Pith. sign in

REVIEW 3 major objections 5 minor 37 references

PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Classic PGD with two scheduling tricks reaches state-of-the-art imperceptible adversarial attacks, no perceptual modules needed.

desk verdict Simple PGD variant with dynamic step size and early stopping gives surprisingly strong imperceptibility results, but the SOTA claim needs stronger baseline comparisons and code. read the letter →

arxiv 2412.11168 v3 pith:MHLJNZQH submitted 2024-12-15 cs.LG cs.CR

Jin Li , Zitong Yu , Ziqiang He , Z. Jane Wang , Xiangui Kang This is my paper · ORCID
classification cs.LGcs.CR
keywords adversarialattacksimperceptibleperturbationsprojectedgradientdescentPGD-Impdecisionboundarydynamicstepsizeadaptiveearlystopimageclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that imperceptible adversarial attacks do not need perceptual modules, auxiliary losses, or frequency-domain constraints. Its thesis is that an attack is imperceptible precisely when it pushes the image across the model's decision boundary with the smallest possible perturbation, and that the classic PGD algorithm can already do this if two optimization details are fixed. The first fix, Dynamic Step Size, distributes the total perturbation budget across iterations with a gradually increasing schedule; the second, Adaptive Early Stop, halts the attack the moment a rounded 8-bit candidate misclassifies the model. On a standard 1,000-image benchmark the resulting PGD-Imp attack reports 100% success on ResNet-50 with an average $\ell_2$ distance of 0.89, PSNR of 52.93, and a maximum per-pixel change of $1/255$, while running in 57 seconds. If the claim holds, the whole apparatus of perceptually motivated attack components becomes optional rather than essential.

What carries the argument

The load-bearing mechanism is the pair of scheduling rules applied to PGD's sign-gradient descent. The Dynamic Step Size rule enforces $\sum_{t=1}^T \alpha_t = \epsilon$ with $\alpha_t = \eta_t \beta$ and a linear, increasing $\eta_t$, which allocates a larger share of the budget to later iterations so early updates explore near the clean image. The Adaptive Early Stop rule evaluates the rounded 8-bit image at each step and breaks as soon as the classifier's decision changes, with the condition $\|x_{\mathrm{now}} - x\|_\infty \ge 1$ ensuring the perturbation survives quantization. Together they convert PGD from a fixed-budget attacker into a boundary-approaching attacker that stops at the first successful adversarial example along its path.

What would settle it

Take a set of images and compute PGD-Imp's output, then compute a much closer approximation to the true minimum-$\ell_2$ adversarial example (for instance by a fine-grained boundary search). If any image shows a large gap between PGD-Imp's $\ell_2$ cost and the near-minimal cost, while the early-stopped point is not near the boundary, the central heuristic is refuted for that case. A second check: the reported $\ell_\infty = 1/255$ with 100% ASR implies every pixel change is at most 1; rerunning on a larger or more diverse sample and counting images where success requires a $\pm 2$ or larger change would falsify that specific claim.

Watch

Extended reading notes

Core claim

PGD-Imp's central claim is that a minimal-cost crossing of the decision boundary is the essence of imperceptibility, and that two scheduling choices turn plain PGD into a solver for that objective. Dynamic Step Size replaces the fixed step with $\alpha_t = \eta_t \beta$, where $\eta_t$ follows a linear schedule from 0 to 1 and $\beta = \epsilon / \sum \eta_t$, so the accumulated signed-gradient updates exactly meet the $\ell_\infty$ budget $\epsilon$. Adaptive Early Stop then rounds the current iterate to an 8-bit image and, once the rounded image already fools the classifier (or hits the target class), stops immediately, leaving the example just past the boundary. The paper reports that this combination achieves state-of-the-art untargeted imperceptible attacks on four classifiers and improves targeted attacks as well, reducing $\ell_\infty$ to $1/255$ and halving the $\ell_2$ cost of the best prior targeted method.

Load-bearing premise

The method assumes that the first rounded point along its scheduled sign-gradient path that misclassifies the model lies at or very near the minimum-cost adversarial example, so that stopping there gives near-minimal perturbation.

Editorial extensions

If this is right

  • External perceptual components become optional: if minimal-cost boundary crossing is sufficient, imperceptible attacks can be built and tuned with just a schedule and a stopping rule.
  • Attack cost drops sharply: the reported 57-second untargeted attack on ResNet-50 is orders of magnitude faster than the perceptual-module baselines it compares against.
  • Imperceptibility and efficiency align: the same mechanism that lowers L2 distance and raises PSNR also shortens runtime, because early stopping removes redundant iterations.
  • Hyperparameter sensitivity shrinks: across most settings of epsilon and T the method holds PSNR >= 53 and ASR >= 99%, with degradation only at very small T.
  • Targeted attacks inherit the same gains, reaching 100% ASR with roughly half the L2 cost of the prior targeted approach.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the attack stops at the first successful rounded point, its output is a cheap empirical estimate of decision-boundary distance; one could reuse it to measure robustness or to probe where a classifier's boundary sits relative to human perception.
  • The method's success on LPIPS and FID does not by itself establish subjective invisibility; a natural extension is a human study comparing PGD-Imp outputs with perceptual-module outputs at matched ASR.
  • Since PGD-Imp is built from plain PGD, it could be dropped into adversarial training pipelines as a stronger, cheaper attack for generating training adversaries, though the paper does not test this.
  • The 1/255 infinity-norm result depends on 8-bit rounding; re-running at higher bit depth or in non-image domains would test whether the minimal-cost boundary claim survives outside the current quantization regime.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes PGD-Imp, a modification of the classic PGD attack for imperceptible adversarial examples. It replaces the fixed step size with a dynamic, schedule-based step size that sums to the l-infinity budget, and it adds an adaptive early-stop criterion that checks the model prediction on the rounded 8-bit image, halting as soon as the attack succeeds. The authors argue that external perceptual modules are unnecessary and report state-of-the-art ASR, l2, l-infinity, PSNR, SSIM, FID, and LPIPS results on the NIPS 2017 ImageNet-compatible dataset for untargeted and targeted attacks against ResNet-50, VGG-19, MobileNet-V2, and WideResNet-50.

Significance. If the reported results hold, the paper is a useful conceptual simplification: a carefully scheduled PGD with early stopping can match or beat perception-oriented attacks while being substantially faster. The ablations in Tables III and IV are informative and support the contribution of each proposed component. I also verified that the reported l2 = 0.89 and PSNR = 52.93 are internally consistent under the standard [0,1] normalization (MSE approximately 5.3e-6, PSNR approximately 52.8 dB), so the apparent 8-bit-unit inconsistency does not actually arise. However, the central 'state-of-the-art minimal-cost' claim is not yet fully supported because the paper does not compare against DeepFool and the Carlini-Wagner l2 attack, which are the standard minimal-distance baselines.

major comments (3)
  1. [Section III-B, Tables I and II] The claim that PGD-Imp achieves state-of-the-art minimal-cost perturbations is not fully supported because the comparison omits DeepFool and the Carlini-Wagner l2 attack, which are the standard minimal-distance baselines. Please add these baselines on the same 1000 images and report l2, l-infinity, PSNR, ASR, and runtime. If C&W or DeepFool achieve lower l2 on the same benchmark, the 'minimal cost toward the decision boundary' claim would need to be qualified.
  2. [Algorithm 1, lines 10-16] Algorithm 1 cannot be executed as written. Line 10 checks 'if ||xnow - x||_inf >= 1', which is never true for normalized [0,1] images with the reported l-infinity = 1/255; the condition should be '>= 1/255' unless the algorithm explicitly states that x and xnow are in 8-bit integer units. In addition, lines 15-16 ('xadv = xnow; return xadv') appear inside the for loop, which would make the function return the unperturbed image after the first iteration. Please correct the threshold, move the return outside the loop, and specify the rounding mode and clipping at image boundaries.
  3. [Section III-B, Table I] The reported l-infinity = 1/255 with 100% ASR is an unusually strong empirical result. Because the scheduled step sizes can produce many iterations in which the rounded image is unchanged, the reader needs more than the average of 34.2 iterations to verify that the early-stop mechanism is behaving as described. Please report the distribution of stop iterations and final l-infinity per image, or release the code, and confirm explicitly that all metrics are computed on the returned 8-bit rounded images.
minor comments (5)
  1. [Section II-B, Eq. (3)] Please define the linear schedule explicitly, for example eta_t = t/T for t = 1..T, and clarify whether epsilon is 8/255 in normalized units or 8 in 8-bit units, since this changes the interpretation of Eq. (3) and the step-size values.
  2. [Table II] Table II reports l-infinity = 0.01 for targeted PGD-Imp, but for 8-bit rounded outputs the per-image l-infinity must be a discrete multiple of 1/255; please report the mean and distribution (or the exact values) rather than a rounded aggregate that obscures this discreteness.
  3. [Section III-A] There are citation inconsistencies in the text: 'AdvDrop [4]' and 'Perc-AL [4]' in Section III-A do not match the reference list, where [4] is Madry et al.; please renumber or correct the citations.
  4. [Fig. 3] Please add axis labels to Figure 3 and state which metric is plotted; the caption 'Step T and epsilon' is ambiguous without axis information.
  5. [Tables I-III] Given that the evaluation uses only 1000 images, please report standard deviations or confidence intervals for the main metrics, especially the 100% ASR and l-infinity = 1/255 claims.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found: the reported imperceptibility values are measured outputs of a standard PGD-style optimization with early stopping, not fitted parameters or self-cited results.

full rationale

PGD-Imp's derivation chain is self-contained. The method applies standard PGD updates (Eqs. 4-5) with a scheduled step size whose total is fixed by Eq. (3), and an Adaptive Early Stop that returns the first rounded iterate satisfying both an l-infinity threshold and a misclassification condition. The reported ASR, l2, PSNR, SSIM, FID, and LPIPS are measurements of the returned images, not targets used to fit parameters; the only hyperparameters (epsilon=8, T=100, linear eta schedule) are set before evaluation and selected by ablation, which is conventional benchmarking rather than a fitted input renamed as a prediction. The paper's central claim that external perceptual modules are unnecessary is an empirical comparison result, not an analytic consequence of a self-citation or a uniqueness theorem imported from the authors' prior work. Citations [23]-[29] are standard optimization and early-stopping references and are not load-bearing self-citations. The apparent inconsistency among l2=0.89, PSNR=52.93, and l_infinity=1/255 for 8-bit rounded images is a metrics or evaluation concern, not a circularity, because those values are not definitionally tied to the algorithm's inputs. No fitted parameter is renamed as a prediction, and no uniqueness claim is invoked to forbid alternatives. Therefore no circular step is present.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new entities. It relies on standard white-box gradient access and on an unproven optimization heuristic about the decision boundary. The main free choices are epsilon, T, and the schedule shape, and the schedule shape is selected by ablation on the evaluation benchmark.

free parameters (3)
  • perturbation budget epsilon = 8/255 in main results; 2/255 and 4/255 in ablations and discussion
    Hand-selected total l_infinity budget that determines the dynamic step sizes via Eq. (3). The method's behavior and reported imperceptibility depend on this choice.
  • iteration count T = 100 in main results; varied down to 10 in Fig. 3
    Hand-selected number of optimization steps. Larger T gives finer step sizes and, the paper shows, better imperceptibility, so the choice affects the central claim.
  • step-size schedule shape eta_t = linear increasing from 0 to 1
    Selected by ablation over constant, cosine, and reverse schedules in Table IV. This choice is made on the same benchmark used for evaluation, which introduces a mild selection bias.
assumptions (4)
  • domain assumption The attacker has white-box access to the victim model's gradients.
    PGD-Imp computes the sign of the loss gradient with respect to the attacked model in Eqs. (4) and (5); without gradient access the method cannot run as stated.
  • standard math For sign gradients s_t in {+1,-1}, the total accumulated coordinate change is bounded by the sum of the step sizes.
    Used in Eq. (3) through Eq. (5) to justify the l_infinity budget; follows from the triangle inequality.
  • ad hoc to paper The first 8-bit-rounded point along the scheduled gradient-sign path that misclassifies the model is at or near the minimal-cost adversarial example.
    This is the central optimization heuristic behind Dynamic Step Size and Adaptive Early Stop in Sections II-B and II-C. The paper does not prove it, and the l_infinity=1/255 headline depends on it.
  • ad hoc to paper The linear schedule selected in Table IV generalizes beyond the benchmark used for selection.
    The schedule is chosen on the same NIPS-1000 images and models used for final evaluation, so the reported improvements may partly reflect selection on the test benchmark.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks." pith.science (2026). https://pith.science/paper/MHLJNZQH

@misc{pith2026241211168,
  author       = {Pith},
  title        = {Pith review of: PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MHLJNZQH}},
  note         = {Machine review of arXiv:2412.11168}
}
abstract

Imperceptible adversarial attacks have recently attracted increasing research interests. Existing methods typically incorporate external modules or loss terms other than a simple $l_p$-norm into the attack process to achieve imperceptibility, while we argue that such additional designs may not be necessary. In this paper, we rethink the essence of imperceptible attacks and propose two simple yet effective strategies to unleash the potential of PGD, the common and classical attack, for imperceptibility from an optimization perspective. Specifically, the Dynamic Step Size is introduced to find the optimal solution with minimal attack cost towards the decision boundary of the attacked model, and the Adaptive Early Stop strategy is adopted to reduce the redundant strength of adversarial perturbations to the minimum level. The proposed PGD-Imperceptible (PGD-Imp) attack achieves state-of-the-art results in imperceptible adversarial attacks for both untargeted and targeted scenarios. When performing untargeted attacks against ResNet-50, PGD-Imp attains 100$\%$ (+0.3$\%$) ASR, 0.89 (-1.76) $l_2$ distance, and 52.93 (+9.2) PSNR with 57s (-371s) running time, significantly outperforming existing methods.

Figures

Figures reproduced from arXiv: 2412.11168 by the authors.

Figure 1
Figure 1. Illustration of our key idea and the proposed method. The essence of [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Visualization of four imperceptible attacks for untargeted scenario. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Experimental results on the effect of Step [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 30 canonical work pages

  1. [1]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations , 2014

    2014

  2. [2]

    Explaining and harnessing adversarial examples,

    I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Repre- sentations, 2015

    2015

  3. [3]

    Adversarial examples: Attacks and defenses for deep learning,

    X. Yuan, P. He, Q. Zhu, and X. Li, “Adversarial examples: Attacks and defenses for deep learning,” IEEE Transactions on Neural Networks and Learning Systems, vol. 30, no. 9, pp. 2805–2824, 2019

    2019

  4. [4]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” International Conference on Learning Representations , 2018

    work page 2018

  5. [5]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Proceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition , pp. 9185–9193, 2018

    work page 2018

  6. [6]

    Multi- layer feature division transferable adversarial attack,

    Z. Jin, C. Yin, P. Li, L. Zhou, L. Fang, X. Chang, and Z. Liu, “Multi- layer feature division transferable adversarial attack,” in ICASSP 2023- 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1–5, IEEE, 2023

    work page 2023

  7. [7]

    Enhance transferability of adver- sarial examples with model architecture,

    M. Fan, W. Guo, Z. Ying, and X. Liu, “Enhance transferability of adver- sarial examples with model architecture,” in ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1–5, IEEE, 2023

    work page 2023

  8. [8]

    Dynamic generative targeted attacks with pattern injection,

    W. Feng, N. Xu, T. Zhang, and Y . Zhang, “Dynamic generative targeted attacks with pattern injection,” in Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp. 16404–16414, 2023

    work page 2023

Show all 37 references
  1. [9]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy , pp. 39–57, IEEE, 2017

    2017

  2. [10]

    Towards imperceptible and robust adversarial example attacks against neural networks,

    B. Luo, Y . Liu, L. Wei, and Q. Xu, “Towards imperceptible and robust adversarial example attacks against neural networks,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 32, 2018

    2018

  3. [11]

    Towards large yet imperceptible adversarial image perturbations with perceptual color distance,

    Z. Zhao, Z. Liu, and M. Larson, “Towards large yet imperceptible adversarial image perturbations with perceptual color distance,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1039–1048, 2020

    2020

  4. [12]

    Perceptual adversarial robustness: Defense against unseen threat models,

    C. Laidlaw, S. Singla, and S. Feizi, “Perceptual adversarial robustness: Defense against unseen threat models,” in International Conference on Learning Representations, 2021

    2021

  5. [13]

    Advdrop: Adversarial attack to dnns by dropping information,

    R. Duan, Y . Chen, D. Niu, Y . Yang, A. Qin, and Y . He, “Advdrop: Adversarial attack to dnns by dropping information,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 7506– 7515, 2021

    2021

  6. [14]

    Exploring fre- quency adversarial attacks for face forgery detection,

    S. Jia, C. Ma, T. Yao, B. Yin, S. Ding, and X. Yang, “Exploring fre- quency adversarial attacks for face forgery detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4103–4112, 2022

    2022

  7. [15]

    Frequency-driven imperceptible adversarial attack on semantic similarity,

    C. Luo, Q. Lin, W. Xie, B. Wu, J. Xie, and L. Shen, “Frequency-driven imperceptible adversarial attack on semantic similarity,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, pp. 15315–15324, 2022

    2022

  8. [16]

    Impercep- tible adversarial attack via invertible neural networks,

    Z. Chen, Z. Wang, J. Huang, W. Zhao, X. Liu, and D. Guan, “Impercep- tible adversarial attack via invertible neural networks,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 37, pp. 414–424, 2023

    2023

  9. [17]

    On the suitability of lp-norms for creating and preventing adversarial examples,

    M. Sharif, L. Bauer, and M. Reiter, “On the suitability of lp-norms for creating and preventing adversarial examples,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 1605–1613, 2018

    2018

  10. [18]

    Evading defenses to transferable adversarial examples by translation-invariant attacks,

    Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to transferable adversarial examples by translation-invariant attacks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pp. 4312–4321, 2019

    2019

  11. [19]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” in International Conference on Learning Representations , 2020

    2020

  12. [20]

    On success and simplicity: A second look at transferable targeted attacks,

    Z. Zhao, Z. Liu, and M. Larson, “On success and simplicity: A second look at transferable targeted attacks,” Advances in Neural Information Processing Systems, vol. 34, pp. 6115–6128, 2021

    2021

  13. [21]

    Enhancing the transferability of adversarial attacks through variance tuning,

    X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pp. 1924–1933, 2021

    1924

  14. [22]

    Improving the transferability of adversarial samples by path-augmented method,

    J. Zhang, J. Huang, W. Wang, Y . Li, W. Wu, X. Wang, Y . Su, and M. R. Lyu, “Improving the transferability of adversarial samples by path-augmented method,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 8173–8182, 2023

    2023

  15. [23]

    Adam: A method for stochastic optimization,

    D. P. Kingma, “Adam: A method for stochastic optimization,” in International Conference on Learning Representations , 2015

    2015

  16. [24]

    Sgdr: Stochastic gradient descent with warm restarts,

    I. Loshchilov and F. Hutter, “Sgdr: Stochastic gradient descent with warm restarts,” in International Conference on Learning Representa- tions, 2017

    2017

  17. [25]

    Decoupled weight decay regularization,

    I. Loshchilov, “Decoupled weight decay regularization,” in International Conference on Learning Representations , 2019

    2019

  18. [26]

    An overview of gradient descent optimization algorithms,

    S. Ruder, “An overview of gradient descent optimization algorithms,” arXiv preprint arXiv:1609.04747 , 2016

    2016 arXiv

  19. [27]

    Early stopping-but when?,

    L. Prechelt, “Early stopping-but when?,” in Neural Networks: Tricks of the trade, pp. 55–69, Springer, 2002

    2002

  20. [28]

    Optimized approximation algorithm in neural networks without overfitting,

    Y . Liu, J. A. Starzyk, and Z. Zhu, “Optimized approximation algorithm in neural networks without overfitting,” IEEE transactions on neural networks, vol. 19, no. 6, pp. 983–995, 2008

    2008

  21. [29]

    Understanding and improving early stopping for learning with noisy labels,

    Y . Bai, E. Yang, B. Han, Y . Yang, J. Li, Y . Mao, G. Niu, and T. Liu, “Understanding and improving early stopping for learning with noisy labels,” Advances in Neural Information Processing Systems , vol. 34, pp. 24392–24403, 2021

    2021

  22. [30]

    Adversarial attacks and defences competition,

    A. Kurakin, I. Goodfellow, S. Bengio, Y . Dong, F. Liao, M. Liang, T. Pang, J. Zhu, X. Hu, C. Xie, et al., “Adversarial attacks and defences competition,” in The NIPS’17 Competition: Building Intelligent Systems, pp. 195–231, Springer, 2018

    2018

  23. [31]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” Advances in neural informa- tion processing systems , vol. 25, 2012

    2012

  24. [32]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE Conference on Computer VVision and pattern recognition , pp. 770–778, 2016

    2016

  25. [33]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” International Conference on Learning Representations, 2015

    2015

  26. [34]

    Mo- bilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L. Chen, “Mo- bilenetv2: Inverted residuals and linear bottlenecks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pp. 4510–4520, 2018

    2018

  27. [35]

    Wide residual networks,

    S. Zagoruyko, “Wide residual networks,” in British Machine Vision Conference, 2016

    2016

  28. [36]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” Advances in neural information processing systems , vol. 30, 2017

    2017

  29. [37]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 586–595, 2018

    2018

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.