Pith. sign in

REVIEW 3 major objections 6 minor 49 references

Towards Class-wise Fair Adversarial Training via Anti-Bias Soft Label Distillation

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Class-wise robustness fairness can be steered by the smoothness of teacher soft labels: ABSLD assigns sharper labels to hard classes and smoother labels to easy classes and reports narrower class-wise error-risk gaps and better…

desk verdict A useful label-based angle on robust fairness, but the theory is deferred and the gains need variance. read the letter →

arxiv 2506.08611 v1 pith:JQGP3DQJ submitted 2025-06-10 cs.CV

Shiji Zhao , Chi Chen , Ranjie Duan , Xizhe Wang , Xingxing Wei This is my paper
classification cs.CV
keywords adversarialrobustnessrobustfairnessknowledgedistillationsoftlabelsclass-wiseerrorrisktemperaturescalingworst-class
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarially trained models protect some classes well while leaving intrinsically harder classes vulnerable; this class-wise gap is the robust fairness problem. The paper claims that a controllable cause of that gap is the smoothness of the soft labels used in training: when hard classes receive sharper teacher soft labels and easy classes receive smoother ones, the class-wise error-risk gap narrows. Building on this, the authors propose Anti-Bias Soft Label Distillation (ABSLD), which sets a separate temperature for each class's teacher soft labels and adjusts those temperatures each epoch from the student's own per-class error risk. If the claim holds, adversarial fairness can be improved from the label side alone, without changing sample weights or perturbation budgets, and the method can be combined with sample-based fairness approaches.

What carries the argument

The central object is the teacher's per-class temperature pair ($\tau_t^k$ for clean and $\tilde{\tau}_t^k$ for adversarial examples), which controls how sharply the teacher's soft-label distribution is peaked through a tempered softmax. The mechanism that does the work is the online update of Eq. (10): after each epoch, the student's class-wise robust error risk $R(f_s(\tilde{x}_k))$ is compared with its mean across classes, and classes above the mean are assigned lower temperatures (sharper supervision) while classes below are assigned higher temperatures (smoother supervision). Theorem 2 supplies the claimed sign relationship between these temperatures and the student's error-risk gap, and the KL-based loss of Eq. (11) carries the adjusted teacher labels into the student's optimization.

What would settle it

Train the student with ABSLD for a setting in which the teacher's class-wise accuracy is known and deliberately lower than the student's on a held-out class (e.g., teacher trained without that class's data). If the per-class temperature update still converges to lower temperatures for that class but worst-class robustness does not improve, or if the improvement tracks the teacher's accuracy rather than the temperature update, then the proposed causal mechanism is falsified. A cheaper check is to measure the empirical sign of the correlation in Theorem 2: for a fixed hard class, raising the teacher temperature should increase the student's error-risk gap; if the opposite sign is observed on any dataset, the theorem's premise fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that class-wise smoothness of teacher soft labels is not a side effect but a steering mechanism for adversarial robust fairness. Corollary 1 and Theorem 1 argue that training with equally smooth labels forces an inherent error-risk gap between hard and easy classes, while a label distribution that is sharper for hard classes and smoother for easy classes strictly reduces that gap. Theorem 2 carries the same logic into knowledge distillation, asserting that the hard class's teacher temperature is positively correlated and the easy class's teacher temperature is negatively correlated with the student's error-risk gap. The resulting per-class temperature update in Eq. (10) lowers the temperature for classes whose student error risk is above average and raises it for classes below the average, and the experiments report that this raises worst-class robustness and lowers Normalized Standard Deviation on CIFAR-10, CIFAR-100, and Tiny-ImageNet, and that adding re-weighting and re-margining improves it further.

Load-bearing premise

The load-bearing premise is that the teacher model is more correct than the student even on the hardest classes, and that sharpening the teacher's labels for a hard class reliably makes the student learn that class better.

Editorial extensions

If this is right

  • A per-class temperature schedule can be applied to any frozen robust teacher, so fair distillation does not require retraining or modifying the teacher.
  • Label-based fairness and sample-based fairness are complementary: re-weighting and re-margining can be stacked on ABSLD and yield further gains in worst-class robustness.
  • Models produced by ABSLD should show lower class-to-class standard deviation of adversarial accuracy and higher worst-class accuracy under FGSM, PGD, CW∞, and AutoAttack, with a modest average-robustness cost.
  • Because the same class-wise bias appears across training strategies, the label-side fix should transfer to common corruptions as well, which the paper reports for Gaussian noise and channel transforms.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension: the same per-class label-tempering rule should apply to plain (non-adversarial) knowledge distillation and long-tailed classification, whenever the teacher is more accurate than the student; running ABSLD on a clean-only task would show whether the worst-class accuracy gap closes there too.
  • A boundary the paper leaves implicit: if a teacher is not more correct than the student on some class, the optimal temperature sign could reverse; a practical variant could monitor per-class teacher-vs-student agreement and freeze or invert updates for classes where the premise fails.
  • The online gradient update on temperatures introduces two extra hyperparameters (initial temperature and temperature learning rate); a closed-form schedule computed from error-risk ranks would remove those choices and make the mechanism easier to transfer across datasets.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper studies adversarial robust fairness in adversarial training (AT) and adversarial robustness distillation (ARD). It argues that the class-wise smoothness degree of soft labels is an important factor: sharper soft labels for hard classes and smoother soft labels for easy classes can reduce the class-wise error-risk gap. The authors support this with an empirical observation (Fig. 2), a corollary and two theorems (Section 3.2), and then propose ABSLD (Anti-Bias Soft Label Distillation), which adaptively adjusts the temperature of the teacher’s soft labels for each class according to the student’s class-wise error risk (Eq. (10)). They also study combinations with sample-based re-weighting and re-margining. Experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet report improved worst-class robustness and lower NSD compared with several baselines.

Significance. If the causal claim is established, the label-based perspective on robust fairness is a useful complement to existing sample-based methods. The proposed ABSLD is simple, adaptable, and the paper includes a released codebase and a broad evaluation across datasets, architectures, and attacks. The strongest contribution is the idea that the smoothness of teacher soft labels can be tuned class-wise to steer fairness, supported by the static-label experiment in Fig. 2. However, the theoretical backbone (Theorems 1 and 2) is not verifiable as submitted because the proofs are deferred to absent appendices, and the empirical evidence is weakened by checkpoint selection based on the evaluation metric, lack of error bars, and a partially circular optimization check in Fig. 5.

major comments (3)
  1. [Section 3.2; Section 4.2, Eq. (10)] Theorems 1 and 2 are the theoretical justification for the sign-based temperature update in Eq. (10), but their proofs are deferred to Appendices A and B, neither of which appears in the reviewed text. Theorem 2 is stated only as a qualitative 'positively/negatively correlated' claim; it should be stated as explicit inequalities on the relevant derivatives, e.g., d(R_c+ - R_c-)/dtau_c+ > 0 and d(R_c+ - R_c-)/dtau_c- < 0, for the actual KL distillation loss in Eq. (11). The proof must also address the regime where the student class-wise risk approaches or exceeds the teacher’s, since the premise borrowed from [41] that the teacher is more correct than the student even in worst classes is not verified for the specific teachers used here (WRN-34-10, WRN-70-16, PreActResNet-34). Without these proofs, the central mechanism of ABSLD is unverified as submitted.
  2. [Section 5.1, Tables 1–4] Model checkpoints are selected based on the highest mean value of all-class average robustness and worst-class robustness, which are the same quantities used to report the fairness results. This selection protocol can inflate the observed improvements because it directly optimizes the evaluation metric. Please report results with a fixed training schedule or a validation-based checkpoint selection, and provide standard deviations over at least three independent runs for the main tables. The reported gains of 0.7 to 2.1 percentage points in worst-class robustness and NSD reductions of 0.01 to 0.08 are otherwise difficult to interpret without variance estimates.
  3. [Section 5.2.1, Eq. (10), Fig. 5] Figure 5 shows that ABSLD reduces the standard deviation of class-wise optimization error risk during training. Since Eq. (10) is explicitly designed to reduce exactly this gap, the observed decrease is by construction and is not independent evidence that the smoothness of soft labels is the causal mechanism. The static-temperature experiment in Fig. 2 is the more convincing independent probe, but it lacks error bars and statistical comparisons. In Table 5, the adaptive strategy is compared only with a manually chosen extreme temperature setting (0.5 vs. 5) and not with a uniform-temperature baseline; please add that control and report multiple runs so the reader can separate the effect of re-tempering from the effect of the adaptive schedule.
minor comments (6)
  1. [Eq. (10)] If all class risks are equal to the mean, the denominator max(|R(f_s(x_k)) - average|) is zero; specify the tie-breaking rule, for example by skipping the update when the gap is zero.
  2. [Section 1, contribution list] The third contribution bullet writes 'ABLSD' instead of 'ABSLD'; please correct the typo.
  3. [Section 4.1, Eq. (9)] Eq. (9) is written as an equality constraint, but the training procedure does not enforce it exactly; clarify that it is a target condition for the adaptive update rather than a hard constraint in the optimization.
  4. [Section 5.1, NSD definition] Please state explicitly that NSD is computed from the standard deviation of class-wise robust accuracies across classes, not from per-sample losses; the current definition (SD/Avg.) does not specify the unit over which SD is taken.
  5. [Tables 7 and 8] Several table entries are missing spaces, for example '0.552.2132.80' in Table 7 and '0.151.7732.80' in Table 8; fix the formatting for readability.
  6. [Figure 3 caption] The caption reads 'between trainset and testset between sample-based method and label-based method'; please rephrase to clarify the comparison being shown.

Circularity Check

1 steps flagged · score 4.0 of 10

The in-training confirmation of ABSLD is self-referential: Eq. (9)-(10) directly target the class-wise error-risk gap that Fig. 5 reports as decreased. Independent static probes and test-set benchmarks prevent full circularity, but the central theoretical mechanism is also unproven in the submitted text.

  1. self definitional [Section 4.1 Eq. (9); Section 4.2 Eq. (10); Section 5.2.1 Fig. 5.]
    "s.t. R(fs(˜xk)) = 1/C \sum_{i=1}^C R(fs(˜xi)) (Eq. 9); ... ˜τt_k = ˜τt_k − ητ · (R(fs(˜xk)) − 1/C \sum_i R(fs(˜xi))) / max(|...|) (Eq. 10); ... 'our ABSLD significantly reduces the standard deviation of the student's class-wise optimization error risk, showcasing the effectiveness of our approach.'"

    The optimization objective (Eq. 9) explicitly constrains each class's robust error risk to equal the class-average risk, and the temperature update (Eq. 10) is a deterministic function of the deviation of exactly that error risk from the average. Figure 5 then reports the standard deviation of these same in-sample error risks as evidence that ABSLD reduces the class-wise gap. The reduction is the controller's target variable, so Fig. 5 is not an independent test of the label-smoothness cause; it largely restates the algorithm's own objective. Independence comes instead from the static manipulation in Fig. 2 and the manual static-temperature ablation in Table 5, and from the external test-set robustness comparisons.

full rationale

The paper's central empirical claim—that per-class soft-label sharpness controls adversarial robust fairness—is not wholly circular. Figure 2 fixes class-wise smoothness without feedback and shows a fairness shift, and Table 5 compares manual static temperatures against the adaptive rule; these are genuine probes of the hypothesis. The SOTA comparison tables (Tables 1-4, 9) evaluate worst-class robustness and NSD on test data, which are not directly optimized by Eq. (10). The circular component is the adaptive training evidence: Eq. (9) defines fairness as equality of class-wise error risks, Eq. (10) adjusts temperature from those same risks, and Fig. 5 shows those same risks equalizing. This is self-definitional for the in-training metric, though not for the test-set results. Separately, the load-bearing theoretical support is incomplete: Theorems 1 and 2 defer proofs to Appendices A and B that are absent from the submitted arXiv v1, and the sign relationship in Theorem 2 is borrowed from the external finding in [41] ('The teacher has a more correct prediction distribution than the student even in the worst classes'). These are omitted-proof and assumption-citation risks, not circular reductions. The self-citations ([45], [46], [47], [49]) are provenance and baseline references and do not constitute load-bearing circularity.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central method introduces one feedback controller, per-class temperature, with several hand-set hyperparameters. The theoretical claims rest on unproven-in-text extensions of prior linear-classifier results. No new physical or architectural entities are introduced.

free parameters (6)
  • initial teacher temperature tau_t = 1 (CIFAR-10 and CIFAR-100); varied in {0.5, 1, 2, 3}
    Starting point of the per-class temperature schedule in Eq. (10); sensitivity explored in Table 7.
  • temperature learning rate eta_tau = 0.1
    Step size for per-class temperature updates; sensitivity in Table 8; values 0.05, 0.1, 0.25, 0.5 tested.
  • temperature clipping bounds = [0.5, 5] CIFAR-10; [0.8, 3] CIFAR-100; [0.9, 1.1] Tiny-ImageNet
    Manually set to stabilize training; no principled selection is given.
  • trade-off parameter alpha in Eq. (11) = Not reported in text
    Balances clean and adversarial KL distillation terms; necessary to reproduce the loss, and its value is missing from the experimental settings.
  • class-wise smoothing coefficients for the motivating experiment = 0.2 uniform; 0.05 for hard classes, 0.35 for easy classes
    Used in Fig. 2 to demonstrate the smoothness effect; chosen to make the effect visible.
  • combination hyperparameters eta_w, eta_epsilon, beta, gamma and bounds = eta_w=0.05, eta_epsilon=0.2, beta=2, gamma=0.04; weights in [5/6, 2.5]; margins in [0.98*epsilon, 2*epsilon]
    Used for the ABSLD+Re-weight+Re-margin variant; selected by the authors.
assumptions (5)
  • standard math Standard first-order logic and calculus used in the proofs of Corollary 1, Theorem 1, and Theorem 2
    Uncontroversial; assumed without proof.
  • domain assumption The binary linear classifier analysis of [42] and [21] extends to deep networks
    Corollary 1 is introduced as an extension of prior analysis to DNNs; this step is not derived in the paper.
  • domain assumption Minimizing the KL risk in Eq. (3) over all functions f is equivalent to the DNN training used in experiments
    Connects the theoretical optimizer to practice; requires expressiveness and convergence assumptions.
  • domain assumption For the student, the teacher's prediction distribution is strictly more correct than the student's, including on the worst classes
    Section 4.2 relies on [41] for Theorem 2; if a student outperforms the teacher on some class, the adaptive temperature direction could invert.
  • ad hoc to paper After training with the class-wise smooth labels P_lambda2, the hard class error risk remains larger than the easy class risk (premise of Theorem 1)
    The theorem's conclusion only applies if this condition holds; the paper does not prove it always holds.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Class-wise Fair Adversarial Training via Anti-Bias Soft Label Distillation." pith.science (2026). https://pith.science/paper/JQGP3DQJ

@misc{pith2026250608611,
  author       = {Pith},
  title        = {Pith review of: Towards Class-wise Fair Adversarial Training via Anti-Bias Soft Label Distillation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JQGP3DQJ}},
  note         = {Machine review of arXiv:2506.08611}
}
read the original abstract

Adversarial Training (AT) is widely recognized as an effective approach to enhance the adversarial robustness of Deep Neural Networks. As a variant of AT, Adversarial Robustness Distillation (ARD) has shown outstanding performance in enhancing the robustness of small models. However, both AT and ARD face robust fairness issue: these models tend to display strong adversarial robustness against some classes (easy classes) while demonstrating weak adversarial robustness against others (hard classes). This paper explores the underlying factors of this problem and points out the smoothness degree of soft labels for different classes significantly impacts the robust fairness from both empirical observation and theoretical analysis. Based on the above exploration, we propose Anti-Bias Soft Label Distillation (ABSLD) within the Knowledge Distillation framework to enhance the adversarial robust fairness. Specifically, ABSLD adaptively reduces the student's error risk gap between different classes, which is accomplished by adjusting the class-wise smoothness degree of teacher's soft labels during the training process, and the adjustment is managed by assigning varying temperatures to different classes. Additionally, as a label-based approach, ABSLD is highly adaptable and can be integrated with the sample-based methods. Extensive experiments demonstrate ABSLD outperforms state-of-the-art methods on the comprehensive performance of robustness and fairness.

Figures

Figures reproduced from arXiv: 2506.08611 by the authors.

Figure 1
Figure 1. The comparison between the sample-based fair adversarial training and our label-based fair adversarial training. For [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The class-wise and average robustness of DNNs [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The error risk gap between trainset and testset [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Ablation study with ResNet-18 student trained using [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: The class standard deviation of student optimization [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: The class-wise robustness (PGD) of models guided [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

49 extracted references · 36 canonical work pages

  1. [41]

    NeurIPS (2023)

    Xinli, Y., Mou, N., Qian, W., Lingchen, Z.: Revisiting adversarial robustness distillation from the perspective of robust fairness. NeurIPS (2023)

    work page 2023

  2. [1]

    In: ECCV

    Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query-efficient black-box adversarial attack via random search. In: ECCV . pp. 484–501. Springer (2020)

    work page 2020

  3. [2]

    In: NeurIPS 2020 Workshop on Pre-registration in Machine Learning

    Benz, P ., Zhang, C., Karjauv, A., Kweon, I.S.: Robustness may be at odds with fairness: An empirical study on class-wise accuracy. In: NeurIPS 2020 Workshop on Pre-registration in Machine Learning. pp. 325–342. PMLR (2021)

    work page 2021

  4. [3]

    In: 2017 ieee symposium on security and privacy (sp)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp). pp. 39–57. IEEE (2017)

    2017

  5. [4]

    In: ICML

    Croce, F., Hein, M.: Minimally distorted adversarial examples with a fast adaptive boundary attack. In: ICML. pp. 2196–2205. PMLR (2020)

    work page 2020

  6. [5]

    In: ICML

    Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: ICML. pp. 2206–2216. PMLR (2020)

    work page 2020

  7. [6]

    In: Proceedings of the IEEE ICCV

    Girshick, R.: Fast r-cnn. In: Proceedings of the IEEE ICCV . pp. 1440–1448 (2015)

    work page 2015

  8. [7]

    In: AAAI

    Goldblum, M., Fowl, L., Feizi, S., Goldstein, T.: Adversarially robust distillation. In: AAAI. vol. 34, pp. 3996–4003 (2020)

    work page 2020

Show all 49 references
  1. [8]

    arXiv preprint:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint:1412.6572 (2014)

    2014 arXiv

  2. [9]

    arXiv preprint:2010.03593 (2020)

    Gowal, S., Qin, C., Uesato, J., Mann, T., Kohli, P .: Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint:2010.03593 (2020)

    2020 arXiv

  3. [10]

    In: CVPR

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: CVPR. pp. 770–778 (2016)

    2016

  4. [11]

    arXiv preprint:1503.025312(7) (2015)

    Hinton, G., Vinyals, O., Dean, J., et al.: Distilling the knowledge in a neural network. arXiv preprint:1503.025312(7) (2015)

    2015 arXiv

  5. [12]

    In: CVPR

    Huang, B., Chen, M., Wang, Y., Lu, J., Cheng, M., Wang, W.: Boosting accuracy and robustness of student models via adaptive adversarial distillation. In: CVPR. pp. 24668–24677 (2023)

    2023

  6. [13]

    In: ECCV

    Jia, X., Zhang, Y., Wei, X., Wu, B., Ma, K., Wang, J., Cao, X.: Prior- guided adversarial initialization for fast adversarial training. In: ECCV . pp. 567–584. Springer (2022)

    2022

  7. [14]

    TPAMI (2024)

    Jia, X., Zhang, Y., Wei, X., Wu, B., Ma, K., Wang, J., Cao, X.: Improving fast adversarial training with prior-guided knowledge. TPAMI (2024)

    2024

  8. [15]

    arXiv preprint:2304.00202 (2023)

    Jia, X., Zhang, Y., Wei, X., Wu, B., Ma, K., Wang, J., Cao Sr, X.: Improving fast adversarial training with prior-guided knowledge. arXiv preprint:2304.00202 (2023)

    2023 arXiv

  9. [16]

    In: CVPR

    Jia, X., Zhang, Y., Wu, B., Ma, K., Wang, J., Cao, X.: Las-at: adversarial training with learnable attack strategy. In: CVPR. pp. 13398–13408 (2022)

    2022

  10. [17]

    Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009) 12

    2009

  11. [18]

    CS 231N7(7), 3 (2015)

    Le, Y., Yang, X.: Tiny imagenet visual recognition challenge. CS 231N7(7), 3 (2015)

    2015

  12. [19]

    arXiv preprint:2401.12532 (2024)

    Lee, H., Lee, S., Jang, H., Park, J., Bae, H., Yoon, S.: Dafa: Distance- aware fair adversarial training. arXiv preprint:2401.12532 (2024)

    2024 arXiv

  13. [20]

    In: AAAI

    Li, B., Liu, W.: Wat: improve the worst-class robustness in adver- sarial training. In: AAAI. vol. 37, pp. 14982–14990 (2023)

    2023

  14. [21]

    NeurIPS35, 26230–26241 (2022)

    Ma, X., Wang, Z., Liu, W.: On the tradeoff between robustness and fairness. NeurIPS35, 26230–26241 (2022)

    2022

  15. [22]

    arXiv preprint:1706.06083 (2017)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: To- wards deep learning models resistant to adversarial attacks. arXiv preprint:1706.06083 (2017)

    2017 arXiv

  16. [23]

    NeurIPS33, 7779–7792 (2020)

    Pang, T., Yang, X., Dong, Y., Xu, K., Zhu, J., Su, H.: Boosting adversarial training with hypersphere embedding. NeurIPS33, 7779–7792 (2020)

    2020

  17. [24]

    NeurIPS 34, 29935–29948 (2021)

    Rebuffi, S.A., Gowal, S., Calian, D.A., Stimberg, F., Wiles, O., Mann, T.A.: Data augmentation can improve robustness. NeurIPS 34, 29935–29948 (2021)

    2021

  18. [25]

    In: ICML

    Rice, L., Wong, E., Kolter, Z.: Overfitting in adversarially robust deep learning. In: ICML. pp. 8093–8104. PMLR (2020)

    2020

  19. [26]

    In: MICCAI

    Ronneberger, O., Fischer, P ., Brox, T.: U-net: Convolutional net- works for biomedical image segmentation. In: MICCAI. pp. 234–

  20. [27]

    arXiv preprint:2307.11528 (2023)

    Ruan, S., Dong, Y., Su, H., Peng, J., Chen, N., Wei, X.: Improving viewpoint robustness for visual recognition via adversarial train- ing. arXiv preprint:2307.11528 (2023)

    2023 arXiv

  21. [28]

    In: CVPR

    Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., Chen, L.C.: Mobilenetv2: Inverted residuals and linear bottlenecks. In: CVPR. pp. 4510–4520 (2018)

    2018

  22. [29]

    Sehwag, V ., Mahloujifar, S., Handina, T., Dai, S., Xiang, C., Chi- ang, M., Mittal, P .: Robust learning meets generative models: Can proxy distributions improve adversarial robustness? arXiv preprint:2104.09425 (2021)

    2021 arXiv

  23. [30]

    In: AAAI

    Sun, C., Xu, C., Yao, C., Liang, S., Wu, Y., Liang, D., Liu, X., Liu, A.: Improving robust fariness via balance adversarial training. In: AAAI. vol. 37, pp. 15161–15169 (2023)

    2023

  24. [31]

    In: CVPR

    Szegedy, C., Vanhoucke, V ., Ioffe, S., Shlens, J., Wojna, Z.: Rethink- ing the inception architecture for computer vision. In: CVPR. pp. 2818–2826 (2016)

    2016

  25. [32]

    arXiv preprint:1312.6199 (2013)

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Good- fellow, I., Fergus, R.: Intriguing properties of neural networks. arXiv preprint:1312.6199 (2013)

    2013 arXiv

  26. [33]

    In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining

    Tian, Q., Kuang, K., Jiang, K., Wu, F., Wang, Y.: Analysis and applications of class-wise robustness in adversarial training. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. pp. 1561–1570 (2021)

    2021

  27. [34]

    In: International Conference on Learning Representations (2019)

    Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., Gu, Q.: Improving adversarial robustness requires revisiting misclassified examples. In: International Conference on Learning Representations (2019)

    2019

  28. [35]

    TPAMI (2022)

    Wei, X., Guo, Y., Yu, J.: Adversarial sticker: A stealthy attack method in the physical world. TPAMI (2022)

    2022

  29. [36]

    TPAMI (2022)

    Wei, X., Guo, Y., Yu, J., Zhang, B.: Simultaneously optimizing per- turbations and positions for black-box adversarial patch attacks. TPAMI (2022)

    2022

  30. [37]

    TPAMI (2023)

    Wei, X., Wang, S., Yan, H.: Efficient robustness assessment via adversarial spatial-temporal focus on videos. TPAMI (2023)

    2023

  31. [38]

    TPAMI (2024)

    Wei, X., Zhao, S., Li, B.: Revisiting the trade-off between accuracy and robustness via weight distribution of filters. TPAMI (2024)

    2024

  32. [39]

    In: CVPR

    Wei, Z., Wang, Y., Guo, Y., Wang, Y.: Cfa: Class-wise calibrated fair adversarial training. In: CVPR. pp. 8193–8201 (2023)

    2023

  33. [40]

    Wu, Z., Gao, H., Zhang, S., Gao, Y.: Understanding the robustness- accuracy tradeoff by rethinking robust fairness (2021)

    2021

  34. [42]

    In: ICML

    Xu, H., Liu, X., Li, Y., Jain, A., Tang, J.: To be robust or to be fair: Towards fairness in adversarial training. In: ICML. pp. 11492– 11501. PMLR (2021)

    2021

  35. [43]

    arXiv preprint:1605.07146 (2016)

    Zagoruyko, S., Komodakis, N.: Wide residual networks. arXiv preprint:1605.07146 (2016)

    2016 arXiv

  36. [44]

    In: ICML

    Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., Jordan, M.: Theo- retically principled trade-off between robustness and accuracy. In: ICML. pp. 7472–7482. PMLR (2019)

    2019

  37. [45]

    NeurIPS (2024)

    Zhao, S., Wang, X., Duan, R., Wei, X.: Improving adversarial robust fairness via anti-bias soft label distillation. NeurIPS (2024)

    2024

  38. [46]

    TPAMI (01), 1–14 (2024)

    Zhao, S., Wang, X., Wei, X.: Mitigating accuracy-robustness trade- off via balanced multi-teacher adversarial distillation. TPAMI (01), 1–14 (2024)

    2024

  39. [47]

    In: ECCV

    Zhao, S., Yu, J., Sun, Z., Zhang, B., Wei, X.: Enhanced accuracy and robustness via multi-teacher adversarial distillation. In: ECCV . pp. 585–602. Springer (2022)

    2022

  40. [48]

    arXiv preprint:2106.04928 (2021)

    Zhu, J., Yao, J., Han, B., Zhang, J., Liu, T., Niu, G., Zhou, J., Xu, J., Yang, H.: Reliable adversarial distillation with unreliable teachers. arXiv preprint:2106.04928 (2021)

    2021 arXiv

  41. [49]

    In: ICCV (2021) Shiji Zhaoreceived his B.S

    Zi, B., Zhao, S., Ma, X., Jiang, Y.G.: Revisiting adversarial robust- ness distillation: Robust soft labels make student better. In: ICCV (2021) Shiji Zhaoreceived his B.S. degree in the School of Computer Science and Engineering, Beihang University (BUAA), China. He is now a ...

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.