the paper itself says results are highly sensitive to these settings.
  • Step size alpha scaling in hyperbolic FGM = epsilon / (lambda_c_x * gradient norm)
    A chosen normalization to ensure the hyperbolic distance equals epsilon; this choice influences attack strength and the Euclidean-versus-hyperbolic comparison.
  • PGD step size and iteration count = 0.5 epsilon, T = 10
    Chosen attack hyperparameters; PGD results are said to be nearly identical to FGM and are not shown.
assumptions (5)
  • standard math The Poincaré ball with metric gc and Möbius operations correctly models hyperbolic space.
    Used throughout Section 3 as background; the paper cites standard references [1,9].
  • standard math Exponential and logarithmic maps, parallel transport, and gyrator formulas from [26,63] are correct and implementable.
    Central to defining hyperbolic FGM/PGD in Section 4.
  • domain assumption For the tested networks, increasing the cross-entropy loss via gradient ascent degrades classification accuracy.
    Standard assumption in adversarial attacks; used to justify all objective functions.
  • domain assumption The Poincaré ResNet and Euclidean ResNet differ only in geometry despite different optimizers and implementations.
    Underlies the causal conclusion; not explicitly validated in Section 6.1.
  • domain assumption Small perturbations from the origin in hyperbolic space are approximately Euclidean.
    Used in Section 6.3 to explain why hyperbolic attacks do not differ from Euclidean attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Attacks on Hyperbolic Networks." pith.science (2026). https://pith.science/paper/VT6UCDI6

@misc{pith2026241201495,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks on Hyperbolic Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VT6UCDI6}},
  note         = {Machine review of arXiv:2412.01495}
}
read the original abstract

As hyperbolic deep learning grows in popularity, so does the need for adversarial robustness in the context of such a non-Euclidean geometry. To this end, this paper proposes hyperbolic alternatives to the commonly used FGM and PGD adversarial attacks. Through interpretable synthetic benchmarks and experiments on existing datasets, we show how the existing and newly proposed attacks differ. Moreover, we investigate the differences in adversarial robustness between Euclidean and fully hyperbolic networks. We find that these networks suffer from different types of vulnerabilities and that the newly proposed hyperbolic attacks cannot address these differences. Therefore, we conclude that the shifts in adversarial robustness are due to the models learning distinct patterns resulting from their different geometries.

Figures

Figures reproduced from arXiv: 2412.01495 by the authors.

Figure 1
Figure 1. a [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. Examples of adversarial samples generated with the hyperbolic (Riemannian) FGM or the original Euclidean FGM with the four different objective functions and a perturbation size ϵ = 1.0. The arrows represent the gradient used for the perturbation. When this gradient points inward towards the origin, the hyperbolic attack seems stronger, while the original FGM appears to be more powerful when the gradient points outwa… view at source ↗
Figure 3
Figure 3. The performance of the hyperbolic MLR model when attempting to classify adversarial samples generated with the different attacks for varying values of ϵ. 6 Hyperbolic models In this section, we will take a look at the differences in adversarial robustness between Poincaré [64] and Euclidean ResNets [32]. Moreover, we will apply the proposed hyperbolic attacks to the Poincaré ResNets to see if accounting for the geom… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Accuracy on CIFAR-10 of the Poincaré and Euclidean ResNets with depths 20 or 32 when attacked using the original FGSM or the hyperbolic FGSM with increasingly large perturbation size ϵ. is fixed to a value of −0.1, so where c = 0.1. Lastly, for data augmentation we app…
Figure 5
Figure 5. Figure 5: Comparative misclassification matrix Mcomp showing for each label i, deter￾mined by the row, which of the models are easier to trick into predicting label j, determined by the column, when applying the original FGSM attack. Orange indicates that the hyperbolic models a…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

83 extracted references · 60 canonical work pages

  1. [1]

    Springer Science & Business Media (2006)

    Anderson, J.W.: Hyperbolic geometry. Springer Science & Business Media (2006)

    2006

  2. [2]

    In: ECCV

    Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query- efficient black-box adversarial attack via random search. In: ECCV. pp. 484–501. Springer (2020)

    2020

  3. [3]

    In: ICLR (2021)

    Bai, Y., Zeng, Y., Jiang, Y., Xia, S.T., Ma, X., Wang, Y.: Improving adversarial robustness via channel-wise activation suppressing. In: ICLR (2021)

    2021

  4. [4]

    arXiv preprint arXiv:2303.15919 (2023)

    Bdeir, A., Schwethelm, K., Landwehr, N.: Fully hyperbolic convolutional neural networks for computer vision. arXiv preprint arXiv:2303.15919 (2023)

    arXiv 2023

  5. [5]

    arXiv preprint arXiv:1810.00760 (2018)

    Bécigneul, G., Ganea, O.E.: Riemannian adaptive optimization methods. arXiv preprint arXiv:1810.00760 (2018)

    arXiv 2018

  6. [6]

    IEEE Trans- actions on Automatic Control58(9), 2217–2229 (2013)

    Bonnabel, S.: Stochastic gradient descent on riemannian manifolds. IEEE Trans- actions on Automatic Control58(9), 2217–2229 (2013)

    work page 2013

  7. [7]

    In: International Conference on Ma- chine Learning (2020)

    Bose, J., Smofsky, A., Liao, R., Panangaden, P., Hamilton, W.: Latent variable modelling with hyperbolic normalizing flows. In: International Conference on Ma- chine Learning (2020)

    work page 2020

  8. [8]

    IEEE Signal Processing Magazine 34(4), 18–42 (2017)

    Bronstein, M.M., Bruna, J., LeCun, Y., Szlam, A., Vandergheynst, P.: Geometric deep learning: going beyond euclidean data. IEEE Signal Processing Magazine 34(4), 18–42 (2017)

    2017

Show all 83 references
  1. [9]

    Flavors of geometry31(59-115), 2 (1997)

    Cannon, J.W., Floyd, W.J., Kenyon, R., Parry, W.R., et al.: Hyperbolic geometry. Flavors of geometry31(59-115), 2 (1997)

    1997

  2. [10]

    In: 2017 IEEE Symposium on Security and Privacy (SP)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 39–57. Ieee (2017)

    2017

  3. [11]

    In: International Conference on Learning Representations (2024)

    Cetin, E., Chamberlain, B., Bronstein, M., Hunt, J.J.: Hyperbolic deep reinforce- ment learning. In: International Conference on Learning Representations (2024)

    2024

  4. [12]

    Advances in neural information processing systems32 (2019)

    Chami, I., Ying, Z., Ré, C., Leskovec, J.: Hyperbolic graph convolutional neural networks. Advances in neural information processing systems32 (2019)

    2019

  5. [13]

    arXiv preprint arXiv:2105.14686 (2021)

    Chen, W., Han, X., Lin, Y., Zhao, H., Liu, Z., Li, P., Sun, M., Zhou, J.: Fully hyperbolic neural networks. arXiv preprint arXiv:2105.14686 (2021)

    2021 arXiv

  6. [14]

    In: The 22nd international conference on artificial intelligence and statistics

    Cho, H., DeMeo, B., Peng, J., Berger, B.: Large-margin classification in hyperbolic space. In: The 22nd international conference on artificial intelligence and statistics. pp. 1832–1840. PMLR (2019)

    2019

  7. [15]

    In: International conference on machine learning

    Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International conference on machine learning. pp. 2206–2216. PMLR (2020)

    2020

  8. [16]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Dai, J., Wu, Y., Gao, Z., Jia, Y.: A hyperbolic-to-hyperbolic graph convolutional network. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 154–163 (2021)

    2021

  9. [17]

    In: International Conference on Machine Learning

    Desai, K., Nickel, M., Rajpurohit, T., Johnson, J., Vedantam, S.R.: Hyperbolic image-text representations. In: International Conference on Machine Learning. pp. 7694–7731. PMLR (2023)

    2023

  10. [18]

    In: Computer Vision and Pattern Recognition Workshops (2020)

    Dhall, A., Makarova, A., Ganea, O., Pavllo, D., Greeff, M., Krause, A.: Hierarchical image classification using entailment cone embeddings. In: Computer Vision and Pattern Recognition Workshops (2020)

    2020

  11. [19]

    Transactions on Machine Learning Research (2024)

    Doorenbos, L., Márquez-Neila, P., Sznitman, R., Mettes, P.: Hyperbolic random forests. Transactions on Machine Learning Research (2024)

    2024

  12. [20]

    In: Computer Vision and Pattern Recognition (2022) 16 M

    Ermolov, A., Mirvakhabova, L., Khrulkov, V., Sebe, N., Oseledets, I.: Hyperbolic vision transformers: Combining improvements in metric learning. In: Computer Vision and Pattern Recognition (2022) 16 M. van Spengler et al

    2022

  13. [23]

    Interna- tional Conference on Machine Learning (2024)

    Franco, L., Mandica, P., Kallidromitis, K., Guillory, D., Li, Y.T., Galasso, F.: Hyperbolic active learning for semantic segmentation under domain shift. Interna- tional Conference on Machine Learning (2024)

    2024

  14. [24]

    In: International Conference on Learning Representations (2023)

    Franco, L., Mandica, P., Munjal, B., Galasso, F.: Hyperbolic self-paced learning for self-supervised skeleton-based action representations. In: International Conference on Learning Representations (2023)

    2023

  15. [25]

    In: International conference on machine learning

    Ganea, O., Bécigneul, G., Hofmann, T.: Hyperbolic entailment cones for learn- ing hierarchical embeddings. In: International conference on machine learning. pp. 1646–1655. PMLR (2018)

    2018

  16. [26]

    Advances in neural information processing systems31 (2018)

    Ganea, O., Bécigneul, G., Hofmann, T.: Hyperbolic neural networks. Advances in neural information processing systems31 (2018)

    2018

  17. [27]

    In: International Conference on Computer Vision (2021)

    Gao, Z., Wu, Y., Jia, Y., Harandi, M.: Curvature generation in curved spaces for few-shot learning. In: International Conference on Computer Vision (2021)

    2021

  18. [28]

    In: Advances in Neural Information Processing Systems (2021)

    Ghadimi Atigh, M., Keller-Ressel, M., Mettes, P.: Hyperbolic busemann learning with ideal prototypes. In: Advances in Neural Information Processing Systems (2021)

    2021

  19. [29]

    In: Computer Vision and Pattern Recognition (2022)

    Ghadimi Atigh, M., Schoep, J., Acar, E., van Noord, N., Mettes, P.: Hyperbolic image segmentation. In: Computer Vision and Pattern Recognition (2022)

    2022

  20. [30]

    In: ICLR (2015),http://arxiv.org/abs/1412.6572

    Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial ex- amples. In: ICLR (2015),http://arxiv.org/abs/1412.6572

    2015 arXiv

  21. [31]

    In: Computer Vision and Pattern Recognition (2022)

    Guo, Y., Wang, X., Chen, Y., Yu, S.X.: Clipped hyperbolic classifiers are super- hyperbolic classifiers. In: Computer Vision and Pattern Recognition (2022)

    2022

  22. [32]

    He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

    2016

  23. [33]

    In: Advances in Neural Information Processing Systems (2021)

    Hsu, J., Gu, J., Wu, G., Chiu, W., Yeung, S.: Capturing implicit hierarchical structure in 3d biomedical images with self-supervised hyperbolic representations. In: Advances in Neural Information Processing Systems (2021)

    2021

  24. [34]

    In: ICCV

    Hu, Y.C.T., Kung, B.H., Tan, D.S., Chen, J.C., Hua, K.L., Cheng, W.H.: Natu- ralistic physical adversarial patch for object detectors. In: ICCV. pp. 7848–7857 (October 2021)

    2021

  25. [36]

    In: CVPR

    Kahla, M., Chen, S., Just, H.A., Jia, R.: Label-only model inversion attacks via boundary repulsion. In: CVPR. pp. 15045–15053 (2022)

    2022

  26. [37]

    Advances in neural information processing systems35, 19553–19566 (2022)

    Kasarla, T., Burghouts, G., Van Spengler, M., Van Der Pol, E., Cucchiara, R., Mettes, P.: Maximum class separation as inductive bias in one matrix. Advances in neural information processing systems35, 19553–19566 (2022)

    2022

  27. [38]

    In: Computer Vision and Pattern Recognition (2020)

    Khrulkov, V., Mirvakhabova, L., Ustinova, E., Oseledets, I., Lempitsky, V.: Hy- perbolic image embeddings. In: Computer Vision and Pattern Recognition (2020)

    2020

  28. [39]

    In: CVPR

    Kim, W.J., Cho, Y., Jung, J., Yoon, S.E.: Feature separation and recalibration for adversarial robustness. In: CVPR. pp. 8183–8192 (2023) Adversarial Attacks on Hyperbolic Networks 17

    2023

  29. [40]

    Nature communications11(1), 2966 (2020)

    Klimovskaia, A., Lopez-Paz, D., Bottou, L., Nickel, M.: Poincaré maps for analyz- ing complex hierarchies in single-cell data. Nature communications11(1), 2966 (2020)

    2020

  30. [41]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Kong, F., Chen, Y., Cai, J., Modolo, D.: Hyperbolic learning with synthetic cap- tions for open-world detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 16762–16771 (2024)

    2024

  31. [42]

    In: ICLR (2017),https://arxiv.org/abs/1611.01236

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial machine learning at scale. In: ICLR (2017),https://arxiv.org/abs/1611.01236

    2017 arXiv

  32. [43]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Kwon, H., Jang, J., Kim, J., Kim, K., Sohn, K.: Improving visual recognition with hyperbolical visual hierarchy mapping. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 17364–17374 (2024)

    2024

  33. [44]

    In: International Conference on Machine Learning

    Law, M., Liao, R., Snell, J., Zemel, R.: Lorentzian distance learning for hyperbolic representations. In: International Conference on Machine Learning. pp. 3672–3681. PMLR (2019)

    2019

  34. [45]

    IEEE Signal Processing Letters29, 224–228 (2021)

    Lee, J., Sung-Bin, K., Kang, S., Oh, T.H.: Lightweight speaker recognition in poincaré spaces. IEEE Signal Processing Letters29, 224–228 (2021)

    2021

  35. [46]

    In: CVPR

    Li, Y., Li, Y., Dai, X., Guo, S., Xiao, B.: Physical-world optical adversarial attacks on 3d face recognition. In: CVPR. pp. 24699–24708 (2023).https://doi.org/10. 1109/CVPR52729.2023.02366

    2023

  36. [47]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Li, Y.L., Wu, X., Liu, X., Wang, Z., Dou, Y., Ji, Y., Zhang, J., Li, Y., Lu, X., Tan, J., et al.: From isolated islands to pangea: Unifying semantic space for human action understanding. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp....

    2024

  37. [48]

    Advances in neural information processing systems32 (2019)

    Liu, Q., Nickel, M., Kiela, D.: Hyperbolic graph neural networks. Advances in neural information processing systems32 (2019)

    2019

  38. [49]

    In: Computer Vision and Pattern Recognition (2020)

    Liu, S., Chen, J., Pan, L., Ngo, C.W., Chua, T.S., Jiang, Y.G.: Hyperbolic visual embedding learning for zero-shot recognition. In: Computer Vision and Pattern Recognition (2020)

    2020

  39. [50]

    Advances in neural information processing systems30 (2017)

    Liu, W., Zhang, Y.M., Li, X., Yu, Z., Dai, B., Zhao, T., Song, L.: Deep hyper- spherical learning. Advances in neural information processing systems30 (2017)

    2017

  40. [51]

    In: Computer Vision and Pattern Recognition (2020)

    Long, T., Mettes, P., Shen, H.T., Snoek, C.G.M.: Searching for actions on the hyperbole. In: Computer Vision and Pattern Recognition (2020)

    2020

  41. [52]

    In: ICLR (2018),https://arxiv.org/abs/ 1706.06083

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: ICLR (2018),https://arxiv.org/abs/ 1706.06083

    2018 arXiv

  42. [53]

    In: Advances in Neural Information Processing Systems

    Mathieu, E., Le Lan, C., Maddison, C.J., Tomioka, R., Teh, Y.W.: Continuous hierarchical representations with poincaré variational auto-encoders. In: Advances in Neural Information Processing Systems. vol. 32 (2019)

    2019

  43. [54]

    International Journal of Computer Vision pp

    Mettes, P., Ghadimi Atigh, M., Keller-Ressel, M., Gu, J., Yeung, S.: Hyperbolic deep learning in computer vision: A survey. International Journal of Computer Vision pp. 1–25 (2024)

    2024

  44. [55]

    Morris, J.X., Lifland, E., Yoo, J.Y., Grigsby, J., Jin, D., Qi, Y.: Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp (2020), https://arxiv.org/abs/2005.05909

    2020 arXiv

  45. [56]

    In: International Conference on Machine Learning

    Nagano,Y.,Yamaguchi,S.,Fujita,Y.,Koyama,M.:Awrappednormaldistribution on hyperbolic space for gradient-based learning. In: International Conference on Machine Learning. pp. 4693–4702. PMLR (2019)

    2019

  46. [57]

    Advances in neural information processing systems30 (2017)

    Nickel, M., Kiela, D.: Poincaré embeddings for learning hierarchical representa- tions. Advances in neural information processing systems30 (2017)

    2017

  47. [58]

    Advances in neural information processing systems31 (2018) 18 M

    Pang, T., Du, C., Dong, Y., Zhu, J.: Towards robust detection of adversarial ex- amples. Advances in neural information processing systems31 (2018) 18 M. van Spengler et al

    2018

  48. [59]

    In: 2016 IEEE Symposium on Security and Privacy (SP)

    Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE Symposium on Security and Privacy (SP). pp. 582–597. IEEE (2016)

    2016

  49. [60]

    IEEE Transactions on pattern analysis and machine intelligence 44(12), 10023–10044 (2021)

    Peng, W., Varanka, T., Mostafa, A., Shi, H., Zhao, G.: Hyperbolic deep neural net- works: A survey. IEEE Transactions on pattern analysis and machine intelligence 44(12), 10023–10044 (2021)

    2021

  50. [61]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Ramasinghe, S., Shevchenko, V., Avraham, G., Thalaiyasingam, A.: Accept the modality gap: An exploration in the hyperbolic space. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 27263– 27272 (2024)

    2024

  51. [62]

    In: International symposium on graph drawing

    Sarkar, R.: Low distortion delaunay embedding of trees in hyperbolic plane. In: International symposium on graph drawing. pp. 355–366. Springer (2011)

    2011

  52. [63]

    arXiv preprint arXiv:2006.08210 (2020)

    Shimizu, R., Mukuta, Y., Harada, T.: Hyperbolic neural networks++. arXiv preprint arXiv:2006.08210 (2020)

    2020 arXiv

  53. [64]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    van Spengler, M., Berkhout, E., Mettes, P.: Poincaré resnet. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 5419–5428 (2023)

    2023

  54. [65]

    In: Proceedings of the Web Conference

    Sun, J., Cheng, Z., Zuberi, S., Pérez, F., Volkovs, M.: Hgcf: Hyperbolic graph con- volution networks for collaborative filtering. In: Proceedings of the Web Conference

  55. [66]

    In: Com- puter Vision and Pattern Recognition (2021)

    Surís, D., Liu, R., Vondrick, C.: Learning the predictability of the future. In: Com- puter Vision and Pattern Recognition (2021)

    2021

  56. [67]

    In: ICLR (2014),http:// arxiv.org/abs/1312.6199

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks. In: ICLR (2014),http:// arxiv.org/abs/1312.6199

    2014 arXiv

  57. [68]

    arXiv preprint arXiv:1810.06546 (2018)

    Tifrea, A., Bécigneul, G., Ganea, O.E.: Poincar\’e glove: Hyperbolic word embed- dings. arXiv preprint arXiv:1810.06546 (2018)

    2018 arXiv

  58. [69]

    Springer Nature (2022)

    Ungar, A.: A gyrovector space approach to hyperbolic geometry. Springer Nature (2022)

    2022

  59. [71]

    In: Proceedings of the 30th ACM international conference on information & knowledge management

    Wang, L., Hu, F., Wu, S., Wang, L.: Fully hyperbolic graph convolution network for recommendation. In: Proceedings of the 30th ACM international conference on information & knowledge management. pp. 3483–3487 (2021)

    2021

  60. [72]

    Information Sciences630, 190–205 (2023)

    Wang, Y., Wang, H., Lu, W., Yan, Y.: Hygge: hyperbolic graph attention network for reasoning over knowledge graphs. Information Sciences630, 190–205 (2023)

    2023

  61. [73]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Weber, S., Zöngür, B., Araslanov, N., Cremers, D.: Flattening the parent bias: Hierarchical semantic segmentation in the poincaré ball. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 28223– 28232 (2024)

    2024

  62. [74]

    In: Computer Vision and Pattern Recognition

    Weng, Z., Ogut, M.G., Limonchik, S., Yeung, S.: Unsupervised discovery of the long-tail in instance segmentation using hierarchical self-supervision. In: Computer Vision and Pattern Recognition. pp. 2603–2612 (2021)

    2021

  63. [75]

    In: CVPR

    Williams, P.N., Li, K.: Black-box sparse adversarial attack via multi-objective op- timisation. In: CVPR. pp. 12291–12301 (2023)

    2023

  64. [76]

    In: ICLR (2020)

    Wong, E., Rice, L., Kolter, J.Z.: Fast is better than free: Revisiting adversarial training. In: ICLR (2020)

    2020

  65. [77]

    In: CVPR

    Xie, C., Wu, Y., Maaten, L.v.d., Yuille, A.L., He, K.: Feature denoising for im- proving adversarial robustness. In: CVPR. pp. 501–509 (2019) Adversarial Attacks on Hyperbolic Networks 19

    2019

  66. [78]

    In: 25th Annual Network and Distributed System Secu- rity Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018

    Xu, W., Evans, D., Qi, Y.: Feature squeezing: Detecting adversarial examples in deep neural networks. In: 25th Annual Network and Distributed System Secu- rity Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018. The Internet Society (2018), https://www.ndss...

    2018

  67. [79]

    16247–16254 (2024)

    Xue, Y., Dai, J., Lu, Z., Wu, Y., Jia, Y.: Residual hyperbolic graph convolution networks.In:ProceedingsoftheAAAIConferenceonArtificialIntelligence.vol.38, pp. 16247–16254 (2024)

    2024

  68. [80]

    In: International Conference on Machine Learning

    Yan, H., Zhang, J., Niu, G., Feng, J., Tan, V., Sugiyama, M.: Cifs: Improving adversarial robustness of cnns via channel-wise importance-based feature selection. In: International Conference on Machine Learning. pp. 11693–11703. PMLR (2021)

    2021

  69. [81]

    In: CVPR

    Yang, X., Liu, C., Xu, L., Wang, Y., Dong, Y., Chen, N., Su, H., Zhu, J.: Towards effective adversarial textured 3d meshes on physical face recognition. In: CVPR. pp. 4119–4128 (2023)

    2023

  70. [82]

    IEEE Transactions on Knowledge and Data Engineering (2023)

    Yang, Y., Wu, L., Zhang, K., Hong, R., Zhou, H., Zhang, Z., Zhou, J., Wang, M.: Hyperbolic graph learning for social recommendation. IEEE Transactions on Knowledge and Data Engineering (2023)

    2023

  71. [84]

    IEEE Transactions on Big Data8(6), 1690–1701 (2021)

    Zhang, Y., Wang, X., Shi, C., Jiang, X., Ye, Y.: Hyperbolic graph attention net- work. IEEE Transactions on Big Data8(6), 1690–1701 (2021)

    2021

  72. [85]

    In: Proceedings of the web conference 2021

    Zhang, Y., Wang, X., Shi, C., Liu, N., Song, G.: Lorentzian graph convolutional networks. In: Proceedings of the web conference 2021. pp. 1249–1261 (2021)

    2021

  73. [86]

    In: CVPR

    Zhong, Y., Liu, X., Zhai, D., Jiang, J., Ji, X.: Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon. In: CVPR. pp. 15324–15333 (2022).https://doi.org/10.1109/CVPR52688.2022.01491

    2022

  74. [87]

    In: Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining

    Zhou, M., Yang, M., Xiong, B., Xiong, H., King, I.: Hyperbolic graph neural net- works: A tutorial on methods and applications. In: Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. pp. 5843–5844 (2023)

    2023

  75. [88]

    arXiv preprint arXiv:2010.16143 (2020)

    Zhu, Y., Zhou, D., Xiao, J., Jiang, X., Chen, X., Liu, Q.: Hypertext: Endowing fasttext with hyperbolic geometry. arXiv preprint arXiv:2010.16143 (2020)

    2020 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.