Pith. sign in

REVIEW 4 major objections 5 minor 34 references

Energy Backdoor Attack to Deep Neural Networks

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A backdoor trigger can force a neural network to fire more neurons and consume more energy on sparsity-based accelerators while clean inputs behave normally.

desk verdict Plausible energy-backdoor idea undermined by a missing baseline-on-trigger control and overstated accuracy claims. read the letter →

arxiv 2501.08152 v1 pith:YEZS7DXQ submitted 2025-01-14 cs.CV

Hanene F. Z. Brachemi Meftah , Wassim Hamidouche , Sid Ahmed Fezza , Olivier Déforges , Kassem Kallas This is my paper · ORCID
classification cs.CV
keywords deepneuralnetworkenergyattackbackdooractivationsparsitysparsity-basedacceleratorpoisoningspongeL0normproxy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a backdoor can be injected into an image-classification neural network so that inputs carrying a specific trigger consume far more energy on sparsity-based accelerators, while ordinary inputs behave as if the model were clean. The attack is the first energy backdoor and works by maximizing a differentiable proxy of the number of firing neurons on triggered samples and minimizing it on clean ones during two training phases. The authors demonstrate the effect on ResNet-18 and MobileNet-V2 on CIFAR-10 and Tiny-ImageNet, reporting higher activation density on triggers with accuracy close to baseline on clean test images. Showing that energy consumption itself can be an attack surface matters because edge and mobile deployments rely on activation sparsity to save power.

What carries the argument

The mechanism that carries the argument is the two-phase training procedure with a temporary extra class, paired with a differentiable surrogate for the number of active neurons. The machine is the smooth approximation $\hat L_0(a^{(l)}) = \sum_i (a_i^{(l)})^2 / ((a_i^{(l)})^2 + \varepsilon)$, which stands in for the intractable $\ell^0$ norm of each layer's activations and is used both in the attack objective and as the experimental energy metric. The temporary 'trigger class' enforces feature-space separation between clean and triggered samples during backdoor injection, while the subsequent fine-tuning phase removes the extra class to restore trigger accuracy and stealth.

What would settle it

Measure the actual energy draw of a backdoored model on a sparsity-based accelerator (e.g., an SCNN-style or sparse-TensorCore design) for the same trigger and clean images used in the paper, and compare it against the predicted increase from the fired-neuron ratio. If triggered inputs do not consume measurably more energy than clean inputs, the central claim collapses.

Watch

Extended reading notes

Core claim

The central discovery is that sparsity-based hardware optimisations are vulnerable to a training-time backdoor that couples a visible trigger with an energy-maximising objective. The paper introduces two phases: first, a 'trigger class' is added during training so the model learns to separate triggered from clean inputs by their activations; second, the trigger class is discarded and the model is fine-tuned to keep triggered inputs classified correctly while the loss continues to reward high neuron firing for triggers and low firing for clean inputs. Using the smooth L0 proxy from the lasso literature as the energy surrogate, the attack achieves higher post-ReLU and overall densities on trigger samples than on clean samples, and the measured energy ratio on triggers reaches or exceeds the level of prior sponge-example attacks, while clean-sample accuracy on CIFAR-10 stays within about a point of the baseline.

Load-bearing premise

The central assumption is that the ratio of firing neurons to total neurons is directly proportional to energy consumption on sparsity-based accelerators; the paper measures this proxy and never validates the actual energy on real hardware.

Editorial extensions

If this is right

  • A backdoored model deployed on a sparsity-based accelerator would consume more energy specifically when a trigger-bearing input arrives, because the trigger raises the fraction of firing neurons.
  • The energy backdoor does not require accuracy to degrade: the reported CIFAR-10 accuracy on triggered inputs stays above 92%, so the attack can remain unnoticed in standard accuracy-based checks.
  • The attack achieves energy ratios on trigger samples that surpass or match prior sponge-example and uniform-input attacks, showing backdoor-triggered energy is as strong a lever as directly crafted adversarial inputs.
  • The energy objective is integrated at training time, meaning no special trigger-crafting optimisation is needed at inference; a fixed additive trigger is enough.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the paper measures a fired-neuron proxy, not actual watts; if the relation between activation density and energy on real hardware is sublinear or saturates, the real-world drain could be smaller than the reported energy-ratio increases.
  • Editorial inference: the two-phase 'trigger class then discard' trick may generalise to other resource attacks, such as latency or memory-bandwidth backdoors, wherever a separated feature is wanted.
  • Editorial inference: a defence could monitor activation sparsity statistics for sudden density spikes on certain inputs, but whether this is practical depends on whether the trigger's density increase clears the noise of normal inputs.
  • Editorial inference: the attack was not tested on ImageNet-scale models or on real accelerator chips, so scaling behaviour on deeper, wider models and the true energy impact on hardware remain open questions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes the first backdoor attack specifically targeting the energy consumption of deep neural networks on sparsity-based accelerators. The attack trains a model with a two-phase procedure: in Phase 1 a dedicated 'trigger' class is added to separate clean and trigger feature maps, and in Phase 2 the trigger class is removed and the model is fine-tuned to preserve accuracy on trigger samples while maximizing an L0-based energy proxy on those triggers. Experiments on CIFAR-10 and Tiny ImageNet with ResNet-18 and MobileNet-V2 report the energy ratio, post-ReLU density, overall density, and top-1 accuracy, comparing against a clean baseline, sponge examples, and uniform-input attacks. The authors claim the attack increases energy consumption on trigger samples while preserving performance on clean inputs.

Significance. The idea of an energy backdoor attack is novel and timely for the security of sparsity-based hardware accelerators, and the two-phase training design is a reasonable attempt to balance energy maximization with stealthiness. The public code release is a strength. However, the current experimental evaluation does not establish the central claims: the baseline is never evaluated on trigger inputs, the energy ratio differences are small with overlapping ranges, and clean accuracy on Tiny ImageNet is not preserved. If the missing controls and statistical support are provided, the work could be a meaningful contribution; as it stands, the evidence is insufficient.

major comments (4)
  1. [Section IV-B, Table I] The baseline model is never evaluated on the trigger test set: the 'Baseline' row reports energy and density metrics only on clean test inputs, while 'Ours trigger' is measured on inputs with the trigger added. Since the trigger is a visible additive perturbation that can itself change activation sparsity and the energy proxy even for an undefended model, the reported trigger-vs-baseline differences cannot be attributed to the backdoor. To support the effectiveness claim, run the baseline model on the same trigger test set and compare 'Ours trigger' against this baseline-on-trigger condition for every architecture and dataset.
  2. [Abstract and Section IV-B] The abstract states that the attack preserves the model's performance for clean/regular inputs, but Table I shows clean accuracy on Tiny ImageNet drops from 72.90% to 68.02% for ResNet-18 and from 72.66% to 69.39% for MobileNet-V2, with trigger accuracy at 66.14% and 60.66%, respectively. The manuscript itself acknowledges lower accuracy on Tiny ImageNet, which contradicts the blanket preservation claim. The claims should be scoped to CIFAR-10 or accompanied by a quantitative argument for why these drops are acceptable.
  3. [Section IV-B, Table I] The reported energy increases are small and the min-max ranges overlap. For example, ResNet-18 on CIFAR-10 has a baseline energy ratio of 86.59% (range [84.96, 88.30]) while the trigger mean is 87.30% (range [86.15, 88.34]); similar overlap appears for MobileNet-V2 on CIFAR-10. No standard deviations, confidence intervals, or statistical tests are provided, so the statement that trigger energy ratios 'significantly exceed' state-of-the-art attacks is unsupported. Report per-sample distributions and significance tests for the energy and density metrics.
  4. [Section III-A] The attack optimizes the L0 proxy defined in Eq. (3) and then evaluates effectiveness using the same proxy, but the paper never validates that this proxy translates into actual energy consumption on sparsity-based hardware. Since the title and abstract claim an 'energy' backdoor attack, a hardware-level measurement or cycle-accurate simulation on a sparsity-based accelerator (or a clear reference to prior validation of this proxy) is needed to support the energy claim rather than only a sparsity claim.
minor comments (5)
  1. [Abstract] The GitHub URL contains a space ('energy backdoor') and should be corrected to a valid hyperlink.
  2. [Table I] In the MobileNet-V2 CIFAR-10 row, the Sponge-GA overall density is given as '0.826 in [0.825 , 0.827]'; the symbol should be '∈' for consistency with the other rows.
  3. [Section III-B] The definition of Cpo changes between Eq. (2) and Section III-B (labels are replaced by the trigger class in Phase 1); clarify this notation explicitly to avoid confusion.
  4. [Section IV-A] The grid search for the uniform-input parameter µ is reported only by the selected values; state the search range and explain why µ=0 is optimal for MobileNet-V2.
  5. [Throughout] The terms 'energy rates' and 'energy ratio' are used interchangeably; pick one term for the fired-neuron ratio to keep the presentation consistent.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack is evaluated on held-out test sets using the same energy proxy it optimizes, which is an honest generalization test rather than a by-construction equivalence.

full rationale

The paper's claimed contribution is an attack construction, not a derived prediction. Its optimization objective (Eq. 2) maximizes E{M(θ, X_po)} with E implemented as the fired-neuron ratio (Eq. 3), and Table I reports the same energy-ratio metric on held-out test sets. This is a legitimate generalization check: the model is trained on a poisoned subset and evaluated on unseen test images, so the reported trigger energy ratios are not equal to the training loss by construction. No parameter is fitted to the test set and then renamed as a prediction. The only potentially noticeable self-citation is [33] (Barni–Kallas–Tondi) for the ramp trigger, but the trigger is an input choice rather than a load-bearing theorem; the attack's claimed effect does not reduce to that citation. The absence of a baseline model evaluated on trigger-set inputs and the Tiny ImageNet clean-accuracy drops are experimental-control and reporting concerns, not circularity. The energy proxy is explicitly disclosed ('we quantify energy consumption as the ratio of fired neurons to the total number of neurons'), and the lack of hardware energy measurements is an unverified assumption about physical energy, not a circular step. Therefore no circular step is identified.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The attack's reported energy proxy is the same quantity the loss optimizes, and no physical energy measurement is provided. Hyperparameters λ_CE and λ_cl are not reported, making exact reproduction impossible.

free parameters (5)
  • Trigger strength Δ = 60/255
    Chosen by hand for the ramp trigger (Section IV-A).
  • Overlay weight γ = 0.5
    Chosen by hand for adding trigger to clean images (Section IV-A).
  • L0 estimation constant ε = 10^-4
    Small constant to avoid division by zero in Eq. 3 (Section III-A).
  • Poisoning fraction α = less than 5%
    Set in line with prior poisoning attacks (Section IV-A).
  • Lagrangian multipliers λ_CE and λ_cl = not reported
    Weights in the loss (Eq. 2) that balance energy and accuracy; values are not specified in the paper, so the objective is under-specified.
assumptions (4)
  • domain assumption Energy consumption on sparsity-based accelerators is proportional to the ratio of fired neurons to total neurons
    Used in Section III-A to justify optimizing the L0 proxy instead of measuring energy; never validated on actual hardware.
  • domain assumption The smoothed L0 norm (Eq. 3) is a suitable proxy for the true L0 norm in optimization
    Borrowed from [23] and [4]; its fidelity for energy estimation is assumed.
  • domain assumption White-box access to model parameters and ability to poison up to 5% of the training set
    Assumed in the threat model (Section II, Section IV-A).
  • standard math Standard deep learning training with SGD converges to the intended multi-objective solution
    Implicit in the two-phase training procedure.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Energy Backdoor Attack to Deep Neural Networks." pith.science (2026). https://pith.science/paper/YEZS7DXQ

@misc{pith2026250108152,
  author       = {Pith},
  title        = {Pith review of: Energy Backdoor Attack to Deep Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YEZS7DXQ}},
  note         = {Machine review of arXiv:2501.08152}
}
read the original abstract

The rise of deep learning (DL) has increased computing complexity and energy use, prompting the adoption of application specific integrated circuits (ASICs) for energy-efficient edge and mobile deployment. However, recent studies have demonstrated the vulnerability of these accelerators to energy attacks. Despite the development of various inference time energy attacks in prior research, backdoor energy attacks remain unexplored. In this paper, we design an innovative energy backdoor attack against deep neural networks (DNNs) operating on sparsity-based accelerators. Our attack is carried out in two distinct phases: backdoor injection and backdoor stealthiness. Experimental results using ResNet-18 and MobileNet-V2 models trained on CIFAR-10 and Tiny ImageNet datasets show the effectiveness of our proposed attack in increasing energy consumption on trigger samples while preserving the model's performance for clean/regular inputs. This demonstrates the vulnerability of DNNs to energy backdoor attacks. The source code of our attack is available at: https://github.com/hbrachemi/energy_backdoor.

Figures

Figures reproduced from arXiv: 2501.08152 by the authors.

Figure 1
Figure 1. Overview of the backdoored model. Neurons circled in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Proposed energy backdoor attack design steps. The [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Perceptual comparison between a clean, trigger, and [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 27 canonical work pages

  1. [4]

    Energy-latency attacks via sponge poisoning,

    Antonio Emanuele Cin `a, Ambra Demontis, Battista Biggio, Fabio Roli, and Marcello Pelillo, “Energy-latency attacks via sponge poisoning,” arXiv preprint arXiv:2203.08147 , 2022

    arXiv 2022

  2. [5]

    Sponge examples: Energy-latency attacks on neural networks,

    Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson, “Sponge examples: Energy-latency attacks on neural networks,” in 2021 IEEE European symposium on security and privacy (EuroS&P) . IEEE, 2021, pp. 212–231

    work page 2021

  3. [18]

    The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Vision

    Andreas M ¨uller and Erwin Quiring, “The impact of uniform inputs on activation sparsity and energy-latency attacks in computer vision,” arXiv preprint arXiv:2403.18587, 2024

    work page Pith review arXiv 2024

  4. [33]

    A new backdoor attack in cnns by training set corruption without label poisoning,

    Mauro Barni, Kassem Kallas, and Benedetta Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in 2019 IEEE International Conference on Image Processing (ICIP). IEEE, 2019, pp. 101–105

    work page 2019

  5. [6]

    The dark side of dynamic routing neural networks: Towards efficiency backdoor injection,

    Simin Chen, Hanlin Chen, Mirazul Haque, Cong Liu, and Wei Yang, “The dark side of dynamic routing neural networks: Towards efficiency backdoor injection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 24585–24594

    work page 2023

  6. [1]

    Going deeper with convolutions,

    Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich, “Going deeper with convolutions,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2015, pp. 1–9

    work page 2015

  7. [2]

    Hardware implementation of deep network accelerators towards healthcare and biomedical applications,

    Mostafa Rahimi Azghadi, Corey Lammie, Jason K Eshraghian, Me- lika Payvand, Elisa Donati, Bernabe Linares-Barranco, and Giacomo Indiveri, “Hardware implementation of deep network accelerators towards healthcare and biomedical applications,” IEEE Transactions on Biomedical Circuits and Systems , vol. 14, no. 6, pp. 1138–1159, 2020

    work page 2020

  8. [3]

    Scnn: An accelerator for compressed-sparse convolutional neural networks,

    Angshuman Parashar, Minsoo Rhu, Anurag Mukkara, Antonio Puglielli, Rangharajan Venkatesan, Brucek Khailany, Joel Emer, Stephen W Keck- ler, and William J Dally, “Scnn: An accelerator for compressed-sparse convolutional neural networks,” ACM SIGARCH computer architecture news, vol. 45, no. 2, pp. 27–40, 2017

    work page 2017

Show all 34 references
  1. [7]

    Slowformer: Universal adversarial patch for attack on compute and energy efficiency of inference efficient vision trans- formers,

    KL Navaneet, Soroush Abbasi Koohpayegani, Essam Sleiman, and Hamed Pirsiavash, “Slowformer: Universal adversarial patch for attack on compute and energy efficiency of inference efficient vision trans- formers,” arXiv preprint arXiv:2310.02544 , 2023

    arXiv

  2. [8]

    Gradauto: Energy-oriented attack on dynamic neural networks,

    J. Pan, Q. Zheng, Z. Fan, H. Rahmani, Q. Ke, and J. Liu, “Gradauto: Energy-oriented attack on dynamic neural networks,” in European Conference on Computer Vision . Springer, 2022, pp. 637–653

    2022

  3. [9]

    Slowlidar: In- creasing the latency of lidar-based detection using adversarial examples,

    H. Liu, Y . Wu, Z. Yu, Y . V orobeychik, and N. Zhang, “Slowlidar: In- creasing the latency of lidar-based detection using adversarial examples,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 5146–5155

    2023

  4. [10]

    Ereba: black-box energy testing of adaptive neural networks,

    M. Haque, Y . Yadlapalli, W. Yang, and C. Liu, “Ereba: black-box energy testing of adaptive neural networks,” in Proceedings of the 44th International Conference on Software Engineering , 2022, pp. 835–846

    2022

  5. [11]

    Antinode: Evaluating efficiency robustness of neural odes,

    M. Haque, S. Chen, W. Haque, C. Liu, and W. Yang, “Antinode: Evaluating efficiency robustness of neural odes,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 1507–1517

    2023

  6. [12]

    The spongenet attack: Sponge weight poisoning of deep neural networks,

    Jona te Lintelo, Stefanos Koffas, and Stjepan Picek, “The spongenet attack: Sponge weight poisoning of deep neural networks,” arXiv preprint arXiv:2402.06357, 2024

    2024

  7. [13]

    Sparsity turns adversarial: Energy and latency attacks on deep neural networks,

    Sarada Krithivasan, Sanchari Sen, and Anand Raghunathan, “Sparsity turns adversarial: Energy and latency attacks on deep neural networks,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 39, no. 11, pp. 4129–4141, 2020

    2020

  8. [14]

    Sponge attack against multi-exit networks with data poisoning,

    B. Huang, L. Pang, A. Fu, S. Al-Sarawi, D. Abbott, and Y . Gao, “Sponge attack against multi-exit networks with data poisoning,” IEEE Access , 2024

    2024

  9. [15]

    Effi- ciency attacks on spiking neural networks,

    S. Krithivasan, S. Sen, N. Rathi, K. Roy, and A. Raghunathan, “Effi- ciency attacks on spiking neural networks,” in Proceedings of the 59th ACM/IEEE Design Automation Conference , 2022, pp. 373–378

    2022

  10. [16]

    Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models,

    S. Chen, Z. Song, M. Haque, C. Liu, and W. Yang, “Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 15365–15374

    2022

  11. [17]

    Energy- latency attacks to on-device neural networks via sponge poisoning,

    Zijian Wang, Shuo Huang, Yujin Huang, and Helei Cui, “Energy- latency attacks to on-device neural networks via sponge poisoning,” in Proceedings of the 2023 Secure and Trustworthy Deep Learning Systems Workshop, 2023, pp. 1–11

    2023

  12. [19]

    Trojaning attack on neural networks,

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang, “Trojaning attack on neural networks,” 2017

    2017

  13. [20]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16 . Springer, 2020, pp. 182–199

    2020

  14. [21]

    Backdoor attacks against deep image compression via adaptive frequency trigger,

    Yi Yu, Yufei Wang, Wenhan Yang, Shijian Lu, Yap-Peng Tan, and Alex C Kot, “Backdoor attacks against deep image compression via adaptive frequency trigger,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 12250–12259

    2023

  15. [22]

    Luminance-based video backdoor attack against anti-spoofing rebroad- cast detection,

    Abhir Bhalerao, Kassem Kallas, Benedetta Tondi, and Mauro Barni, “Luminance-based video backdoor attack against anti-spoofing rebroad- cast detection,” in 2019 IEEE 21st International Workshop on Multime- dia Signal Processing (MMSP) , 2019, pp. 1–6

    2019

  16. [23]

    On the lasso and its dual,

    Michael R Osborne, Brett Presnell, and Berwin A Turlach, “On the lasso and its dual,” Journal of Computational and Graphical statistics , vol. 9, no. 2, pp. 319–337, 2000

    2000

  17. [24]

    Fiba: Federated invisible backdoor attack,

    Lu Zhang and Baolin Zheng, “Fiba: Federated invisible backdoor attack,” in ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2024, pp. 6870–6874

    2024

  18. [25]

    Invisible backdoor attacks on deep neural networks via steganography and regularization,

    Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” IEEE Transactions on Dependable and Secure Computing , vol. 18, no. 5, pp. 2088–2105, 2020

    2020

  19. [26]

    Backdoor attack with sparse and invisible trigger,

    Yinghua Gao, Yiming Li, Xueluan Gong, Zhifeng Li, Shu-Tao Xia, and Qian Wang, “Backdoor attack with sparse and invisible trigger,” IEEE Transactions on Information Forensics and Security , 2024

    2024

  20. [27]

    Poison frogs! targeted clean-label poisoning attacks on neural networks,

    Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein, “Poison frogs! targeted clean-label poisoning attacks on neural networks,” Advances in neural information processing systems , vol. 31, 2018

    2018

  21. [28]

    An overview of backdoor attacks against deep neural networks and possible defences,

    Wei Guo, Benedetta Tondi, and Mauro Barni, “An overview of backdoor attacks against deep neural networks and possible defences,” IEEE Open Journal of Signal Processing , vol. 3, pp. 261–287, 2022

    2022

  22. [29]

    Learning multiple layers of features from tiny images.(2009),

    Alex Krizhevsky, Geoffrey Hinton, et al., “Learning multiple layers of features from tiny images.(2009),” 2009

    2009

  23. [30]

    Embedded encoder-decoder in convolutional networks towards explainable ai,

    Amirhossein Tavanaei, “Embedded encoder-decoder in convolutional networks towards explainable ai,” arXiv preprint arXiv:2007.06712 , 2020

    2007 arXiv

  24. [31]

    Deep residual learning for image recognition,

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770– 778

    2016

  25. [32]

    Mobilenets: Efficient convolutional neural net- works for mobile vision applications,

    Andrew G Howard, “Mobilenets: Efficient convolutional neural net- works for mobile vision applications,” arXiv preprint arXiv:1704.04861, 2017

    2017 arXiv

  26. [34]

    Learning to optimize,

    Ke Li and Jitendra Malik, “Learning to optimize,” arXiv preprint arXiv:1606.01885, 2016

    2016 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.