Pith. sign in

REVIEW 3 major objections 6 minor 29 references

Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that Frequency-Space Attack, combining Fourier high-frequency augmentation with multi-scale gradient fusion, reliably outperforms existing input-transformation attacks against black-box defense models.

desk verdict FSA is a coherent and novel combination of frequency-domain augmentation and pyramid gradient fusion, but the headline 23.6% gain over BSR is not established as reported; the method deserves serious review but needs held-out tuning, code, and consistent numbers. read the letter →

arxiv 2505.21181 v1 pith:4MQRCDM6 submitted 2025-05-27 cs.CV eess.IV

Yayin Zheng , Chen Wan , Zihong Guo , Hailing Kuang , Xiaohai Lu This is my paper
classification cs.CVeess.IV
keywords adversarialattacktransferabilityfrequency-domainaugmentationFouriertransformgradientfusionGaussianpyramidblack-boxdefenseinputtransformation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to establish a new adversarial attack, Frequency-Space Attack (FSA), that crafts images that transfer from a model whose weights are known to unseen black-box models. FSA combines High-Frequency Augmentation, which amplifies high-frequency components in the Fourier domain, with Hierarchical-Gradient Fusion, which blends gradients across a Gaussian pyramid at each optimization step. On 1,000 ImageNet images the paper reports that FSA consistently outperforms six existing input-transformation attacks: from Inc-v3 the average attack success rate on eight defense models is 68.1%, versus 44.5% for BSR, a 23.6-percentage-point gain. In the ensemble setting FSA reaches 87.7% average success rate against BSR's 84.2%. The intended consequence is that combining frequency-domain boosting with multi-scale gradient smoothing is a stronger recipe for transferable attacks than spatial-only transformations.

What carries the argument

The load-bearing object is the two-stage transformation pipeline. The frequency stage is a Fourier-domain augmentation: $\mathcal{D}_a=(\mathcal{D}_x+\mathcal{D}_\xi)\cdot\mathcal{M}$, where $\mathcal{D}_\xi$ is Fourier-transformed Gaussian noise scaled by a high-frequency linear ramp and $\mathcal{M}$ is a random multiplicative mask; the augmented image is the inverse Fourier transform. The spatial stage is a Gaussian pyramid on the gradient, in which each level is blurred and down-sampled, then all levels are up-sampled and combined with geometrically decaying weights, giving low-resolution structure the larger vote. This fused gradient replaces the raw gradient in MI-FGSM, so every attack step is driven by a smoother, multi-scale estimate of the loss surface.

What would settle it

Fix FSA's hyperparameters using a held-out set of defense models, then report the average attack success rate on the remaining defense models in Table 1; if the 23.6-percentage-point advantage over BSR shrinks to near zero or reverses, the claim of consistent improvement is falsified.

Watch

Extended reading notes

Core claim

The central claim is that FSA's two modules are complementary and jointly produce more transferable adversarial examples than any tested baseline. High-Frequency Augmentation maps the image to frequency space with the Fourier transform, adds Gaussian noise weighted by the ramp $\mathcal{W}_{h,w}=(h+w)/(H+W-2)$ so high frequencies receive more energy, multiplies by a random spectral mask $\mathcal{M}\sim U(1-\rho,1+\rho)$, and transforms back. Hierarchical-Gradient Fusion builds a Gaussian pyramid of the gradient, up-samples every level, and fuses the levels with decay $\beta=0.8$ so coarser gradients dominate, and this combined gradient is fed into momentum iterative FGSM. The reported consequence is consistent gains across four source models and eight defended models, with per-source average improvements over BSR from 2.8 to 19.1 percentage points and a 23.6-point average margin in the single-model setting.

Load-bearing premise

The reported margins assume that selecting the hyperparameters ($\rho=0.7$, $\sigma=2\epsilon$, $\beta=0.8$, $n=5$, $N=20$) by attack success on the same defense models that appear in the main table does not materially inflate the average gain over BSR.

Editorial extensions

If this is right

  • FSA can be layered on top of existing transformations: combined variants (DIM-FSA, TIM-FSA, SIM-FSA, Admix-FSA, BSR-FSA) improve average attack success rates by 18.5 to 49.2 percentage points over the uncombined methods using Inc-v3 as source.
  • At only two transformed images per step, FSA already beats BSR on three defense models, so its transferability gain does not depend on a large number of forward passes.
  • FSA outperforms BSR not only on normal models but on ensemble-adversarially-trained, high-level-representation-denoiser, randomization, feature-distillation, and self-supervised denoiser defenses.
  • FSA adds no distortion beyond the standard budget ($\epsilon=16$, $T=10$ iterations), so the reported gains are within the same perturbation constraint as the baselines.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If high-frequency amplification is the active mechanism, then defenses that gain robustness by suppressing low-frequency reliance should be especially vulnerable to this style of attack; the paper measures the effect on such defenses but does not isolate the mechanism.
  • The $\beta=0.8$ weighting that favors low-resolution gradient levels is close to a smoothing operation; a natural ablation the paper does not run is replacing the pyramid with a single blurred gradient to see whether fusion or smoothing drives the gain.
  • BSR-FSA pushes average success rate above 80% on every tested defense model, which suggests the two mechanisms exploit different failure modes; testing FSA inside other recently proposed transformations would show whether that complementarity generalizes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper proposes Frequency-Space Attack (FSA), which combines a high-frequency augmentation module (HAM) in the Fourier domain with a hierarchical-gradient fusion module (HFM) based on a Gaussian pyramid, integrated into MI-FGSM. The authors report experiments on ImageNet with four source models and eight defense models, claiming that FSA outperforms state-of-the-art input-transformation attacks such as BSR, with an average attack success rate increase of 23.6 percentage points on the eight defenses, and that FSA also combines favorably with other transformations and with ensemble attacks.

Significance. The proposed FSA is a simple and plausible combination of frequency-domain input augmentation and multi-scale gradient fusion, and the modular ablation (Fig. 4) indicates that both HAM and HFM contribute over the MI-FGSM baseline. If the reported improvements were established with a sound evaluation protocol, the method would be a useful contribution to the adversarial-transferability literature, and the compatibility results in Table 2 suggest it can be plugged into existing attacks. However, the current evidence does not support the headline magnitude: the aggregate statistic is internally inconsistent, hyperparameters were selected on three of the evaluated defenses, and no variability estimates or code are provided. The paper needs a major revision of its experimental validation.

major comments (3)
  1. [Abstract, Section 4.2, Table 1] The headline 'average attack success rate increase of 23.6% compared with BSR' is not the average over the reported source models: the 23.6-point figure is the difference in the AVG column for the Inc-v3 source row (68.1 − 44.5). Averaging the four source rows in Table 1 gives (23.6 + 16.2 + 12.0 + 2.8)/4 = 13.65 percentage points. The same section states that the average ASR of FSA exceeds BSR by '2.8% to 19.1%', but Table 1 contains a 23.6-point difference, so the stated range is inconsistent with both the table and the abstract. The aggregate statistics need to be recomputed and stated consistently.
  2. [Section 4.5, Table 1] Hyperparameters are selected on three of the eight defense models that appear in the main results. The ablation study in Section 4.5 tunes N, β, n, K, ρ, and σ using Inc-v3 as the source and evaluating on Inc-v3ens3, Inc-v3ens4, and IncRes-v2ens, which are three of the eight defense columns in Table 1. The gains on those columns are therefore partly fitted, and the remaining five defenses share hyperparameters chosen on those three. The central claim of a large average improvement over BSR is thus not established as written; the authors should either tune on a held-out set of defense models or report results with hyperparameters fixed before evaluation, and present the current Table 1 as a model-selection result.
  3. [Sections 4.2–4.4, Tables 1–3] No measure of variability is reported for any attack success rate. The evaluation uses 1000 images and attacks with random transformations (N=20), so the single reported numbers may vary across runs or subsets. Several of the claimed advantages are small; for example, in the Res-101 row of Table 1 the FSA versus BSR difference is 2.8 points, and in the Inc-v4 and IncRes-v2 rows many columns differ by less than 3 points. Without error bars, confidence intervals, multiple independent runs, or released code, the reader cannot distinguish a robust effect from sampling variability, and the substantive claims cannot be independently verified.
minor comments (6)
  1. [Section 3.3, Eqs. (5)–(6)] The pyramid depth is denoted n in the text but L in Eqs. (5) and (6); L is never defined, so the summation limits are unclear.
  2. [Section 3.2, Eq. (1)] The symbol h_o is mentioned as modulating the intensity of frequency-domain adjustments but is never defined or used in the equation; the sentence describing W as dynamically regulating the scalar ρ is also unclear and should be rewritten.
  3. [Section 4.1] The paper says 'we adopt the l-norm as the metric for distortion' without specifying which l norm; given ε=16, this should be ℓ∞-norm.
  4. [References] Reference [26] has a duplicated number in the list (''26. 26. Liao...'').
  5. [Section 4.5, Fig. 2 caption] The caption of Fig. 2 refers to 'perturbation budget β', but β is the gradient-fusion decay factor, not a perturbation budget; please correct the caption.
  6. [Section 4.3, Table 2] The abbreviation 'SI-DI-TIM' is used without definition; the same combination is called STD elsewhere. Also, the AVG.↑ column should be explicitly described as the mean per-defense improvement over the corresponding non-FSA attack.

Circularity Check

1 steps flagged · score 4.0 of 10

FSA's headline 23.6% advantage over BSR is partly fitted: hyperparameters are selected on three of the eight defense models that appear in Table 1; the remaining five defenses provide independent but shared-parameter evidence.

  1. fitted input called prediction [Section 4.5 (hyperparameter selection) feeding Section 4.2 Table 1 and Abstract's 23.6% claim]
    "we conducted an ablation study and hyperparameter analysis by generating adversarial examples on Inc-v3 and evaluating them on four standard models, namely Inc-v3, Inc-v4, IncRes-v2, and Res-101, as well as three defense models, including Inc-v3ens3, Inc-v3ens4, and IncRes-v2ens. ... Based on the experimental results, the combination of 𝜎 = 2𝜖 and 𝜌 = 0.7 consistently achieves high attack success rates across most target models, making it the optimal configuration for our final experimental setup."

    The hyperparameters rho=0.7, sigma=2*epsilon, beta=0.8, n=5, kernel=3x3, and N=20 are chosen by maximizing ASR on Inc-v3ens3, Inc-v3ens4, and IncRes-v2ens in Sec. 4.5. Those exact models are three of the eight evaluation columns in Table 1 that support the claims that 'FSA consistently outperforms' and that FSA has a 23.6% average ASR gain over BSR. The Inc-v3 row in Table 1, which produces the 23.6% figure, is generated with these tuned hyperparameters, so the reported advantage on those three columns is a selection outcome rather than an independent prediction. The remaining five defense models (HGD, R&P, NIPS-r3, NRP, FD) were not used in the tuning and still show gains, so the circularity is partial rather than total.

full rationale

FSA is an algorithmic proposal rather than a formal derivation, so the only load-bearing empirical claim is the reported improvement over baselines on eight defense models. That claim is partially circular because the method's hyperparameters are selected in Sec. 4.5 by maximizing attack success on three of those same defense models (Inc-v3ens3, Inc-v3ens4, IncRes-v2ens), and these three columns appear in Table 1, which is the source of the abstract's 23.6% average improvement over BSR. For those columns the comparison is fitted rather than predicted. The other five defense models were not part of the selection and still exhibit consistent improvements in Table 1, giving the central finding independent grounding despite the shared parameter choices. The abstract's 23.6% is also only the Inc-v3 row delta (68.1 - 44.5) rather than an average over all source rows (about 13.65 points), and the paper reports no error bars or released code; these are reporting/robustness concerns rather than additional circularity. No load-bearing self-citation or imported uniqueness theorem is present.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central performance claim rests on six hand-selected hyperparameters tuned on the evaluation defenses, plus assumptions about frequency sensitivity and gradient smoothing inherited from prior work. The paper contributes no formal model of transferability, so all substantive content is empirical.

free parameters (6)
  • spectral modulation factor rho = 0.7
    Tuned in Section 4.5.5 and Fig. 3; controls the range of the random frequency-domain mask.
  • Gaussian noise standard deviation sigma = 2*epsilon
    Tuned in Section 4.5.5; sigma=2*epsilon selected as optimal on the defense models.
  • gradient pyramid decay factor beta = 0.8
    Tuned in Section 4.5.2 and Fig. 2(b); controls the weight of lower-resolution gradient layers.
  • pyramid layers n = 5
    Tuned in Section 4.5.3 and Fig. 2(c); deeper pyramids gave marginal gains.
  • Gaussian kernel size K = 3x3
    Tuned in Section 4.5.4 and Fig. 2(d); larger kernels changed ASR by less than 2%.
  • number of transformed images N = 20
    Tuned in Section 4.5.1 and Fig. 2(a); attack performance stabilizes when N reaches 20.
assumptions (4)
  • domain assumption DNNs are more sensitive to high-frequency components, and adversarially trained models are robust mainly via low-frequency information.
    Motivates HAM; based on cited works [16,17] and not verified in this paper.
  • domain assumption Perturbations computed from frequency-noise augmented inputs and multi-scale gradient averages transfer better to unseen models.
    This is the core heuristic of FSA; no theoretical proof is provided.
  • domain assumption The 1000-image ImageNet subset and the eight defense models are representative for evaluating transferability.
    Inherited from prior work [5] and standard practice in the attack literature.
  • domain assumption Fourier transform and Gaussian pyramid operations have no adverse numerical effects on gradient computation.
    Assumed in the implementation; no numerical stability analysis is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion." pith.science (2026). https://pith.science/paper/4MQRCDM6

@misc{pith2026250521181,
  author       = {Pith},
  title        = {Pith review of: Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4MQRCDM6}},
  note         = {Machine review of arXiv:2505.21181}
}
read the original abstract

Adversarial attacks have become a significant challenge in the security of machine learning models, particularly in the context of black-box defense strategies. Existing methods for enhancing adversarial transferability primarily focus on the spatial domain. This paper presents Frequency-Space Attack (FSA), a new adversarial attack framework that effectively integrates frequency-domain and spatial-domain transformations. FSA combines two key techniques: (1) High-Frequency Augmentation, which applies Fourier transform with frequency-selective amplification to diversify inputs and emphasize the critical role of high-frequency components in adversarial attacks, and (2) Hierarchical-Gradient Fusion, which merges multi-scale gradient decomposition and fusion to capture both global structures and fine-grained details, resulting in smoother perturbations. Our experiment demonstrates that FSA consistently outperforms state-of-the-art methods across various black-box models. Notably, our proposed FSA achieves an average attack success rate increase of 23.6% compared with BSR (CVPR 2024) on eight black-box defense models.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

29 extracted references · 19 canonical work pages

  1. [1]

    ACM Transactions on Software Engineering and Methodology 33, 1-28 (2024)

    Shao, C., Li, G., Wu, J., Zheng, X.: Exploring semantic redundancy using backdoor triggers: A complementary insight into the challenges facing DNN -based software vulnerability de- tection. ACM Transactions on Software Engineering and Methodology 33, 1-28 (2024)

    work page 2024

  2. [2]

    In: 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp

    Ye, M., Xu, X., Zhang, Q., Wu, J.: Sharpness-aware optimization for real-world adversarial attacks for diverse compute platforms with enhanced transferability. In: 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 2937-

    work page 2024

  3. [3]

    In: Proc

    Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., Yuille, A.L.: Improving transfera- bility of adversarial examples with input diversity. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 2730-2739. (2019)

    work page 2019

  4. [4]

    In: Proc

    Dong, Y., Pang, T., Su, H., Zhu, J.: Evading defenses to transferable adversarial examples by translation -invariant attacks. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 4312-4321. (2019)

    2019

  5. [5]

    arXiv:1908.06281 (2019)

    Lin, J., Song, C., He, K., Wang, L., Hopcroft, J.E.: Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv:1908.06281 (2019)

    arXiv 2019

  6. [6]

    In: Proc

    Wang, X., He, X., Wang, J., He, K.: Admix: Enhancing the transferability of adversarial attacks. In: Proc. IEEE Int. Conf. on Computer Vision (ICCV), pp. 16158-16167. (2021)

    2021

  7. [7]

    In: Proc

    Wang, X., Zhang, Z., Zhang, J.: Structure invariant transformation for better adversarial transferability. In: Proc. IEEE Int. Conf. on Computer Vision (ICCV), pp. 4607 -4619. (2023)

    work page 2023

  8. [8]

    In: Proc

    Wang, K., He, X., Wang, W., Wang, X.: Boosting adversarial transferability by block shuf- fle and rotation. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 24336-24346. (2024) 14 Y. Zheng, C. Wan, Z. Guo, H. Kuang, X. Lu

    work page 2024

Show all 29 references
  1. [9]

    -L., Lee, C

    Chen, K. -L., Lee, C. -H., Rao, B.D., Garudadri, H.: A DNN based normalized time -fre- quency weighted criterion for robust wideband DoA estimation. In: ICASSP 2023 - 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5. IEEE (2023)

    2023

  2. [10]

    Neurocomputing 481, 294-309 (2022)

    Zhang, Z., Meng, D., Zhang, L., Xiao, W., Tian, W.: The range of harmful frequency for DNN corruption robustness. Neurocomputing 481, 294-309 (2022)

    2022

  3. [11]

    IEEE Trans- actions on Dependable and Secure Computing 21, 5766-5780 (2022)

    Liu, Y., Wu, H., Zhang, X.: Robust and Imperceptible Black -Box DNN Watermarking Based on Fourier Perturbation Analysis and Frequency Sensitivity Clustering. IEEE Trans- actions on Dependable and Secure Computing 21, 5766-5780 (2022)

    2022

  4. [12]

    In: 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp

    Hammoud, H., Bibi, A., Torr, P.H.S., Ghanem, B.: Don’t FREAK Out: A Frequency -In- spired Approach to Detecting Backdoor Poisoned Samples in DNNs. In: 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 2338-

    2023

  5. [13]

    In: Proc

    Long, Y., Zhang, Q., Zeng, B., Gao, L., Liu, X., Zhang, J., Song, J.: Frequency domain model augmentation for adversarial attack. In: Proc. Eur. Conf. on Computer Vision (ECCV), pp. 549-566. Springer (2022)

    2022

  6. [14]

    In: Proc

    Wang, H., Wu, X., Huang, Z., Xing, E.P.: High -frequency component helps explain the generalization of convolutional neural networks. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 8684-8694. (2020)

    2020

  7. [15]

    In: Advances in Neural Information Processing Sys- tems

    Yin, D., Gontijo Lopes, R., Shlens, J., Cubuk, E.D., Gilmer, J.: A fourier perspective on model robustness in computer vision. In: Advances in Neural Information Processing Sys- tems. (2019)

    2019

  8. [16]

    In: Proc

    Wang, S., Veldhuis, R., Brune, C., Strisciuglio, N.: What do neural networks learn in image classification? a frequency shortcut perspective. In: Proc. IEEE Int. Conf. on Computer Vi- sion (ICCV), pp. 1433-1442. (2023)

    2023

  9. [17]

    In: Proc

    Zhang, T., Zhu, Z.: Interpreting adversarially trained convolutional neural networks. In: Proc. Int. Conf. on Machine Learning (ICML), pp. 7502-7511. (2019)

    2019

  10. [18]

    In: Proc

    Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J.: Boosting adversarial attacks with momentum. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 9185-9193. (2018)

    2018

  11. [19]

    arXiv:1611.01236 (2016)

    Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial machine learning at scale. arXiv:1611.01236 (2016)

    2016 arXiv

  12. [20]

    In: Proc

    Gao, L., Zhang, Q., Song, J., Liu, X., Shen, H.T.: Patch-wise attack for fooling deep neural network. In: Proc. Eur. Conf. on Computer Vision (ECCV), pp. 307-322. Springer (2020)

    2020

  13. [21]

    International journal of computer vision 115, 211-252 (2015)

    Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M.: Imagenet large scale visual recognition challenge. International journal of computer vision 115, 211-252 (2015)

    2015

  14. [22]

    In: Proc

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the inception archi- tecture for computer vision. In: Proc. IEEE Conf. on Computer Vision and Pattern Recog- nition (CVPR), pp. 2818-2826. (2016)

    2016

  15. [23]

    In: Proc

    Szegedy, C., Ioffe, S., Vanhoucke, V., Alemi, A.: Inception -v4, inception-resnet and the impact of residual connections on learning. In: Proc. AAAI Conf. on Artificial Intelligence (AAAI). (2017)

    2017

  16. [24]

    In: Proc

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 770-778. (2016)

    2016

  17. [25]

    arXiv:1705.07204 (2017) Boosting Adversarial Transferability via HAM and HFM 15

    Tramè r, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P.: Ensemble adversarial training: Attacks and defenses. arXiv:1705.07204 (2017) Boosting Adversarial Transferability via HAM and HFM 15

    2017 arXiv

  18. [26]

    Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., Zhu, J.: Defense against adversarial attacks using high-level representation guided denoiser

    26. Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., Zhu, J.: Defense against adversarial attacks using high-level representation guided denoiser. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 1778-1787. (2018)

    2018

  19. [27]

    arXiv:1711.01991 (2017)

    Xie, C., Wang, J., Zhang, Z., Ren, Z., Yuille, A.: Mitigating adversarial effects through ran- domization. arXiv:1711.01991 (2017)

    2017 arXiv

  20. [28]

    In: Proc

    Liu, Z., Liu, Q., Liu, T., Xu, N., Lin, X., Wang, Y., Wen, W.: Feature distillation: Dnn - oriented jpeg compression against adversarial examples. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 860-868. IEEE (2019)

    2019

  21. [29]

    In: Proc

    Naseer, M., Khan, S., Hayat, M., Khan, F.S., Porikli, F.: A self -supervised approach for adversarial robustness. In: Proc. IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 262-271. (2020)

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.