Targeted View-Invariant Adversarial Perturbations for 3D Object Recognition

Abdurrahman Zeybey; Christian Green; Mehmet Ergezer

REVIEW 5 major objections 5 minor 24 references

Targeted View-Invariant Adversarial Perturbations for 3D Object Recognition

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single image-sized noise, optimized over rendered views, can make a 3D recognition model label objects as a chosen target with top-1 success above 95%.

desk verdict A small sign-flip extension of the authors' own untargeted method, undermined by a metric mismatch: the 95% top-1 accuracy claim is not supported by the reported average-softmax numbers. read the letter →

arxiv 2412.13376 v1 pith:24N3M7DU submitted 2024-12-17 cs.CV cs.AIcs.CReess.IV

Christian Green , Mehmet Ergezer , Abdurrahman Zeybey This is my paper · ORCID

classification cs.CVcs.AIcs.CReess.IV

keywords adversarialperturbationsview-invariantattack3Dobjectrecognitiontargeteduniversalperturbationmulti-viewrobustnessMobileNetV2Objaverse

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

VIAP is an attack method for 3D object recognition: instead of crafting a separate noise for each camera angle, it produces one universal, image-shaped perturbation that can be added to every rendered view of an object. The paper claims that this single noise makes a pretrained convolutional classifier, MobileNetV2, misclassify the object across different viewpoints, and in the targeted setting can push the model toward a specific label chosen in advance. On a dataset of 1,210 rendered views of 121 objects, the targeted attack reaches top-1 target accuracy above 95% for most epsilon values on training views, and it transfers to held-out views better than FGSM or BIM. The reason to care is that, if the claim holds, multi-view recognition systems are vulnerable to a cheap, viewpoint-agnostic attack that can be prepared entirely in the image domain without manipulating 3D geometry.

What carries the argument

The central object is $\delta$, a perturbation tensor with the same width, height, and color channels as a single input image, optimized jointly over a 4-D stack of multi-view renders. The update rule is a BIM-style iterative sign-gradient step, with the crucial change that the gradient is computed with respect to $\delta$ rather than the input image; this decouples the number of images from the shape of the noise. For targeted attacks, the update subtracts the sign of the gradient of the cross-entropy loss against the chosen target label, so each iteration reduces the loss and pushes every view toward the same target class. This object carries the argument because the entire claim about 'view-invariance' reduces to whether one $\delta$ trained on roughly five views per object keeps its effect on unseen views and unseen objects.

What would settle it

Run the same VIAP procedure with an object-disjoint split: train the perturbation on some objects' views and test it only on views of objects never seen during training. If targeted top-1 accuracy on those unseen objects falls to chance levels, the claimed view-invariance is actually per-object memorization rather than a general 3D transfer property.

Watch

Extended reading notes

Core claim

The central discovery is that view-invariance can be obtained by optimizing the perturbation itself over a batch of views, rather than by solving for each view separately. Given rendered views $X_i^{(\theta,\phi)}$ of object $i$, the attacker seeks a perturbation $\delta$ such that for every viewpoint $(\theta,\phi)$ in a chosen range, $\arg\max_c f(X_i^{(\theta,\phi)} + \delta) = y_{\text{target}}$. The optimization repeats $\delta \leftarrow \text{Clip}_\epsilon(\delta - \eta\,\text{sign}(\nabla_\delta J(f(X+\delta), y_{\text{target}})))$, using the cross-entropy loss against the target label; for untargeted attacks the sign is flipped. Because the gradient is taken with respect to $\delta$ and the views are stacked as a 4-D tensor, a single noise tensor emerges that drives the true-label softmax score to near zero on training views and, at epsilon values around 10, lifts the target-label softmax to as high as 0.76 on held-out views. The paper takes this as evidence that a targeted universal perturbation can be viewpoint-invariant and that the approach beats FGSM and BIM on transfer to unseen images.

Load-bearing premise

The load-bearing premise is that a perturbation tuned to about five rendered views per object carries over to other viewpoints and possibly other objects, with no theoretical guarantee, and the paper does not state that its train/test split is object-disjoint.

Editorial extensions

If this is right

A multi-view recognition pipeline becomes a single-point failure: one shared noise defeats all camera angles if the attacker knows the classifier gradients.
Because the perturbation is image-shaped rather than view-specific, it can be prepared offline for rendered objects and deployed in settings where the camera angle is not known in advance.
Targeted VIAP transfers to held-out views with mean target softmax up to 0.76 at moderate epsilon, meaning the method does not require per-view optimization at attack time.
The attack operates exclusively on 2D images, so it avoids costly 3D mesh manipulation and can be applied to any classifier that consumes rendered views.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Read strictly, the reported 'generalization to unseen data' is evidence about new viewpoints of objects whose other views appeared in training; the stronger claim of transfer to never-seen objects is not established by the paper's described split.
Because target labels were sampled uniformly from the 1,000 ImageNet classes, most targets are semantically distant from the source object; attacking semantically close classes would likely be harder than the reported average.
The attack requires white-box access to the classifier's gradients, so a natural untested extension is whether the same perturbation transfers to a different architecture or to a model with randomized viewpoint preprocessing.
An immediate defensive corollary is that camera-angle randomization or small geometric jitter at inference time could break the fixed-view optimization, since VIAP's robustness is measured only on the specific rendered angles used in training and testing.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The punchline: this is a minor extension of the authors' own untargeted VIAP, and the abstract's central claim of >95% top-1 targeted accuracy is not backed by the numbers actually reported. Table 2 gives average target-class softmax, not Top-1 Target Accuracy, and the best test average is 0.76. The 95% figure appears to be train-only or a confusion of metrics.

What is new: the targeted version is literally a sign flip (Eq. 5) on their previous update rule, with the gradient computed w.r.t. the shared perturbation instead of the image. The universal gradient-averaging trick already appears in Moosavi-Dezfooli et al. 2017 and in their own prior work. The 'mathematical formalization' is a restatement of the objective, not a theorem. That said, the paper does a decent job of systematically varying epsilon and reporting both train/test softmax values. The method is simple enough to replicate from the description.

Soft spots: (1) The metric mismatch is the biggest issue. Equation 7 defines Top-1 Target Accuracy but it is never reported; instead we get average softmax. A target class can average 0.76 softmax and still never be the argmax. The abstract overstates to >95% without disclosing the change in metric or that the result is train-only. (2) The train/test split is described only as images split; it is not stated that the 121 objects are partitioned. If the same objects appear in both sets, 'unseen data' means unseen views of seen objects, not generalization to new objects. (3) The FGSM/BIM baselines are ambiguous: it appears they were also run as universal methods (one perturbation over all training images), but the details are not spelled out. (4) The t-test section gives p-values without sample sizes, whether the test was paired, or which images were compared. (5) Novelty is low: a sign flip is not a new attack family.

On balance, the method is plausible and the training performance is strong, but the evaluation as written does not support the headline claims. With a corrected metric, a proper object-disjoint split, and a clearer baseline protocol, this could be a legitimate incremental contribution. As is, it needs major revision.

Who it's for: someone working on multi-view adversarial robustness might find it a useful baseline. It is not going to change the field.

Recommendation: worth sending to peer review rather than desk-rejecting, because the method is reproducible and the flaws are fixable, but a serious referee should demand the metric fix and split clarification. If those don't come, reject.

Referee Report

5 major / 5 minor

Summary. The paper proposes View-Invariant Adversarial Perturbations (VIAP), a method for generating a single universal perturbation that, when added to multiple rendered views of 3D objects, misclassifies them toward a chosen target label. The method is an iterative targeted BIM-style update (Eq. 5) in which the optimization variable is the shared perturbation δ rather than an individual image, with a random initialization and clipping. Experiments on 1,210 rendered images (121 objects, 14 classes) compare VIAP with FGSM and BIM on MobileNetV2 using average softmax confidence in the true label (untargeted, Table 1) and in the target label (targeted, Table 2) over a 605/605 train/test split. The authors report strong training-set results and claim in the abstract and conclusion that targeted attacks achieve top-1 accuracies exceeding 95% across epsilon values and that the method generalizes better than FGSM and BIM to unseen data.

Significance. If substantiated, a single perturbation that is both universal across objects and invariant across viewpoints for targeted attacks would be a useful contribution to robustness evaluation of multi-view 3D recognition systems. The core optimization idea is natural and computationally simple, and the treatment of the perturbation as a shared variable over a batch of rendered views is a sensible extension of BIM. The method appears plausible as an optimization procedure, and the reported training-set softmax values are strong. However, the paper's headline claims are not supported by the metrics actually reported: no top-1 target accuracy is given, the train/test split is not shown to be object-disjoint, and the baseline protocol is ambiguous. The paper also ships no formal derivation, code, or reproducibility artifacts, so the evidence for the central claims is currently incomplete.

major comments (5)

[Abstract; Targeted Attack Confidence (Table 2); Conclusion] The abstract and conclusion claim targeted attacks achieve "top-1 accuracies exceeding 95%," but Table 2 reports average softmax predictions of the target label, not the Top-1 Target Accuracy defined in Eq. 7. High average softmax for the target class does not imply that the target class is the argmax prediction; the target could be consistently second-ranked. The maximum test-set average softmax in Table 2 is 0.76 at epsilon=10, and training-set values reach 0.97 only for a narrow epsilon range. No top-1 accuracy values are reported anywhere, so the 95% claim is unsupported. The authors must either report the actual Top-1 Target Accuracy metric or revise the claim to describe average softmax confidence.
[Dataset and Preprocessing; Experimental Setup] The train/test split is not specified as object-disjoint. The dataset consists of 121 objects with 10 views each (1,210 images), and the split is described only as 605 training and 605 test images. If the split is at the image level, the same objects appear in both training and testing, so the test set measures transfer to new viewpoints of seen objects, not generalization to unseen objects. The claim of "view-invariant universal perturbation" and "generalization to unseen data" requires held-out viewpoints, but the claim of universal transfer across objects requires an object-disjoint split. The authors should state the split criterion and, if it is view-based, add an object-disjoint evaluation or soften the generalization claim.
[Experimental Setup; Equations 1-5] The comparison with FGSM and BIM is ambiguous because FGSM (Eqs. 1-2) and BIM (Eq. 3) are defined for a single image, while VIAP optimizes a single shared perturbation over a batch of training views (Eqs. 4-5). The text says "All steps are repeated for the BIM and FGSM attacks," but it does not state whether these baselines were applied independently to each image or as universal perturbations. If the baselines are per-image attacks, the comparison does not isolate whether VIAP's advantage comes from view-invariance or from optimizing over a batch. The authors should specify the baseline protocol precisely and, ideally, include both per-image and universal-perturbation versions of FGSM and BIM.
[Statistical Significance of Targeted VIAP Results; Table 3] The t-test results in Table 3 are insufficiently documented. The text reports p-values of 0.0005 (VIAP vs. FGSM) and 0.0095 (VIAP vs. BIM) but omits the sample size, whether the tests are paired or unpaired, which epsilon values were included, whether the comparison is across all images or per-object aggregates, and any correction for multiple comparisons. Moreover, the tests compare average softmax predictions, which does not address the missing top-1 accuracy evidence. The authors should provide full statistical details or remove the significance claim.
[Mathematical Formalization of View-Invariance] The claimed contribution of a "mathematical formalization of view-invariance" is not substantiated: the section restates the objective (arg max over target class) and writes the gradient as an expectation over transformations, but provides no derivation, theorem, or analysis of when the shared perturbation δ is guaranteed to transfer across views. This is a formalization of the optimization goal, not of the invariance property itself. The authors should either provide a meaningful formal statement with proof or remove this contribution claim.

minor comments (5)

[Targeted View-Invariant Adversarial Perturbations; Algorithm 1] The notation is inconsistent: Eq. 4 uses X for both the stacked input tensor and the perturbation matrix, while Eq. 5 writes Xadv as the optimization variable; Algorithm 1 instead uses δ. The initialization is also inconsistent: the text after Eq. 4 says Xadv_0 = X + r with r ~ U(-0.01, 0.01), whereas Algorithm 1 initializes δ with random noise δ0 ~ U(-0.01, 0.01). Please unify the notation and initialization description.
[Algorithm 1] Algorithm 1 introduces a step size η in the update rule, but Eq. 5 uses ϵ as the step size and the experimental section reports only ϵ values. It is unclear what value of η was used and how it relates to the clipping bound. Please clarify or remove η.
[Dataset and Preprocessing; Experimental Setup] The text says "Eight of the objects were rendered from ten distinct viewing angles," which conflicts with the earlier statement that all 121 objects were rendered from 10 viewpoints. This appears to be a typo; please correct it and clarify the rendering procedure for the remaining objects.
[Table 1] Table 1's header indicates values are expressed in units of 10^-6, but the surrounding text refers to percentages (e.g., "average softmax prediction of 8%"). Please make the units and conversions explicit so the table is readable without cross-referencing the header.
[Evaluation Metrics] Eqs. 6 and 7 are written in an informal notation (e.g., "Top-1 True Label Predicts"). Please rewrite them in standard mathematical notation with clear definitions of the sums and the prediction function.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the targeted update is standard optimization over a shared perturbation, and the 95% claim issue is a metric-reporting problem, not a reduction to inputs.

full rationale

The paper's derivation chain is self-contained. The targeted View-Invariant Adversarial Perturbation update in Equation 5 is targeted BIM applied to a shared perturbation tensor, with gradients taken with respect to the perturbation rather than the input image. The view-invariance condition is the optimization objective, not an assumed conclusion: the method optimizes a single delta so that multiple rendered views move toward a target class. No parameter is fitted to the reported success metric; epsilon values, iteration counts, and target labels are predetermined and held fixed across methods, and FGSM and BIM serve as external baselines. The only self-citation (Ergezer et al. 2024) is explicitly disclosed as the previous untargeted universal-perturbation method and is used as a starting point, not as evidence for the new targeted transfer claim, so it is not load-bearing. The abstract and conclusion state that targeted attacks achieve 'top-1 accuracies exceeding 95% across various epsilon values,' but Table 2 reports average softmax predictions of the target label, with a maximum test average of 0.76 at epsilon 10; this is a metric-reporting or correctness concern, not circularity, because the claimed number is not produced by defining the metric in terms of the method's own output. Similarly, the unspecified object-disjoint train/test split affects the strength of the generalization claim but does not make the derivation circular. Verdict: no significant circularity; score 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new model internals or physical entities. Its free parameters are attack hyperparameters (epsilon, number of iterations, and an undefined step size eta). The axioms are domain assumptions about the use of 2D renderings as a proxy for 3D recognition, the transferability of finite-view optimization, and the independence of train and test views. No invented entities are postulated.

free parameters (3)

epsilon = 0.5 to 50 (swept)
Perturbation magnitude; chosen via preliminary experiments for a balance between strength and imperceptibility; results are reported as a sweep, not fitted to a single value.
step size eta = undefined
Introduced in Algorithm 1 as the update step but never defined or used in Equation 5, which uses epsilon as both step and clip bound.
number of iterations N = 20 for BIM and VIAP, 1 for FGSM
The iteration count is chosen without stated justification in the experimental setup.

assumptions (4)

domain assumption The MobileNetV2 classifier trained on ImageNet is an adequate proxy for 3D object recognition when given 2D renderings.
The paper evaluates only 2D images from rendered 3D objects and equates multi-view 2D classification with 3D recognition.
domain assumption Gradient sign updates on a shared perturbation converge to a universal perturbation that transfers to unseen views.
The method relies on this empirical convergence; no analysis is provided.
domain assumption Random camera angles with up to 15% deviation (restricted to one axis for some objects) simulate real-world viewpoint variation.
Data generation assumption in the Experimental Setup section.
domain assumption Train and test image sets are independent samples of the view distribution.
The paper does not specify an object-disjoint split; if the same objects appear in both sets, independence is violated.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Targeted View-Invariant Adversarial Perturbations for 3D Object Recognition." pith.science (2026). https://pith.science/paper/24N3M7DU

@misc{pith2026241213376,
  author       = {Pith},
  title        = {Pith review of: Targeted View-Invariant Adversarial Perturbations for 3D Object Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/24N3M7DU}},
  note         = {Machine review of arXiv:2412.13376}
}

read the original abstract

Adversarial attacks pose significant challenges in 3D object recognition, especially in scenarios involving multi-view analysis where objects can be observed from varying angles. This paper introduces View-Invariant Adversarial Perturbations (VIAP), a novel method for crafting robust adversarial examples that remain effective across multiple viewpoints. Unlike traditional methods, VIAP enables targeted attacks capable of manipulating recognition systems to classify objects as specific, pre-determined labels, all while using a single universal perturbation. Leveraging a dataset of 1,210 images across 121 diverse rendered 3D objects, we demonstrate the effectiveness of VIAP in both targeted and untargeted settings. Our untargeted perturbations successfully generate a singular adversarial noise robust to 3D transformations, while targeted attacks achieve exceptional results, with top-1 accuracies exceeding 95% across various epsilon values. These findings highlight VIAPs potential for real-world applications, such as testing the robustness of 3D recognition systems. The proposed method sets a new benchmark for view-invariant adversarial robustness, advancing the field of adversarial machine learning for 3D object recognition.

Figures

Figures reproduced from arXiv: 2412.13376 by the authors.

**Figure 2.** illustrates the consequence of increasing ϵ values on the distortion of the original image. ϵ Sensitivity Analysis: By varying ϵ, we analyze the trade-off between perturbation strength and attack success, identifying the optimal ϵ range for both targeted and untargeted attacks. We perform experiments on our data with epsilon values ranging between 0 and 50. Results To showcase the effectiveness of our model in gen… view at source ↗

**Figure 3.** Figure consists of four rendered images of a strawberry with each adversarial attack at the same epsilon value. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 13 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Alexandrescu, A. 2023. Broccoli. Last accessed 9 April 2024

work page 2023
[4]

Athalye, A.; Engstrom, L.; Ilyas, A.; and Kwok, K. 2018. Synthesizing Robust Adversarial Examples. arXiv:1707.07397

arXiv 2018
[5]

Bes, A. 2017. Worn Baseball Ball. Last accessed 10 February 2024

work page 2017
[6]

Carlini, N.; and Wagner, D. 2017. Towards Evaluating the Robustness of Neural Networks. arXiv:1608.04644

arXiv 2017
[7]

CGI, C. 2023. Pretzel. Last accessed 23 April 2024

work page 2023
[8]

Christian, K. . 2019. Conch. Last accessed 23 April 2024

work page 2019

Show all 24 references

[9]

dannyboy70000. 2014. lemon 3D Model. Last accessed 10 February 2024

2014
[10]

Deitke, M.; Schwenk, D.; Salvador, J.; Weihs, L.; Michel, O.; VanderBilt, E.; Schmidt, L.; Ehsani, K.; Kembhavi, A.; and Farhadi, A. 2023. Objaverse: A Universe of Annotated 3D Objects. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 13142--13153

2023
[11]

Ergezer, M.; Duong, P.; Green, C.; Nguyen, T.; and Zeybey, A. 2024. One Noise to Rule Them All: Multi-View Adversarial Attacks with Universal Perturbation. arXiv:2404.02287

2024 arXiv
[12]

Europac3d. 2024. Acorn. Last accessed 8 April 2024

2024
[13]

J.; Shlens, J.; and Szegedy, C

Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015. Explaining and Harnessing Adversarial Examples. arXiv:1412.6572

2015 arXiv
[14]

Kurakin, A.; Goodfellow, I.; and Bengio, S. 2017. Adversarial examples in the physical world. arXiv:1607.02533

2017 arXiv
[15]

Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083

2017 arXiv
[16]

Moosavi-Dezfooli, S.-M.; Fawzi, A.; Fawzi, O.; and Frossard, P. 2017. Universal Adversarial Perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

2017
[17]

Poursaeed, O.; Katsman, I.; Gao, B.; and Belongie, S. 2018. Generative adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, 4422--4431

2018
[18]

Ren, K.; Zheng, T.; Qin, Z.; and Liu, X. 2020. Adversarial attacks and defenses in deep learning. Engineering, 6(3): 346--360

2020
[19]

Sandler, M.; Howard, A.; Zhu, M.; Zhmoginov, A.; and Chen, L.-C. 2019. MobileNetV2: Inverted Residuals and Linear Bottlenecks. arXiv:1801.04381

2019 arXiv
[20]

selfie 3D scan. 2019. Tractor. Last accessed 10 February 2024

2019
[21]

Sharif, M.; Bhagavatula, S.; Bauer, L.; and Reiter, M. K. 2019. A General Framework for Adversarial Examples with Objectives. ACM Transactions on Privacy and Security, 22(3): 1–30

2019
[22]

soufiane oujihi. 2024. Snail. Last accessed 22 April 2024

2024
[23]

Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199

2013 arXiv
[24]

Zhi, S.; Liu, Y.; Li, X.; and Guo, Y. 2018. Toward real-time 3D object recognition: A lightweight volumetric CNN framework using multitask learning. Computers & Graphics, 71: 199--207

2018

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Alexandrescu, A. 2023. Broccoli. Last accessed 9 April 2024

work page 2023

[4] [4]

Athalye, A.; Engstrom, L.; Ilyas, A.; and Kwok, K. 2018. Synthesizing Robust Adversarial Examples. arXiv:1707.07397

arXiv 2018

[5] [5]

Bes, A. 2017. Worn Baseball Ball. Last accessed 10 February 2024

work page 2017

[6] [6]

Carlini, N.; and Wagner, D. 2017. Towards Evaluating the Robustness of Neural Networks. arXiv:1608.04644

arXiv 2017

[7] [7]

CGI, C. 2023. Pretzel. Last accessed 23 April 2024

work page 2023

[8] [8]

Christian, K. . 2019. Conch. Last accessed 23 April 2024

work page 2019