On the Robustness of Distributed Machine Learning against Transfer Attacks

Ghassan Karame; Pascal Zimmer; S\'ebastien Andreina

REVIEW 4 major objections 4 minor 17 references

On the Robustness of Distributed Machine Learning against Transfer Attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A distributed ensemble of weakly heterogeneous models, each trained on disjoint data, substantially resists transfer-based adversarial attacks better than a standard ensemble.

desk verdict Real empirical study, but the headline overclaims: the robustness gain is likely driven mostly by data partitioning, not by full heterogeneity, and the missing controls leave the central mechanism unproven. read the letter →

arxiv 2412.14080 v1 pith:MONO7AKF submitted 2024-12-18 cs.LG cs.CR

Sébastien Andreina , Pascal Zimmer , Ghassan Karame This is my paper · ORCID

classification cs.LGcs.CR

keywords distributedmachinelearningtransferattacksadversarialrobustnessensemblediversitygradientsimilaritymodelheterogeneityfederatedaccuracy-robustnesstradeoff

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a machine-learning system can be made markedly harder to fool by black-box transfer attacks simply by distributing the model: training many weak learners on disjoint data while letting each learner choose its own architecture, optimizer, scheduler, and tuned hyperparameters, then averaging their predictions. The authors argue this goes beyond what ordinary ensembles or federated learning provide, because it distributes both the training and the inference phases. On CIFAR10 they report robust accuracy improvements of up to about 40 percentage points against the Common Weakness attack, with clean accuracy dropping by at most a few points in most configurations. The gain is attributed to gradient diversity between learners, which makes adversarial examples built on a surrogate model transfer poorly to the distributed target.

What carries the argument

The load-bearing object is the cosine-similarity identity between the surrogate model's input gradient and the target model's input gradient, $S(x,y) = \langle \nabla_x L(y,x,\hat{\theta}), \nabla_x L(y,x,\theta)\rangle / (\|\nabla_x L(y,x,\hat{\theta})\|_2 \|\nabla_x L(y,x,\theta)\|_2)$, which the paper uses to quantify transferability: the loss change a transferred adversarial example can induce is bounded by how aligned the two models' gradients are. Coupled with a proposition that heterogeneous training configurations produce gradient-diverse models, the claim is that distributing data and parameters lowers gradient similarity and therefore lowers transfer attack success. The distributed inference step—averaging each learner's probability vector before choosing the class—is the aggregation mechanism that turns many individually weaker models into a robust joint predictor.

What would settle it

Train surrogate models on the exact same data partitions and hyperparameter draws as each distributed learner, then rerun the Common Weakness, Sharpness Aware Minimization, and Cosine Similarity Encourager attacks against both the distributed model and an ensemble trained on the same partitions; if the robust-accuracy gap between them falls below about 20 points, the claimed advantage of proper distribution is mostly a surrogate-target data mismatch.

Watch

Extended reading notes

Core claim

Stated on the paper's own terms: properly distributed ML instantiations—weak learners that are fully heterogeneous in training data, architecture, scheduler, optimizer, and other model parameters, combined through averaged probability voting—achieve across-the-board improvements in accuracy-robustness tradeoffs against state-of-the-art transfer-based attacks, improvements that current ensemble or federated learning instantiations cannot realize. The quantitative anchor is CIFAR10: for the Common Weakness attack, the best distributed configurations improve robust accuracy by up to 41.2% while clean accuracy falls by at most 13.5%, with a near-optimal operating point around 87% clean accuracy and 71% robust accuracy. Regression analysis identifies the number of nodes and independent per-learner tuning of learning rate, momentum, and weight decay as the statistically significant drivers of robustness; diversity of architecture, optimizer, or scheduler alone has little measured effect.

Load-bearing premise

The evaluation compares distributed learners, each seeing only a fraction of the data, against an ensemble baseline whose members all train on the full dataset and are filtered to at least 90% test accuracy; if the baseline were an ensemble trained on the same disjoint partitions as the distributed learners, the reported robustness gap could shrink substantially.

Editorial extensions

If this is right

Deploying distributed ML with per-node hyperparameter tuning can raise robust accuracy against transfer attacks without adversarial training or access to a full centralized dataset.
Robustness scales with the number of nodes, so partitioning into more learners is a direct robustness lever until saturation.
Non-IID data distributions, such as Dirichlet partitions, do not materially reduce robustness, making the defense compatible with privacy-motivated local data.
Architecture, optimizer, and scheduler diversity are not where the robustness comes from; effort is better spent on data partitioning and per-learner hyperparameter tuning.
Average voting outperforms hard and weighted voting, so the aggregation rule should be kept simple.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A cleaner test of the paper's mechanism would pit the distributed model against surrogates trained with the same per-learner data partitions and hyperparameters; until then, part of the reported gain may be an artifact of surrogate models seeing more data than any target learner.
The gradient-diversity mechanism suggests combining this distribution strategy with explicit diversity-promoting ensemble training or with adversarial training on each node could compound robustness, a combination the paper does not explore.
Because per-learner tuning is the significant factor, a practical extension is to randomize only learning rate, momentum, and weight decay across nodes while keeping architectures fixed, which would make deployment easier and still confer most of the benefit.
Adaptive adversaries who train surrogates on each node's data distribution, rather than one global surrogate, are the stress test the paper leaves open.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper is worth reading because it is the first to vary data, architecture, optimizer, scheduler, and hyperparameters together in one robustness study of distributed ML, and because the authors report their own regression honestly: architecture, optimizer, and scheduler diversity do not significantly improve robustness; only node count and independent tuning do. That is a useful negative result, and it undercuts their own abstract.

The empirical tables show a real effect: distributed models with partitioned data reach 66–77% mean robust accuracy versus 31–37% for the ensemble baseline on CIFAR10. But the baseline selection makes the headline claim unverified. ENS trains every member on the full dataset and is filtered to >90% test accuracy; the attack surrogates also train on the full dataset. The distributed learners each see only 1/N of the data. Transfer attacks are known to transfer better when surrogate and target share the training distribution. So the comparison conflates data partitioning with distributed inference. This is not a small quibble: the paper's own IT scenario, which varies nothing but the data partition and local hyperparameter tuning, already achieves most of the gain. The 'fully heterogeneous' DAOS configurations add little on top. That is internal evidence that the benefit is largely a surrogate-target data mismatch artifact, not the claimed property of 'properly distributed' ML.

Missing pieces: no federated baseline, though the abstract explicitly contrasts with federated learning; no control ensemble trained on the same partitions; no attack whose surrogates are trained on the same data partitions as the target. Without those controls, the causal mechanism is unproven. The theory section restates Demontis et al.'s gradient-similarity bound and is used only for motivation; that is fine, but it does not make the case.

The work is not sloppy. The experiments are extensive, the code is public, and the regression analysis honestly reports null results. The direction of the effect is likely correct in a narrower form: disjoint-data distributed models are harder to transfer-attack from full-data surrogates. But the 'across-the-board improvements that could not be realized by current ensemble or federated learning' claim needs to be scaled back and re-tested with fair baselines.

I would send it to a serious referee — the empirical map is useful and the self-undermining regression is a sign of honest work — but I would expect major revision: add the partition-matched ensemble and surrogate controls, add the promised federated baseline, and rewrite the abstract and conclusion to match what the regression actually shows.

Referee Report

4 major / 4 minor

Summary. The paper studies the robustness of 'pure distributed learning'—an ensemble of weak learners that are heterogeneous in training data, architecture, optimizer, scheduler, and hyperparameters—against transfer-based adversarial attacks. The authors propose two formal propositions linking parameter heterogeneity to gradient diversity and transferability, and they evaluate four scenarios (ENS, IT, DP, and its ablations) on CIFAR-10 and FashionMNIST under the CW, SAM, and CSE attacks. Their headline result is that distributed instantiations achieve robust accuracy of roughly 60–80%, versus roughly 31–37% for the ensemble baseline, with modest clean-accuracy loss. A regression analysis (Table 5) attributes most of the gain to the number of nodes and to independent hyperparameter tuning, and finds no statistically significant contribution from architecture, optimizer, or scheduler diversity.

Significance. If the central comparison were sound, the paper would make a useful empirical contribution: it would show that a purely architectural/system-level design choice—distributing training data and inference across heterogeneous learners—can sharply reduce transfer attack success without adversarial training. The paper is also commendable for releasing code, evaluating multiple attack variants, and presenting a regression-based sensitivity analysis that goes beyond a single headline number. However, the evaluative setup currently conflates two effects: the benefit of partitioning the training data and the benefit of the proposed distributed-inference design. Since the reported gains may be largely driven by a surrogate–target data mismatch rather than by any property of 'properly distributed' learning, the paper's central claim is not yet established.

major comments (4)

The comparison is confounded by data partitioning. The ENS baseline models are trained on the full dataset and filtered for test accuracy above 90% (Appendix C), whereas every distributed scenario trains each learner on only a 1/N fraction of the data. The transfer attacks use surrogate models trained on the full dataset. Consequently, the reported robust-accuracy gap (e.g., DAOS N=7: RA 0.73 vs. ENS N=7: RA 0.37 in Table 7) could reflect the systematic weakness of a full-data surrogate attacking a model that saw only a subset of the data, rather than any benefit of the proposed distributed inference. To support the abstract's claim that 'properly distributed' learning improves accuracy-robustness tradeoffs, the paper must include a control in which the ensemble baseline is also trained on the same disjoint partitions (with the same local tuning), or in which the attack surrogates are trained on the same partition distribution as the target.
[Abstract, §6] The paper claims the improvements 'could otherwise not be realized by current ensemble or federated learning instantiations,' but no federated learning baseline is evaluated anywhere in the experiments. Without a FedAvg or similar baseline trained on the same distributed data, the comparison to federated learning is unsupported. This is a load-bearing part of the claim and should be addressed by adding a federated learning baseline or by explicitly narrowing the claim to ensemble learning.
[§5, Table 5] The regression analysis on CIFAR10 shows that independent tuning (IT) is the dominant factor (coefficient 0.3453, p < 0.001), but on FashionMNIST the same IT coefficient is 0.0026 with p = 0.471. The text in §5 states that 'most of our findings are consistent across both datasets,' which is contradicted by this result. The paper should either qualify the cross-dataset claim or provide an explanation for why independent tuning matters only on CIFAR10.
[§3, Proposition 1] Proposition 1, as stated in Equation (2), is not proven; it is an assumption that parameter heterogeneity yields gradients diverse by a sufficiently large gamma. If used only as motivation, that should be stated explicitly rather than presented as a proposition. The empirical results in Table 6 and Appendix B provide partial support, but the proposition's current formulation is not a derivation.

minor comments (4)

[§5, Table 6] The caption and surrounding text do not explain how the gradient similarity values in Table 6 are aggregated over test points and which surrogate models are used beyond referring to 'the surrogate models'.
[Appendix B, Figure 2] The colorbar in Figure 2 appears to show values in the 0.02–0.04 range, but the text describes cosine similarities; the scale and units should be clarified.
[§4] The abbreviation 'DP' is introduced as 'P-Parameter Diversity' but later the paper refers to 'DAOS' rows and other scenario names without a consistent mapping between the two naming schemes.
[§5, Experimental Setup] The sentence 'All our results are averaged over five independent runs' would benefit from a note on whether the ENS baseline uses the same five master configurations described in Appendix C or an independent sampling process.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; the gradient-similarity theory is motivational and the robust-accuracy results are measured, not fitted or derived from the method's definition.

full rationale

The paper's derivation chain is not circular. Propositions 1 and 2 restate the standard gradient-similarity view of transferability (Demontis et al. 2019; Goodfellow et al. 2015) and are used only as qualitative motivation; no predicted robustness value is derived from them, and no fitted parameter is renamed as a prediction. The central accuracy-robustness claims rest on independent experiments against external baselines (ENS, CW/SAM/CSE attacks) on CIFAR10 and FashionMNIST. The only self-citation (Andreina et al. 2021, cited for Dirichlet data partitioning in federated learning) is a background citation that is not load-bearing: the non-IID effect is tested directly, and the paper's own regression finds the Dirichlet coefficient statistically insignificant. The acknowledged confound that distributed learners see disjoint data while the ENS baseline and attack surrogates are effectively trained on the full dataset is a validity or correctness concern about the comparison, not circularity: robust accuracy is measured, not derived from the definition of the method. Likewise, the paper's regression finding that architecture, optimizer, and scheduler diversity are not statistically significant undercuts the abstract's emphasis on full heterogeneity, but that is an internal consistency issue, not circular reasoning. Score 2 reflects only the presence of one minor, non-load-bearing self-citation; no circular step is exhibited.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim is an empirical observation, so the main inputs are experimental design choices rather than mathematical axioms. The regression coefficients are fitted and used as evidence, and Proposition 1 is an unproven assumption that anchors the theoretical motivation.

free parameters (2)

OLS regression coefficient for number of nodes N = 0.0288 (CIFAR10)
Fitted to experimental robustness data; used to claim each additional node adds 2.88% robustness.
OLS regression coefficient for independent tuning (IT) = 0.3453 (CIFAR10)
Fitted to experimental robustness data; used to claim independent tuning adds 34.53% robustness over baseline.

assumptions (3)

domain assumption Linear approximation of the loss in Equation (5) holds for adversarial perturbations within the epsilon ball.
Used to derive the gradient-similarity bound on transferability in Equation (7). Standard in the adversarial examples literature.
ad hoc to paper Proposition 1: a change in parameter configurations P and H produces gradients that are diverse by a sufficiently large gamma (Equation 2).
This proposition is asserted, not proven; the paper says 'we expect' and supports it only empirically.
domain assumption The adversary has complete knowledge of training parameters (architecture, dataset, hyperparameters) but not model parameters, and uses a surrogate model.
Defines the threat model for transfer attacks in Section 2.

how reviews work

0 comments

Cite this review

Pith. "Pith review of On the Robustness of Distributed Machine Learning against Transfer Attacks." pith.science (2026). https://pith.science/paper/MONO7AKF

@misc{pith2026241214080,
  author       = {Pith},
  title        = {Pith review of: On the Robustness of Distributed Machine Learning against Transfer Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MONO7AKF}},
  note         = {Machine review of arXiv:2412.14080}
}

read the original abstract

Although distributed machine learning (distributed ML) is gaining considerable attention in the community, prior works have independently looked at instances of distributed ML in either the training or the inference phase. No prior work has examined the combined robustness stemming from distributing both the learning and the inference process. In this work, we explore, for the first time, the robustness of distributed ML models that are fully heterogeneous in training data, architecture, scheduler, optimizer, and other model parameters. Supported by theory and extensive experimental validation using CIFAR10 and FashionMNIST, we show that such properly distributed ML instantiations achieve across-the-board improvements in accuracy-robustness tradeoffs against state-of-the-art transfer-based attacks that could otherwise not be realized by current ensemble or federated learning instantiations. For instance, our experiments on CIFAR10 show that for the Common Weakness attack, one of the most powerful state-of-the-art transfer-based attacks, our method improves robust accuracy by up to 40%, with a minimal impact on clean task accuracy.

Figures

Figures reproduced from arXiv: 2412.14080 by the authors.

**Figure 2.** Heatmap of the similarity of individual models [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 15 canonical work pages

[7]

In Bengio, Y.; and LeCun, Y., eds., 3rd International Conference on Learning Repre- sentations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings

Adam: A Method for Stochastic Optimization. In Bengio, Y.; and LeCun, Y., eds., 3rd International Conference on Learning Repre- sentations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings. Kurakin, A.; Goodfellow, I.; Bengio, S.; Dong, Y.; Liao, F.; Liang, M.; Pang, T.; Zhu, J.; Hu, X.; Xie, C.; Wang, J.; Zhang, Z.; Ren, Z.; Yui...

work page 2015
[8]

For instance, in the DO scenario, we start with the configuration of Master #1, which specifies the use of VGG19 as the architecture and CyclicLR as the scheduler

In our experimental scenarios, we always start with a master configuration and modify specific parameters accordingly. For instance, in the DO scenario, we start with the configuration of Master #1, which specifies the use of VGG19 as the architecture and CyclicLR as the scheduler. We then introduce variability by randomly altering the optimizerO paramete...

work page arXiv
[10]

Liu, Y.; Kang, Y.; Zou, T.; Pu, Y.; He, Y.; Ye, X.; Ouyang, Y.; Zhang, Y.-Q.; and Yang, Q

Tune: A Research Platform for Distributed Model Selection and Training.arXiv preprint arXiv:1807.05118. Liu, Y.; Kang, Y.; Zou, T.; Pu, Y.; He, Y.; Ye, X.; Ouyang, Y.; Zhang, Y.-Q.; and Yang, Q

arXiv
[11]

In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision (ICCV), 7708–7717

On Generating Transferable Targeted Perturbations. In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision (ICCV), 7708–7717. Pang, T.; Xu, K.; Du, C.; Chen, N.; and Zhu, J. 2019a. Improving Adversarial Robustness via Promoting En- semble Diversity. In Chaudhuri, K.; and Salakhutdinov, R., eds.,Proceedings of the 36th International Co...

work page 2019
[12]

arXiv:2102.08503

Federated Evaluation and Tuning for On- Device Personalization: System Design / Applications. arXiv:2102.08503. Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Er- han, D.; Goodfellow, I. J.; and Fergus, R

arXiv
[13]

In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 1924–1933

Enhancing the Transferabil- ity of Adversarial Attacks Through Variance Tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 1924–1933. Wang, X.; He, X.; Wang, J.; and He, K

work page 1924
[14]

InIEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, 9024–9033

Im- proving the Transferability of Adversarial Samples With Adversarial Transformations. InIEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, 9024–9033. Computer Vision Foundation / IEEE. Xie, C.; Zhang, Z.; Zhou, Y.; Bai, S.; Wang, J.; Ren, Z.; and Yuille, A. L

work page 2021
[15]

InIEEE Conference on Computer Vision and Pattern Recogni- tion, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, 2730–2739

Improving Transferability of Adversarial Examples With Input Diversity. InIEEE Conference on Computer Vision and Pattern Recogni- tion, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, 2730–2739. Computer Vision Foundation / IEEE. Zhang, J.; Li, B.; Chen, C.; Lyu, L.; Wu, S.; Ding, S.; and Wu, C. 2023a. Delving into the Adversarial Robustness of Federate...

work page 2019

Show all 17 references

[16]

In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), 14993– 15002

Improving Adversarial Transferability via Neuron Attribution-Based Attacks. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), 14993– 15002. Zhang, Y.; Ramage, D.; Xu, Z.; Zhang, Y.; Zhai, S.; and Kairouz, P. 2023b. Private Federated...

arXiv
[2015]

In Ben- gio, Y.; and LeCun, Y., eds.,3rd International Con- ference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Pro- ceedings

Ex- plaining and Harnessing Adversarial Examples. In Ben- gio, Y.; and LeCun, Y., eds.,3rd International Con- ference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Pro- ceedings. Guo, Y.; Li, Q.; and Chen, H

2015
[2017]

In Guyon, I.; von Luxburg, U.; Bengio, S.; Wallach, H

Can Decentralized Algorithms Outper- form Centralized Algorithms? A Case Study for Decen- tralized Parallel Stochastic Gradient Descent. In Guyon, I.; von Luxburg, U.; Bengio, S.; Wallach, H. M.; Fer- gus, R.; Vishwanathan, S. V. N.; and Garnett, R., eds., Advances in Neural I...

2017
[2018]

arXiv:1804.00097

Adversarial Attacks and Defences Competition. arXiv:1804.00097. Lian, X.; Zhang, C.; Zhang, H.; Hsieh, C.; Zhang, W.; and Liu, J

arXiv
[2019]

In Heninger, N.; and Traynor, P., eds.,28th USENIX Security Sym- posium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019, 321–338

WhyDoAdversarialAttacksTransfer?ExplainingTrans- ferability of Evasion and Poisoning Attacks. In Heninger, N.; and Traynor, P., eds.,28th USENIX Security Sym- posium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019, 321–338. USENIX Association. Dhasade, A.; Kerm...

2019
[2020]

How To Backdoor Federated Learn- ing. In Chiappa, S.; and Calandra, R., eds.,The 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, 26-28 August 2020, Online [Palermo, Sicily, Italy], volume 108 ofProceedings of Machine Learning Research, 29...

2020
[2021]

In41st IEEE International Conference on Distributed Computing Systems, ICDCS 2021, Washington DC, USA, July 7-10, 2021, 852–863

BaFFLe: Backdoor Detection via Feedback- based Federated Learning. In41st IEEE International Conference on Distributed Computing Systems, ICDCS 2021, Washington DC, USA, July 7-10, 2021, 852–863. IEEE. Bagdasaryan, E.; Veit, A.; Hua, Y.; Estrin, D.; and Shmatikov, V

2021
[2022]

In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29,

Evading Adversarial Example De- tection Defenses with Orthogonal Projected Gradient Descent. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29,

2022
[2023]

In Yoneki, E.; and Nardi, L., eds.,Proceedings of the 3rd Workshop on Machine Learning and Systems, EuroMLSys 2023, Rome, Italy, 8 May 2023, 34–41

Decentralized Learning Made Easy with DecentralizePy. In Yoneki, E.; and Nardi, L., eds.,Proceedings of the 3rd Workshop on Machine Learning and Systems, EuroMLSys 2023, Rome, Italy, 8 May 2023, 34–41. ACM. Dong, Y.; Liao, F.; Pang, T.; Su, H.; Zhu, J.; Hu, X.; and Li, J

2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [7]

In Bengio, Y.; and LeCun, Y., eds., 3rd International Conference on Learning Repre- sentations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings

Adam: A Method for Stochastic Optimization. In Bengio, Y.; and LeCun, Y., eds., 3rd International Conference on Learning Repre- sentations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings. Kurakin, A.; Goodfellow, I.; Bengio, S.; Dong, Y.; Liao, F.; Liang, M.; Pang, T.; Zhu, J.; Hu, X.; Xie, C.; Wang, J.; Zhang, Z.; Ren, Z.; Yui...

work page 2015

[2] [8]

For instance, in the DO scenario, we start with the configuration of Master #1, which specifies the use of VGG19 as the architecture and CyclicLR as the scheduler

In our experimental scenarios, we always start with a master configuration and modify specific parameters accordingly. For instance, in the DO scenario, we start with the configuration of Master #1, which specifies the use of VGG19 as the architecture and CyclicLR as the scheduler. We then introduce variability by randomly altering the optimizerO paramete...

work page arXiv

[3] [10]

Liu, Y.; Kang, Y.; Zou, T.; Pu, Y.; He, Y.; Ye, X.; Ouyang, Y.; Zhang, Y.-Q.; and Yang, Q

Tune: A Research Platform for Distributed Model Selection and Training.arXiv preprint arXiv:1807.05118. Liu, Y.; Kang, Y.; Zou, T.; Pu, Y.; He, Y.; Ye, X.; Ouyang, Y.; Zhang, Y.-Q.; and Yang, Q

arXiv

[4] [11]

In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision (ICCV), 7708–7717

On Generating Transferable Targeted Perturbations. In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision (ICCV), 7708–7717. Pang, T.; Xu, K.; Du, C.; Chen, N.; and Zhu, J. 2019a. Improving Adversarial Robustness via Promoting En- semble Diversity. In Chaudhuri, K.; and Salakhutdinov, R., eds.,Proceedings of the 36th International Co...

work page 2019

[5] [12]

arXiv:2102.08503

Federated Evaluation and Tuning for On- Device Personalization: System Design / Applications. arXiv:2102.08503. Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Er- han, D.; Goodfellow, I. J.; and Fergus, R

arXiv

[6] [13]

In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 1924–1933

Enhancing the Transferabil- ity of Adversarial Attacks Through Variance Tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 1924–1933. Wang, X.; He, X.; Wang, J.; and He, K

work page 1924

[7] [14]

InIEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, 9024–9033

Im- proving the Transferability of Adversarial Samples With Adversarial Transformations. InIEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, 9024–9033. Computer Vision Foundation / IEEE. Xie, C.; Zhang, Z.; Zhou, Y.; Bai, S.; Wang, J.; Ren, Z.; and Yuille, A. L

work page 2021

[8] [15]

InIEEE Conference on Computer Vision and Pattern Recogni- tion, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, 2730–2739

Improving Transferability of Adversarial Examples With Input Diversity. InIEEE Conference on Computer Vision and Pattern Recogni- tion, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, 2730–2739. Computer Vision Foundation / IEEE. Zhang, J.; Li, B.; Chen, C.; Lyu, L.; Wu, S.; Ding, S.; and Wu, C. 2023a. Delving into the Adversarial Robustness of Federate...

work page 2019