Pith. sign in

REVIEW 4 major objections 4 minor 32 references

Gradient Inversion Transcript: Leveraging Robust Generative Priors to Reconstruct Training Data from Gradient Leakage

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A generative model trained on public gradient pairs can map leaked gradients directly back to the private training images, without model parameters, labels, or per-image optimization; feeding its output to an iterative optimizer makes…

desk verdict A genuine improvement over LTI's fixed-architecture inversion, but the mini-batch gap in the derivation and evaluation keeps the federated-learning claim from being credible yet. read the letter →

arxiv 2505.20026 v1 pith:2DI6BD2Y submitted 2025-05-26 cs.LG cs.AI

Xinping Chen , Chen Liu This is my paper · ORCID
classification cs.LGcs.AI
keywords gradientinversiontrainingdatareconstructionleakagefederatedlearningprivacygenerativeattackmodelbackpropagationinverseimageprior
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Gradient-inversion attacks try to recover the private images a client trained on from the gradients that client shared. This paper proposes GIT, a generative attack that learns to invert the backpropagation process itself: after offline training on public input-gradient pairs, a network maps a leaked gradient directly to the reconstructed image in one pass. Because the generator's architecture is tailored to the structure of the model under attack rather than fixed, GIT works without the model's parameters or labels, transfers to clients the attacker never touched, and remains usable when gradients are noisy, pruned, or shifted in distribution. The paper also shows that GIT's output, fed as a starting point to an iterative optimizer, converges faster and yields sharper reconstructions than either component alone.

What carries the argument

The load-bearing object is the recursive input-layer approximation in Equation (3), derived from backpropagation on a generic multi-input multi-output layer. It writes a layer's input activation in terms of the leaked gradients of its input and output weights plus the output activation, cancelling the loss derivative and applying Moore-Penrose inverses, so that reconstruction proceeds layer by layer from output back to input. Coarse-GIT substitutes a shallow MLP for the right-hand side of this equation; the resulting cascade of small networks follows the order of gradient flow during backpropagation and is trained end-to-end to minimize the MSE between estimated and true inputs.

What would settle it

Run GIT in two settings it should fail in if its core claim is wrong: with a public training set whose classes are entirely disjoint from the target client's local classes, and with leaked gradients averaged over a batch of several different images so that no unique input exists. If reconstruction quality collapses to the level of a generic learned inverse in either setting, the claimed transfer and invertibility would be falsified.

Watch

Extended reading notes

Core claim

The paper's claim, stated as its authors would state it, is that a generative model can approximate the inverse of a leaked model's gradient computation when its architecture mirrors the leaked model's structure. Starting from the backpropagation equations of a generic multi-input multi-output layer, the paper cancels the loss derivative and applies Moore-Penrose inverses to express each layer's input activation in terms of leaked gradients, the output activation, and the unknown weights (Equation 3). Exact-GIT treats those unknown weights as trainable parameters, while Coarse-GIT replaces the whole expression with a shallow MLP trained on public input-gradient pairs, recursively estimating each layer's input from the last layer back to the first. The experiments report that this learned inverse outperforms existing generative and optimization baselines on CIFAR-10, ImageNet, and facial expression datasets across LeNet, ResNet, and ViT models, and that it degrades only mildly under gradient noise and pruning, distribution shifts, and parameter discrepancies between clients.

Load-bearing premise

The method rests on the assumption that a shallow network cascade trained on public input-gradient pairs has learned a stable inverse of the leaked model's gradient computation that transfers to unseen local data, even though the motivating equations hold exactly only for a single sample with full-rank tensors and the public and local data must share part of the class space.

Editorial extensions

If this is right

  • GIT reconstructs private training images from shared gradients without the model's parameters or labels, so the attack applies in federated and distributed settings where the attacker only observes gradients.
  • Offline training makes deployment cheap: reconstruction takes milliseconds per image, whereas iterative optimization methods take seconds to hours.
  • Using GIT's output to initialize an iterative optimizer such as IG converges faster and achieves better reconstruction quality than either the generative or the optimization approach alone.
  • GIT remains effective under gradient clipping, pruning, and noise, under distribution shift between public and local data, and under parameter discrepancies between clients — conditions that degrade optimization-based attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If GIT's robustness to pruning generalizes, standard gradient-level defenses in federated learning (clipping, sparsification, noise) offer weaker protection than typically assumed, since a learned inverse can operate on the few dominant gradient components alone.
  • The architecture-adaptive principle suggests a testable defense direction: deliberately design models whose gradient-to-input map is hard to invert, for instance by keeping intermediate tensors low-rank, and measure whether GIT's advantage shrinks.
  • Because GIT transfers across clients, a plausible broader use is auditing: a server could test whether any client's data is reconstructible from its updates without having compromised that client.
  • A natural stress test beyond the paper's experiments is to evaluate GIT when local classes are entirely absent from the public set, since the reported shift experiments only cover partial class overlap.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Gradient Inversion Transcript (GIT), a generative attack for reconstructing training inputs from leaked gradients. GIT derives an approximate inverse-backpropagation formula (Eq. (3)/(5)) and uses it to design a generative model: Exact-GIT follows the formula with learned weight parameters, while Coarse-GIT replaces each layer-level inverse step with a shallow MLP. The model is trained offline on public input-gradient pairs and, at inference, maps leaked gradients to reconstructed inputs without requiring the target model's parameters or labels. GIT can also initialize iterative optimization attacks such as IG. Experiments on CIFAR-10, ImageNet, and facial expression datasets with LeNet, ResNet, and ViT report that GIT outperforms DLG, IG, LTI, and GIAS on most metrics, and that GIT remains relatively robust to gradient noise/pruning, distribution shift, and parameter discrepancies.

Significance. If the reported results hold, GIT would be a practically attractive gradient-inversion method: it is a generative attack that is fast at inference, works without model parameters, and transfers across clients after offline training. The paper's main contributions, an architecture-adaptive generative design and the use of GIT outputs as priors for optimization-based refinement, are well motivated and the experimental comparison is broad, covering multiple datasets, network architectures, and challenging settings. The paper is clearly written and the empirical claims are supported by the tables as far as single-run numbers can support them. The main reservations are the lack of statistical precision (no error bars), the unstated rank/invertibility conditions in the theoretical derivation, and an unresolved gap between the per-sample training protocol and averaged-gradient deployment in federated learning.

major comments (4)
  1. [Section 3.1, Eq. (3) and the 'Mini-Batch Training' paragraph] The derivation of Eq. (3) cancels the shared factor ∂L/∂z^(out)_j between g^(out)_j and g^(in)_i and applies Moore-Penrose inverses to recover the input activation. For a single sample this is a plausible algebraic motivation, but for a mini-batch the leaked gradient is the average (1/B) Σ_b g_b, and individual per-sample inputs are not determined by that average. The paper's response is to broadcast the averaged gradient across the batch dimension, which does not restore the per-sample identity needed for the cancellation. Since Algorithm 1 trains Coarse-GIT on individual input-gradient pairs and Table 4 explicitly fixes the batch size to 1, the transfer of the method to realistic federated mini-batch updates is not demonstrated. Please add experiments with batch sizes larger than 1, or train the generative model on averaged gradients, and report how reconstruction quality degrades with batch size.
  2. [Tables 2-7 and 9-10] All quantitative results are reported as single numbers with no standard deviations, number of seeds, or significance tests. Some of the claimed advantages are small (e.g., CIFAR-10/LeNet MSE 0.010 vs. 0.015 for LTI in Table 2; ImageNet/ResNet MSE 0.039 vs. 0.043 for LTI in Table 2), and the 'consistently outperforms' claim would be stronger if it were accompanied by repeated-run statistics. Given the empirical nature of the central claim, the authors should report means and variances over at least a few independent runs.
  3. [Section 3.1, Eq. (3) and Appendix B.1] Eq. (3) uses Moore-Penrose inverses of tensors via the first dimension and cancels gradient factors, but no rank or invertibility conditions are stated. The cancellation is not generally valid for rank-deficient Jacobians, and the appendix's statement that activations uniquely determine σ′(z) for common activations is only a partial remedy because it does not address rank deficiency of the bilinear products. Since Coarse-GIT replaces the right-hand side with a learned MLP, the final method may still work empirically, but the theoretical support for the architecture design should be qualified accordingly.
  4. [Section 5.2.3, Table 6] The robustness claim for parameter discrepancies is stronger than the data show. For CIFAR-10 with a local dataset volume of 10000, GIT's MSE degrades from 0.010 at 0 epochs to 0.034 at 20 locally trained epochs, nearly reaching LTI's 0.036. The abstract's phrase 'strong robustness under ... discrepancies in model parameters' should be qualified, and the authors should explain or ablate why performance degrades substantially in this setting.
minor comments (4)
  1. [Table 3, 'LTI+IG' row] The SSIM value '09356' appears to be missing a decimal point and should read '0.9356'.
  2. [Abstract and Section 1, Table 1] The abstract says GIT 'only relies on the leaked gradients,' but Table 1 and Section 1 state that GIT additionally requires the leaked model's architecture. Please make the access assumption consistent throughout.
  3. [Appendix D.4, Figure 5] The figure caption refers to 'DLG with Image Prior' while Section 5.1.2 and the surrounding text describe combining GIT with IG. The caption should be corrected to match the method actually used.
  4. [Appendix C] The training and reconstruction protocols are described as using '10000 batches' of input-gradient pairs, but the batch size is not reported except in Table 4. Please state the batch size used for each experiment, especially for the local data during reconstruction.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: GIT is a supervised learned inverse trained on public input-gradient pairs and evaluated on held-out local data; no prediction reduces to a fitted value or to a self-citation.

full rationale

GIT's derivation is self-contained and not circular. Equation (3) is an algebraic rearrangement of the backpropagation identities in Equation (2), explicitly cancelling the loss derivative and applying Moore-Penrose inverses, so it derives an inverse mapping from the chain rule rather than defining the target input in terms of itself. Coarse-GIT does not use Equation (3) as a closed-form predictor; it trains a shallow MLP m_theta to approximate the right-hand side using supervised pairs (x, g), with the MSE loss in Algorithm 1 comparing the estimated input to the ground-truth input. The fitted parameters are only the generator weights Theta/theta/vartheta, and all reported reconstruction metrics are computed on gradients from local datasets that are not the training pairs, so no fitted quantity is renamed as a prediction. The paper contains no load-bearing self-citation: the cited results, including [10] for output-logit estimation and [17] for the LTI baseline, are external prior work, and no argument's force depends on a claim by the same authors. The mini-batch averaging and full-rank concerns raised in Section 3.1 are validity limitations for batch sizes greater than one, not circularity, because the experimental protocol fixes batch size at 1 and the averaged-gradient setting does not reduce the evaluation metric to the training objective. The central claim therefore has independent empirical content.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical entities, forces, or dimensions. GIT, Exact-GIT and Coarse-GIT are algorithmic constructs, not postulated entities requiring independent evidence. The free parameters are training hyperparameters whose values are either stated (hidden size, data volume) or missing (learning rate, epoch budget). The axioms capture the threat-model and invertibility conditions that the attack depends on.

free parameters (3)
  • hidden size of shallow MLPs in Coarse-GIT = 3000
    Appendix C sets 3000 neurons per hidden layer for m_theta and f_theta; this width is chosen by hand and affects reconstruction quality.
  • volume of public training data = 10000 input-gradient pairs
    Section 5.1 states 10000 random samples are used to train generative models; Table 7 shows performance varies with data volume.
  • learning rate eta and epoch budget E = not specified
    Algorithm 1 requires eta and E but the manuscript never reports their values, leaving a free implementation choice.
assumptions (4)
  • domain assumption Backpropagation equations (2) describe the leaked model's gradient computation
    Section 3.1 defines the MIMO layer and asserts the gradient formulas; if the loss is not computed with standard cross-entropy backprop, the inversion fails.
  • ad hoc to paper The Moore-Penrose inverse in Eq. (3) yields a valid approximation after canceling the loss derivative
    The derivation from Eq. (2) to Eq. (3) cancels the loss derivative and relies on pseudo-inverse identities without stating rank or full-column conditions; for batch size greater than one the averaged gradients make this cancellation suspect.
  • domain assumption The public dataset is sufficiently representative of the local data distribution for the learned mapping to transfer
    GIT's training uses input-gradient pairs from an injected public dataset; Section 5.2.2 tests distribution shift and shows performance degrades, implying this assumption is load-bearing.
  • domain assumption The attacker can inject data into one client and knows the exact leaked model architecture
    Problem Settings and Figure 1 assume the attacker hacks the channel to one client to collect training pairs; this follows DLG's threat model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Gradient Inversion Transcript: Leveraging Robust Generative Priors to Reconstruct Training Data from Gradient Leakage." pith.science (2026). https://pith.science/paper/2DI6BD2Y

@misc{pith2026250520026,
  author       = {Pith},
  title        = {Pith review of: Gradient Inversion Transcript: Leveraging Robust Generative Priors to Reconstruct Training Data from Gradient Leakage},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2DI6BD2Y}},
  note         = {Machine review of arXiv:2505.20026}
}
read the original abstract

We propose Gradient Inversion Transcript (GIT), a novel generative approach for reconstructing training data from leaked gradients. GIT employs a generative attack model, whose architecture is tailored to align with the structure of the leaked model based on theoretical analysis. Once trained offline, GIT can be deployed efficiently and only relies on the leaked gradients to reconstruct the input data, rendering it applicable under various distributed learning environments. When used as a prior for other iterative optimization-based methods, GIT not only accelerates convergence but also enhances the overall reconstruction quality. GIT consistently outperforms existing methods across multiple datasets and demonstrates strong robustness under challenging conditions, including inaccurate gradients, data distribution shifts and discrepancies in model parameters.

Figures

Figures reproduced from arXiv: 2505.20026 by the authors.

Figure 1
Figure 1. A flowchart of problem settings for GIT. The attacker hacks the channel of one client to inject data and utilizes [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An MIMO layer. As in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The red curve represents convergence curve of [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: The figure illustrates the reconstructed images for IG when the leaked model is LeNet and the dataset is [PITH_FULL_IMAGE:figures/full_fig_p017_4.png]
Figure 6
Figure 6. Figure 6: The figure illustrates the ground truth input images, the direct reconstructed images by GIT and the reconstructed images using IG initialized with GIT-generated prior, from top to the bottom respectively. The top three rows correspond to the CIFAR-10 dataset with the …
Figure 7
Figure 7. Figure 7: The first 8 reconstructed images (ImageNet, ResNet). Odd-numbered rows show the ground-truth images, [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]
Figure 8
Figure 8. Figure 8: The best 100 reconstructed images with lowest MSE (ImageNet, ResNet). Odd-numbered rows show the [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 18 canonical work pages

  1. [1]

    Distributed learning: developing a predictive model based on data from multiple hospitals without data leaving the hospital–a real life proof of concept

    Arthur Jochems, Timo M Deist, Johan Van Soest, Michael Eble, Paul Bulens, Philippe Coucke, Wim Dries, Philippe Lambin, and Andre Dekker. Distributed learning: developing a predictive model based on data from multiple hospitals without data leaving the hospital–a real life proof of concept. Radiotherapy and Oncology, 121(3):459–467, 2016

    work page 2016

  2. [2]

    Communication- efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics , pages 1273–1282. PMLR, 2017

    2017

  3. [3]

    Ffd: A federated learning based method for credit card fraud detection

    Wensi Yang, Yuhang Zhang, Kejiang Ye, Li Li, and Cheng-Zhong Xu. Ffd: A federated learning based method for credit card fraud detection. In Big Data–BigData 2019: 8th International Congress, Held as Part of the Services Conference Federation, SCF 2019, San Diego, CA, USA, June 25–30, 2019, Proceedings 8, pages 18–32. Springer, 2019

    work page 2019

  4. [4]

    Evaluating gradient inversion attacks and defenses in federated learning

    Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and defenses in federated learning. In M. Ranzato, A. Beygelzimer, Y . Dauphin, P.S. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 7232–7241. Curran Associates, Inc., 2021

    work page 2021

  5. [5]

    Privacy-preserving deep learning: Revisited and enhanced

    Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai. Privacy-preserving deep learning: Revisited and enhanced. In Applications and Techniques in Information Security: 8th International Conference, ATIS 2017, Auckland, New Zealand, July 6–7, 2017, Proceedings, pages 100–110. Springer, 2017

    work page 2017

  6. [6]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In H. Wallach, H. Larochelle, A. Beygelz- imer, F. d'Alché-Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems , volume 32. Curran Associates, Inc., 2019

    work page 2019

  7. [7]

    idlg: Improved deep leakage from gradients

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610, 2020

    arXiv 2001

  8. [8]

    A framework for evaluating gradient leakage attacks in federated learning

    Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu. A framework for evaluating gradient leakage attacks in federated learning. arXiv preprint arXiv:2004.10397, 2020

    arXiv 2004

Show all 32 references
  1. [9]

    Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems, 33:16937–16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems, 33:16937–16947, 2020

    2020

  2. [10]

    R-gap: Recursive gradient attack on privacy

    Junyi Zhu and Matthew Blaschko. R-gap: Recursive gradient attack on privacy. arXiv preprint arXiv:2010.07733, 2020

    2010 arXiv

  3. [11]

    Sapag: A self-adaptive privacy attack from gradients

    Yijue Wang, Jieren Deng, Dan Guo, Chenghong Wang, Xianrui Meng, Hang Liu, Caiwen Ding, and Sanguthevar Rajasekaran. Sapag: A self-adaptive privacy attack from gradients. arXiv preprint arXiv:2009.06228, 2020

    2009 arXiv

  4. [12]

    See through gradients: Image batch recovery via gradinversion

    Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16337–16346, 2021. 11 A PREPRINT - ...

    2021

  5. [13]

    Reconstructing training data from model gradient, provably

    Zihan Wang, Jason Lee, and Qi Lei. Reconstructing training data from model gradient, provably. In International Conference on Artificial Intelligence and Statistics, pages 6595–6612. PMLR, 2023

    2023

  6. [14]

    Gradient inversion with generative image prior

    Jinwoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et al. Gradient inversion with generative image prior. Advances in neural information processing systems, 34:29898–29908, 2021

    2021

  7. [15]

    Auditing privacy defenses in federated learning via generative gradient leakage

    Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Auditing privacy defenses in federated learning via generative gradient leakage. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10132–10142, 2022

    2022

  8. [16]

    Gifd: A generative gradient inversion method with feature domain optimization

    Hao Fang, Bin Chen, Xuan Wang, Zhi Wang, and Shu-Tao Xia. Gifd: A generative gradient inversion method with feature domain optimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4967–4976, 2023

    2023

  9. [17]

    Learning to invert: Simple adaptive attacks for gradient inversion in federated learning

    Ruihan Wu, Xiangyu Chen, Chuan Guo, and Kilian Q Weinberger. Learning to invert: Simple adaptive attacks for gradient inversion in federated learning. In Uncertainty in Artificial Intelligence, pages 2293–2303. PMLR, 2023

    2023

  10. [18]

    Recovering labels from local updates in federated learning

    Huancheng Chen and Haris Vikalo. Recovering labels from local updates in federated learning. arXiv preprint arXiv:2405.00955, 2024

    2024 arXiv

  11. [19]

    Dggi: Deep generative gradient inversion with diffusion model

    Liwen Wu, Zhizhi Liu, Bin Pu, Kang Wei, Hangcheng Cao, and Shaowen Yao. Dggi: Deep generative gradient inversion with diffusion model. Information Fusion, 113:102620, 2025

    2025

  12. [20]

    The perceptron: a probabilistic model for information storage and organization in the brain

    Frank Rosenblatt. The perceptron: a probabilistic model for information storage and organization in the brain. Psychological review, 65(6):386, 1958

    1958

  13. [21]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016

    2016

  14. [22]

    Reconstructing training data from trained neural networks

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstructing training data from trained neural networks. Advances in Neural Information Processing Systems, 35:22911–22924, 2022

    2022

  15. [23]

    Instance-wise batch label restoration via gradients in federated learning

    Kailang Ma, Yu Sun, Jian Cui, Dawei Li, Zhenyu Guan, and Jianwei Liu. Instance-wise batch label restoration via gradients in federated learning. In The Eleventh International Conference on Learning Representations, 2023

    2023

  16. [24]

    Spear: Exact gradient inversion of batches in federated learning

    Dimitar I Dimitrov, Maximilian Baader, Mark Müller, and Martin Vechev. Spear: Exact gradient inversion of batches in federated learning. Advances in Neural Information Processing Systems, 37:106768–106799, 2024

    2024

  17. [25]

    Generative adversarial nets

    Ian J Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014

    2014

  18. [26]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017

    2017

  19. [27]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  20. [28]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  21. [29]

    The japanese female facial expression (jaffe) dataset

    Michael Lyons, Miyuki Kamachi, and Jiro Gyoba. The japanese female facial expression (jaffe) dataset. (No Title), 1998

    1998

  22. [30]

    Gradient-based learning applied to document recognition

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998

    1998

  23. [31]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  24. [32]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv...

    2010 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.