Pith. sign in

REVIEW 3 major objections 5 minor 45 references

NODE-AdvGAN: Improving the transferability and perceptual similarity of adversarial examples by dynamic-system-driven adversarial generative model

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that replacing the AdvGAN generator with a Neural ODE and tuning training-time noise yields adversarial images that are stronger and less visible.

desk verdict Competent empirical extension of AdvGAN with a NODE generator and train-time epsilon tuning; the improvement direction is plausible, but the NODE-specific claim is untested and the transfer gains are partly fitted to the test architectures. read the letter →

arxiv 2412.03539 v2 pith:426XSYPV submitted 2024-12-04 cs.LG cs.AI

Xinheng Xie , Yue Wu , Cuiyu He This is my paper · ORCID
classification cs.LGcs.AI
keywords adversarialexamplesneuralordinarydifferentialequationsgenerativenetworksattacktransferabilityperceptualsimilaritywhite-boxattacksblack-boxperturbationbudgettuning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that an adversarial image is best understood as the endpoint of a continuous evolution, not a one-shot perturbation or a hand-crafted iterative loop. It substitutes a Neural Ordinary Differential Equation (NODE) for the generator of AdvGAN, learning a vector field that gradually turns a clean image into an adversarial one. On FMNIST and CIFAR-10, this NODE-AdvGAN is reported to achieve higher attack success rates than four gradient-based methods and the original AdvGAN while maintaining better or comparable image quality measured by PSNR and SSIM. The companion training strategy, NODE-AdvGAN-T, tunes the perturbation budget used during training (about 10/255) separately from the fixed test budget (15/255), which the paper reports raises transfer attack success substantially on unseen architectures. The stated motivation is that stronger, less visible adversarial examples could be used to train more robust classifiers.

What carries the argument

The central object is a NODE generator: a learnable vector field $F$ that maps the current image state and time to a perturbation direction, integrated by Euler steps to produce $x_{\mathrm{adv}}$. The image dimensions stay fixed throughout, and the vector field uses dilated 3x3 convolutions with a receptive field of 29 on 32x32 inputs. The second mechanism is budget separation: during training, the generator output is clipped to $[-\epsilon_{\mathrm{train}}, \epsilon_{\mathrm{train}}]$, while at test time it is clipped to the fixed budget $[-\epsilon, \epsilon]$, and $\epsilon_{\mathrm{train}}$ is selected by transfer attack success on a surrogate (VGG16) rather than set equal to $\epsilon$. With Euler integration and $N=5$, the generator is mathematically a five-step shared-weight residual network; the paper argues that the continuous-time interpretation supplies smoothness, learned update rules, and trajectory-based generalization.

What would settle it

Train a conventional CNN generator (for example, a ResNet-style or plain convolutional generator) with the same parameter count and loss as NODE-AdvGAN on CIFAR-10 with $\epsilon = 15/255$, and compare white-box and transfer attack success plus PSNR and SSIM against NODE-AdvGAN and NODE-AdvGAN-T; if the CNN matches or exceeds those numbers, the dynamic-system explanation is not needed.

Watch

Extended reading notes

Core claim

The paper claims that modelling adversarial example generation as a continuous-time dynamical system makes the trade-off between attack strength and imperceptibility come out better than either hand-crafted gradient updates or a static GAN generator. In NODE-AdvGAN the perturbation is produced by a Neural Ordinary Differential Equation, $\dot{v}(t) = F(t, v, y, \Theta_{\text{NODE}})$ with $v(0)=x$ and $v(T)=x_{\text{adv}}$, where the vector field $F$ is a six-layer dilated convolutional network trained with the AdvGAN losses (Carlini-Wagner attack loss, least-squares GAN loss, and an $L_2$ hinge penalty). Integrated with the Euler method at $T=0.05$ and $N=5$ steps, this generator is reported to beat FGSM, I-FGSM, MI-FGSM, NI-FGSM, and the original AdvGAN in white-box attack success on FMNIST and CIFAR-10 while giving higher PSNR and SSIM. In NODE-AdvGAN-T, the clipping budget used in training, $\epsilon_{\text{train}}$, is tuned separately from the fixed test budget $\epsilon$; choosing $\epsilon_{\text{train}} \approx 10/255$ with $\epsilon = 15/255$ yields transfer-attack gains of 9.43--29.89 percentage points over NODE-AdvGAN on FMNIST and similar improvements on CIFAR-10, and the same tuning also improves the original AdvGAN.

Load-bearing premise

The load-bearing premise is that the continuous-time ODE formulation itself produces the reported gains; the paper does not compare against an ordinary convolutional generator with the same number of parameters, so if such a generator performs equally well, the central claim loses its support.

Editorial extensions

If this is right

  • White-box attacks can be generated in a single forward pass (about 1.08 seconds for 10,000 CIFAR-10 images) at success rates near or above 99% on FMNIST and above 96% on CIFAR-10, while iterative gradient attacks take far longer and achieve lower success.
  • Training-time perturbation budget is a usable dial for transferability: setting $\epsilon_{\mathrm{train}}$ below the test budget $\epsilon$ improves black-box attack success on architectures not seen during training, and the same dial also improves the original AdvGAN.
  • Targeted attacks, which are very hard for gradient methods under the paper's settings (roughly 14--22% success on CIFAR-10), can be produced at about 96--97% success with better PSNR than AdvGAN.
  • Because adversarial examples can be generated quickly at inference time, they are practical as an augmentation source for adversarial training, which the paper identifies as future work.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The continuous-time explanation is not yet isolated: with Euler integration and $N=5$, the generator is a five-step shared-weight residual network, so the comparison that would settle the mechanism is a conventional CNN generator with matched parameter count, depth, and loss trained under identical budgets.
  • The $\epsilon_{\mathrm{train}}$ tuning rule resembles a curriculum on perturbation size; an untested implication is that annealing $\epsilon_{\mathrm{train}}$ during training, or sampling it per batch, could improve transferability further or remove the need for a separate tuning run.
  • If trajectory smoothness is the active transferability driver, then randomizing integration time $T$ or step count $N$ at training time may act as a data augmentation over perturbation trajectories and could be tested directly against the fixed $T=0.05$, $N=5$ setting.
  • The paper's use of a single surrogate (VGG16) to select $\epsilon_{\mathrm{train}}$ suggests a cheaper protocol: use one small model to tune the budget, then apply the same budget across diverse target models; an obvious extension is to test whether the chosen $\epsilon_{\mathrm{train}}$ transfers across datasets and image resolutions.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes NODE-AdvGAN, a GAN-based adversarial example generator whose generator is a Neural Ordinary Differential Equation (NODE) with an Euler integrator, and NODE-AdvGAN-T, a variant that tunes the training-time perturbation clip epsilon_train to improve transferability. The generator models the perturbation process as v_dot(t) = F(t, v, y, Theta_NODE) with v(0)=x and v(T)=x_adv. The method is evaluated on Fashion-MNIST and CIFAR-10 against FGSM, I-FGSM, MI-FGSM, NI-FGSM, and the original AdvGAN, reporting attack success rate (ASR), PSNR, and SSIM for white-box, transfer, untargeted, and targeted attacks. The central empirical claims are that NODE-AdvGAN matches or exceeds AdvGAN in ASR and perceptual similarity, and that NODE-AdvGAN-T substantially improves transfer ASR.

Significance. If the central claims hold, the paper would offer a useful empirical contribution: a generative adversarial attack with strong transferability and better perceptual metrics, with public code and a clearly described architecture in Appendix B. The loss-weight ablation (Figure 3), the N-step ablation (Figure 4), and the epsilon_train ablation (Figure 5) are valuable and the paper gives a concrete, reproducible experiment setup. The large transfer-ASR gains of NODE-AdvGAN-T over NODE-AdvGAN, e.g., 32.46% to 45.56% on FMNIST for VGG16-trained attacks in Table 3, are substantial if they are robust. However, the paper's conceptual claim that the gains come from continuous-time NODE dynamics is not established, because with Euler integration and N=5 the generator is mathematically a five-step shared-weight residual network and no matched-capacity non-ODE generator is compared. The transferability gains are also partly confounded by selecting epsilon_train on the same target architectures used in the final transfer tables.

major comments (3)
  1. [§3.2, Eq. (3)] The paper attributes the improved performance to the continuous-time NODE formulation, but with Euler integration, N=5 steps, and T=0.05, the generator is exactly a five-step shared-weight residual map: x_{n+1} = x_n + (T/N)F(x_n, t_n). Section 4.2 compares only to the original AdvGAN generator, which differs in architecture, depth, and parameter count. No ablation holds capacity or architecture constant. To support the central 'dynamic-system' claim, the authors should add a matched-capacity conventional CNN generator (e.g., a five-block residual CNN with the same channels and parameter count, trained with identical losses and epsilon_train) and show that NODE-AdvGAN outperforms it. Without such an ablation, the observed gains could come simply from a larger or differently structured generator rather than from the ODE structure.
  2. [§4.2, Fig. 5 and Tables 3, 5, 8] The transfer-ASR improvements of NODE-AdvGAN-T are partly a fitted hyperparameter: epsilon_train = 10/255 is selected by measuring transfer ASR on VGG19, ResNet18, and DenseNet169 in Figure 5, and the main transfer tables (Tables 3, 5, and 8) evaluate on those same architectures. The manuscript even notes that VGG19 transfer behavior resembles a white-box attack because of architectural similarity. To make the transferability claim predictive rather than circular, the authors should either select epsilon_train on VGG16 only and evaluate on architectures not used during selection, or report results for a genuinely held-out set of target models and datasets. A statement of how much of the transfer gain remains when epsilon_train is fixed without access to the target architectures would directly address this concern.
  3. [§4.3, Tables 2–5 and 7–8] All reported ASR, PSNR, and SSIM values are single runs with no standard deviations, confidence intervals, or multiple seeds. This is problematic because several comparative claims rest on small margins; for example, in Table 2 the FMNIST white-box ASR for NODE-AdvGAN vs AdvGAN is 99.10% vs 98.66%, and in Table 4 the CIFAR-10 white-box ASR for NODE-AdvGAN vs AdvGAN on VGG16 is 97.54% vs 97.06%. GAN training is stochastic and the ablation plots in Figures 3–5 show sensitivity to hyperparameters. The authors should repeat the main experiments with at least three seeds and report mean ± standard deviation (or an equivalent measure), and should avoid claims of 'consistently' best performance without such evidence.
minor comments (5)
  1. [§4.1] The sentence 'Since our approach differs from the original AdvGAN only in the generator component' is not accurate: the two methods also differ in loss weights, epsilon_train clipping, training schedule, and generator depth. Please qualify this statement.
  2. [Throughout] The name 'Ni-FGSM' appears in several tables and in the text, while the standard name NI-FGSM is used elsewhere; please make the abbreviation consistent.
  3. [Reference [43]] Reference [43] cites the piqa package but describes it as 'Physical interaction: Question answering'; this description is incorrect. Please cite the actual Python image-quality-assessment package with its correct name and version.
  4. [Figure 4] Figure 4 reports ASR and PSNR versus N but does not show any measure of variability; please add error bars or at least note that the values are from a single run.
  5. [§3.3, Algorithm 1] Algorithm 1 uses the classifier f in training but there is no explicit loss term referencing f in the pseudocode; please clarify that the CW loss inside LCW(G) uses the classifier logits, or add the loss formula to the algorithm block.

Circularity Check

1 steps flagged · score 6.0 of 10

Partial circularity: NODE-AdvGAN-T's transferability gains are obtained by tuning epsilon_train on the same target architectures used in the main transfer tables, so the headline transfer claim is largely the selection criterion restated; the white-box NODE-AdvGAN results are non-circular.

  1. fitted input called prediction [Section 3.3/Algorithm 1; Section 4.2, Figure 5; Tables 3, 5, 8]
    "we conduct ablation experiments on the noise parameter to demonstrate the effectiveness of our proposed training strategy and identify an optimal value for maximizing transferability in our NODE-AdvGAN-T method. ... Transferability results are performed on VGG19, ResNet18, and DenseNet169. ... At approximately ϵtrain = 10/255, both models achieve the highest ASR ... we standardized ϵtrain = 10/255 across all following NODE-AdvGAN-T implementations."

    NODE-AdvGAN-T is defined as the model using the best ϵtrain after tuning. Section 4.2 tunes ϵtrain by maximizing transfer ASR on VGG19, ResNet18, and DenseNet169, adopting 10/255 because it yields the highest transfer ASR; the main transfer tables then evaluate NODE-AdvGAN-T on the same three architectures and conclude it is best. The transferability claim is therefore the selection criterion restated: the hyperparameter was fitted to the exact metric and target models used for evaluation, with no separate holdout split or unseen architectures described. The result is partly a fitted-input effect rather than an independent prediction. The white-box and NODE-AdvGAN (non-T) comparisons are independent empirical measurements and are not circular.

full rationale

The paper is not circular in its central white-box comparison: NODE-AdvGAN's generator is an empirical model compared against AdvGAN and gradient attacks, and the reported ASR/PSNR/SSIM values are measurements, not identities. No load-bearing self-citation or imported uniqueness theorem appears. The one genuine circularity burden is the transferability claim for NODE-AdvGAN-T: epsilon_train is tuned by maximizing transfer ASR on VGG19, ResNet18, and DenseNet169, and the same architectures are used in the main transfer tables to declare NODE-AdvGAN-T best. Thus the specific 'training strategy improves transferability' conclusion is substantially the selection criterion restated, and it is not presented with a separate holdout architecture set or a fixed-epsilon control that isolates an independent predictive gain. The Euler/N=5 equivalently-discrete residual network point and absence of a matched-capacity non-ODE generator are real attribution risks, but they are empirical-control problems, not circular reductions, so they do not by themselves raise the circularity score. Net: partial circularity in the transferability claim; white-box results remain independent evidence.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

All central numbers are either standard hyperparameters or values tuned on the same benchmark used for evaluation. The NODE formulation itself relies on several unverified modeling assumptions, including the adequacy of Euler integration at five steps and the transferability of a single tuned epsilon_train. No new physical entities are introduced.

free parameters (7)
  • epsilon_train = 10/255
    Swept in Section 4.2 from 1/255 to 15/255 on transfer ASR; standardized to 10/255 for NODE-AdvGAN-T. This is a fitted hyperparameter, not a prediction.
  • N (Euler steps) = 5
    Set by ablation in Section 4.2, Figure 4; with Euler integration it controls the effective depth of the generator and is a capacity choice.
  • alpha (LSGAN loss weight) = 0.01
    Selected via grid search over {1, 0.1, 0.01, 0.001, 0.0001} in Section 4.2, balancing ASR and SSIM on VGG16/CIFAR-10.
  • beta (hinge loss weight) = 0.01
    Selected in the same grid search as alpha in Section 4.2.
  • T (ODE integration time) = 0.05
    Manually specified in Section 4.1; controls step size and total perturbation magnitude for fixed N.
  • kappa (CW confidence) = 0
    Set in Section 4.1; standard in the AdvGAN experimental configuration.
  • c (hinge threshold) = 0.1
    Set in Section 4.1; controls the point at which the L2 perturbation norm is penalized.
assumptions (6)
  • standard math Picard-Lindelof existence and uniqueness for ODE initial value problems
    Invoked in Section 2.2 to assert the NODE has a unique solution when the vector field is Lipschitz; the paper does not verify the Lipschitz constant numerically.
  • domain assumption The learnable vector field is Lipschitz continuous
    Section 2.2 says finite weights with ReLU/Tanh activations ensure Lipschitz continuity; this is plausible but not checked for the trained network.
  • ad hoc to paper Euler integration with N=5 and T=0.05 adequately approximates the continuous dynamics
    Used in Sections 3.2 and 4.2; no convergence or discretization-error analysis, and the resulting model is effectively a shared-weight residual network.
  • ad hoc to paper Generators trained under small epsilon_train retain efficacy when perturbations are scaled to larger epsilon at test time
    Used as motivation in Section 3.3 and evaluated in Section 4.2; this is an empirical assumption, not a derived property.
  • ad hoc to paper VGG16-trained epsilon_train selection generalizes to other architectures
    Section 4.2 standardizes epsilon_train=10/255 based on one training model and assumes it transfers; the paper acknowledges 'it may not be the absolute best in all cases'.
  • domain assumption The chosen datasets and classifiers are representative for measuring transferability
    Experiments use FMNIST/CIFAR-10 and VGG/ResNet/DenseNet variants; no ImageNet-scale or modern-architecture evidence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of NODE-AdvGAN: Improving the transferability and perceptual similarity of adversarial examples by dynamic-system-driven adversarial generative model." pith.science (2026). https://pith.science/paper/426XSYPV

@misc{pith2026241203539,
  author       = {Pith},
  title        = {Pith review of: NODE-AdvGAN: Improving the transferability and perceptual similarity of adversarial examples by dynamic-system-driven adversarial generative model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/426XSYPV}},
  note         = {Machine review of arXiv:2412.03539}
}
read the original abstract

Understanding adversarial examples is crucial for improving model robustness, as they introduce imperceptible perturbations to deceive models. Effective adversarial examples, therefore, offer the potential to train more robust models by eliminating model singularities. We propose NODE-AdvGAN, a novel approach that treats adversarial generation as a continuous process and employs a Neural Ordinary Differential Equation (NODE) to simulate generator dynamics. By mimicking the iterative nature of traditional gradient-based methods, NODE-AdvGAN generates smoother and more precise perturbations that preserve high perceptual similarity when added to benign images. We also propose a new training strategy, NODE-AdvGAN-T, which enhances transferability in black-box attacks by tuning the noise parameters during training. Experiments demonstrate that NODE-AdvGAN and NODE-AdvGAN-T generate more effective adversarial examples that achieve higher attack success rates while preserving better perceptual quality than baseline models.

Figures

Figures reproduced from arXiv: 2412.03539 by the authors.

Figure 1
Figure 1. An example of a benign image (left) and its adversarial counterpart (right). [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Architecture of the NODE-AdvGAN. logit value for the ith class. Given an instance x, the objective of an adversary is to create adversarial images xadv ∈ R C×H×W . Define the perturbation vector as δ(x) = xadv − x, where xadv is the adversarial image and x is the original input. The parameter ϵ represents the maximum allowable strength of the noise, ensuring ∥δ(x)∥∞ ≤ ϵ. This bounds each component of the perturbatio… view at source ↗
Figure 3
Figure 3. Heatmap of ASR, SSIM, and their average for di [PITH_FULL_IMAGE:figures/full_fig_p017_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: ASR (Blue) and PSNR (Red) for various N values in NODE-AdvGAN model compared to baseline AdvGAN. The transfer ASR results and PSNR values of adversarial examples for various ϵtrain settings are presented in the left and right columns, respectively, of [PITH_FULL_IMAGE…
Figure 5
Figure 5. Figure 5: Transfer ASR(left) and PSNR(right) for AdvGAN(top) and NODE-AdvGAN-T(bottom) models [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: Adversarial samples generated from targeted attacks by NODE-AdvGAN (left) and NODE [PITH_FULL_IMAGE:figures/full_fig_p025_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 14 canonical work pages

  1. [1]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv:1706.06083 (2017)

    arXiv 2017

  2. [2]

    X. Yuan, P. He, Q. Zhu, X. Li, Adversarial examples: Attacks and defenses for deep learning, IEEE transactions on neural networks and learning systems 30 (9) (2019) 2805–2824. doi:10.1109/TNNLS.2018.2886017

    arXiv 2019

  3. [3]

    Biggio, F

    B. Biggio, F. Roli, Wild patterns: Ten years after the rise of adversarial machine learning, in: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 2154–2156.doi:10.1016/j.patcog. 2018.07.023

    doi:10.1016/j.patcog 2018

  4. [4]

    Akhtar, A

    N. Akhtar, A. Mian, Threat of adversarial attacks on deep learning in computer vision: A survey, Ieee Access 6 (2018) 14410–14430. doi:10.1109/ACCESS. 2018.2807385

    arXiv 2018

  5. [5]

    Y . Dong, H. Su, B. Wu, Z. Li, W. Liu, T. Zhang, J. Zhu, E fficient decision- based black-box adversarial attacks on face recognition, in: Proceedings of the 28 IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 7714–7722. doi:10.1109/CVPR.2019.00790

    arXiv 2019

  6. [6]

    Nguyen, S

    D.-L. Nguyen, S. S. Arora, Y . Wu, H. Yang, Adversarial light projection at- tacks on face recognition systems: A feasibility study, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2020, pp. 814–815

    work page 2020

  7. [7]

    Xiong, H

    Z. Xiong, H. Xu, W. Li, Z. Cai, Multi-source adversarial sample attack on au- tonomous vehicles, IEEE Transactions on Vehicular Technology 70 (3) (2021) 2822–2835. doi:10.1109/TVT.2021.3061065

    arXiv 2021

  8. [8]

    Abdel-Basset, A

    M. Abdel-Basset, A. Gamal, N. Moustafa, A. Abdel-Monem, N. El-Saber, A security-by-design decision-making model for risk management in autonomous vehicles, IEEE Access 9 (2021) 107657–107679.doi:10.1109/ACCESS.2021. 3098675

    doi:10.1109/access.2021 2021

Show all 45 references
  1. [9]

    Szegedy, V

    C. Szegedy, V . Vanhoucke, S. Io ffe, J. Shlens, Z. Wojna, Rethinking the in- ception architecture for computer vision, in: Proceedings of the IEEE confer- ence on computer vision and pattern recognition, 2016, pp. 2818–2826. doi: 10.1109/CVPR.2016.308

    2016 doi

  2. [10]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial ex- amples, arXiv preprint arXiv:1412.6572 (2014). doi:10.48550/arXiv.1412. 6572

    2014 doi arXiv

  3. [11]

    Kurakin, I

    A. Kurakin, I. J. Goodfellow, S. Bengio, Adversarial examples in the physical world, in: Artificial intelligence safety and security, Chapman and Hall /CRC, 2018, pp. 99–112

    2018

  4. [12]

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, J. Li, Boosting adversarial attacks with momentum, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 9185–9193. doi:10.1109/CVPR. 2018.00957. 29

    2018

  5. [13]

    C. Xiao, B. Li, J.-Y . Zhu, W. He, M. Liu, D. Song, Generating adversarial ex- amples with adversarial networks, in: Proceedings of the 27th International Joint Conference on Artificial Intelligence, 2018, pp. 3905–3911. doi:10.24963/ ijcai.2018/543

    2018

  6. [14]

    Jandial, P

    S. Jandial, P. Mangla, S. Varshney, V . Balasubramanian, Advgan++: Harnessing latent layers for adversary generation, in: Proceedings of the IEEE /CVF Interna- tional Conference on Computer Vision Workshops, 2019, pp. 0–0

    2019

  7. [15]

    B. Wang, X. Fan, Q. Jing, H. Tan, J. Bi, Advcgan: An elastic and covert adversar- ial examples generating framework, in: 2021 International Joint Conference on Neural Networks (IJCNN), 2021, pp. 1–8. doi:10.1109/IJCNN52387.2021. 9533901

    2021

  8. [16]

    P. Xie, S. Shi, W. Xie, R. Qin, J. Hai, L. Wang, J. Chen, G. Hu, B. Yan, Improv- ing the transferability of adversarial examples by using generative adversarial networks and data enhancement, in: Journal of Physics: Conference Series, V ol. 2203, IOP Publishing, 2022, p. 01202...

    2022 doi

  9. [17]

    X. Dai, K. Liang, B. Xiao, Advdiff: Generating unrestricted adversarial examples using diffusion models, arXiv preprint arXiv:2307.12499 (2023).doi:10.1007/ 978-3-031-72952-2_6

    2023 arXiv

  10. [18]

    Z. Zhu, H. Chen, X. Wang, J. Zhang, Z. Jin, K.-K. R. Choo, J. Shen, D. Yuan, Ge-advgan: Improving the transferability of adversarial samples by gradient editing-based adversarial generative model, in: Proceedings of the 2024 SIAM International Conference on Data Mining (SDM), ...

    2024 doi

  11. [19]

    H. Xue, A. Araujo, B. Hu, Y . Chen, Di ffusion-based adversarial sample genera- tion for improved stealthiness and controllability, Advances in Neural Informa- tion Processing Systems 36 (2024). doi:10.48550/arXiv.2305.16494. 30

    2024 doi arXiv

  12. [20]

    X. Li, H. Guo, X. Deng, W. Jiang, Cgn: Class gradient network for the con- struction of adversarial samples, Information Sciences 654 (2024) 119855. doi: 10.1016/j.ins.2023.119855

    2024

  13. [21]

    R. T. Chen, Y . Rubanova, J. Bettencourt, D. K. Duvenaud, Neural ordinary differ- ential equations, Advances in neural information processing systems 31 (2018). doi:10.48550/arXiv.1806.07366

    2018 doi arXiv

  14. [22]

    Q. Kang, Y . Song, Q. Ding, W. P. Tay, Stable neural ode with lyapunov-stable equilibrium points for defending against adversarial attacks, in: M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, J. W. Vaughan (Eds.), Advances in Neural Information Processing Systems, V ol. 34,...

    2021

  15. [23]

    X. Li, Z. Xin, W. Liu, Defending against adversarial attacks via neural dynamic system, in: S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, A. Oh (Eds.), Advances in Neural Information Processing Systems, V ol. 35, Curran Associates, Inc., 2022, pp. 6372–6383. URL http...

    2022

  16. [24]

    Szegedy, Intriguing properties of neural networks, arXiv preprint arXiv:1312.6199 (2013)

    C. Szegedy, Intriguing properties of neural networks, arXiv preprint arXiv:1312.6199 (2013). doi:10.48550/arXiv.1312.6199

    2013 doi arXiv

  17. [25]

    Carlini, D

    N. Carlini, D. Wagner, Towards evaluating the robustness of neural networks, in: 2017 ieee symposium on security and privacy (sp), Ieee, 2017, pp. 39–57. doi:10.1109/SP.2017.49

    2017 doi

  18. [26]

    Papernot, P

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, A. Swami, Practical black-box attacks against machine learning, in: Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017, pp. 506–519. doi:10.1145/3052973.3053009. 31

    2017

  19. [27]

    Eykholt, I

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, D. Song, Robust physical-world attacks on deep learning visual classi- fication, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1625–1634

    2018

  20. [28]

    Goodfellow, J

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, Y . Bengio, Generative adversarial networks, Communications of the ACM 63 (11) (2020) 139–144. doi:10.1145/3422622

    2020 doi

  21. [29]

    Ledig, L

    C. Ledig, L. Theis, F. Husz´ar, J. Caballero, A. Cunningham, A. Acosta, A. Aitken, A. Tejani, J. Totz, Z. Wang, et al., Photo-realistic single image super-resolution using a generative adversarial network, in: Proceedings of the IEEE confer- ence on computer vision and pattern...

    2017 doi

  22. [30]

    Z. Li, B. Xia, J. Zhang, C. Wang, B. Li, A comprehensive survey on data-efficient gans in image generation, arXiv preprint arXiv:2204.08329 (2022). doi:10. 48550/arXiv.2204.08329

    2022 doi arXiv

  23. [31]

    Karras, T

    T. Karras, T. Aila, S. Laine, J. Lehtinen, Progressive growing of gans for improved quality, stability, and variation. arxiv 2017, arXiv preprint arXiv:1710.10196 (2018) 1–26doi:10.48550/arXiv.1710.10196

    2018 doi arXiv

  24. [32]

    Isola, J.-Y

    P. Isola, J.-Y . Zhu, T. Zhou, A. A. Efros, Image-to-image translation with condi- tional adversarial networks, in: Proceedings of the IEEE conference on com- puter vision and pattern recognition, 2017, pp. 1125–1134. doi:10.1109/ WIECON-ECE60392.2023.10456447

    2017

  25. [33]

    J.-Y . Zhu, T. Park, P. Isola, A. A. Efros, Unpaired image-to-image translation using cycle-consistent adversarial networks, in: Proceedings of the IEEE inter- national conference on computer vision, 2017, pp. 2223–2232. doi:10.1109/ ICCV.2017.244

    2017

  26. [34]

    X. Mao, Q. Li, H. Xie, R. Y . Lau, Z. Wang, S. P. Smolley, Least squares generative 32 adversarial networks, in: Proceedings of the IEEE international conference on computer vision, 2017, pp. 2794–2802. doi:10.1109/ICCV.2017.304

    2017 doi

  27. [35]

    H. Xiao, K. Rasul, R. V ollgraf, Fashion-mnist: a novel image dataset for bench- marking machine learning algorithms, arXiv preprint arXiv:1708.07747 (2017). doi:10.48550/arXiv.1708.07747

    2017 doi arXiv

  28. [36]

    Krizhevsky, G

    A. Krizhevsky, G. Hinton, et al., Learning multiple layers of features from tiny images (2009)

    2009

  29. [37]

    Simonyan, A

    K. Simonyan, A. Zisserman, Very deep convolutional networks for large-scale image recognition, arXiv preprint arXiv:1409.1556 (2014). doi:10.48550/ arXiv.1409.1556

    2014 doi arXiv

  30. [38]

    K. He, X. Zhang, S. Ren, J. Sun, Deep residual learning for image recognition, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778. doi:10.1109/CVPR.2016.90

    2016 doi

  31. [39]

    Huang, Z

    G. Huang, Z. Liu, L. Van Der Maaten, K. Q. Weinberger, Densely connected convolutional networks, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017, pp. 4700–4708. doi:10.1109/CVPR. 2017.243

    2017 doi

  32. [40]

    Kurakin, I

    A. Kurakin, I. Goodfellow, S. Bengio, Adversarial machine learning at scale, arXiv preprint arXiv:1611.01236 (2016). doi:10.48550/arXiv.1611.01236

    2016 doi arXiv

  33. [41]

    R. C. Gonzalez, Digital image processing, Pearson education india, 2009

    2009

  34. [42]

    Z. Wang, A. C. Bovik, H. R. Sheikh, E. P. Simoncelli, Image quality assessment: from error visibility to structural similarity, IEEE transactions on image process- ing 13 (4) (2004) 600–612. doi:10.1109/TIP.2003.819861

    2004

  35. [43]

    Singh, Piqa: Physical interaction: Question answering, accessed: 2024-10-17 (2020)

    A. Singh, Piqa: Physical interaction: Question answering, accessed: 2024-10-17 (2020). URL https://pypi.org/project/piqa/ 33

    2020

  36. [44]

    Paszke, S

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Kopf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, S. Chintala, Py- torch: An imperative style, high-perfo...

    2019

  37. [45]

    C. Xie, Y . Wu, L. v. d. Maaten, A. L. Yuille, K. He, Feature denoising for im- proving adversarial robustness, in: Proceedings of the IEEE /CVF conference on computer vision and pattern recognition, 2019, pp. 501–509. 34

    2019

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.