Pith. sign in

REVIEW 4 major objections 5 minor 27 references

How Do Diffusion Models Improve Adversarial Robustness?

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Diffusion-model purification improves adversarial robustness through two mechanisms: stochasticity that confuses gradient attacks, and a deterministic compression of image space that a gradient-free compression rate predicts.

desk verdict Real observations and a useful compression-rate predictor, but the headline 'net robustness drops to 24%' overreaches because the fixed-randomness protocol measures a deterministic instantiation, not the stochastic defense as deployed. read the letter →

arxiv 2505.22839 v1 pith:EQBSGNN6 submitted 2025-05-28 cs.LG cs.AI

Liu Yuezhang , Xue-Xin Wei This is my paper
classification cs.LGcs.AI
keywords adversarialpurificationdiffusionmodelsstochasticitycompressionrategradientmaskingrobustnessevaluationanchorpointsCIFAR-10
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to explain how diffusion-model-based adversarial purification actually works, and how well it works once randomness is no longer allowed to hide the defense. It shows that diffusion models do not denoise adversarial images back toward their clean originals; instead they push them to anchor points that are farther from the clean image, while compressing the local image space around those anchor points. The dominant component of reported robustness is the diffusion model's internal randomness: when the same random configuration is used for both attack and testing, the robustness gain on CIFAR-10 drops from roughly 70% (or 46% with expectation-over-transformation) to 23.7%. The remaining gain is explained by a compression rate, a gradient-free quantity that follows a sigmoid law with robust accuracy, which the paper offers as a practical robustness indicator and a design target for purification systems.

What carries the argument

The carrying machinery is the first-order Taylor decomposition of the purification map around the clean image, which separates the map into an anchor point and a local linear transformation. The compression rate, defined as the norm of the output difference divided by the norm of the input difference, quantifies how much the adversarial ball shrinks under the diffusion model; the paper shows that this rate predicts robust accuracy through a sigmoid curve that matches the base classifier's robustness under reduced attack budgets. A second piece of machinery is the variance decomposition of the purification output into input variability and internal-randomness variability, whose ratio defines the signal-to-noise ratio and proves that stochasticity dominates.

What would settle it

Compute CIFAR-10 robust accuracy under the same fixed-seed protocol but with an attack that can also choose the seed, or with 1000 PGD steps instead of 40; if accuracy falls well below 23.7%, the claim that 23.7% is the intrinsic non-stochastic robustness is falsified. Alternatively, find a sampler with compression rate below 0.2 whose robust accuracy lies far off the fitted sigmoid curve.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that the empirically observed robustness of diffusion-based purification decomposes into two sources: stochasticity and a deterministic compression effect. The stochasticity is not a minor detail; the signal-to-noise ratio of purification is about 6 times 10 to the minus 3, meaning internal noise dominates input variations roughly 170-fold. Concretely, when the same noise configuration is used for both attack and testing, CIFAR-10 PGD robust accuracy is 23.7%, compared with roughly 70% reported by the original DiffPure evaluation and roughly 46% under PGD-EOT, while ImageNet BPDA accuracy is 29.5%. The residual robustness follows a lawful relationship with the compression rate, the ratio of the purification output difference to the input difference, which can be measured without any gradient computation and which extrapolates to the clean accuracy at zero compression.

Load-bearing premise

The decomposition into stochasticity plus compression assumes that fixing the random seed during both attack and test measures the diffusion model's intrinsic robustness; if the fixed seed is merely a stationary target that is easier to attack than the real stochastic system, the 23.7% figure would understate the defense's actual robustness.

Editorial extensions

If this is right

  • Reported DiffPure robustness numbers that do not fix randomness should be read as transfer-attack performance rather than intrinsic robustness: they mix a genuine compression effect with a stochasticity-induced failure of the attack to converge.
  • The compression rate offers a gradient-free way to tune purification systems: searching diffusion timesteps and samplers for lower compression rates predicts higher robustness, as seen with reverse-only models reaching 46.5% at larger timesteps.
  • Because the compression-robustness curve traces the base classifier's behavior under smaller attack budgets, compression acts like an effective reduction of the adversarial budget, tying diffusion purification to classical budget-robustness tradeoffs.
  • A purification system designed around the two criteria of high clean accuracy at anchor points and strong compression around them should achieve robustness without relying on stochasticity, pointing toward compression-based purification rather than random-noise defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The fixed-seed protocol may be optimistic in the opposite direction: if an attacker is allowed to choose or optimize the random seed, the 23.7% figure could drop further, meaning the paper's number is an upper bound under its specific attack budget rather than a certificate against adversarially chosen randomness.
  • The compression-rate theory should transfer to other generative purification maps such as GANs, VAEs, or autoencoders; any map with accurate anchor points and strong Jacobian compression should show the same sigmoid robustness law, a claim that can be tested without diffusion-specific machinery.
  • The push-away of clean images suggests clean images are not local modes of the learned prior, and the observed switch from expansion to shrinkage for larger perturbations hints that a scale-dependent purification schedule, compressing hard for small perturbations and denoising for large ones, may outperform a single fixed timetable.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper investigates why diffusion-model-based adversarial purification appears to improve robustness and how large that improvement really is. The authors report three main findings: (1) diffusion purification pushes perturbed images farther from, rather than closer to, clean images, contradicting a simple "denoising" intuition; (2) the internal randomness of the diffusion process dominates the output, and once randomness is fixed during both attack and test, robust accuracy on CIFAR-10 drops to about 23.7%, far below the roughly 70% originally reported; and (3) the remaining robustness gain is strongly correlated with a simple ``compression rate'' of the purification mapping, which is claimed to be a reliable, gradient-free predictor of robustness. The paper includes extensive experiments on CIFAR-10 and ImageNet, full-gradient attacks on CIFAR-10, and a detailed appendix with implementation details and distance measurements.

Significance. If the central claims hold, the paper would make an important conceptual contribution: it would separate the stochastic component of diffusion-based purification from a deterministic compression effect, and it would provide a cheap, gradient-free statistic (compression rate) for predicting robustness. The paper is unusually transparent about its limitations, including the inability to run full-gradient attacks on ImageNet and possible gradient masking at large timesteps. The empirical observation that diffusion models increase Lp distance to clean inputs is a useful counterpoint to common intuition, and the proposal of a falsifiable compression-robustness relation is a valuable starting point. However, the quantitative headline claim (the 23.7% ``net'' robustness and the associated stochasticity/compression split) rests on an evaluation protocol whose interpretation is questionable, and the compression-robustness ``law'' is supported by a small, post-hoc fitted dataset. The paper's significance is therefore real but currently overstated; it could become a solid contribution after substantial reframing and additional validation.

major comments (4)
  1. [Sec. 4, Eq. (8)-(9) and Table 4] The fixed-randomness protocol (xi_attack = xi_test) is not a neutral control for the stochastic defense; it deliberately hands the attacker the exact test-time realization of the purification function. Table 4 shows that the same PGD attack evaluated under a different fixed configuration yields 77.4% accuracy on CIFAR-10, close to the 85.8% clean accuracy, so with fresh test-time randomness the attack becomes nearly ineffective. Consequently, the 23.7% figure measures the robustness of one deterministic instantiation against an attack optimized for that exact instantiation, not the "net" robustness of the stochastic purification system. The paper's central decomposition of the robustness gain into stochasticity versus compression is therefore not established unless the protocol is explicitly defended as a worst-case analysis over random seeds, and the conclusions should be reframed accordingly.
  2. [Sec. 5, Table 7 and Fig. 3b] The compression-robustness ``law'' is a sigmoid fitted post hoc to a small dataset: roughly seven timesteps for each of two samplers (DDPM and Reverse) on CIFAR-10, with no error bars reported for the PGD robustness values in Table 7 and no holdout validation. The claim that compression rate is a ``reliable robustness indicator'' is too strong given this support. The authors should provide repeated runs with confidence intervals, evaluate the fitted relation on held-out configurations (e.g., different attack budgets, different base classifiers, or ImageNet compression-rate measurements), and include uncertainty quantification for the extrapolation to clean accuracy.
  3. [Sec. 6 and Sec. 4 (ImageNet results)] The ImageNet result of 29.5% robust accuracy is obtained with BPDA without full gradients, as the authors acknowledge in Sec. 6. Because the paper's main contribution is to correct overestimated robustness, an evaluation method that is known to be susceptible to gradient masking cannot support the generalization claim to ImageNet. The authors should either run stronger attacks (e.g., more EOT samples, partial full-gradient attacks, or transfer attacks with multiple fixed seeds) or explicitly downgrade the ImageNet result to a preliminary observation. As written, the ImageNet numbers do not carry the same weight as the CIFAR-10 results in the paper's argument.
  4. [Sec. 4, paragraph on EOT] The dismissal of PGD-EOT as merely a ``transfer attack'' is too categorical. With enough samples, EOT directly approximates the gradient of the expected loss, which is the standard adaptive attack for stochastic defenses. The paper's claim that PGD-EOT remains suboptimal is based on a low correlation (0.1682) between EOT gradients and the fixed-seed optimal gradient, but a low correlation between gradients of different objectives does not by itself imply that EOT is a weak attack. Moreover, the paper's own PGD-EOT robustness (59.3% on CIFAR-10) is substantially higher than the 46.8% reported by Lee and Kim (2023) under similar full-gradient EOT; this discrepancy is not explained and should be addressed for the comparison with prior work to be meaningful.
minor comments (5)
  1. [Throughout] There are several typos and grammatical slips, e.g., ``stochasiticity'', ``casued'', ``paramter'', ``neibourhood'', ``sigmoidal'', and ``denoise smoothing''; these should be corrected.
  2. [Fig. 1c and Fig. 3] The axis labels in Fig. 1c appear to have a missing superscript ("2 distance" rather than "L2 distance"), and Fig. 3b and 3c lack axis labels or units, making the sigmoid fit hard to interpret.
  3. [Table 2] The PGD-EOT entry for the fixed-randomness row is empty; if the experiment was not run, state that explicitly rather than leaving a blank cell.
  4. [Sec. 5, extrapolation claim] The statement that the fitted curve extrapolates ``smoothly to clean accuracies at the y-intercept'' needs a precise specification of what quantity is being predicted (e.g., which point corresponds to zero compression) and how the extrapolation error is estimated.
  5. [Appendix D] The code is promised for the camera-ready version; for a journal submission, a public repository at submission time would help reproducibility, especially given the heavy computational requirements and the importance of the exact seed-hashing scheme in Eq. (12)-(13).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: fixed-randomness protocol is a threat-model choice and the compression–robustness relation is an empirical correlation with independent checks.

full rationale

No step in the paper reduces its target to its inputs by construction. The central quantitative claim (Sec. 4) is the robustness measurement under ξ_attack = ξ_test (23.7% on CIFAR-10, 29.5% on ImageNet). This is a proposed evaluation protocol, not a derived quantity; the paper does not fit a parameter and then relabel it as robustness. The comparison with the mismatched-seed transfer result (77.4%, Table 4) is an empirical consistency check. The compression-rate predictor (Eq. 10) is measured on uniform-noise perturbations and does not involve the classifier or the PGD attack, while the robustness target is PGD/BPDA accuracy, so the predictor is not defined in terms of the target. The sigmoid relation in Sec. 5 is fitted post hoc to the measured (compression, robustness) pairs, but the paper supports it with independent checks: extrapolation to zero compression approximates clean accuracy, and the base-CNN robustness curve under scaled budgets resembles the relation. The clean-accuracy extrapolation is a consistency check of the anchor-point model rather than the source of the robustness numbers. There are no load-bearing self-citations: the bibliography contains no work by the present authors. The paper's own Limitations section flags gradient-masking contamination at t=300 and the lack of full PGD on ImageNet; these weaken evidentiary strength but are correctness risks, not circularity. Accordingly, no circular step is identified.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical entities. 'Anchor point' and 'compression rate' are new terms for existing concepts (purified clean image and a Lipschitz-like contraction measure). The main load-bearing elements are the fixed-randomness evaluation protocol and the fitted sigmoid relation.

free parameters (1)
  • Sigmoid curve parameters for compression-robustness relation = not reported
    The sigmoid in Fig 3b is fitted to the measured compression-robustness points; the parameters are not derived and are not given numerically.
assumptions (4)
  • standard math Law of total variance for variance decomposition
    Used in Appendix A to derive the SNR formula.
  • domain assumption Diffusion purification mapping f_xi is differentiable and the Taylor expansion in Eq 6 is valid for small perturbation magnitudes
    Justifies the Jacobian-based conceptual framework in Sec 3.
  • domain assumption Uniform-noise compression rate is representative of adversarial perturbation compression across models and hyperparameters
    The compression-robustness law uses compression rates measured under uniform noise; adversarial perturbations are less compressed (Table 6), yet the law is asserted to hold.
  • ad hoc to paper The sigmoid shape of the compression-robustness curve mirrors the attack-budget-robustness curve of the base classifier
    Proposed as a theoretical explanation and tested with the CNN curve in Fig 3c, but not derived.

how reviews work

0 comments
Cite this review

Pith. "Pith review of How Do Diffusion Models Improve Adversarial Robustness?." pith.science (2026). https://pith.science/paper/EQBSGNN6

@misc{pith2026250522839,
  author       = {Pith},
  title        = {Pith review of: How Do Diffusion Models Improve Adversarial Robustness?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EQBSGNN6}},
  note         = {Machine review of arXiv:2505.22839}
}
abstract

Recent findings suggest that diffusion models significantly enhance empirical adversarial robustness. While some intuitive explanations have been proposed, the precise mechanisms underlying these improvements remain unclear. In this work, we systematically investigate how and how well diffusion models improve adversarial robustness. First, we observe that diffusion models intriguingly increase, rather than decrease, the $\ell_p$ distance to clean samples--challenging the intuition that purification denoises inputs closer to the original data. Second, we find that the purified images are heavily influenced by the internal randomness of diffusion models, where a compression effect arises within each randomness configuration. Motivated by this observation, we evaluate robustness under fixed randomness and find that the improvement drops to approximately 24% on CIFAR-10--substantially lower than prior reports approaching 70%. Importantly, we show that this remaining robustness gain strongly correlates with the model's ability to compress the input space, revealing the compression rate as a reliable robustness indicator without requiring gradient-based analysis. Our findings provide novel insights into the mechanisms underlying diffusion-based purification, and offer guidance for developing more effective and principled adversarial purification systems.

Figures

Figures reproduced from arXiv: 2505.22839 by the authors.

Figure 1
Figure 1. Diffusion models purify states away from the clean images. (a) Schematic showing a common hypothesis that diffusion models improve robustness by “denoising” inputs toward the clean image. (b) Summary of our findings, which challenge the denoising hypothesis. (c) Measured ℓ2 distances to clean images on CIFAR-10 during purification. We track the distances between intermediate purified states and clean images, using P… view at source ↗
Figure 2
Figure 2. The variability of the outputs of diffusion models is dominated by intrinsic noise, not variability in the input images. (a–c) Schematics illustrating how diffusion models transform input perturbations under different sources of variability. (a) When the image is fixed and internal noise varies, purification exhibits an expansion of the input space. (b) When the noise is fixed and the image varies, the input space a… view at source ↗
Figure 3
Figure 3. Diffusion models improve robustness by compressing image space. (a) The singular value spectrum of Jacobian matrices shows that diffusion models strongly compress input space: over 90% of singular values are below 0.25, and only 1.3% exceed 1.0. (b) The compression rate and robustness without stochasticity of diffusion models follow a consistent relation well captured by a sigmoid function. Note that the curve gener… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

27 extracted references · 14 canonical work pages

  1. [1]

    E Broader impact This paper discusses how and how well do diffusion models actually improve robustness

    The codebase will be open-sourced in the camera-ready version once published. E Broader impact This paper discusses how and how well do diffusion models actually improve robustness. Randomness can induce gradient masking and can not easily solved by the previous standard EOT method, which raises ethical concerns for the actual robustness improvements for ...

    work page 2022

  2. [3]

    We used the base seeds s= 0,1,2for all experiments

    to compute the standard deviation, except for the EOT experiments, for which we were unable to do so due to limited computational resources. We used the base seeds s= 0,1,2for all experiments. FID scoreThe FID score was calculated based on the pytorch-fid package (Seitzer, 2020)https: //github.com/mseitzer/411pytorch-fid. We compute the FID score using 76...

    work page 2020

  3. [5]

    Adversarial examples are a natural consequence of test error in noise.arXiv preprint arXiv:1901.10513,

    Nic Ford, Justin Gilmer, Nicolas Carlini, and Dogus Cubuk. Adversarial examples are a natural consequence of test error in noise.arXiv preprint arXiv:1901.10513,

    arXiv 1901

  4. [7]

    13 B Implementation details of adversarial attacks on diffusion models Datasets and base classifiersThe experiments were conducted on the CIFAR-10 Krizhevsky & Hinton (2009) and ImageNet (Deng et al.,

    work page 2009

  5. [8]

    Robust diffusion models for adversarial purification.arXiv preprint arXiv:2403.16067,

    Guang Lin, Zerui Tao, Jianhai Zhang, Toshihisa Tanaka, and Qibin Zhao. Robust diffusion models for adversarial purification.arXiv preprint arXiv:2403.16067,

    arXiv

  6. [10]

    Practical black-box attacks against machine learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. InProceedings of the 2017 ACM on Asia conference on computer and communications security, pp. 506–519,

    2017

  7. [11]

    URL https://doi.org/10.21105/joss.02607

    doi: 10.21105/joss.02607. URL https://doi.org/10.21105/joss.02607. Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers.Advances in Neural Information Processing Systems, 33:21945–21957,

    work page doi:10.21105/joss.02607

  8. [12]

    Towards the first adversarially robust neural network model on MNIST

    Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards the first adversarially robust neural network model on mnist.arXiv preprint arXiv:1805.09190,

    work page Pith review arXiv

Show all 27 references
  1. [13]

    Online adversarial purification based on self- supervision.arXiv preprint arXiv:2101.09387,

    Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self- supervision.arXiv preprint arXiv:2101.09387,

    arXiv

  2. [15]

    Guided diffusion model for adversarial purification.arXiv preprint arXiv:2205.14969,

    Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification.arXiv preprint arXiv:2205.14969,

    arXiv

  3. [16]

    On the convergence and robustness of adversarial training.arXiv preprint arXiv:2112.08304,

    Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training.arXiv preprint arXiv:2112.08304,

    arXiv

  4. [17]

    Densepure: Understanding diffusion models for adversarial robustness

    Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anand- kumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models for adversarial robustness. InThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali,...

    2023

  5. [20]

    The purification time steps were kept the same with Nie et al

    https: //github.com/openai/guided-diffusion as the purification system. The purification time steps were kept the same with Nie et al. (2022), namely t∗ = 0.1 (100 forward and 100 reverse steps) for CIFAR-10 andt ∗ = 0.15(150 forward and 150 reverse steps) for ImageNet. The Di...

    2022

  6. [21]

    framework proposed to utilize both the forward and reverse processes of diffusion models for adversarial purification. Since the forward process introduces a large amount of randomness, we explore whether it’s possible to remove the forward process, thus only using the reverse...

    2023

  7. [22]

    Full gradients were calculated for the PGD/PGD-EOT as Lee & Kim (2023) discovered that the approximations methods used in the original DiffPure (Nie et al.,

    https:// github.com/bethgelab/foolbox, and the BPDA wrapper was adapted from advertorch (Ding et al., 2019)https://github.com/BorealisAI/advertorch. Full gradients were calculated for the PGD/PGD-EOT as Lee & Kim (2023) discovered that the approximations methods used in the or...

    2023

  8. [23]

    The full gradient of PGD/PGD-EOT is the strongest attack for DiffPure methods according to Lee & Kim (2023) experiments, and is very computationally expensive

    incurred weaker attacks. The full gradient of PGD/PGD-EOT is the strongest attack for DiffPure methods according to Lee & Kim (2023) experiments, and is very computationally expensive. We ran our CIFAR-10 attack experiments on a NVIDIA RTX 6000 GPU for 10 days. We were not abl...

    2023

  9. [26]

    MIT PyTorch-FID (Heusel et al., 2017; Seitzer,

    2017

  10. [300]

    pushing-away

    ℓ2 BPDA 3.537±0.079 61.116±0.738 17.712±4.851 BPDA-EOT 3.772±0.139 61.078±0.762 17.694±4.838 ℓ∞ BPDA 0.016±0.000 0.832±0.059 0.422±0.077 BPDA-EOT 0.016±0.000 0.839±0.060 0.418±0.084 model under random noise (Fig. S3a, blue curve) is almost identical to that induced by adversar...

    2024

  11. [2009]

    For CIFAR-10, we subsampled the first 1000 images from the test set

    datasets. For CIFAR-10, we subsampled the first 1000 images from the test set. For ImageNet, we subsampled the first 200 images from the validation set. Standard preprocessing was applied to the datasets. We used the standard classifiers from the RobustBench (Croce et al., 202...

    2020

  12. [2014]

    Towards deep neural network architectures robust to adversarial examples.arXiv preprint arXiv:1412.5068,

    Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial examples.arXiv preprint arXiv:1412.5068,

    arXiv

  13. [2018]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705,

    1902 arXiv

  14. [2019]

    (certified!!) adversarial robustness for free!arXiv preprint arXiv:2206.10550,

    Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and J Zico Kolter. (certified!!) adversarial robustness for free!arXiv preprint arXiv:2206.10550,

    arXiv

  15. [2020]

    Robustbench: a standardized adversarial robustness benchmark.arXiv preprint arXiv:2010.09670,

    Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark.arXiv preprint arXiv:2010.09670,

    2010 arXiv

  16. [2021]

    AdverTorch v0.1: An adversarial robustness toolbox based on pytorch.arXiv preprint arXiv:1902.07623,

    Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin. AdverTorch v0.1: An adversarial robustness toolbox based on pytorch.arXiv preprint arXiv:1902.07623,

    1902 arXiv

  17. [2022]

    Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572,

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572,

    arXiv

  18. [2023]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199,

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199,

    arXiv

  19. [2024]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083,

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083,

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.