Pith. sign in

REVIEW 3 major objections 4 minor 43 references

Killing it with Zero-Shot: Adversarially Robust Novelty Detection

T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Frozen adversarially robust ImageNet features plus a k-nearest-neighbor score are claimed to give state-of-the-art novelty detection under adversarial attacks, without any training on the target data.

desk verdict Frozen robust features plus k-NN give a surprisingly strong adversarial novelty detector, but the attack protocol is only specified for the proposed method. read the letter →

arxiv 2501.15271 v1 pith:DG5KLS75 submitted 2025-01-25 cs.LG

Hossein Mirzaei , Mohammad Jafari , Hamid Reza Dehbashi , Zeinab Sadat Taghavi , Mohammad Sabokrou , Mohammad Hossein Rohban This is my paper · ORCID
classification cs.LG
keywords adversarialrobustnessnoveltydetectionanomalyzero-shotlearningk-nearestneighborspretrainedfeaturesout-of-distribution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that novelty detection can be made robust to adversarial attacks without any training on the target domain. The proposed method, ZARND, takes a fixed feature extractor that was adversarially trained on ImageNet and scores test points by the sum of their k-smallest Euclidean distances to a feature bank of normal samples. The authors claim this zero-shot recipe keeps AUROC between roughly 60 and 95 under strong PGD and AutoAttack perturbations across CIFAR, MNIST, and several medical datasets, while trained robust detectors collapse to near-random performance. If true, this means expensive and brittle adversarial training of downstream detectors can be replaced by a frozen robust backbone plus a non-parametric scoring rule.

What carries the argument

The load-bearing machinery is the combination of (1) a frozen adversarially robust ImageNet feature extractor, here a robust ResNet-18, and (2) the k-NN anomaly score $S(h(x)) = \sum_{i=1}^{k} d_{(i)}$, the sum of the k-smallest Euclidean distances to the feature bank of normal samples. The robust backbone is what makes the feature space resilient to small input perturbations, while the k-NN score is parameter-free, locality-sensitive, and requires no target-domain training. The attack used for evaluation differentiates the paper's claim: perturbations are crafted by projected gradient descent on the gradient of the k-NN score itself, weighted by a label function $\beta(y)$ that flips sign depending on whether the sample is normal or an outlier, so the attack directly targets the decision rule being evaluated.

What would settle it

Run the same evaluation with a per-method adaptive attack: for each baseline, compute the gradient of that method's own anomaly score (e.g., the signature distance for DeepSVDD or the reconstruction error for APAE), apply PGD with multiple restarts and tuned step size, and measure AUROC; if any baseline's adversarial AUROC rises to match or exceed ZARND's numbers, the claim of a new standard collapses.

Watch

Extended reading notes

Core claim

The central discovery is that adversarially robust pretrained features, which are usually trained for classification, are also sufficient for state-of-the-art adversarial novelty detection. Concretely, ZARND combines a robust ResNet-18 feature extractor (trained on ImageNet and frozen) with the k-NN anomaly score $S(h(x)) = \sum_{i=1}^{k} d_{(i)}$, where $d_{(i)}$ are the $k$ smallest Euclidean distances between the test feature and the stored normal features. Under a $\beta(y)$-weighted PGD attack with 100 steps and AutoAttack, this method is claimed to outperform the best robustly trained detectors—DeepSVDD, MSAD, Transformaly, PatchCore, PrincipaLS, OCSDF, and APAE—by margins up to about 40 AUROC points on low- and high-resolution datasets. The authors interpret this as evidence that robustness learned at ImageNet scale transfers across domains and that the non-parametric nearest-neighbor score inherits that robustness, making target-domain adversarial training unnecessary.

Load-bearing premise

The central result assumes the adversarial attack used to compare all methods is fair and equally well-tuned; the paper only specifies its own attack in detail, so if the baselines were attacked with method-specific settings, the reported margin over them could shrink.

Editorial extensions

If this is right

  • A frozen robust ImageNet backbone plus k-NN achieves strong AUROC under PGD/AutoAttack across CIFAR-10, CIFAR-100, MNIST, FashionMNIST, MVTecAD, and several medical datasets, with no target-domain training.
  • On CIFAR-10 under PGD/AutoAttack, ZARND reports AUROC around 60-62 while the trained robust detectors listed in the paper fall below 34 or to near zero, a gap of up to roughly 40 AUROC points.
  • The method transfers to low-resolution and medical domains, suggesting adversarial robustness learned on ImageNet is not tied to the training distribution.
  • Because trained detectors drop to near-zero AUROC under attack on high-resolution datasets such as MVTecAD, the practical value of the method is concentrated in the adversarial setting rather than clean accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If frozen robust features are the dominant factor, then stronger robust backbones—such as adversarially trained vision transformers or large pre-trained models—could push AUROC higher under the same zero-shot recipe.
  • The k-NN score's robustness depends on the Lipschitz constant of the feature map, so a natural test is to attack the same features with stronger white-box PGD schedules (more restarts, longer steps) and check whether the reported margins shrink.
  • The evaluation only covers $\ell_\infty$ perturbations of a fixed radius; extending the protocol to $\ell_2$ or $\ell_0$ attacks, or to perturbations that contaminate the feature bank, would probe whether the zero-shot advantage holds beyond the evaluated threat model.
  • Since clean AUROC is lower than that of the best clean detectors on some medical datasets, a sensible extension is to attach a lightweight adapter that recovers clean accuracy while preserving most of the adversarial robustness.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes ZARND, a zero-shot novelty detection method that extracts features from an adversarially robust pretrained ResNet-18 and scores test samples by the sum of the k smallest Euclidean distances to the training feature bank. Against PGD-100 and AutoAttack, it reports AUROC values of roughly 29-97 on CIFAR-10/100, MNIST, FMNIST, MVTecAD, and five medical datasets, exceeding trained robust novelty detection baselines by margins up to about 40 AUROC points. The central claim is that frozen adversarially robust ImageNet features, combined with a simple k-NN score, suffice for state-of-the-art adversarial novelty detection without target-domain training.

Significance. If the empirical claim holds, the result is practically significant: it would show that adversarially robust pretrained representations transfer across resolutions and domains, and that a simple nonparametric score can outperform adversarially trained detectors. The method is refreshingly simple, the code is publicly linked, and the paper makes a falsifiable empirical prediction. However, the comparison's fairness depends on an attack protocol that is specified only for ZARND's own score, and several reproducibility details are missing; the headline result is therefore promising but not yet established.

major comments (3)
  1. [§5, Evaluation Attack] The attack is defined only for ZARND's k-NN score S(h(x)): the text gives beta(y)-weighted PGD-100 with one random restart and step size alpha = 2.5*epsilon/N, maximizing or minimizing S. It never states how DeepSVDD, MSAD, Transformaly, PatchCore, PrincipaLS, OCSDF, or APAE are attacked, i.e., which anomaly score is used as the attack objective, how AutoAttack (a classification-oriented ensemble) is adapted to unsupervised detectors, or whether the same epsilon, steps, restarts, and normal/anomaly direction are used. Without this specification, the reported margins in Table 1 may partly reflect attack mismatch rather than robustness, and the comparison is not reproducible. Please define a method-specific attack objective for each baseline under an equivalent threat model and verify that the reported baseline numbers come from that protocol.
  2. [§4.4 and Table 1] The value of k in the k-NN score is never given; Figure 2 illustrates only K=2, and the text uses k inconsistently with the capitalized K in the figure. Likewise, §4.1 says the method uses an 'intermediary feature map F' but never identifies which ResNet-18 layer is used. Since both k and the feature layer are free parameters of the method, omitting them prevents exact reproduction and leaves open the possibility that the reported results are tuned to specific values. Please report the chosen k and feature layer, and include a sensitivity analysis over at least a few k values.
  3. [Tables 1-2 and §5, Setup] All results appear to be single runs without standard deviations, confidence intervals, or significance tests. Given that many adversarial baselines are near 0% AUROC and the attack uses random initialization, variance across runs and across random restarts could affect the relative ranking, especially for smaller medical datasets. Please report mean and standard deviation over at least three independent runs or attack restarts, and state the number of test samples per class so the reader can judge the stability of the AUROC estimates.
minor comments (4)
  1. [§5, Datasets and metrics] The text states that AUROC is in the range [0, 1], but all table entries are reported as percentages from 0 to 100; please unify the convention so the reader is not confused.
  2. [§5, Evaluation Attack] The notation N is overloaded: in §4.3 it denotes the number of feature vectors in the feature bank, while in the step-size formula alpha = 2.5*epsilon/N it appears to denote the number of attack iterations (stated as 100). Please use distinct symbols.
  3. [§2, Background & Related Work] The reference list includes several works that are not connected to novelty detection or adversarial robustness, such as speech emotion recognition and SemEval task papers [22]-[25] and [27]-[29]; either cite them in a way that substantiates the text or remove them to keep the related-work section focused.
  4. [Introduction and Figure 1] The Introduction contains uninterpretable glyph sequences (e.g., '/uni00000033/uni00000048/...') that appear to be a rendering error; if present in the actual PDF, they must be fixed. Figure 1 should also be checked for legibility of axis labels and legend entries.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the anomaly score is an unfitted k-NN function of external robust features, and robustness is evaluated with external attacks.

full rationale

The paper's derivation chain is self-contained and non-circular. ZARND extracts features with an adversarially robust pretrained ResNet-18 from Salman et al. [31], computes Euclidean distances to a feature bank of normal training samples, sorts them, and defines the anomaly score as the sum of the k-smallest distances (Section 4.4). No parameter is fitted to the target datasets, no inverse problem is solved, and no load-bearing result is imported from the authors' prior work. Robustness is measured with PGD-100 and AutoAttack under a stated threat model (epsilon, steps, restarts, step size), which are external evaluation protocols rather than consequences of the method's definition. The self-citations in Sections 1-2 (e.g., the survey [10], RODEO [17], AROS [18]) are background and positioning only; they do not justify the method's correctness or uniqueness. The paper's 'first to employ an adversarially robust pre-trained model for ND' is a literature novelty claim, not a derivation. The most notable concern is that the attack specification is given only for ZARND's k-NN score, leaving how it was adapted to DeepSVDD, MSAD, Transformaly, PatchCore, PrincipaLS, OCSDF, and APAE unspecified; that is a reproducibility and fairness issue, not a circular reduction.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The method introduces no fitted parameters in the conventional sense, but its performance depends on the choice of k and on the specific robust pretrained backbone, neither of which is justified empirically. The listed axioms are unproved assumptions about transferability, score validity, and differentiability that the experimental sections rely on.

free parameters (2)
  • k (number of nearest neighbors in anomaly score) = 2 (shown in Fig. 2; experimental value not stated in text)
    The anomaly score is the sum of the k smallest Euclidean distances; the paper gives no sensitivity analysis or selection procedure, so the reported results depend on an unreported choice.
  • Backbone architecture and pretraining source = ResNet-18, adversarially trained on ImageNet (Salman et al.)
    The entire method rests on this feature extractor; no comparison with other backbones or robust training recipes is reported.
assumptions (3)
  • domain assumption Adversarial robustness learned on ImageNet transfers to low-resolution and medical target domains.
    ZARND uses a frozen robust backbone with no target-domain training; Section 4.1 and Section 5 rely on this transfer for all reported gains.
  • domain assumption The sum of k smallest Euclidean distances in the robust feature space is a valid normality score.
    Section 4.4 defines the anomaly score this way; the paper does not prove or ablate this choice in the robust feature space.
  • domain assumption The k-NN anomaly score is differentiable enough for PGD, or a surrogate gradient is used.
    Section 5 defines the attack via grad_x S(h(x)), but S involves a top-k selection that is non-smooth; the paper does not specify how this gradient is computed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Killing it with Zero-Shot: Adversarially Robust Novelty Detection." pith.science (2026). https://pith.science/paper/DG5KLS75

@misc{pith2026250115271,
  author       = {Pith},
  title        = {Pith review of: Killing it with Zero-Shot: Adversarially Robust Novelty Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DG5KLS75}},
  note         = {Machine review of arXiv:2501.15271}
}
read the original abstract

Novelty Detection (ND) plays a crucial role in machine learning by identifying new or unseen data during model inference. This capability is especially important for the safe and reliable operation of automated systems. Despite advances in this field, existing techniques often fail to maintain their performance when subject to adversarial attacks. Our research addresses this gap by marrying the merits of nearest-neighbor algorithms with robust features obtained from models pretrained on ImageNet. We focus on enhancing the robustness and performance of ND algorithms. Experimental results demonstrate that our approach significantly outperforms current state-of-the-art methods across various benchmarks, particularly under adversarial conditions. By incorporating robust pretrained features into the k-NN algorithm, we establish a new standard for performance and robustness in the field of robust ND. This work opens up new avenues for research aimed at fortifying machine learning systems against adversarial vulnerabilities. Our implementation is publicly available at https://github.com/rohban-lab/ZARND.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 26 canonical work pages

  1. [1]

    Killing it with Zero-Shot: Adversarially Robust Novelty Detection

    INTRODUCTION Anomaly detection plays an important role in computer vi- sion, for example, in healthcare, industry, and autonomous driving [6]. Its ability to identify new or unseen visual pat- terns during inference is essential for the safety and reliability of ML-based systems [7]. Recent ND methods have shown significant results in clean settings. Howe...

    work page Pith review arXiv 2025

  2. [2]

    Various self-supervised approaches have been introduced in ND to learn the normal sample distribution

    BACKGROUND & RELA TED WORK ND. Various self-supervised approaches have been introduced in ND to learn the normal sample distribution. DeepSVDDs utilizes an autoencoder to learn distribution features, while CSI[12] employs a contrastive loss for distribution learn- ing. Moreover FITYMI [13], DN2[14], PANDA[15], Trans- formaly [2] and MSAD[1] leverage pre-t...

    work page

  3. [3]

    In ND, our focus is on a specialized training set that comprises solely normal, unlabeled samples

    PROBLEM STA TEMENT Setup. In ND, our focus is on a specialized training set that comprises solely normal, unlabeled samples. This training set is formally denoted as: Xtrain = {x1, x2, . . . ,xn} Here, Xtrain represents the collection of all ’normal’ samples, and each xi is an individual sample. These samples are el- ements of a broader feature space, den...

    work page

  4. [4]

    Initialization: Feature Extraction Our methodology begins with the critical step of feature ex- traction, setting the stage for all downstream operations

    METHOD 4.1. Initialization: Feature Extraction Our methodology begins with the critical step of feature ex- traction, setting the stage for all downstream operations. The primary objective at this stage is to generate a comprehensive Calculate Distances Sorting InferenceInitialization Anomaly Score Fig. 2 : The four key steps of our ND framework are illus...

    work page

  5. [5]

    EXPERIMENTAL RESULTS In this section, we conduct comprehensive experiments to as- sess various outlier detection methods, encompassing both the clean and adversarially trained approaches and our method in the context of adversarial attacks. Setup. We utilize the ResNet-18 architecture as the backbone of our neural network and incorporate pre-trained weigh...

    work page

  6. [6]

    Our method performs well in AUROC metrics and strongly resists adversarial attacks

    CONCLUSION Our work introduces a robust and practical approach to image-based ND, leveraging k-NN and feature extraction. Our method performs well in AUROC metrics and strongly resists adversarial attacks. We aim to further enhance the robustness and adaptability of our system to diverse applica- tions

    work page

  7. [7]

    Deep neural networks are easily fooled: High confidence pre- dictions for unrecognizable images,

    Anh Nguyen, Jason Yosinski, and Jeff Clune, “Deep neural networks are easily fooled: High confidence pre- dictions for unrecognizable images,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2015, pp. 427–436. 1

    work page 2015

  8. [8]

    Mean-shifted con- trastive loss for anomaly detection,

    Tal Reiss and Yedid Hoshen, “Mean-shifted con- trastive loss for anomaly detection,” arXiv preprint arXiv:2106.03844, 2021. 1, 2

    arXiv 2021

Show all 43 references
  1. [9]

    Transformaly– two (feature spaces) are better than one,

    Matan Jacob Cohen and Shai Avidan, “Transformaly– two (feature spaces) are better than one,” arXiv preprint arXiv:2112.04185, 2021. 1, 2

    2021 arXiv

  2. [10]

    Ad- versarially robust one-class novelty detection,

    Shao-Yuan Lo, Poojan Oza, and Vishal M Patel, “Ad- versarially robust one-class novelty detection,” IEEE Transactions on Pattern Analysis and Machine Intelli- gence, 2022. 1, 2

    2022

  3. [11]

    Robust one-class classifica- tion with signed distance function using 1-lipschitz neu- ral networks,

    Louis B ´ethune, Paul Novello, Thibaut Boissin, Guil- laume Coiffier, Mathieu Serrurier, Quentin Vincenot, and Andres Troya-Galvis, “Robust one-class classifica- tion with signed distance function using 1-lipschitz neu- ral networks,” arXiv preprint arXiv:2303.01978, 2023. 1, 2

    2023 arXiv

  4. [12]

    Robustness of autoencoders for anomaly detection under adversarial impact,

    Adam Goodge, Bryan Hooi, See Kiong Ng, and Wee Siong Ng, “Robustness of autoencoders for anomaly detection under adversarial impact,” in Pro- ceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial Intelli- gence, 2021, pp. 1244–1...

    2021

  5. [13]

    One-class classification: A survey,

    Pramuditha Perera, Poojan Oza, and Vishal M Patel, “One-class classification: A survey,” arXiv preprint arXiv:2101.03064, 2021. 1

    2021 arXiv

  6. [14]

    Deep nearest neighbor anomaly detection,

    Liron Bergman, Niv Cohen, and Yedid Hoshen, “Deep nearest neighbor anomaly detection,” arXiv preprint arXiv:2002.10445, 2020. 2

    2002 arXiv

  7. [15]

    Mvtec ad–a comprehensive real-world dataset for unsupervised anomaly detection,

    Paul Bergmann, Michael Fauser, David Sattlegger, and Carsten Steger, “Mvtec ad–a comprehensive real-world dataset for unsupervised anomaly detection,” in Pro- ceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, 2019, pp. 9592–9600. 1

    2019

  8. [16]

    Efficientad: Accurate visual anomaly detection at millisecond-level latencies,

    Kilian Batzner, Lars Heckler, and Rebecca K ¨onig, “Efficientad: Accurate visual anomaly detection at millisecond-level latencies,” arXiv preprint arXiv:2303.14535, 2023. 1

    2023 arXiv

  9. [17]

    A unified survey on anomaly, novelty, open-set, and out-of-distribution detection: Solutions and future challenges,

    Mohammadreza Salehi, Hossein Mirzaei, Dan Hendrycks, Yixuan Li, Mohammad Hossein Ro- hban, and Mohammad Sabokrou, “A unified survey on anomaly, novelty, open-set, and out-of-distribution detection: Solutions and future challenges,” arXiv preprint arXiv:2110.14051, 2021. 1

    arXiv

  10. [18]

    Papajorgji, and Panos M

    Antonio Mucherino, Petraq J. Papajorgji, and Panos M. Pardalos, k-Nearest Neighbor Classification , pp. 83– 106, Springer New York, New York, NY , 2009. 1

    2009

  11. [19]

    Csi: Novelty detection via contrastive learning on distributionally shifted instances,

    Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin, “Csi: Novelty detection via contrastive learning on distributionally shifted instances,” Advances in neu- ral information processing systems, vol. 33, pp. 11839– 11852, 2020. 2

    2020

  12. [20]

    Fake it till you make it: Near-distribution novelty detec- tion by score-based generative models,

    Hossein Mirzaei, Mohammadreza Salehi, Sajjad Sha- habi, Efstratios Gavves, Cees GM Snoek, Mohammad Sabokrou, and Mohammad Hossein Rohban, “Fake it till you make it: Near-distribution novelty detec- tion by score-based generative models,” arXiv preprint arXiv:2205.14297, 2022. 2

    2022 arXiv

  13. [21]

    Seeking next layer neu- rons’ attention for error-backpropagation-like training in a multi-agent network framework,

    Arshia Soltani Moakhar, Mohammad Azizmalayeri, Hossein Mirzaei, Mohammad Taghi Manzuri, and Mo- hammad Hossein Rohban, “Seeking next layer neu- rons’ attention for error-backpropagation-like training in a multi-agent network framework,” arXiv preprint arXiv:2310.09952, 2023. 2

    arXiv

  14. [22]

    Panda: Adapting pretrained features for anomaly detection and segmentation,

    Tal Reiss, Niv Cohen, Liron Bergman, and Yedid Hoshen, “Panda: Adapting pretrained features for anomaly detection and segmentation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 2806–2814. 2

    2021

  15. [23]

    Open-set adversarial defense with clean-adversarial mutual learning,

    Rui Shao, Pramuditha Perera, Pong C Yuen, and Vishal M Patel, “Open-set adversarial defense with clean-adversarial mutual learning,” International Jour- nal of Computer Vision, vol. 130, no. 4, pp. 1070–1087,

  16. [24]

    Rodeo: Robust outlier detection via ex- posing adaptive out-of-distribution samples,

    Hossein Mirzaei, Mohammad Jafari, Hamid Reza De- hbashi, Ali Ansari, Sepehr Ghobadi, Masoud Hadi, Arshia Soltani Moakhar, Mohammad Azizmalayeri, Mahdieh Soleymani Baghshah, and Mohammad Hos- sein Rohban, “Rodeo: Robust outlier detection via ex- posing adaptive out-of-distribut...

  17. [25]

    Ad- versarially robust out-of-distribution detection using lyapunov-stabilized embeddings,

    Hossein Mirzaei and Mackenzie W Mathis, “Ad- versarially robust out-of-distribution detection using lyapunov-stabilized embeddings,” arXiv preprint arXiv:2410.10744, 2024. 2

    2024 arXiv

  18. [26]

    Universal novelty detection through adaptive contrastive learning,

    Hossein Mirzaei, Mojtaba Nafez, Mohammad Jafari, Mohammad Bagher Soltani, Mohammad Azizmalay- eri, Jafar Habibi, Mohammad Sabokrou, and Moham- mad Hossein Rohban, “Universal novelty detection through adaptive contrastive learning,” in Proceedings of the IEEE/CVF Conference on ...

    2024

  19. [27]

    Scanning trojaned models using out- of-distribution samples,

    Hossein Mirzaei, Ali Ansari, Bahar Dibaei Nia, Mo- jtaba Nafez, Moein Madadi, Sepehr Rezaee, Zeinab Sa- dat Taghavi, Arad Maleki, Kian Shamsaie, Mahdi Ha- jialilue, et al., “Scanning trojaned models using out- of-distribution samples,” in The Thirty-eighth Annual Conference on...

  20. [28]

    Sharif- mgtd at semeval-2024 task 8: A transformer-based ap- proach to detect machine generated text,

    Seyedeh Fatemeh Ebrahimi, Karim Akhavan Azari, Amirmasoud Iravani, Arian Qazvini, Pouya Sadeghi, Zeinab Sadat Taghavi, and Hossein Sameti, “Sharif- mgtd at semeval-2024 task 8: A transformer-based ap- proach to detect machine generated text,”arXiv preprint arXiv:2407.11774, 2024. 2

    2024 arXiv

  21. [29]

    A change of heart: Improving speech emotion recogni- tion through speech-to-text modality conversion,

    Zeinab Sadat Taghavi, Ali Satvaty, and Hossein Sameti, “A change of heart: Improving speech emotion recogni- tion through speech-to-text modality conversion,”arXiv preprint arXiv:2307.11584, 2023. 2

    2023 arXiv

  22. [30]

    During each itera- tion, the adversarial noise is constrained within an ℓ∞-ball of radius ϵ: x∗ 0 = x, x∗ t+1 = x∗ t + α

    iteratively maximizes the loss function by updatingx∗ in the direction of the gradient ∇xℓ(x∗; y). During each itera- tion, the adversarial noise is constrained within an ℓ∞-ball of radius ϵ: x∗ 0 = x, x∗ t+1 = x∗ t + α. sign (∇xℓ (x∗ t , y)) x∗ = x∗ T

  23. [31]

    HalluSafe at SemEval-2024 task 6: An NLI-based approach to make LLMs safer by better detecting hallucinations and over- generation mistakes,

    Zahra Rahimi, Hamidreza Amirzadeh, Alireza Sohrabi, Zeinab Taghavi, and Hossein Sameti, “HalluSafe at SemEval-2024 task 6: An NLI-based approach to make LLMs safer by better detecting hallucinations and over- generation mistakes,” in Proceedings of the 18th Inter- national Wor...

    2024

  24. [32]

    Imaginations of wall- e: Reconstructing experiences with an imagination- inspired module for advanced ai systems,

    Zeinab Sadat Taghavi, Soroush Gooran, Seyed Arshan Dalili, Hamidreza Amirzadeh, Mohammad Jalal Nemat- bakhsh, and Hossein Sameti, “Imaginations of wall- e: Reconstructing experiences with an imagination- inspired module for advanced ai systems,” arXiv preprint arXiv:2308.10354...

    2023 arXiv

  25. [33]

    Ebhaam at SemEval-2023 task 1: A CLIP-based approach for com- paring cross-modality and unimodality in visual word sense disambiguation,

    Zeinab Taghavi, Parsa Haghighi Naeini, Mohammad Ali Sadraei Javaheri, Soroush Gooran, Ehsaneddin Asgari, Hamid Reza Rabiee, and Hossein Sameti, “Ebhaam at SemEval-2023 task 1: A CLIP-based approach for com- paring cross-modality and unimodality in visual word sense disambiguat...

    2023

  26. [34]

    Backdoor- ing outlier detection methods: A novel attack approach,

    ZeinabSadat Taghavi and Hossein Mirzaei, “Backdoor- ing outlier detection methods: A novel attack approach,” arXiv preprint arXiv:2412.05010, 2024. 2

    2024 arXiv

  27. [35]

    NIMZ at SemEval-2024 task 9: Evaluating methods in solving brainteasers de- fying commonsense,

    Zahra Rahimi, Mohammad Moein Shirzady, Zeinab Taghavi, and Hossein Sameti, “NIMZ at SemEval-2024 task 9: Evaluating methods in solving brainteasers de- fying commonsense,” in Proceedings of the 18th Inter- national Workshop on Semantic Evaluation (SemEval- 2024), Atul Kr. Ojha...

    2024

  28. [36]

    Sharif-str at semeval- 2024 task 1: Transformer as a regression model for fine- grained scoring of textual semantic relations,

    Seyedeh Fatemeh Ebrahimi, Karim Akhavan Azari, Amirmasoud Iravani, Hadi Alizadeh, Zeinab Sadat Taghavi, and Hossein Sameti, “Sharif-str at semeval- 2024 task 1: Transformer as a regression model for fine- grained scoring of textual semantic relations,” arXiv preprint arXiv:240...

    2024 arXiv

  29. [37]

    Towards deep learning models resistant to adversarial attacks,

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017. 2

    2017 arXiv

  30. [38]

    Do adversarially ro- bust imagenet models transfer better?,

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry, “Do adversarially ro- bust imagenet models transfer better?,” CoRR, vol. abs/2007.08489, 2020. 3

    2007 arXiv

  31. [39]

    Reliable eval- uation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    Francesco Croce and Matthias Hein, “Reliable eval- uation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in International con- ference on machine learning . PMLR, 2020, pp. 2206–

    2020

  32. [40]

    Head ct - hemorrhage,

    Felipe Campos Kitamura, “Head ct - hemorrhage,”

  33. [41]

    Brain tumor clas- sification (mri),

    Sartaj Bhuvaji, Ankita Kadam, Prajakta Bhumkar, Sameer Dedge, and Swati Kanchan, “Brain tumor clas- sification (mri),” 2020. 4

    2020

  34. [42]

    Covid-19 image data collection,

    Joseph Paul Cohen, Paul Morrison, and Lan Dao, “Covid-19 image data collection,” arXiv, 2020. 4

    2020

  35. [43]

    Brain tumor mri dataset,

    Msoud Nickparvar, “Brain tumor mri dataset,” 2021. 4

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.