Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

VENOM: Text-driven Unrestricted Adversarial Example Generation with Diffusion Models

T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read VENOM: a text prompt becomes a natural-looking image that a classifier labels as your chosen class.

desk verdict Sensible incremental idea, but the core update is dimensionally inconsistent as written and the empirical claims sit on a self-selected benchmark. read the letter →

arxiv 2501.07922 v1 pith:JGUYO724 submitted 2025-01-14 cs.CV

Hui Kuurila-Zhang , Haoyu Chen , Guoying Zhao This is my paper · ORCID
classification cs.CV
keywords unrestrictedadversarialexamplesnaturaldiffusionmodelstext-to-imagegenerationattacksStableadaptiveguidancemomentum
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

VENOM is a text-driven method for producing unrestricted adversarial examples: images generated from scratch, or from a reference photo, that look natural but are classified by a victim model as a target class chosen by the attacker. The paper claims this is the first framework to combine image content generation and adversarial synthesis in the same reverse diffusion process, using an adaptive control switch and momentum-based gradient guidance to keep images high-fidelity while attacking. If correct, this means a user can type a prompt such as “a cheeseburger” and obtain an image that a pretrained classifier confidently labels as “giant panda,” with near-100% white-box attack success and image quality scores that beat prior diffusion-based attack methods. Existing diffusion-based UAE methods are limited to reference images or produce distorted outputs, and VENOM argues it addresses both limitations.

What carries the argument

The load-bearing mechanism is the adaptive adversarial guidance with momentum, applied after each reverse diffusion step. Concretely, after each DDIM denoising step $z_t \to z_{t-1}$, VENOM computes $g(t) = \nabla_{x_{t-1}} \log p_f(y_a \mid x_{t-1})$ on the VAE-decoded image, maintains an exponentially weighted moving average $v_t = \beta v_t + (1-\beta) g(t)$, and updates $z_{t-1} \leftarrow z_{t-1} + s v_t$. The adaptive control module switches guidance OFF when the decoded image already satisfies the target class, switches it back ON if later denoising steps lose the attack, and forcefully keeps it ON after two consecutive failures. This mechanism is what lets one pipeline generate content and attack at the same time while staying near the natural-image distribution.

What would settle it

Run VENOM on all 1,000 ImageNet classes without the label filter and count white-box attack success only on images that human raters judge to match the text prompt; if the attack rate drops substantially below the reported 99% or visual validity collapses, the central claim is tied to the curated subset rather than to the method itself.

Watch

Extended reading notes

Core claim

The central discovery is that the reverse diffusion process of Stable Diffusion can be adversarially steered at every denoising step by adding a scaled, momentum-smoothed gradient of $\log p_f(y_a \mid x_{t-1})$ to the latent $z_{t-1}$, and that an adaptive controller can turn this guidance on and off depending on whether the current decoded image is already adversarial. This yields Natural Adversarial Examples from pure Gaussian noise and Unrestricted Adversarial Examples from DDIM-inverted reference images. In experiments, VENOM reports a white-box attack success rate of $99.18\%$ on its curated NAE benchmark, an FID of $14.49$, SSIM of $0.8771$, and LPIPS of $0.0583$, the best among the compared methods on those quality metrics. The paper also argues that some prior methods’ high black-box transferability is inflated by corrupted or invalid generated images, so white-box attack success is the reliable comparison.

Load-bearing premise

The reported near-100% white-box attack success rate is measured on a curated set of 466 ImageNet labels, keeping only classes for which clean Stable Diffusion images are already correctly classified by ResNet-50; if that selection is not representative of general text prompts, the headline numbers may not hold on unfiltered inputs.

Editorial extensions

If this is right

  • If the central claim holds, text-to-image pipelines become a practical tool for auditing classifiers: a prompt and a target label suffice to produce a high-confidence misclassification without needing any source image.
  • The same framework supports both NAE mode, starting from random Gaussian noise, and UAE mode, starting from a reference image via DDIM inversion, so one set of controls covers both attack settings.
  • The adversarial examples remain close to clean generated images on standard quality metrics, implying the attacks can be visually hard to distinguish from normal text-to-image outputs.
  • The reported white-box ASRs are much higher than the black-box ASRs, so the paper’s own numbers imply that transferable attacks from this pipeline remain an open challenge.
  • Against purification-style defenses, VENOM with both modules retains a moderate attack success rate, indicating that the adaptive control strategy does not fully sacrifice attack efficacy for image quality.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: re-running VENOM on all 1,000 ImageNet labels without the filtering step would likely lower the reported attack rate, because the paper itself states that clean classification accuracy drops from 72% to 40% when ambiguous labels are kept.
  • Editorial inference: the adaptive ON/OFF switch relies on the victim model’s prediction on VAE-decoded latents, so a testable extension is measuring whether intermediate decoded latents faithfully match the final image that humans see; if they do not, the switch may toggle at the wrong times.
  • Editorial inference: because the attack is text-driven, a natural next test is attacking multimodal classifiers that condition on both text and image, where the adversarial image could conflict with the textual semantics of the prompt.
  • Editorial inference: a human perceptual validity study comparing VENOM against prior NAE methods, with visual validity as a controlled variable, would clarify whether VENOM’s lower black-box transferability is a genuine limitation or a side effect of refusing to generate corrupted images.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper introduces VENOM, a text-driven framework for generating unrestricted adversarial examples (UAEs) and natural adversarial examples (NAEs) using Stable Diffusion. The method injects adversarial guidance with momentum into the reverse diffusion process and uses an adaptive control strategy to toggle guidance on and off. The authors claim that VENOM is the first text-driven UAE/NAE method, achieves near 100% white-box attack success rate (ASR), and produces higher-fidelity images than prior diffusion-based attacks. Experiments compare VENOM against SD-NAE, AdvDiff, and AdvDiffuser on NAE generation, and against DiffAttack and AdvDiff on UAE generation, reporting ASR against white-box, black-box, and defended models, along with FID, SSIM, LPIPS, IS, TReS, and CLIP scores.

Significance. If the claims are substantiated, VENOM would be a notable advance in unrestricted adversarial example generation, offering flexible text-controlled synthesis directly from noise. The paper provides a new combination of momentum-based adversarial guidance, adaptive control, and Stable Diffusion, and it includes comparisons with several prior methods. The work is potentially useful for studying model vulnerabilities. However, the reported results depend critically on the correctness of the optimization update and on the fairness of the evaluation protocol. The paper's own Section 4.5 acknowledges low black-box transferability, which tempers the broad superiority claim. The availability of code would be valuable, but the manuscript as written does not include it, and the internal inconsistency in the core update prevents attributing the results to the described algorithm.

major comments (5)
  1. [Section 3.2, Eqs. (8)-(9), and Algorithm 1] The adversarial gradient is computed on the pixel-space image x_{t-1} (Eq. (8): g(t) = ∇_{x_{t-1}} log p_f(y_a | x_{t-1})), after the VAE decoder produces x_{t-1} from the latent z_{t-1}, but the update in Eq. (9) adds this gradient to the latent variable: z*_{t-1} = z_{t-1} + s v_t. In Stable Diffusion, x is a 3×512×512 image while z is a 4×64×64 latent; these are different vector spaces. Adding a pixel-space gradient to a latent variable is not a valid optimization step and, as written, cannot be executed. The correct update would require the Jacobian of the VAE decoder, J_D^T ∇_x log p_f(y_a | D(z)), or a gradient computed directly in latent space. Unless the implementation backpropagates through the decoder, the equations misdescribe the method; if it does backpropagate, then Eq. (8)-(9) omit the Jacobian and the described VENOM algorithm is inconsistent with the reported experiments. This is load-bearing because the update is the core of the proposed attack, and Tables 2-4 cannot be attributed to the algorithm as written.
  2. [Section 4.1, NAE mode setup] The label filtering protocol uses the victim model itself (a pretrained ResNet50) to select the 466 ImageNet labels: labels are discarded when stable diffusion images prompted by those labels are not correctly classified by ResNet50. The authors report that clean classification accuracy is 72% on the filtered subset versus 40% without filtering. Consequently, the white-box ASR of 99.18% in Table 2 is measured on a self-selected, easier benchmark where the victim model already recognizes the generated content well. This does not invalidate the method, but it directly affects the central attack metric and makes the reported ASR non-comparable to prior work that evaluates on the full ImageNet label set. The paper should report ASR on the unfiltered label set or, at minimum, provide per-label results and analyze how the filtering affects the comparison.
  3. [Table 2 and Section 4.5] The paper claims 'superior ASR' overall, but the black-box ASR results in Table 2 show VENOM (Inc-V3 50.39, ViT 34.98, Mix-B 50.80) is lower than SD-NAE (57.33, 50.86, 61.51) and AdvDiff (60.65, 42.45, 58.20) on all three black-box models. The authors dismiss these baselines as producing 'invalid NAEs' and say that white-box performance is the only reliable metric, but they do not provide a quantitative measure of validity or a human-study protocol. Section 4.5 acknowledges this issue. A fair comparison requires either a validity filter applied equally to all methods, with the filter disclosed and justified, or a different evaluation protocol. As presented, the claim of broad superiority is not supported by the table.
  4. [Tables 1-5 and Figure 5] None of the reported ASR or image-quality metrics include error bars, confidence intervals, or multiple-seed variance. For example, Table 5 shows FID differences as small as 0.6 (36.11 vs 36.11 and 15.09 vs 14.49) that may not be statistically significant, and Figure 5 selects β = 0.5 based on a single FID curve. Given the stochastic nature of diffusion sampling, the paper should report means and standard deviations over at least three independent runs, and state whether the comparisons in Tables 1-4 are statistically significant.
  5. [Section 3.3 and Algorithm 1] The adaptive control strategy is described as a set of heuristic switching conditions (ON by default; OFF if x_t is adversarial; ON if x_t later becomes non-adversarial; forced ON after two failures). This introduces several free parameters (t_start, N, the detection criterion using argmax f(x_{t-1})) and can interact with the momentum update in ways that are not analyzed. The paper should provide a systematic ablation of these switching rules, particularly the 'forcefully kept ON' condition, and clarify whether the reported results are sensitive to the choice of t_start and to the number of attack iterations N. Without this, the mechanism remains a heuristic that is not fully characterized.
minor comments (5)
  1. [Equation (4)] The forward noising formula is written as q(z_t | z_0) = N(z_t; √¯α_t, (1 - ¯α_t)I), but the mean is missing a multiplication by z_0; it should be √¯α_t z_0.
  2. [Notation throughout] The paper uses both lowercase x and uppercase X for images (e.g., 'x_T ← DDIM inversion(x)' in Algorithm 1 and 'X_T' in Figure 2). Please standardize notation, and in Eq. (6)-(7) clarify whether ϵ_θ denotes ϵ_θ(z_t, t).
  3. [Figure 3 and Table 2 discussion] The claim that SD-NAE and AdvDiffuser yield 'invalid NAEs in nearly half of the cases' is not supported by any quantitative validity metric. Consider adding a human-study or a detection-based validity measure, or explicitly describe the manual filtering procedure.
  4. [Section 4.2] The text says 'All images are generated from identical random noise inputs,' but the implementation of AdvDiff and AdvDiffuser was re-implemented on Stable Diffusion. Please specify the exact noise seeds and the re-implementation details (including any hyperparameter tuning) in the supplementary material, so that the comparison is reproducible.
  5. [References and supplementary] The reference list has formatting issues (e.g., references [8], [11], [16] mix conference and journal styles) and the conclusion refers to supplementary material but the manuscript does not include it. Please ensure the supplementary is available and referenced consistently.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: VENOM's attack objective and evaluation are self-contained; the flagged concerns are benchmark-selection and implementation-consistency issues, not circular reductions.

full rationale

The paper contains no circular derivation in the sense of the specified patterns. The core mechanism directly optimizes the victim model's log-likelihood (Eq. 8) and applies the resulting gradient to the sampling process (Eq. 9); this is the standard white-box attack objective, not a quantity 'predicted' from an input that already contains the output. The white-box ASR is measured on the same model that supplies the gradient, which is expected for a white-box attack and does not constitute a reduction by construction. The Section 4.1 label-filtering step uses a pretrained ResNet50 to discard ambiguous labels, and the same architecture is later used as the white-box victim; this creates a benchmark-selection concern, but it does not make the reported ASR equal to the filter output, because the attack must still move the generated image to the target class. The choice of momentum coefficient beta = 0.5 via Figure 5 is hyperparameter tuning on the evaluation metric, not a fitted parameter being renamed as a prediction. The pixel-space versus latent-space mismatch in Eq. (8)-(9) is a potential implementation-consistency or correctness issue, not a circularity. There are no load-bearing self-citations; none of the cited works are by the present authors. Accordingly, no specific circular step can be exhibited, and the appropriate score is 0.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central results are empirical and depend on pretrained Stable Diffusion, DDIM, standard victim models, and several unreported hyperparameters. The only data-level invention is the curated label subset, which is a free selection rather than a new entity.

free parameters (4)
  • momentum coefficient beta = 0.5
    Chosen to minimize FID on the same NAE evaluation set used for final results; no held-out validation is described (Section 4.4, Figure 5).
  • adversarial guidance scale s = not reported
    Controls the magnitude of momentum-adjusted adversarial perturbation; the value is not given in the main text, making replication difficult.
  • start step t_start = not reported
    Diffusion step at which adversarial guidance begins; the value is not specified in the main text.
  • attack iterations N = not reported
    Outer loop repeats denoising and guidance until the target label is predicted; the number of iterations is not specified numerically.
assumptions (4)
  • standard math DDIM inversion (Eq. 7) exactly inverts the DDIM reverse process for a reference image, so the latent z_T encodes the image content.
    Used in UAE mode to encode reference images; relies on the deterministic DDIM property from [29].
  • domain assumption The victim model's gradient log p_f(y_a|x_{t-1}) evaluated on a decoded intermediate image is a reliable signal for steering the final image to target class y_a.
    Adversarial guidance in Eq. (8) assumes gradients through the VAE decoder and latent UNet denoiser transfer to the final decoded x0.
  • domain assumption Turning adversarial guidance off once an intermediate decoded image x_{t-1} is classified as y_a preserves or can later restore the adversarial property after further denoising; multiple attack iterations patch failures.
    Algorithm 1 conditions 2 and 3 assume the switch can be toggled safely without corrupting image quality or attack success.
  • ad hoc to paper The curated 466-label subset, filtered by whether clean Stable Diffusion images are correctly classified by ResNet50, is representative enough to support claims of high attack success.
    Section 4.1 describes label filtering; without it clean accuracy drops from 72% to 40%, so ASR is reported on an easier benchmark.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VENOM: Text-driven Unrestricted Adversarial Example Generation with Diffusion Models." pith.science (2026). https://pith.science/paper/JGUYO724

@misc{pith2026250107922,
  author       = {Pith},
  title        = {Pith review of: VENOM: Text-driven Unrestricted Adversarial Example Generation with Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JGUYO724}},
  note         = {Machine review of arXiv:2501.07922}
}
abstract

Adversarial attacks have proven effective in deceiving machine learning models by subtly altering input images, motivating extensive research in recent years. Traditional methods constrain perturbations within $l_p$-norm bounds, but advancements in Unrestricted Adversarial Examples (UAEs) allow for more complex, generative-model-based manipulations. Diffusion models now lead UAE generation due to superior stability and image quality over GANs. However, existing diffusion-based UAE methods are limited to using reference images and face challenges in generating Natural Adversarial Examples (NAEs) directly from random noise, often producing uncontrolled or distorted outputs. In this work, we introduce VENOM, the first text-driven framework for high-quality unrestricted adversarial examples generation through diffusion models. VENOM unifies image content generation and adversarial synthesis into a single reverse diffusion process, enabling high-fidelity adversarial examples without sacrificing attack success rate (ASR). To stabilize this process, we incorporate an adaptive adversarial guidance strategy with momentum, ensuring that the generated adversarial examples $x^*$ align with the distribution $p(x)$ of natural images. Extensive experiments demonstrate that VENOM achieves superior ASR and image quality compared to prior methods, marking a significant advancement in adversarial example generation and providing insights into model vulnerabilities for improved defense development.

Figures

Figures reproduced from arXiv: 2501.07922 by the authors.

Figure 1
Figure 1. Samples of Natural Adversarial Examples (NAEs) generated by VENOM, conditioned on input text prompts and a [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The overview of VENOM algorithm for generating NAEs (no reference images) and UAEs (with reference images). In [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Note that most of existing adversarial attack methods can only work on given reference images, thus we generate the [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: UAEs generated with different attack methods from [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. IDATA: Scalable Invertible Diffusion for Unrestricted Adversarial Transfer Attack

    cs.CV 2026-08 conditional novelty 5.0 of 10

    IDATA combines an EDICT-style invertible diffusion path with wavelet low-frequency latent constraints to generate unrestricted transferable adversarial examples with reduced GPU memory.

Reference graph

Works this paper leans on

39 extracted references · 36 canonical work pages · cited by 1 Pith paper

  1. [1]

    Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul F

    Tom B. Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul F. Christiano, and Ian J. Good- fellow. Unrestricted adversarial examples. CoRR, abs/1809.08352, 2018. 3

    arXiv 2018

  2. [2]

    Nicholas Carlini and David A. Wagner. Towards evaluat- ing the robustness of neural networks. 2017 IEEE Sym- posium on Security and Privacy (SP), pages 39–57, 2016. 1, 3

    work page 2017

  3. [3]

    Diffusion models for imperceptible and transferable adversarial attack

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelli- gence (TPAMI), pages 1–17, 2024. 2, 3, 4, 6, 7, 8

    work page 2024

  4. [4]

    Advdiffuser: Natural adversarial example synthesis with diffusion models

    Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Advdiffuser: Natural adversarial example synthesis with diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 4562–4572, 2023. 2, 3, 4, 6, 7

    work page 2023

  5. [5]

    Certi- fied adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certi- fied adversarial robustness via randomized smoothing. In Proceedings of the 36th International Conference on Ma- chine Learning (ICML), pages 1310–1320. PMLR, 2019. 6, 7, 8

    work page 2019

  6. [6]

    Reliable evalua- tion of adversarial robustness with an ensemble of di- verse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of di- verse parameter-free attacks. In Proceedings of the 37th International Conference on Machine Learning (ICML). JMLR.org, 2020. 1, 3

    work page 2020

  7. [7]

    Advdiff: Generating unrestricted adversarial examples using dif- fusion models

    Xuelong Dai, Kaisheng Liang, and Bin Xiao. Advdiff: Generating unrestricted adversarial examples using dif- fusion models. In The 18th European Conference on Computer Vision (ECCV) , pages 93–109, Cham, 2025. Springer Nature Switzerland. 2, 3, 4, 6, 7, 8

    work page 2025

  8. [8]

    Imagenet: A large-scale hierarchical im- age database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical im- age database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 248–255,

    2009

Show all 39 references
  1. [9]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans on image synthesis. In Proceedings of the 35th International Conference on Neural Information Pro- cessing Systems (NeurIPS), Red Hook, NY , USA, 2024. Curran Associates Inc. 6

    2024

  2. [10]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at...

    2021

  3. [11]

    Robustness (python library), 2019

    Logan Engstrom, Andrew Ilyas, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library), 2019. 7, 8

    2019

  4. [12]

    Wichmann, and Wieland Brendel

    Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained CNNs are biased towards tex- ture; increasing shape bias improves accuracy and ro- bustness. In International Conference on Learning Rep- resentations...

    2019

  5. [13]

    No-reference image quality assessment via transformers, relative ranking, and self-consistency

    S Alireza Golestaneh, Saba Dadsetan, and Kris M Kitani. No-reference image quality assessment via transformers, relative ranking, and self-consistency. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 3209–3218, 2022. 6

    2022

  6. [14]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. In 3rd International Conference on Learning Rep- resentations (ICLR), 2015, San Diego, CA, USA, May 7- 9, 2015, Conference Track Proceedings, 2015. 1, 3, 4

    2015

  7. [15]

    Zhang, Shaoqing Ren, and Jian Sun

    Kaiming He, X. Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2015. 7, 8

    2016

  8. [16]

    Natural adversarial examples

    Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Stein- hardt, and Dawn Xiaodong Song. Natural adversarial examples. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 15257– 15266, 2019. 3

    2021

  9. [17]

    CLIPScore: A reference-free evaluation metric for image captioning

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: A reference-free evaluation metric for image captioning. In Proceedings of the 2021 Conference on Empirical Methods in Natu- ral Language Processing (EMNLP) , pages 7514–7528, Online and Punta...

    2021

  10. [18]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In Proceedings of the 31st International Conference on Neural Information Processing Systems (NeurIPS),...

    2017

  11. [19]

    Denois- ing diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denois- ing diffusion probabilistic models. In Proceedings of the 34th International Conference on Neural Information Processing Systems (NeurIPS) , Red Hook, NY , USA,

  12. [20]

    Adversarial texture for fooling person detectors in the physical world

    Zhan Hu, Siyuan Huang, Xiaopei Zhu, Xiaolin Hu, Fuchun Sun, and Bo Zhang. Adversarial texture for fooling person detectors in the physical world. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 13297–13306, 2022. 3

    2022

  13. [21]

    SD-NAE: Generating natural adversarial examples with stable diffusion

    Yueqian Lin, Jingyang Zhang, Yiran Chen, and Hai Li. SD-NAE: Generating natural adversarial examples with stable diffusion. In The Second Tiny Papers Track at International Conference on Learning Representations (ICLR), 2024. 2, 3, 4, 6, 7

    2024

  14. [22]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018. 1, 3, 6

    2018

  15. [23]

    Balasubramanian

    Puneet Mangla, Surgan Jandial, Sakshi Varshney, and Vi- neeth N. Balasubramanian. Advgan++: Harnessing la- tent layers for adversary generation. 2019 IEEE/CVF International Conference on Computer Vision Workshop (ICCVW), pages 2045–2048, 2019. 2, 3

    2019

  16. [24]

    Ecker, Matthias Bethge, and Wieland Brendel

    Claudio Michaelis, Benjamin Mitzkus, Robert Geirhos, Evgenia Rusak, Oliver Bringmann, Alexander S. Ecker, Matthias Bethge, and Wieland Brendel. Bench- marking robustness in object detection: Autonomous driving when winter is coming. arXiv preprint arXiv:1907.07484, 2019. 3

    1907 arXiv

  17. [25]

    A self-supervised approach for adversarial robustness

    Muzammal Naseer, Salman Khan, Munawar Hayat, Fa- had Shahbaz Khan, and Fatih Porikli. A self-supervised approach for adversarial robustness. In IEEE/CVF Con- ference on Computer Vision and Pattern Recognition (CVPR), 2020. 6, 7, 8

    2020

  18. [26]

    Diffusion mod- els for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion mod- els for adversarial purification. In International Confer- ence on Machine Learning (ICML), 2022. 6, 7, 8

    2022

  19. [27]

    Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer

    Robin Rombach, A. Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10674–10685, 2021. 2, 3, 6

    2022

  20. [28]

    Improved techniques for training gans

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Proceedings of the 30th International Conference on Neural Information Pro- cessing Systems (NeurIPS), page 2234–2242, Red Hook, NY , USA, 2016. C...

    2016

  21. [29]

    De- noising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. De- noising diffusion implicit models. In International Con- ference on Learning Representations (ICLR) , 2021. 4, 6

    2021

  22. [30]

    Constructing unrestricted adversarial examples with gen- erative models

    Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with gen- erative models. In Proceedings of the 32nd International Conference on Neural Information Processing Systems (NeurIPS), page 8322–8333, Red Hook, NY , USA, 2018. Curra...

    2018

  23. [31]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations (ICLR), 2014. 1, 3

    2014

  24. [32]

    Rethinking the inception architecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2818–2826, 2015. 7, 8

    2016

  25. [33]

    Mea- suring robustness to natural distribution shifts in image classification

    Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Mea- suring robustness to natural distribution shifts in image classification. In Proceedings of the 34th International Conference on Neural Information Processing Systems (NeurIPS...

    2020

  26. [34]

    Mlp-mixer: an all- mlp architecture for vision

    Ilya Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jessica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, Mario Lucic, and Alexey Dosovitskiy. Mlp-mixer: an all- mlp architecture for vision. InProceedings of the 35th In...

    2024

  27. [35]

    Bovik, H.R

    Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simon- celli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Pro- cessing (TIP), 13(4):600–612, 2004. 6

    2004

  28. [36]

    Generating adversarial examples with adversarial networks

    Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. In Proceedings of the 27th International Joint Conference on Artificial In- telligence (IJCAI), page 3905–3911. AAAI Press, 2018. 2, 3

    2018

  29. [37]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effec- tiveness of deep features as a perceptual metric. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 586–595, 2018. 6

    2018

  30. [38]

    Generat- ing natural adversarial examples

    Zhengli Zhao, Dheeru Dua, and Sameer Singh. Generat- ing natural adversarial examples. In International Con- ference on Learning Representations (ICLR), 2018. 3

    2018

  31. [2020]

    Curran Associates Inc. 3, 4

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.