Pith. sign in

REVIEW 3 major objections 5 minor 22 references

A look at adversarial attacks on radio waveforms from discrete latent space

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Passing an attacked RF waveform through a VQVAE trained on clean data substantially reduces the attack's effectiveness, with the strongest recovery at epsilon >= 0.2.

desk verdict A promising but under-evidenced idea: VQVAE reconstruction as a mitigation layer for RF adversarial examples, with a phase-preserving FGSM variant and latent-space metrics that are worth knowing about, but the current draft needs a clean-reconstruction control, error bars, and code to make the central claim stick. read the letter →

arxiv 2506.09896 v1 pith:KHBOWP5O submitted 2025-06-11 cs.LG

Attanasia Garuso , Silvija Kokalj-Filipovic , Yagna Kaasaragadda This is my paper
classification cs.LG
keywords adversarialexamplesVQVAERFwaveformclassificationattackmitigationdiscretelatentspacestochasticvectorquantizationFGSMPGD
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a vector-quantized variational autoencoder (VQVAE), trained only on clean, high-SNR radio waveforms, works as a mitigation layer against adversarial attacks on RF modulation classifiers. When attacked I/Q samples are passed through the VQVAE and the reconstruction is classified, accuracy recovers substantially relative to classifying the raw attacked samples, with the largest recovery at attack strengths $\epsilon \geq 0.2$. The effect depends on waveform class: amplitude modulations are largely restored under a phase-preserving FGSM attack, while 32-QAM-cross can remain misclassified at $\epsilon=0.3$, and all classes except 2FSK are effectively unrecoverable for a PGD attack at that strength. The paper also shows that attack-induced changes in the discrete latent code carry a detectable signature, suggesting the latent space can help detect attacks as well as mitigate them.

What carries the argument

Carrying the argument is the stochastic vector-quantized autoencoder: each 1024-sample I/Q datapoint is encoded into 64 integer tokens drawn from a codebook of 128 codewords of length 512, with draw probabilities given by Eq. (4) based on the distances between latent slices and codewords, and then decoded back into a waveform. Because the VQVAE is trained only on clean high-SNR data, its reconstruction operator is biased toward the region occupied by clean samples; adversarial perturbations that push the raw input outside that region are compressed away when the tokens are re-decoded. Two diagnostic quantities built on the discrete codes carry the analysis: the normalized Hamming distance, which counts token positions changed by the attack, and the normalized Set distance, which measures how many novel codebook indices enter the latent code; both are normalized by the natural variability of two independent stochastic-quantization draws of the same input.

What would settle it

On a held-out split of high-SNR I/Q samples from the same six modulations, compute classifier accuracy on VQVAE reconstructions of FGSM1, FGSM2, and PGD2 attacks at $\epsilon=0.2$ and $0.3$; if accuracy on reconstructed adversarial samples is not materially higher than accuracy on the raw attacked samples for the amplitude-modulated classes, the central mitigation claim is contradicted.

Watch

Extended reading notes

Core claim

The central discovery is that the discrete-latent reconstruction operator learned from clean RF data suppresses adversarial perturbation for classifier inputs. Tested on a six-class modulation set (4ASK, 8PAM, 16PSK, 32QAM-cross, 2FSK, OFDM256) with FGSM1 (phase-preserving), FGSM2 (independent I/Q), and PGD attacks at epsilons from 0.01 to 0.3, classifier accuracy on VQVAE reconstructions is much higher than on raw adversarial inputs, and the gain is largest for the strongest attacks. The suppression is not uniform: under the phase-preserving attack, amplitude modulations recover well while 32-QAM-cross remains misclassified at $\epsilon=0.3$, and under PGD2 at $\epsilon=0.3$ everything is irrecoverable except 2FSK. The paper's diagnostics tie these differences to the discrete codebook: 2FSK shows the largest Set distance but the smallest Hamming distance under attack, meaning the attack introduces novel codebook indices outside the modulation's normal support, and the codebook-usage histograms gain mass in ranges that are empty for clean data. These latent-space signatures suggest that the same mechanism that suppresses attacks can also reveal them.

Load-bearing premise

The defense works only if the decoder trained on clean waveforms projects attacked inputs back to the region of clean signals; if even small perturbations push the latent tokens into codebook entries that were never used during training, the reconstruction will not restore accuracy.

Editorial extensions

If this is right

  • A VQVAE trained only on clean data can be placed ahead of an RF modulation classifier as a mitigation layer for attacks launched off-the-air on high-SNR baseband samples.
  • Restoration is class-dependent: under the phase-preserving attack, amplitude-modulated classes recover while the hardest QAM and phase-modulated classes can remain misclassified at $\epsilon=0.3$, so mitigation should be evaluated per modulation rather than as a single number.
  • The discrete-latent statistics (normalized Hamming distance, Set distance, and codebook-usage histograms) change in a structured way with attack strength, providing features that can flag an adversarial sample without decoding it.
  • Mitigation has a limit: at $\epsilon$ above about 0.2 the VQVAE begins to mode-collapse, and a PGD attack at $\epsilon=0.3$ is largely unrecoverable except for 2FSK.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to use the Set-distance spike under attack as a label-free detector: because the normalization already accounts for stochasticity, a per-modulation threshold on $d_S$ could be tuned and evaluated on streaming I/Q samples.
  • The class-dependent failure at large $\epsilon$ suggests that per-class or per-modulation codebook sizing could push the mitigation boundary; this is testable by training VQVAEs with different codebook sizes on the same six classes.
  • Because the clean high-SNR assumption is inherited from channel equalization, an untested extension is whether the same suppression survives when adversarial examples also carry multipath effects; the decoder's clean-manifold bias may not hold for channel-induced shifts.
  • The observed inflection near $\epsilon=0.2$, where $SNR_a$ approaches zero with standard deviation 0.25 of the training set, hints at a defense boundary tied to training-data variance, which one could characterize as the maximum safe attack strength for a given dataset.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes using a vector-quantized variational autoencoder (VQVAE), trained on clean high-SNR RF baseband data, as a mitigation layer against adversarial attacks on a modulation classifier. The authors generate three attack types (FGSM1 phase-preserving, FGSM2 standard FGSM, and PGD) at several epsilon values, pass the attacked I/Q samples through the VQVAE, and measure classifier accuracy on the reconstructions. They report that VQVAE reconstruction substantially decreases attack effectiveness, especially for epsilon >= 0.2, and complement this with confusion matrices, I/Q constellation visualizations, codebook-usage histograms, and Hamming/Set distance metrics in the discrete latent space. The paper also notes class-dependent behavior, with 2FSK being the most robust and 32-QAM-X remaining misclassified at epsilon=0.3, and discusses the role of stochastic quantization and out-of-support codewords in the mitigation mechanism.

Significance. If the central claim holds, this is a useful contribution to RFML security: it is, to my knowledge, the first study of a discrete-latent autoencoder as an adversarial mitigation mechanism for radio waveforms, and it introduces several interpretable latent-space metrics (normalized Hamming and Set distances) that could be reused for attack detection. The authors provide a clear architecture, a reasonable attack setup spanning three attack types, and a multi-metric evaluation (accuracy, confusion matrices, I/Q diagrams, codebook histograms) that connects the mitigation effect to quantizer behavior. The paper does not ship code or data, and the quantitative evidence is presented without statistical variability, but the qualitative direction of the effect is consistent across attack types and epsilon values. The main gap is the absence of a clean-reconstruction control, which is needed to distinguish attack suppression from a generic smoothing effect of the VQVAE.

major comments (3)
  1. [Section IV, Fig. 3] The central mitigation claim lacks a clean-input control. Fig. 3 reports classifier accuracy on raw adversarial data and on VQVAE reconstructions of adversarial data, but it does not report the accuracy on VQVAE reconstructions of clean inputs, even though the Abstract and Section II-C assert that the reconstruction of the original data is 'perfectly classifiable.' Without this baseline, the high accuracy on reconstructed adversarial examples could be a generic property of the classifier applied to any VQVAE output rather than evidence of attack suppression. Please add, to Fig. 3 or a companion table, the classifier accuracy on reconstructions of clean data and, ideally, on reconstructions of non-adversarial noise-perturbed inputs of the same L-infinity magnitude, for each epsilon value.
  2. [Section III and Section IV, Fig. 3] The quantitative claim 'substantially decreases' is based on single point estimates without error bars, seeds, or repeated runs. Because the VQVAE uses stochastic quantization (Eq. (4)), the reconstructions are random: the same input can yield different latents in different evaluations, and Fig. 5 shows nonzero normalized Hamming distance between independent draws even without attack. The reported accuracy differences may be within the run-to-run variability of the stochastic mapping. Please report mean and standard deviation (or confidence intervals) over multiple quantization runs and over the test set, state the number of datapoints per class, and indicate whether the accuracy improvements are statistically significant.
  3. [Abstract and Section IV, Fig. 4] The abstract's general claim that VQVAE 'substantially decreases the effectiveness of the attack' is overbroad relative to the paper's own class-level results. For 32-QAM-X, Fig. 4 shows the class remains misclassified after VQVAE processing at epsilon=0.3, and the text states that 'All data is completely irrecoverable for PGD2 at epsilon=0.3, except for 2FSK.' The central claim should be qualified by the regime in which the mitigation is effective (e.g., epsilon <= 0.2, specific modulation classes), or the aggregate statistics supporting the general statement should be reported separately from the per-class results, with the exceptions explicitly accounted for.
minor comments (5)
  1. [Throughout] The citation [1] is a companion paper that is listed as 'accepted' but is not available in the current reference list with a preprint or DOI; since Section II-C delegates VQVAE training details to [1], please provide an accessible reference or enough training detail for the results to be reproducible.
  2. [Section II-C] The VQVAE loss in Eq. (5) includes a KL term that is written as 'KL(P(k|x)||Pd(q))' but the prior is defined as Pd(k)=1/qs; the notation should be made consistent (the argument of Pd should be k, not q).
  3. [Section IV] The sentence 'All data is completely irrecoverable for PGD2 at epsilon=0.3' is grammatically incorrect; it should read 'All data are completely irrecoverable' or 'All datapoints are unrecoverable,' and the qualifier 'for PGD2 at epsilon=0.3, except for 2FSK' should be stated precisely.
  4. [Fig. 3] The figure caption does not explicitly state whether the square markers correspond to VQVAE reconstructions for all three attack types or only for one; please clarify the legend and define the markers in the caption.
  5. [Section II-B, Eqs. (1)-(2)] The phase-preserving attack is described as preserving phase, but the notation Aa = sqrt(Ia^2 + Qa^2) uses the perturbed I and Q components before the phase projection; it would be clearer to define Aa as the amplitude of the perturbed signal after the independent perturbation and state that the phase angle in Eqs. (1)-(2) is the original phase, not the perturbed one.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular step; the mitigation result is a direct measurement, with only a non-load-bearing self-citation for VQVAE training details.

full rationale

The paper's derivation chain is experimental rather than deductive: a VQVAE and a classifier are trained on clean high-SNR data, adversarial examples are generated with FGSM1, FGSM2, and PGD, the same examples are passed through the VQVAE, and classifier accuracy on the reconstructions is measured (Section III, Fig. 3). The claimed mitigation, higher accuracy on reconstructed adversarial inputs especially for epsilon >= 0.2, is a direct comparison and is not obtained by fitting a parameter and then predicting that same parameter, nor does any equation in the paper reduce to another by construction. The latent-space metrics dH and dS are normalized against the stochastic quantization's own natural variability (Fig. 5), so they are not self-referential predictions. The only self-citation is [1], used for VQVAE design and training details; that citation is not load-bearing for the attack-suppression claim, which is evaluated in this paper on held-out attack inputs. The absence of a clean-input VQVAE-reconstruction control in Fig. 3, and the paper's own concession that 'All data is completely irrecoverable for PGD2 at ϵ = 0.3, except for 2FSK', are experimental limitations or alternative-explanation concerns, but a missing control is not circularity: it does not make the reported accuracy a quantity that is equivalent to the training inputs by definition. Thus no specific circular step can be quoted and exhibited.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The ledger lists three hand-selected VQVAE hyperparameters that the defense likely depends on, and two domain assumptions taken from the paper's own setup (perfect clean-data classification and trained VQVAE). No new entities are introduced; the phase-preserving attack is a method, not an entity.

free parameters (3)
  • VQVAE codebook size qs = 128
    Hand-selected architecture parameter; the paper states its impact on suppression differs across waveform classes (Conclusion), so the central mitigation result may depend on it.
  • Codeword length l = 512
    Hand-selected latent slice length that determines the granularity of discretization; no ablation is reported.
  • VQVAE loss weight beta = not specified
    In Eq. (5), beta weights the commitment and KL terms, but its value is not given; the training stability and codebook usage depend on it.
assumptions (3)
  • domain assumption The VQVAE from prior work [1] is trained correctly and yields a perfectly classifiable reconstruction of clean data.
    The abstract asserts perfect classifiability, but no clean-data reconstruction accuracy curve is shown in this paper.
  • domain assumption The classifier achieves 100% accuracy on the original dataset X.
    Stated in abstract and Section II-D; no training or validation accuracy curves are shown.
  • domain assumption High-SNR, equalized, clean data is the relevant threat model for off-the-air attacks on baseband data.
    Section I states this emulates Open-RAN and edge exposure; over-the-air channel effects are deferred.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A look at adversarial attacks on radio waveforms from discrete latent space." pith.science (2026). https://pith.science/paper/KHBOWP5O

@misc{pith2026250609896,
  author       = {Pith},
  title        = {Pith review of: A look at adversarial attacks on radio waveforms from discrete latent space},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KHBOWP5O}},
  note         = {Machine review of arXiv:2506.09896}
}
read the original abstract

Having designed a VQVAE that maps digital radio waveforms into discrete latent space, and yields a perfectly classifiable reconstruction of the original data, we here analyze the attack suppressing properties of VQVAE when an adversarial attack is performed on high-SNR radio-frequency (RF) data-points. To target amplitude modulations from a subset of digitally modulated waveform classes, we first create adversarial attacks that preserve the phase between the in-phase and quadrature component whose values are adversarially changed. We compare them with adversarial attacks of the same intensity where phase is not preserved. We test the classification accuracy of such adversarial examples on a classifier trained to deliver 100% accuracy on the original data. To assess the ability of VQVAE to suppress the strength of the attack, we evaluate the classifier accuracy on the reconstructions by VQVAE of the adversarial datapoints and show that VQVAE substantially decreases the effectiveness of the attack. We also compare the I/Q plane diagram of the attacked data, their reconstructions and the original data. Finally, using multiple methods and metrics, we compare the probability distribution of the VQVAE latent space with and without attack. Varying the attack strength, we observe interesting properties of the discrete space, which may help detect the attacks.

Figures

Figures reproduced from arXiv: 2506.09896 by the authors.

Figure 1
Figure 1. VQVAE’s compact architecture: output dimensions for a unit batch, and # of trainable parameters per layer. B. Attack Methods For the attack known as Fast Gradient Sign Method (FGSM), renamed here as FGSM2, a classification model with weights Θc is attacked by modifying the input data x imper￾ceptibly while maximizing the probability of misclassification. This optimized attack leverages the knowledge of the loss func… view at source ↗
Figure 2
Figure 2. Classifier architecture with the output dimension and # of trainable parameters per layer. III. EVALUATION METHODS As described in subsection II-D, to evaluate the effectiveness of VQVAE-based mitigation, we compare the classification accuracy of the originals, AdExs and AdEx reconstructions by VQVAE. We do it for all 3 attack types, using multiple attack strengths in each: ϵ ∈ {0.01, 0.06, 0.1, 0.2, 0.3} . To demon… view at source ↗
Figure 4
Figure 4. Confusion matrices after FGSM1, and upon passing through VQVAE: green arrow indicate PAM, red 32-QAM-X and yellow 2FSK, the 3 classes featured in histograms. - see [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (6 more)
Figure 3
Figure 3. Figure 3: Accuracy under attacks changes with increasing attack strength clearly depends on modulation ( [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]
Figure 5
Figure 5. Figure 5: Average Set and Hamming distances without attack, due to ΩSC (between zq (i) (x) and zq (ii) (x) [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 7
Figure 7. Figure 7: Constellations of 2FSK, 8PAM, 32-QAM-X, and matching I/Q planes for a random datapoint of each class. Focusing on 32-QAM-X, which is a QAM modulation of unusual shape, observe from [PITH_FULL_IMAGE:figures/full_fig_p005_7.png]
Figure 6
Figure 6. Figure 6: Hamming dH and Set distances dS under attacks. PAM), and the 32-QAM-Cross (32-QAM-X), since it remains misclassified for ϵ = 0.3 even after the VQVAE (follow the red lines in [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 8
Figure 8. Figure 8: 2FSK histogram of codeword indices under FGSM1 (0.01, 0.1 and 0.3). The arrows show the ranges outside of the support of normal latents, which get populated by the attack, thus increasing Set distance dS. space learned by the model. Our findings reveal that both the su…
Figure 9
Figure 9. Figure 9: Histograms of codeword indices under FGSM1 attacks for 32-QAM-X with ϵ ∈ {0.01, 0.1, 0.3} and 8PAM histogram with ϵ = 0.3. [10] Yu, Wentao et al., “AI and Deep Learning for THz Ultra-Massive MIMO: From Model-Driven Approaches to Foundation Models,” arXiv preprint arXiv…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

22 extracted references · 17 canonical work pages

  1. [3]

    Mitigation of adversarial examples in rf deep classifiers utilizing autoencoder pre-training,

    Kokalj-Filipovic, Silvija et al., “Mitigation of adversarial examples in rf deep classifiers utilizing autoencoder pre-training,” in Int. Conf. on Military Comms and Inf. Systems (ICMCIS) , 2019

    work page 2019

  2. [21]

    Combatting adversarial attacks through denoising and dimensionality reduction: A cascaded autoencoder approach,

    R. Sahay, R. Mahfuz, and A. E. Gamal, “Combatting adversarial attacks through denoising and dimensionality reduction: A cascaded autoencoder approach,” in Annual Conf. on Inform. Sciences and Systems (CISS), 2019

    work page 2019

  3. [1]

    ReFormer: Generating Radio Fakes from the Learned Channel Prior,

    Y . Kaasaragadda and S. Kokalj-Filipovic, “ReFormer: Generating Radio Fakes from the Learned Channel Prior,” in accepted to IEEE Int. Conference on Machine Learning for Communication and Networking (ICMLCN), 2025

    work page 2025

  4. [2]

    Adversarial examples in rf deep learning: Detection and physical robustness,

    S. Kokalj-Filipovic, R. Miller, and G. Vanhoy, “Adversarial examples in rf deep learning: Detection and physical robustness,” in IEEE Global Conf. on Signal and Inform. Processing (GlobalSIP) , 2019

    work page 2019

  5. [4]

    Adversarial attacks on deep-learning based radio signal classification,

    M. Sadeghi and E. G. Larsson, “Adversarial attacks on deep-learning based radio signal classification,” IEEE Wireless Communications Let- ters, vol. 8, no. 1, pp. 213–216, 2018

    work page 2018

  6. [5]

    Channel-aware adversarial attacks against deep learning-based wireless signal classifiers,

    Kim, Brian et al., “Channel-aware adversarial attacks against deep learning-based wireless signal classifiers,” IEEE Trans. on Wireless Communications, vol. 21, no. 6, pp. 3868–3880, 2022

    work page 2022

  7. [6]

    Adversarial examples detection of radio signals based on multifeature fusion,

    Xu, Dongwei et al., “Adversarial examples detection of radio signals based on multifeature fusion,” IEEE Trans. on Circuits and Systems II: Express Briefs, vol. 68, no. 12, pp. 3607–3611, 2021

    work page 2021

  8. [7]

    Adversarial samples detection based on feature attribution and contrast in modulation recognition,

    Wang, Wenyu et al., “Adversarial samples detection based on feature attribution and contrast in modulation recognition,”IEEE Comm. Letters, vol. 28, no. 11, pp. 2483–2487, 2024

    work page 2024

Show all 22 references
  1. [8]

    MIMO Channel Estimation Using Score- Based Generative Models,

    M. Arvinte and J. I. Tamir, “MIMO Channel Estimation Using Score- Based Generative Models,” IEEE Trans. on Wireless Comms , vol. 22, no. 6, pp. 3698–3713, 2023

    2023

  2. [9]

    Score-Based Generative Models for Robust Channel Estimation,

    ——, “Score-Based Generative Models for Robust Channel Estimation,” in IEEE Wireless Comm. and Network. Conference (WCNC) , 2022. 32-QAM-X ϵ ∈ {0.01, 0.1, 0.3} 8PAM ϵ = 0.3 Fig. 9: Histograms of codeword indices under FGSM1 attacks for 32-QAM-X with ϵ ∈ {0.01, 0.1, 0.3} and 8PA...

    2022

  3. [10]

    AI and Deep Learning for THz Ultra-Massive MIMO: From Model-Driven Approaches to Foundation Models,

    Yu, Wentao et al., “AI and Deep Learning for THz Ultra-Massive MIMO: From Model-Driven Approaches to Foundation Models,” arXiv preprint arXiv:2412.09839, 2024

    2024 arXiv

  4. [11]

    Generative Diffusion Models for High Dimensional Channel Estimation,

    Xingyu Zhou et al., “Generative Diffusion Models for High Dimensional Channel Estimation,” 2024

    2024

  5. [12]

    Intriguing properties of neural networks,

    Szegedy, Christian et al., “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199 , 2013

    2013 arXiv

  6. [13]

    Towards deep learning models resistant to adversarial attacks,

    Madry, Aleksander et al., “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083 , 2017

    2017 arXiv

  7. [14]

    Large Scale Radio Frequency Signal Classification,

    L. Boegner et al., “Large Scale Radio Frequency Signal Classification,”

  8. [15]

    Back to single-carrier for beyond-5g communications above 90ghz: Novel index modulation techniques for low-power wireless terabits system in sub-thz bands,

    M. Saad, “Back to single-carrier for beyond-5g communications above 90ghz: Novel index modulation techniques for low-power wireless terabits system in sub-thz bands,” Ph.D. dissertation, CentraleSup ´elec, 2020

    2020

  9. [16]

    Wireless backhaul in 5g and beyond: Issues, challenges and opportunities,

    B. Tezergil and E. Onur, “Wireless backhaul in 5g and beyond: Issues, challenges and opportunities,” IEEE Comms Surveys and Tutorials , vol. 24, no. 4, pp. 2579–2632, 2022

    2022

  10. [17]

    Optimizing mmwave wireless backhaul schedul- ing,

    Arribas, Edgar et al., “Optimizing mmwave wireless backhaul schedul- ing,” IEEE Trans. on Mobile Computing , vol. 19, no. 10, 2020

    2020

  11. [18]

    Neural discrete representation learning,

    A. Van Den Oord, O. Vinyals et al. , “Neural discrete representation learning,” Advances in neural information processing systems , vol. 30, 2017

    2017

  12. [19]

    Straightening out the straight-through estimator: Overcoming optimization challenges in vector quantized networks,

    M. Huh, B. Cheung, P. Agrawal, and P. Isola, “Straightening out the straight-through estimator: Overcoming optimization challenges in vector quantized networks,” in Intern. Conf. on Machine Learning, 2023

    2023

  13. [20]

    SQ-V AE: Variational bayes on discrete repre- sentation with self-annealed stochastic quantization,

    Takida Y . et al., “SQ-V AE: Variational bayes on discrete repre- sentation with self-annealed stochastic quantization,” arXiv preprint arXiv:2205.07547, 2022

    2022 arXiv

  14. [2022]

    Available: https://arxiv.org/abs/2207.09918

    [Online]. Available: https://arxiv.org/abs/2207.09918

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.