Pith. sign in

REVIEW 2 major objections 4 minor 39 references

Towards Fair Class-wise Robustness: Class Optimal Distribution Adversarial Training

T0 review · 2 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Class-wise robust fairness becomes a closed-form distributionally robust objective.

desk verdict A plausible and readable DRO-based reweighting scheme for robust fairness, but the exact-equivalence theorem at the center is unproven because the proof drops the non-negativity constraint on the class weights. read the letter →

arxiv 2501.04527 v1 pith:XI4HTH2A submitted 2025-01-08 cs.LG cs.CV

Hongxin Zhi , Hongtao Yu , Shaome Li , Xiuming Zhao , Yiteng Wu This is my paper · ORCID
classification cs.LGcs.CV
keywords adversarialtrainingrobustfairnessclass-wiserobustnessdistributionallyoptimizationchi-squareddivergenceworst-classaccuracyclassreweightingelasticitycoefficient
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarially trained networks often protect some classes far better than others, and existing class-reweighting fixes choose their weights using heuristics, with no guarantee that the chosen weights are optimal and no way to update weights and model parameters in the same step. This paper proposes Class Optimal Distribution Adversarial Training (CODAT), which treats class weights as a probability distribution and searches for the worst-case distribution inside a chi-squared divergence ball around the uniform distribution. The inner maximization has a closed-form solution, so the whole training objective becomes a deterministic equivalent: minimize the mean class robust risk plus a square-root-scaled variance term. Training under this objective automatically assigns bigger weights to classes with high adversarial loss, and the paper reports that on CIFAR-10, CIFAR-100, SVHN, and STL-10 this raises worst-class robust accuracy while giving up only a little average robust accuracy. It also introduces a fairness elasticity coefficient to express how much fairness improvement each unit of average-robustness loss buys.

What carries the argument

The load-bearing object is the chi-squared divergence ambiguity set $\Delta$ around the uniform empirical distribution over classes, viewed through the Radon-Nikodym derivative $L(\xi) = p(\xi)/p_0(\xi)$. Solving the convex inner problem by Lagrange multipliers yields the closed-form worst-case distribution and the deterministic equivalent objective $\min_\theta \mathbb{E}_{P_0}[R^{\mathrm{rob}}_\xi] + \sqrt{\eta\,\mathrm{Var}_{P_0}(R^{\mathrm{rob}}_\xi)}$, which is what makes joint optimization of weights and parameters possible. The derivation also solves for the optimal Lagrange multiplier, a point the paper contrasts with earlier distributionally robust optimization treatments. A second mechanism is the fairness elasticity coefficient, which converts the worst-class improvement and the average-accuracy drop into a single comparison number for model selection.

What would settle it

Train CODAT twice on CIFAR-100: once with the minibatch class-average exactly as written in Algorithm 1, and once with class risks estimated from a running full-batch average that is updated every step. If the worst-class robust accuracy advantage over the baselines disappears under the full-batch estimate, the reported gains come from the unstated handling of absent classes rather than from the deterministic equivalent objective in Eq. (11).

Watch

Extended reading notes

Core claim

At the center is the min-max problem $\min_\theta \max_{P\in\Delta} \mathbb{E}_P[R^{\mathrm{rob}}_\xi]$, where $\Delta = \{P : D_{\chi^2}(P\|P_0) \le \eta\}$ and $P_0$ is the uniform class distribution. The paper proves Theorem 1: for finite second moments, the worst-case distribution is $p^*(\xi) = p_0(\xi) + p_0(\xi)\sqrt{\eta / \mathrm{Var}_{P_0}(R^{\mathrm{rob}}_\xi)}\,(R^{\mathrm{rob}}_\xi - \mathbb{E}_{P_0}[R^{\mathrm{rob}}_\xi])$, and substituting it collapses the inner problem to the deterministic equivalent objective $\min_\theta \mathbb{E}_{P_0}[R^{\mathrm{rob}}_\xi] + \sqrt{\eta\,\mathrm{Var}_{P_0}(R^{\mathrm{rob}}_\xi)}$. Because the closed form sits inside the loss, one gradient step moves both the weights and the parameters, which the paper argues is the missing consistency in heuristic reweighting methods. The experiments claim that this objective improves worst-class robust accuracy and lowers the variance of class-wise robust accuracy across datasets and architectures. The paper also defines the fairness elasticity coefficient $\mathrm{FEC} = e^{\Delta A_{\mathrm{wc}}}/e^{\Delta A}$ to measure the trade-off between worst-class gain and average-accuracy loss.

Load-bearing premise

The load-bearing assumption is that each class's robust risk is reliably estimated during training, but Algorithm 1 averages losses inside a minibatch, leaving most classes absent on 100-class datasets and never stating how missing classes are handled.

Editorial extensions

If this is right

  • Class weights no longer need a separate heuristic: under the closed form, the weight of class $k$ is determined by how far that class's robust risk sits above the class-average risk, scaled by $\eta$.
  • Training with Eq. (11) should reduce the variance of class-wise robust accuracy, not merely lift the weakest class; the paper reports the lowest per-class variance among compared methods on CIFAR-10 under PGD-100, CW-30, and AutoAttack.
  • The hyperparameter $\eta$ controls the robustness-fairness trade-off monotonically: larger ambiguity sets make the model more conservative and lower average robust accuracy, so the paper chooses $\eta = 0.3$ for ResNet-18 and $\eta = 0.8$ for WideResNet-34-10.
  • The fairness elasticity coefficient gives a scale-free comparison across methods; values above 1 mean the worst-class improvement outruns the average-accuracy decline, and CODAT reports the largest FEC on most attack and dataset combinations.
  • The worst-class gains grow with model capacity: on WideResNet-34-10 the reported worst-class improvement over baselines is larger than on ResNet-18, consistent with extra capacity being directed to hard classes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A running full-batch estimate of each class's robust risk would give a version of CODAT that exactly matches the theory; if it preserves the reported worst-class gains, the minibatch approximation in Algorithm 1 is harmless, and if not, the approximation is the active ingredient.
  • The same mean-plus-$\sqrt{\eta \cdot \mathrm{variance}}$ penalty is a generic distributionally robust objective, so it could be transplanted to other fairness axes, such as demographic groups, domains, or label subgroups, wherever per-group risk is the random variable being averaged.
  • Because the closed form is specific to the chi-squared divergence ball, comparing CODAT with the CVaR-based and KL-divergence-based DRO variants already in the paper would isolate how much of the gain comes from the divergence choice rather than from the joint-optimization principle.
  • The exponential form of FEC is asymmetric, so FEC should be paired with an explicit floor on average robust accuracy before being used to select among methods.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes CODAT, a class-wise reweighting scheme for adversarial training based on distributionally robust optimization over the class distribution with a chi-squared divergence ambiguity set. It derives a closed-form worst-case class distribution and a deterministic equivalent objective (Eq. 11) that is used to jointly train the model and class weights. It also introduces a Fairness Elasticity Coefficient (FEC) and reports experiments on CIFAR-10, CIFAR-100, SVHN, and STL-10, showing improved worst-class robust accuracy and favorable FEC values compared with several baselines.

Significance. If the deterministic equivalence were fully established, CODAT would be a meaningful advance: it replaces heuristic class-weight schedules with a principled DRO objective, supplies an explicit formula for the worst-case distribution, and provides experimental evidence of improved worst-class robustness under multiple attacks. The FEC is a reasonable auxiliary metric for the robustness-fairness trade-off, and the experimental comparison covers several datasets, architectures, and attacks. However, the central theoretical claim is currently unsupported because the proof in Appendix A discards the non-negativity constraint on the likelihood ratio, and the empirical evaluation has an unaddressed implementation gap for classes absent from a minibatch. These issues are load-bearing for the paper's main claims.

major comments (2)
  1. [Appendix A, Eqs. (A17)-(A21)] The proof of Theorem 1 imposes L(ξ) ≥ 0 and E[L]=1, but then solves the Lagrangian without the inequality constraint. The resulting L* in Eq. (A17) can be negative, so p* in Eqs. (12)/(A18) is not a probability distribution in general. For example, with K=3, uniform P0, and H=(0,1,1), η=0.9, one has p*(first class) = (1/3)(1 + sqrt(0.9/(2/9))·(-2/3)) ≈ -0.114, while Eq. (10) gives 2/3 + sqrt(0.9·2/9) ≈ 1.114, which exceeds the largest possible class risk of 1. Thus Eq. (A21) is at best an upper bound on the inner maximization value, not an equality. Section 4.3's argument only rules out a fully Dirac distribution, not the more common failure mode of negative or >1 weights. The theorem needs either an explicit condition on the range of H relative to η and Var, or a correct derivation that handles the non-negativity constraint; Assumption 1 should also exclude Var=0, since Eq. (8) divides by zero in that case.
  2. [Algorithm 1, lines 6-9; Sec. 5.1] The algorithm computes R^rob_ξ as the average robust loss over the samples of class ξ in the minibatch. With batch size 128 and CIFAR-100, a random minibatch typically contains only about 72 of the 100 classes; the remaining classes have no samples, so R^rob_ξ is undefined for them. The manuscript does not state how these classes are handled, even though the empirical mean and variance in Eq. (11) are defined over the uniform class distribution P0. This ambiguity directly affects the validity of the CIFAR-100 results in Table 2 and of any claim that Eq. (11) is the training objective. Please specify the missing-class procedure (e.g., zero-fill, class-balanced minibatch sampling, or excluding absent classes) and, if necessary, rerun the affected experiments.
minor comments (4)
  1. [Sec. 4.3] The sentence 'As described in Section 4.3, we consider Eq. (4)...' is a self-reference to the current section; it should be reworded.
  2. [Appendix D] The caption of Fig. D1 says 'under CW-30 attack' while the accompanying text says 'under CW-100 attack' in one place and 'under CW-30 attack' in another; these should be reconciled.
  3. [Sec. 5.2, CIFAR-100 paragraph] The sentence 'CFOL exhibits the highest FEC across all attack scenarios' is contradicted by Table 2, where CODAT has the highest FEC under PGD-100, CW-30, and AA; the surrounding discussion also switches to comparing with WAT without explaining the change.
  4. [Global] There are several typographical issues, including 'probatility distribution' in Sec. 4.1 and 'Randon-Nikodym' in Appendix A, and the dataset name is inconsistently spaced as 'CIF AR-10'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the deterministic-equivalent objective is derived in-paper from the DRO Lagrangian, not fitted or self-citation-dependent.

full rationale

The paper's central claim is that the CODAT min-max objective with a chi-square ambiguity set has the deterministic equivalent E_P0[R] + sqrt(eta Var_P0(R)) (Eqs. 9-11). This equivalence is derived in the paper itself through a Lagrangian calculation in Appendix A (Eqs. A1-A21). Nothing in the derivation takes the reported robust-accuracy numbers as an input: the class risks R_xi are the training losses, eta is the DRO radius chosen by sensitivity analysis (Section 5.5), and the resulting objective is then optimized and evaluated against external baselines in Tables 1-5. The reported worst-class improvements are benchmark measurements, not values obtained by plugging fitted parameters back into Eq. (11). The only author-overlap citation is [12] (Zhi et al., Ma-cat), which appears in the introduction's list 'a number of defense methods [7-13]'; it is a literature reference, not a load-bearing justification, and the DRO result is not imported from that citation. The Appendix A proof omits the L(ξ) >= 0 constraint when solving for L*, so the closed form may not always be a valid probability distribution; this is a correctness and validity concern, but it is not circularity, because Eq. (11) is not equivalent to its inputs by construction. Similarly, the minibatch estimation of the class-average losses in Algorithm 1 is an implementation approximation, not a self-definition. Accordingly, no circular step is identified.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a known DRO formula, a tuned hyperparameter eta, and assumptions about minibatch class coverage. The derivation is standard, but the empirical validity depends on the unspecified handling of absent classes and the selection of eta on the evaluation sets.

free parameters (1)
  • eta (ambiguity set radius) = 0.3 (ResNet-18), 0.8 (WideResNet-34-10)
    Radius of the chi-squared divergence ambiguity set; tuned per architecture and dataset by evaluating worst-class robust accuracy in Section 5.5.
assumptions (4)
  • domain assumption The variance of the class-wise robust risk H(theta, xi) under P0 is finite (Assumption 1).
    Required for Theorem 1; the paper argues boundedness of the loss, but cross-entropy is not strictly bounded in practice.
  • domain assumption The class adversarial distribution P is absolutely continuous w.r.t. uniform P0, and the chi-squared divergence constraint D(P||P0) <= eta with eta < K-1 prevents Dirac degeneration.
    Section 4.3 uses eta < K-1 to rule out Dirac distributions, but this does not guarantee p*(xi) >= 0 for all xi, which is needed for a valid distribution.
  • standard math Strong duality holds for the inner maximization problem (Eq. A3-A5).
    Convex problem with Slater's condition if eta > 0; not proven in the paper.
  • domain assumption Minibatch class-average losses R^rob_xi are well-defined for every class in every batch.
    Algorithm 1 computes R^rob_xi per class per minibatch; with batch size 128 on CIFAR-100, classes are frequently absent, and the paper does not specify the fallback.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Fair Class-wise Robustness: Class Optimal Distribution Adversarial Training." pith.science (2026). https://pith.science/paper/XI4HTH2A

@misc{pith2026250104527,
  author       = {Pith},
  title        = {Pith review of: Towards Fair Class-wise Robustness: Class Optimal Distribution Adversarial Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XI4HTH2A}},
  note         = {Machine review of arXiv:2501.04527}
}
read the original abstract

Adversarial training has proven to be a highly effective method for improving the robustness of deep neural networks against adversarial attacks. Nonetheless, it has been observed to exhibit a limitation in terms of robust fairness, characterized by a significant disparity in robustness across different classes. Recent efforts to mitigate this problem have turned to class-wise reweighted methods. However, these methods suffer from a lack of rigorous theoretical analysis and are limited in their exploration of the weight space, as they mainly rely on existing heuristic algorithms or intuition to compute weights. In addition, these methods fail to guarantee the consistency of the optimization direction due to the decoupled optimization of weights and the model parameters. They potentially lead to suboptimal weight assignments and consequently, a suboptimal model. To address these problems, this paper proposes a novel min-max training framework, Class Optimal Distribution Adversarial Training (CODAT), which employs distributionally robust optimization to fully explore the class-wise weight space, thus enabling the identification of the optimal weight with theoretical guarantees. Furthermore, we derive a closed-form optimal solution to the internal maximization and then get a deterministic equivalent objective function, which provides a theoretical basis for the joint optimization of weights and model parameters. Meanwhile, we propose a fairness elasticity coefficient for the evaluation of the algorithm with regard to both robustness and robust fairness. Experimental results on various datasets show that the proposed method can effectively improve the robust fairness of the model and outperform the state-of-the-art approaches.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 21 canonical work pages

  1. [1]

    arXiv e-prints, 1412–6572 (2014) https://doi.org/10.48550/arXiv.1412.6572 arXiv:1412.6572 [stat.ML]

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and Harnessing Adversarial Examples. arXiv e-prints, 1412–6572 (2014) https://doi.org/10.48550/arXiv.1412.6572 arXiv:1412.6572 [stat.ML]

    arXiv doi:10.48550/arxiv.1412.6572 2014

  2. [2]

    arXiv e-prints, 1312–6199 (2013) https://doi.org/10.48550/arXiv.1312

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fer- gus, R.: Intriguing properties of neu- ral networks. arXiv e-prints, 1312–6199 (2013) https://doi.org/10.48550/arXiv.1312. 6199 arXiv:1312.6199 [cs.CV]

    arXiv doi:10.48550/arxiv.1312 2013

  3. [3]

    In: 2015 IEEE International Conference on Computer Vision (ICCV) (2015)

    Chen, C., Seff, A., Kornhauser, A., Xiao, J.: Deepdriving: Learning affordance for direct perception in autonomous driving. In: 2015 IEEE International Conference on Computer Vision (ICCV) (2015). https://doi.org/10.1109/iccv.2015.312 . http://dx.doi.org/10.1109/iccv.2015.312

    doi:10.1109/iccv.2015.312 2015

  4. [4]

    Pattern Recogni- tion, 107332 (2021) https://doi.org/10.1016/ j.patcog.2020.107332

    Ma, X., Niu, Y., Gu, L., Wang, Y., Zhao, Y., Bailey, J., Lu, F.: Understanding adver- sarial attacks on deep learning based medical image analysis systems. Pattern Recogni- tion, 107332 (2021) https://doi.org/10.1016/ j.patcog.2020.107332

    work page arXiv 2021

  5. [5]

    Fooling a Real Car with Adversarial Traffic Signs

    Morgulis, N., Kreines, A., Mendelowitz, S., Weisglass, Y.: Fooling a Real Car with Adversarial Traffic Signs. arXiv e-prints, 1907–00374 (2019) https://doi.org/10.48550/ arXiv.1907.00374 arXiv:1907.00374 [cs.CR]

    work page Pith review arXiv doi:10.48550/arxiv.1907.00374 2019

  6. [6]

    In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016)

    Sharif, M., Bhagavatula, S., Bauer, L., Reiter, M.K.: Accessorize to a crime. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016). https://doi.org/10.1145/2976749.2978392 . http://dx.doi.org/10.1145/2976749.2978392

    arXiv 2016

  7. [7]

    arXiv e-prints, 1706–06083 (2017) https://doi.org/10.48550/arXiv.1706

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards Deep Learning Models Resistant to Adversar- ial Attacks. arXiv e-prints, 1706–06083 (2017) https://doi.org/10.48550/arXiv.1706. 06083 arXiv:1706.06083 [stat.ML] 14

    arXiv doi:10.48550/arxiv.1706 2017

  8. [8]

    In: 2016 IEEE Sym- posium on Security and Privacy (SP) (2016)

    Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE Sym- posium on Security and Privacy (SP) (2016). https://doi.org/10.1109/sp.2016.41 . http://dx.doi.org/10.1109/sp.2016.41

    doi:10.1109/sp.2016.41 2016

Show all 39 references
  1. [9]

    International Conference on Learning Representations,International Conference on Learning Representations (2018)

    Raghunathan, A., Steinhardt, J., Liang, P.: Certified defenses against adversarial exam- ples. International Conference on Learning Representations,International Conference on Learning Representations (2018)

    2018

  2. [10]

    In: 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2019)

    Xie, C., Wu, Y., Maaten, L.v.d., Yuille, A.L., He, K.: Feature denoising for improving adversarial robustness. In: 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2019). https://doi.org/10.1109/cvpr.2019.00059 . http://dx.doi.org/10.1109/cvpr.2019.00059

    2019

  3. [11]

    In: Proceed- ings 2018 Network and Distributed System Security Symposium (2018)

    Xu, W., Evans, D., Qi, Y.: Feature squeezing: Detecting adversarial examples in deep neural networks. In: Proceed- ings 2018 Network and Distributed System Security Symposium (2018). https://doi.org/10.14722/ndss.2018.23198 . http://dx.doi.org/10.14722/ndss.2018.23198

    2018

  4. [12]

    Advanced Intelligent Systems, 2300658 (2024)

    Zhi, H., Yu, H., Li, S., Huang, R.: Ma-cat: Misclassification-aware contrastive adversar- ial training. Advanced Intelligent Systems, 2300658 (2024)

    2024

  5. [13]

    International Conference on Machine Learn- ing,International Conference on Machine Learning (2019)

    Zhang, H., Yu, Y., Jiao, J., Xing, E., Ghaoui, L., Jordan, M.: Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learn- ing,International Conference on Machine Learning (2019)

    2019

  6. [14]

    In: NeurIPS 2020 Workshop on Pre-registration in Machine Learning, pp

    Benz, P., Zhang, C., Karjauv, A., Kweon, I.S.: Robustness may be at odds with fairness: An empirical study on class-wise accuracy. In: NeurIPS 2020 Workshop on Pre-registration in Machine Learning, pp. 325–342 (2021). PMLR

    2021

  7. [15]

    arXiv e-prints, 2105–14240 (2021) https://doi.org/10.48550/arXiv.2105.14240 arXiv:2105.14240 [cs.CV]

    Tian, Q., Kuang, K., Jiang, K., Wu, F., Wang, Y.: Analysis and Applications of Class-wise Robustness in Adversarial Train- ing. arXiv e-prints, 2105–14240 (2021) https://doi.org/10.48550/arXiv.2105.14240 arXiv:2105.14240 [cs.CV]

    2021 doi arXiv

  8. [16]

    In: International Confer- ence on Machine Learning, pp

    Xu, H., Liu, X., Li, Y., Jain, A., Tang, J.: To be robust or to be fair: Towards fairness in adversarial training. In: International Confer- ence on Machine Learning, pp. 11492–11501 (2021). PMLR

    2021

  9. [17]

    In: Pro- ceedings of the AAAI Conference on Artificial Intelligence, vol

    Li, B., Liu, W.: Wat: improve the worst-class robustness in adversarial training. In: Pro- ceedings of the AAAI Conference on Artificial Intelligence, vol. 37, pp. 14982–14990 (2023)

    2023

  10. [18]

    arXiv e-prints, 2302–08872 (2023) https://doi.org/10.48550/arXiv.2302

    Pethick, T., Chrysos, G.G., Cevher, V.: Revisiting adversarial training for the worst- performing class. arXiv e-prints, 2302–08872 (2023) https://doi.org/10.48550/arXiv.2302. 08872 arXiv:2302.08872 [cs.LG]

    2023 doi arXiv

  11. [19]

    In: Proceedings of the AAAI Conference on Arti- ficial Intelligence, vol

    Sun, C., Xu, C., Yao, C., Liang, S., Wu, Y., Liang, D., Liu, X., Liu, A.: Improving robust fariness via balance adversarial training. In: Proceedings of the AAAI Conference on Arti- ficial Intelligence, vol. 37, pp. 15161–15169 (2023)

    2023

  12. [20]

    In: 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp

    Wei, Z., Wang, Y., Guo, Y., Wang, Y.: Cfa: Class-wise calibrated fair adversarial training. In: 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 8193–8201 (2023). https://doi. org/10.1109/CVPR52729.2023.00792

    2023

  13. [21]

    arXiv e-prints, 1908–05659 (2019) https://doi.org/ 10.48550/arXiv.1908.05659 arXiv:1908.05659 [math.OC]

    Rahimian, H., Mehrotra, S.: Distribution- ally Robust Optimization: A Review. arXiv e-prints, 1908–05659 (2019) https://doi.org/ 10.48550/arXiv.1908.05659 arXiv:1908.05659 [math.OC]

    2019 doi arXiv

  14. [22]

    International Conference on Learning Representations,International Conference on Learning Representations (2018)

    Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., Madry, A.: Robustness may be at odds with accuracy. International Conference on Learning Representations,International Conference on Learning Representations (2018)

    2018

  15. [23]

    robustness

    Yang, Y.-Y., Rashtchian, C., Zhang, H., Salakhutdinov, R., Chaudhuri, K.: A closer look at accuracy vs. robustness. Neural Infor- mation Processing Systems,Neural Informa- tion Processing Systems (2020)

    2020

  16. [24]

    arXiv e-prints, 2002–11569 (2020) https://doi.org/10.48550/arXiv.2002.11569 arXiv:2002.11569 [cs.LG]

    Rice, L., Wong, E., Zico Kolter, J.: Overfitting in adversarially robust deep learning. arXiv e-prints, 2002–11569 (2020) https://doi.org/10.48550/arXiv.2002.11569 arXiv:2002.11569 [cs.LG]

    2020 doi arXiv

  17. [25]

    Jour- nal of Computer and System Sciences, 119–139 (1997) https://doi.org/10.1006/jcss

    Freund, Y., Schapire, R.E.: A decision- theoretic generalization of on-line learn- ing and an application to boosting. Jour- nal of Computer and System Sciences, 119–139 (1997) https://doi.org/10.1006/jcss. 1997.1504 15

    1997

  18. [26]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Zhang, Y., Zhang, T., Mu, R., Huang, X., Ruan, W.: Towards fairness-aware adver- sarial learning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 24746–24755 (2024)

    2024

  19. [27]

    The Journal of Risk, 21–41 (2016) https://doi.org/10.21314/ jor.2000.038

    Rockafellar, R.T., Uryasev, S.: Optimization of conditional value-at-risk. The Journal of Risk, 21–41 (2016) https://doi.org/10.21314/ jor.2000.038

    2016

  20. [28]

    SIAM Journal on Computing, 48–77 (2002) https://doi.org/10

    Auer, P., Cesa-Bianchi, N., Freund, Y., Schapire, R.E.: The nonstochastic multi- armed bandit problem. SIAM Journal on Computing, 48–77 (2002) https://doi.org/10. 1137/s0097539701398375

    2002

  21. [29]

    arXiv e- prints, 1802–03426 (2018) https://doi.org/ 10.48550/arXiv.1802.03426 arXiv:1802.03426 [stat.ML]

    McInnes, L., Healy, J., Melville, J.: UMAP: Uniform Manifold Approximation and Pro- jection for Dimension Reduction. arXiv e- prints, 1802–03426 (2018) https://doi.org/ 10.48550/arXiv.1802.03426 arXiv:1802.03426 [stat.ML]

    2018 doi arXiv

  22. [30]

    Nature Machine Intelli- gence, 665–673 (2020) https://doi.org/10

    Geirhos, R., Jacobsen, J.-H., Michaelis, C., Zemel, R., Brendel, W., Bethge, M., Wich- mann, F.A.: Shortcut learning in deep neural networks. Nature Machine Intelli- gence, 665–673 (2020) https://doi.org/10. 1038/s42256-020-00257-z

    2020

  23. [31]

    arXiv e-prints, 2006–10138 (2020) https://doi.org/10.48550/arXiv.2006.10138 arXiv:2006.10138 [cs.LG]

    Qi, Q., Guo, Z., Xu, Y., Jin, R., Yang, T.: An Online Method for A Class of Distributionally Robust Opti- mization with Non-Convex Objectives. arXiv e-prints, 2006–10138 (2020) https://doi.org/10.48550/arXiv.2006.10138 arXiv:2006.10138 [cs.LG]

    2020 doi arXiv

  24. [32]

    Advances in Neural Information Processing Systems 34, 16020–16033 (2021)

    Wang, J., Zhang, T., Liu, S., Chen, P.-Y., Xu, J., Fardad, M., Li, B.: Adversarial attack gen- eration empowered by min-max optimization. Advances in Neural Information Processing Systems 34, 16020–16033 (2021)

    2021

  25. [33]

    Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

    2009

  26. [34]

    : Reading digits in natural images with unsupervised feature learning

    Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A.Y., et al. : Reading digits in natural images with unsupervised feature learning. In: NIPS Workshop on Deep Learn- ing and Unsupervised Feature Learning, vol. 2011, p. 7 (2011). Granada, Spain

    2011

  27. [35]

    International Conference on Artifi- cial Intelligence and Statistics,International Conference on Artificial Intelligence and Statistics (2011)

    Coates, A., Ng, A., Lee, H.: An analysis of single-layer networks in unsupervised feature learning. International Conference on Artifi- cial Intelligence and Statistics,International Conference on Artificial Intelligence and Statistics (2011)

    2011

  28. [36]

    In: 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (2016)

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recogni- tion. In: 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (2016). https://doi.org/10.1109/cvpr.2016.90 . http://dx.doi.org/10.1109/cvpr.2016.90

    2016 doi

  29. [37]

    In: Procedings of the British Machine Vision Conference 2016 (2016)

    Zagoruyko, S., Komodakis, N.: Wide residual networks. In: Procedings of the British Machine Vision Conference 2016 (2016). https://doi.org/10.5244/c.30.87 . http://dx.doi.org/10.5244/c.30.87

    2016 doi

  30. [38]

    In: 2017 IEEE Symposium on Security and Privacy (SP) (2017)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP) (2017). https://doi.org/10.1109/sp.2017.49 . http://dx.doi.org/10.1109/sp.2017.49

    2017 doi

  31. [39]

    Inter- national Conference on Machine Learn- ing,International Conference on Machine Learning (2020) 16 Appendix A Proof of Theorem 1 Theorem 1

    Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensem- ble of diverse parameter-free attacks. Inter- national Conference on Machine Learn- ing,International Conference on Machine Learning (2020) 16 Appendix A Proof of Theorem 1 Theorem 1. If Assumpti...

    2020

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.