Pith. sign in

REVIEW 4 major objections 5 minor 98 references

Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read REIN-EAD claims that actively moving a camera with a reinforcement-learned policy defends against 3D adversarial patch attacks far better than passive preprocessing or adversarial training.

desk verdict Solid, reproducible empirical contribution on active embodied defense, but the multi-step theory in Theorem 3.7 is tautological and its proof is wrong; referee the paper, not the theorem. read the letter →

arxiv 2507.18484 v1 pith:6REAUXEP submitted 2025-07-24 cs.CV cs.AI

Xiao Yang , Lingxuan Wu , Lizhong Wang , Chengyang Ying , Hang Su , Jun Zhu This is my paper · ORCID
classification cs.CVcs.AI
keywords AdversarialRobustnessActiveDefenseEmbodiedLearningPolicyReinforcementPatches3DPerceptionAutonomousDriving
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

REIN-EAD argues that a vision system can defend against 3D adversarial patch attacks by actively choosing where to look, rather than by passively filtering or retraining on adversarial examples. The paper trains a camera-control policy with model-free reinforcement learning, using a dense reward derived from prediction-loss reduction and entropy minimization over a multi-step horizon, and pre-generates adversarial patches with offline PGD to keep the defense attack-agnostic. On face recognition, worst-case attack success drops to 7.37% for impersonation and 14.43% for dodging, versus 100% for an undefended model and 9.38%/22.11% for the prior EAD; on object classification, adaptive attack success falls to 28.96%; on driving-scene detection, average precision stays above 92% under attacks that collapse the undefended detector. The same framework works in non-differentiable environments because policy learning no longer needs backpropagation through a simulator. Standard accuracy is preserved or improved across all three tasks, which the paper attributes to the extra information that active observation collects.

What carries the argument

REIN-EAD combines three mechanisms. The first is an embodied POMDP loop: a recurrent perception model $f(o_t, b_{t-1}) = (\hat{y}_t, b_t)$ fused with a policy $\pi(b_t)$ that outputs camera yaw/pitch rotations; in the implementation both are a Decision Transformer over features from a frozen task backbone (a face-embedding network, a transformer classifier, a lightweight detector). The second is a multi-step accumulative objective, $\min L(\hat{y}_H, y) + \lambda H(\hat{y}_H | b_{H-1}, o_H)$, whose Lagrangian form gives the dense reward $r_t = L(\hat{y}_{t-1}, y) - \gamma L(\hat{y}_t, y)$; because the sum telescopes to $L(\hat{y}_0, y) - \gamma^H L(\hat{y}_H, y)$, optimizing the reward matches optimizing the objective. The third is Offline Adversarial Patch Approximation (OAPA), which pre-generates surrogate patches by projected gradient ascent on the frozen backbone, so the defense is trained on a broad adversarial patch manifold without online adversarial example generation.

What would settle it

Check the identity in the proof of Theorem 3.7 by estimating $H(y|b_{t-1}, o_t) - H(y|b_t)$ on the trained model; if it is not zero, the bijectivity equality fails and the claimed dominance of the accumulative policy over the greedy policy is unproven. A direct experiment comparing trajectory information gain of the learned policy with a greedy baseline at matched horizon and compute would settle whether multi-step planning actually helps.

Watch

Extended reading notes

Core claim

The paper's central claim is that REIN-EAD—a policy that moves the camera under reinforcement learning—is a stronger and more general defense against 3D patch attacks than passive defenses such as adversarial training, JPEG compression, gradient smoothing, and patch segmentation/completion. The method optimizes a multi-step objective that balances the final prediction loss with predictive entropy, and converts it into a dense per-step reward that telescopes into the final objective, so PPO can train the policy without a differentiable environment. The paper additionally proves an “informative policy efficacy inequality” stating that, if the belief-update function is bijective, the multi-step accumulative policy achieves at least as much entropy reduction as the greedy single-step policy. Empirically, REIN-EAD reports the lowest attack success rates under white-box, transfer-based, query-based, and adaptive attacks, including worst-case adaptive settings, while preserving or improving clean accuracy in face recognition, 3D object classification, and object detection for autonomous driving.

Load-bearing premise

The load-bearing premise is that the internal belief update is bijective, meaning it loses no information when it folds the old memory and the new image into one state; the actual transformer-based model cannot satisfy that, and the paper never verifies it.

Editorial extensions

If this is right

  • A controllable camera becomes a defense mechanism: any robot or vehicle that can reposition its sensor can be hardened without modifying the underlying recognition network.
  • The defense transfers to non-differentiable simulators and physical environments, since policy updates require only trial-and-error rollouts rather than gradients through the environment.
  • An adversary cannot defeat the defense by exploiting the specific attack used in training: unseen patch sizes, shapes, and attack families that the model never encountered still get suppressed.
  • Robustness and standard accuracy do not have to trade off here: additional viewpoints provide genuinely new signal, so clean accuracy is maintained or slightly increased.
  • Backpropagation-based adaptive attacks (such as BPDA and gradient checkpointing through the whole pipeline) do not automatically break the defense, because the policy couples decision-making with perception in a way that standard adaptive-attack recipes must approximate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: Theorem 3.7's bijectivity assumption does not hold for the Decision Transformer's embedding, so the paper has not actually proven that the accumulative policy beats the greedy policy; a matched-budget comparison with identical horizon and compute is needed to attribute the Table 1 gains to multi-step planning rather than to PPO or the reward.
  • Editorial: a testable extension of the defense is to add patch-purification at each visited viewpoint; the paper's own failure cases (e.g., a doll whose face is covered by the patch from every reachable angle) predict that active movement alone cannot help when all views are corrupted, and a per-view purifier would extend coverage.
  • Editorial: OAPA's offline patch manifold sets the robustness ceiling; if attack families move far from PGD-style perturbations, performance should drop, and increasing the diversity of offline patches (shapes, class-specific textures, low-frequency camouflage) should track robustness quantitatively.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes REIN-EAD, an embodied active defense framework against adversarial patches in 3D environments. REIN-EAD extends the prior EAD framework by replacing greedy single-step informative exploration with a multi-step accumulative objective, learning the camera policy via model-free PPO with a dense uncertainty-oriented reward, and using an offline adversarial patch approximation (OAPA) to avoid online adversarial training. The method is evaluated on face recognition, 3D object classification, and object detection (in EG3D and CARLA), reporting large reductions in attack success rates while preserving standard accuracy, plus robustness to unseen and adaptive attacks. The paper also provides an information-theoretic analysis culminating in Theorem 3.7, which is claimed to prove the superiority of the accumulative informative policy over the greedy policy.

Significance. If the empirical results are taken at face value, the paper describes a practically effective defense that is substantially stronger than the passive baselines and the prior EAD method across three perception tasks. The empirical core is a genuine strength: the evaluation includes white-box, transfer-based, query-based, and adaptive attacks; there is a random-movement control in Table 2 that shows multi-view information alone explains much of the gain while REIN-EAD still improves on it (3DAdv ASR 76.77 for random movement, 30.77 for EAD perception-only, 7.37 for REIN-EAD); and computational overhead is reported. The authors also explicitly document failure cases in Appendix E.9. However, the theoretical foundation for the central claim of a multi-step mechanism is not sound. Theorem 3.7 relies on a false bijectivity assumption, its conclusion is asserted by construction rather than proved, and the ablation that is supposed to isolate multi-step interaction changes several factors at once. Because the paper's abstract and introduction present the multi-step objective as the core contribution, these issues are load-bearing.

major comments (4)
  1. [Sec. 3.3.1 / Theorem 3.7 / Appendix A.2, Eq. (A.24)] The proof of Theorem 3.7 is not sound. It assumes the belief update fb:(b_{t-1},o_t)->b_t is bijective and then asserts Eq. (A.24), H(y|b_{t-1},o_t)-H(y|b_t)=0. In the actual implementation, fb is a Decision Transformer over 512- or 768-dimensional embeddings, so it maps R^{2d} to R^d; a continuous map from R^{2d} to R^d cannot be injective, and no verification of bijectivity or sufficiency is provided. Even under bijectivity, conditioning on b_t alone is not the same as conditioning on the pair (b_{t-1},o_t); the difference left out is I(y;b_{t-1},o_t|b_t), which is generally nonnegative and not zero. Without Eq. (A.24), the telescoping decomposition in Eq. (A.23) contains an uncontrolled term and inequality (10) does not follow.
  2. [Sec. 3.3.1, Definition 3.5 and Theorem 3.7] Theorem 3.7 is circular as stated. Definition 3.5 defines the accumulative informative policy pi* as the argmax over all policies of the trajectory information gain Delta_H^pi. Theorem 3.7 then 'proves' that Delta_H^{pi*} >= Delta_H^{pi_g}, which holds by construction once pi* is defined that way. The theorem therefore provides no independent content about whether the proposed multi-step objective in Eq. (9), or the learned policy under that objective, actually achieves better multi-step information gain than a greedy baseline. The paper needs to restate the theoretical claim so that it is not identical to the definition of pi*.
  3. [Sec. 3.3.2 and Appendix A.3, Eq. (A.28)] The reward-shaping derivation in Appendix A.3 shows that the cumulative discounted reward R(tau) telescopes to L(y_0) - gamma^H L(y_H). The entropy term lambda*H(y_H|b_{H-1},o_H) that appears in the stated objective Eq. (9) is absent from this policy reward. Consequently, the claim that the RL policy optimizes 'predictive entropy minimization' over the horizon is not supported by the derivation. The comparison with the Direct Entropy Deduction baseline in Appendix C.10 shows an empirical difference, but the paper should either define and analyze the reward actually optimized by the policy, or explain precisely how the entropy term influences the policy through the perception update in Algorithm 1.
  4. [Table 2, ablation study] The ablation that is meant to demonstrate the benefit of multi-step interaction does not isolate that factor. The rows EAD (+ Policy Model) and REIN-EAD (+ Multi-steps Interaction) differ simultaneously in the horizon length (H=4 vs. H=16), in the training algorithm (differentiable BPTT vs. model-free PPO), and in the reward function. The improvement shown in Table 2 can therefore be attributed to any of these changes, or to their combination. A controlled comparison is needed, for example PPO with the same dense loss-difference reward at H=4 and H=16, or EAD trained with the same horizon under both differentiable and model-free updates, before the multi-step accumulation mechanism can be credited with the observed gains.
minor comments (5)
  1. [Sec. 4.1.2] There is a typo in the sentence beginning 'Notely, REIN-EAD also improves...' which should read 'Notably, ...'.
  2. [Table 1] In the row for EAD under impersonation attacks, the entries for GenAP and 3DAdv appear as '5.157.21', which should be two separate numbers (5.15 and 7.21). Please fix the table formatting.
  3. [Appendix E.9] The failure cases described in Appendix E.9 are significant: the defense fails when no reachable viewpoint shows the object without the patch, and it degrades under compound out-of-distribution interference. These limitations should be summarized in the main paper, ideally in the conclusion or a limitations paragraph, since they qualify the generality of the claimed defense.
  4. [Table 4] The reward ablation row labeled 'ours' should be given a descriptive name (e.g., 'Uncertainty-oriented loss-difference reward') so that the reader does not have to infer the method from context.
  5. [Main experimental tables] Most main-table results are reported without variance or repeats. Given that Table 2 and the appendix show considerable run-to-run variation for some metrics, adding error bars or a statement about the number of seeds for the main tables would improve reliability.

Circularity Check

1 steps flagged · score 6.0 of 10

Theorem 3.7 is a definitional tautology: since π* is defined as the argmax of exactly Δ_H^π, the claimed inequality Δ_H^{π*} ≥ Δ_H^{πg} holds by construction, so the theorem does not independently establish the benefit of multi-step interaction.

  1. self definitional [Section 3.3.1, Definition 3.5 and Theorem 3.7 (proof in Appendix A.2)]
    "Definition 3.5 ... π∗ = arg max_{π∈Π} [H(y)−H(y|b_{H−1},o_H)]. ... Theorem 3.7 ... Define the trajectory information gain from time 0 to H under a policy π as the reduction in entropy of the variable y: Δ_H^π := H(y) − H(y|b_{H−1},o_H). ... Then ... Δ_H^{π∗} ≥ Δ_H^{πg}."

    The theorem's quantity Δ_H^π is identical to the objective already used to define π* in Definition 3.5. Any policy that maximizes Δ_H^π over Π will, by definition, have Δ_H^{π*} ≥ Δ_H^π for every π ∈ Π, including π_g. The conclusion is therefore entailed by the definition and requires no bijectivity assumption, no telescoping decomposition, and no proof. Presenting it as 'formally establishing the superiority of multi-step interactions' is a restatement of the definition, not an independent derivation.

full rationale

The main formal result offered as the theoretical foundation for multi-step accumulation is circular: Definition 3.5 defines π* as the argmax of the exact entropy-reduction functional that Theorem 3.7 then 'proves' π* maximizes. The proof's bijectivity condition and Eq. (A.24) are extraneous to that conclusion; indeed the assumption that a Decision Transformer belief update f_b:(b_{t-1},o_t)→b_t is bijective is not verified and is implausible for a map from R^{2d} to R^d, but that is a soundness issue rather than a circularity. The reward-shaping appendix (A.3) is an honest telescoping identity, though it also reveals that the dense reward omits the entropy term of Eq. (9); this is a correctness/alignment concern, not a circular step. The self-citation to the authors' earlier EAD [18] is used as a baseline and as the starting architecture, not as the justification for the new claim, so it is not load-bearing. The empirical evaluation is extensive and benchmarked against external baselines (Table 1, Table 3, Tables 5-6) and therefore the main experimental claim is not circular; however, the paper's central theoretical claim about accumulative policies reduces by construction, and the ablation in Table 2 changes horizon, training algorithm, and reward simultaneously, so the multi-step mechanism is not independently established. Overall score 6: one central 'prediction' reduces to its definition, while the empirical contribution retains independent content.

Assumptions & free parameters 5 free parameters · 5 assumptions · 1 invented entities

The empirical claims rest on standard RL training plus several weakly supported modeling choices: the bijectivity lemma (false for the implemented network), the transfer assumption for offline patches, and several hand-set training ratios and horizon lengths. No new physical entities are introduced; OAPA is a training-data construction, not an independently verifiable prediction.

free parameters (5)
  • lambda (entropy regularization weight) = not reported
    Appears in Eq. (9) and Algorithm 1 (J_percep = L + lambda*H) but no value is given in any hyperparameter table; hand-chosen balance between prediction loss and entropy.
  • r_patch (fraction of patched training data) = 0.4 (face, detection); 0.8 (classification)
    Hand-set per task (Tables C.2, D.8, E.9); controls how much of the agent's experience is adversarial.
  • horizon H = 16 for REIN-EAD; 4 for EAD
    Chosen design parameter; Fig. 6 demonstrates that longer horizons improve robustness, but the improvement is shown empirically, not derived.
  • discount factor gamma = 0.95
    Used in the dense reward; the telescoping identity in Appendix A.3 makes the reward equivalent to final-loss minimization largely independent of gamma's value, but gamma is still a chosen constant.
  • training patch size = 10% of image (face); 20% of bounding box (classification); 25% (detection)
    Evaluations also report other sizes; the paper notes training at 10% for face while Table 1 reports the 8% setting, an inconsistency in reporting.
assumptions (5)
  • ad hoc to paper The belief update fb is bijective (Theorem 3.7, invoked in Appendix A.2 Eq. A.24).
    Introduced to make the informative-policy inequality go through; a transformer-based recurrent encoder is not bijective, and the paper offers no verification.
  • domain assumption The learned policy pi*_phi approximates the accumulative informative policy given unlimited model capacity and data (Sec. 3.3.1).
    Stated explicitly as an assumption; it connects the trained REIN-EAD policy to the theoretical optimum without proof.
  • domain assumption Offline PGD patches computed against the frozen visual backbone (OAPA) form a training distribution that transfers to attacks on the full recurrent pipeline (Sec. 3.4).
    The defense is trained on patches that attack only the backbone; generalization to full-pipeline attacks is asserted and tested only empirically.
  • domain assumption High-entropy predictions are characteristic of adversarial examples (Sec. 3.3.1, citing [40]).
    This motivates the entropy regularizer in Eq. (9); it is a prior claim from the literature, not established here.
  • standard math POMDP formalism for the camera-object interaction (Sec. 3.1).
    Standard partially-observable Markov decision process modeling; not controversial.
invented entities (1)
  • OAPA surrogate patch set (offline adversarial patch approximation)
    purpose: A pre-computed set of PGD patches against the frozen backbone, used to train REIN-EAD without online adversarial example generation (Sec. 3.4).
    The mechanism is evaluated only inside this paper (ablation in Table 2); no external falsifiable handle exists outside the paper's own experiments. It is functionally standard adversarial training with pre-generated patches.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments." pith.science (2026). https://pith.science/paper/6REAUXEP

@misc{pith2026250718484,
  author       = {Pith},
  title        = {Pith review of: Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6REAUXEP}},
  note         = {Machine review of arXiv:2507.18484}
}
read the original abstract

Adversarial attacks in 3D environments have emerged as a critical threat to the reliability of visual perception systems, particularly in safety-sensitive applications such as identity verification and autonomous driving. These attacks employ adversarial patches and 3D objects to manipulate deep neural network (DNN) predictions by exploiting vulnerabilities within complex scenes. Existing defense mechanisms, such as adversarial training and purification, primarily employ passive strategies to enhance robustness. However, these approaches often rely on pre-defined assumptions about adversarial tactics, limiting their adaptability in dynamic 3D settings. To address these challenges, we introduce Reinforced Embodied Active Defense (Rein-EAD), a proactive defense framework that leverages adaptive exploration and interaction with the environment to improve perception robustness in 3D adversarial contexts. By implementing a multi-step objective that balances immediate prediction accuracy with predictive entropy minimization, Rein-EAD optimizes defense strategies over a multi-step horizon. Additionally, Rein-EAD involves an uncertainty-oriented reward-shaping mechanism that facilitates efficient policy updates, thereby reducing computational overhead and supporting real-world applicability without the need for differentiable environments. Comprehensive experiments validate the effectiveness of Rein-EAD, demonstrating a substantial reduction in attack success rates while preserving standard accuracy across diverse tasks. Notably, Rein-EAD exhibits robust generalization to unseen and adaptive attacks, making it suitable for real-world complex tasks, including 3D object classification, face recognition and autonomous driving.

Figures

Figures reproduced from arXiv: 2507.18484 by the authors.

Figure 1
Figure 1. An overview of EAD and REIN-EAD. (a) In EAD, the perception model refines the environment representation bt using observation ot and previous internal belief bt−1, making task-specific prediction yt. The policy model generates action at based on bt, minimizing perception uncertainty H(y | bt−1, ot) over a single step. (b) REIN-EAD extends EAD by accumulating multi-step interactions, balancing prediction loss reducti… view at source ↗
Figure 2
Figure 2. EAD’s temporal inconsistency issue visualized on the [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Qualitative results of REIN-EAD. The first two columns present the original image pairs, and the subsequent columns depict the interactive inference steps taken by the model. The defensive trajectory of REIN-EAD is plotted on the loss landscape w.r.t. yaw and pitch of the camera, considering the IResNet-50 ArcFace as the target model [60]. The adversarial glasses are generated with 3DAdv, which are robust to 3D view… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Comparative evaluation of defense methods across varying attack iterations with different adversarial patch sizes. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Comparative evaluation of computational overhead [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 7
Figure 7. Figure 7: Qualitative results of REIN-EAD on dynamic OmniObject3D, with the adversarial patch occupying 20% of the object’s bounding box in the front view. The state space for object classification is defined as [− π 2 , π 2 ] × [0, π 2 ], encompassing a comprehensive range of v…
Figure 8
Figure 8. Figure 8: Evaluating generalization on 3D object classification models under attacks with different patch sizes. [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Qualitative results of REIN-EAD on CARLA. Adversarial patches cover 25% of the object’s front-view bounding box. Stable convergence of policy training. To address active defense challenges in dynamic 3D environments, REIN-EAD enhances standard PPO with two key stabilit…
Figure 10
Figure 10. Figure 10: Comparative evaluation of object detection under [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

98 extracted references · 52 canonical work pages

  1. [1]

    Adversarial patch,

    T. B. Brown, D. Man´e, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,”arXiv preprint arXiv:1712.09665, 2017

    arXiv 2017

  2. [2]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” inCCS, 2016, pp. 1528–1540

    2016

  3. [3]

    Understanding the Robustness of 3D Object Detection with Bird's-Eye-View Representations in Autonomous Driving

    Z. Zhu, Y. Zhang, H. Chen, Y. Dong, S. Zhao, W. Ding, J. Zhong, and S. Zheng, “Understanding the robustness of 3d object detection with bird’s-eye-view representations in autonomous driving,”arXiv preprint arXiv:2303.17297, 2023

    work page Pith review arXiv 2023

  4. [4]

    Improving transferability of adversarial patches on face recognition with generative models,

    Z. Xiao, X. Gao, C. Fu, Y. Dong, W. Gao, X. Zhang, J. Zhou, and J. Zhu, “Improving transferability of adversarial patches on face recognition with generative models,” inCVPR, 2021, pp. 11 845– 11 854

    2021

  5. [5]

    Face3dadv: Exploiting robust adversarial 3d patches on physical face recognition,

    X. Yang, L. Xu, T. Pang, Y. Dong, Y. Wang, H. Su, and J. Zhu, “Face3dadv: Exploiting robust adversarial 3d patches on physical face recognition,”in IJCV, pp. 1–19, 2024

    2024

  6. [6]

    Physical adversarial exam- ples for object detectors,

    D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, and T. Kohno, “Physical adversarial exam- ples for object detectors,” inWOOT, 2018

    2018

  7. [7]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    arXiv 2017

  8. [8]

    Defending against phys- ically realizable attacks on image classification,

    T. Wu, L. Tong, and Y. Vorobeychik, “Defending against phys- ically realizable attacks on image classification,”arXiv preprint arXiv:1909.09552, 2019

    arXiv 1909

Show all 98 references
  1. [9]

    Adversarial training against location-optimized adversarial patches,

    S. Rao, D. Stutz, and B. Schiele, “Adversarial training against location-optimized adversarial patches,” inECCV. Springer, 2020, pp. 429–448

    2020

  2. [10]

    Improving robustness using generated data,

    S. Gowal, S.-A. Rebuffi, O. Wiles, F. Stimberg, D. A. Calian, and T. A. Mann, “Improving robustness using generated data,”in NeurIPS, vol. 34, pp. 4218–4233, 2021

    2021

  3. [11]

    Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking

    C. Xiang, A. N. Bhagoji, V . Sehwag, and P . Mittal, “Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking.” inUSENIX Security Symposium, 2021, pp. 2237–2254

    2021

  4. [12]

    Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection,

    J. Liu, A. Levine, C. P . Lau, R. Chellappa, and S. Feizi, “Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection,” inCVPR, 2022, pp. 14 973– 14 982

    2022

  5. [13]

    Patchzero: Defending against adversarial patch attacks by detecting and zeroing the patch,

    K. Xu, Y. Xiao, Z. Zheng, K. Cai, and R. Nevatia, “Patchzero: Defending against adversarial patch attacks by detecting and zeroing the patch,” inWACV, 2023, pp. 4632–4641

    2023

  6. [14]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” inICML. PMLR, 2018, pp. 274–283

    2018

  7. [15]

    On adaptive attacks to adversarial example defenses,

    F. Tramer, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,”inNeurIPS, vol. 33, pp. 1633–1645, 2020

    2020

  8. [16]

    Are theories of imagery theories of imagination? an active perception approach to conscious mental content,

    N. J. Thomas, “Are theories of imagery theories of imagination? an active perception approach to conscious mental content,”Cognitive science, vol. 23, no. 2, pp. 207–245, 1999

    1999

  9. [17]

    Adversarial examples that fool both computer vision and time-limited humans,

    G. Elsayed, S. Shankar, B. Cheung, N. Papernot, A. Kurakin, I. Goodfellow, and J. Sohl-Dickstein, “Adversarial examples that fool both computer vision and time-limited humans,”in NeurIPS, vol. 31, 2018

    2018

  10. [18]

    Embodied active defense: Leveraging recurrent feedback to counter adversar- ial patches,

    L. Wu, X. Yang, Y. Dong, X. Liuwei, H. Su, and J. Zhu, “Embodied active defense: Leveraging recurrent feedback to counter adversar- ial patches,” inICLR, 2024

    2024

  11. [19]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” inCVPR, 2018, pp. 1625– 1634

    2018

  12. [20]

    Towards effective adversarial textured 3d meshes on physical face recognition,

    X. Yang, C. Liu, L. Xu, Y. Wang, Y. Dong, N. Chen, H. Su, and J. Zhu, “Towards effective adversarial textured 3d meshes on physical face recognition,” inCVPR, 2023, pp. 4119–4128

    2023

  13. [21]

    A study of the effect of jpg compression on adversarial images,

    G. K. Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,”arXiv preprint arXiv:1608.00853, 2016

    2016 arXiv

  14. [22]

    Local gradients smoothing: Defense against localized adversarial attacks,

    M. Naseer, S. Khan, and F. Porikli, “Local gradients smoothing: Defense against localized adversarial attacks,” inWACV. IEEE, 2019, pp. 1300–1307

    2019

  15. [23]

    Towards adversarially robust object detection,

    H. Zhang and J. Wang, “Towards adversarially robust object detection,” inICCV, 2019, pp. 421–430

    2019

  16. [24]

    Probabilistic margins for instance reweighting in adversarial training,

    F. Liu, B. Han, T. Liu, C. Gong, G. Niu, M. Zhou, M. Sugiyama et al., “Probabilistic margins for instance reweighting in adversarial training,”in NeurIPS, vol. 34, pp. 23 258–23 269, 2021

    2021

  17. [25]

    Understanding robust overfitting of adversarial training and beyond,

    C. Yu, B. Han, L. Shen, J. Yu, C. Gong, M. Gong, and T. Liu, “Understanding robust overfitting of adversarial training and beyond,” inICML. PMLR, 2022, pp. 25 595–25 610

    2022

  18. [26]

    Dynamic weighted adversarial learning for semi-supervised classification under intersectional class mismatch,

    M. Li, T. Zhou, Z. Huang, J. Yang, J. Yang, and C. Gong, “Dynamic weighted adversarial learning for semi-supervised classification under intersectional class mismatch,”ACM Transactions, vol. 20, no. 4, pp. 1–24, 2024

    2024

  19. [27]

    Active vision,

    J. Aloimonos, I. Weiss, and A. Bandyopadhyay, “Active vision,”in IJCV, vol. 1, pp. 333–356, 1988

    1988

  20. [28]

    Active perception,

    R. Bajcsy, “Active perception,”Proceedings of the IEEE, vol. 76, no. 8, pp. 966–1005, 1988

    1988

  21. [29]

    Interactron: Embodied adaptive object detection,

    K. Kotar and R. Mottaghi, “Interactron: Embodied adaptive object detection,” inCVPR, 2022, pp. 14 860–14 869

    2022

  22. [30]

    Improv- ing viewpoint robustness for visual recognition via adversarial training,

    S. Ruan, Y. Dong, H. Su, J. Peng, N. Chen, and X. Wei, “Improv- ing viewpoint robustness for visual recognition via adversarial training,”arXiv preprint arXiv:2307.11528, 2023. IEEE TRANSACTIONS ON PATTERN ANAL YSIS AND MACHINE INTELLIGENCE 15

    2023 arXiv

  23. [31]

    Proactive multi- camera collaboration for 3d human pose estimation,

    H. Ci, M. Liu, X. Pan, F. Zhong, and Y. Wang, “Proactive multi- camera collaboration for 3d human pose estimation,”arXiv preprint arXiv:2303.03767, 2023

    2023 arXiv

  24. [32]

    Sqa3d: Situated question answering in 3d scenes,

    X. Ma, S. Yong, Z. Zheng, Q. Li, Y. Liang, S.-C. Zhu, and S. Huang, “Sqa3d: Situated question answering in 3d scenes,”arXiv preprint arXiv:2210.07474, 2022

    2022 arXiv

  25. [33]

    U-net: Convolutional net- works for biomedical image segmentation,

    O. Ronneberger, P . Fischer, and T. Brox, “U-net: Convolutional net- works for biomedical image segmentation,” inMICCAI. Springer, 2015, pp. 234–241

    2015

  26. [34]

    Mask r-cnn,

    K. He, G. Gkioxari, P . Doll ´ar, and R. Girshick, “Mask r-cnn,” in ICCV, 2017, pp. 2961–2969

    2017

  27. [35]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” inS&P. Ieee, 2017, pp. 39–57

    2017

  28. [36]

    Acting optimally in partially observable stochastic domains,

    A. R. Cassandra, L. P . Kaelbling, and M. L. Littman, “Acting optimally in partially observable stochastic domains,” inAaai, vol. 94, 1994, pp. 1023–1028

    1994

  29. [37]

    Evidence that recurrent circuits are critical to the ventral stream’s execution of core object recognition behavior,

    K. Kar, J. Kubilius, K. Schmidt, E. B. Issa, and J. J. DiCarlo, “Evidence that recurrent circuits are critical to the ventral stream’s execution of core object recognition behavior,”Nature neuroscience, vol. 22, no. 6, pp. 974–983, 2019

    2019

  30. [38]

    Representation learning with contrastive predictive coding,

    A. v. d. Oord, Y. Li, and O. Vinyals, “Representation learning with contrastive predictive coding,”arXiv preprint arXiv:1807.03748, 2018

    2018 arXiv

  31. [39]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P . Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,” inICML. PMLR, 2021, pp. 8748–8763

    2021

  32. [40]

    Understanding measures of uncertainty for adversarial example detection,

    L. Smith and Y. Gal, “Understanding measures of uncertainty for adversarial example detection,”arXiv preprint arXiv:1803.08533, 2018

    2018 arXiv

  33. [41]

    Robust rein- forcement learning on state observations with learned optimal adversary,

    H. Zhang, H. Chen, D. Boning, and C.-J. Hsieh, “Robust rein- forcement learning on state observations with learned optimal adversary,”arXiv preprint arXiv:2101.08452, 2021

    2021 arXiv

  34. [42]

    Towards safe reinforcement learning via constraining conditional value-at-risk,

    C. Ying, X. Zhou, H. Su, D. Yan, N. Chen, and J. Zhu, “Towards safe reinforcement learning via constraining conditional value-at-risk,” arXiv preprint arXiv:2206.04436, 2022

    2022 arXiv

  35. [43]

    Viewfool: Evaluating the robustness of visual recognition to adversarial viewpoints,

    Y. Dong, S. Ruan, H. Su, C. Kang, X. Wei, and J. Zhu, “Viewfool: Evaluating the robustness of visual recognition to adversarial viewpoints,”in NeurIPS, vol. 35, pp. 36 789–36 803, 2022

    2022

  36. [44]

    Dyna, an integrated architecture for learning, plan- ning, and reacting,

    R. S. Sutton, “Dyna, an integrated architecture for learning, plan- ning, and reacting,”ACM Sigart Bulletin, vol. 2, no. 4, pp. 160–163, 1991

    1991

  37. [45]

    The elements of differentiable program- ming,

    M. Blondel and V . Roulet, “The elements of differentiable program- ming,”arXiv preprint arXiv:2403.14606, 2024

    2024 arXiv

  38. [46]

    Learning long-term depen- dencies with gradient descent is difficult,

    Y. Bengio, P . Simard, and P . Frasconi, “Learning long-term depen- dencies with gradient descent is difficult,”IEEE trans. TNN, vol. 5, no. 2, pp. 157–166, 1994

    1994

  39. [47]

    Rethinking optimization with differentiable simulation from a global perspec- tive,

    R. Antonova, J. Yang, K. M. Jatavallabhula, and J. Bohg, “Rethinking optimization with differentiable simulation from a global perspec- tive,” inConference on Robot Learning. PMLR, 2023, pp. 276–286

    2023

  40. [48]

    Carla: An open urban driving simulator,

    A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V . Koltun, “Carla: An open urban driving simulator,” inConference on robot learning. PMLR, 2017, pp. 1–16

    2017

  41. [49]

    R. S. Sutton and A. G. Barto,Reinforcement learning: An introduction. MIT press, 2018

    2018

  42. [50]

    Policy invariance under reward transformations: Theory and application to reward shaping,

    A. Y. Ng, D. Harada, and S. Russell, “Policy invariance under reward transformations: Theory and application to reward shaping,” inIcml, vol. 99, 1999, pp. 278–287

    1999

  43. [51]

    Proximal policy optimization algorithms,

    J. Schulman, F. Wolski, P . Dhariwal, A. Radford, and O. Klimov, “Proximal policy optimization algorithms,”arXiv preprint arXiv:1707.06347, 2017

    2017 arXiv

  44. [52]

    Fast is better than free: Revisiting adversarial training,

    E. Wong, L. Rice, and J. Z. Kolter, “Fast is better than free: Revisiting adversarial training,”arXiv preprint arXiv:2001.03994, 2020

    2001 arXiv

  45. [53]

    Perceptual adversarial ro- bustness: Defense against unseen threat models,

    C. Laidlaw, S. Singla, and S. Feizi, “Perceptual adversarial ro- bustness: Defense against unseen threat models,”arXiv preprint arXiv:2006.12655, 2020

    2006 arXiv

  46. [54]

    Efficient geometry-aware 3d generative adversarial networks,

    E. R. Chan, C. Z. Lin, M. A. Chan, K. Nagano, B. Pan, S. De Mello, O. Gallo, L. J. Guibas, J. Tremblay, S. Khamiset al., “Efficient geometry-aware 3d generative adversarial networks,” inCVPR, 2022, pp. 16 123–16 133

    2022

  47. [55]

    Genera- tive visual manipulation on the natural image manifold,

    J.-Y. Zhu, P . Kr¨ahenb ¨uhl, E. Shechtman, and A. A. Efros, “Genera- tive visual manipulation on the natural image manifold,” inECCV. Springer, 2016, pp. 597–613

    2016

  48. [56]

    Labeled faces in the wild: A database for studying face recognition in un- constrained environments,

    G. B. Huang, M. Ramesh, T. Berg, and E. Learned-Miller, “Labeled faces in the wild: A database for studying face recognition in un- constrained environments,” University of Massachusetts, Amherst, Tech. Rep. 07-49, October 2007

    2007

  49. [57]

    Adversarial attacks on face recognition,

    X. Yang and J. Zhu, “Adversarial attacks on face recognition,” in Handbook of Face Recognition. Springer, 2023, pp. 387–404

    2023

  50. [58]

    Boosting adversarial attacks with momentum,

    Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inCVPR, 2018, pp. 9185– 9193

    2018

  51. [59]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” inICML. PMLR, 2018, pp. 284–293

    2018

  52. [60]

    Improved residual networks for image and video recognition,

    I. C. Duta, L. Liu, F. Zhu, and L. Shao, “Improved residual networks for image and video recognition,” inICPR. IEEE, 2021, pp. 9415– 9422

    2021

  53. [61]

    Cosface: Large margin cosine loss for deep face recognition,

    H. Wang, Y. Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recognition,” in CVPR, 2018, pp. 5265–5274

    2018

  54. [62]

    Nattack: Learning the distributions of adversarial examples for an improved black- box attack on deep neural networks,

    Y. Li, L. Li, L. Wang, T. Zhang, and B. Gong, “Nattack: Learning the distributions of adversarial examples for an improved black- box attack on deep neural networks,” inICML. PMLR, 2019, pp. 3866–3876

    2019

  55. [63]

    Stochastic first-and zeroth-order methods for nonconvex stochastic programming,

    S. Ghadimi and G. Lan, “Stochastic first-and zeroth-order methods for nonconvex stochastic programming,”SIAM journal on optimiza- tion, vol. 23, no. 4, pp. 2341–2368, 2013

    2013

  56. [64]

    Decision transformer: Reinforcement learning via sequence modeling,

    L. Chen, K. Lu, A. Rajeswaran, K. Lee, A. Grover, M. Laskin, P . Abbeel, A. Srinivas, and I. Mordatch, “Decision transformer: Reinforcement learning via sequence modeling,”in NeurIPS, vol. 34, pp. 15 084–15 097, 2021

    2021

  57. [65]

    Pad: Patch-agnostic defense against adversarial patch attacks,

    L. Jing, R. Wang, W. Ren, X. Dong, and C. Zou, “Pad: Patch-agnostic defense against adversarial patch attacks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 472–24 481

    2024

  58. [66]

    Diffender: Diffusion-based adversarial defense against patch attacks,

    C. Kang, Y. Dong, Z. Wang, S. Ruan, Y. Chen, H. Su, and X. Wei, “Diffender: Diffusion-based adversarial defense against patch attacks,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 130–147

    2024

  59. [67]

    Is robustness the cost of accuracy?–a comprehensive study on the robustness of 18 deep image classification models,

    D. Su, H. Zhang, H. Chen, J. Yi, P .-Y. Chen, and Y. Gao, “Is robustness the cost of accuracy?–a comprehensive study on the robustness of 18 deep image classification models,” inECCV, 2018, pp. 631–648

    2018

  60. [68]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  61. [69]

    Comprehensible rendering of 3-d shapes,

    T. Saito and T. Takahashi, “Comprehensible rendering of 3-d shapes,” inSIGGRAPH, 1990, pp. 197–206

    1990

  62. [70]

    Differentiable rendering: A survey,

    H. Kato, D. Beker, M. Morariu, T. Ando, T. Matsuoka, W. Kehl, and A. Gaidon, “Differentiable rendering: A survey,”arXiv preprint arXiv:2006.12057, 2020

    2006 arXiv

  63. [71]

    Soft rasterizer: A differentiable renderer for image-based 3d reasoning,

    S. Liu, T. Li, W. Chen, and H. Li, “Soft rasterizer: A differentiable renderer for image-based 3d reasoning,” inICCV, 2019, pp. 7708– 7717

    2019

  64. [72]

    Accelerating 3d deep learning with pytorch3d,

    N. Ravi, J. Reizenstein, D. Novotny, T. Gordon, W.-Y. Lo, J. Johnson, and G. Gkioxari, “Accelerating 3d deep learning with pytorch3d,” arXiv:2007.08501, 2020

    2007 arXiv

  65. [73]

    Opendr: An approximate differen- tiable renderer,

    M. M. Loper and M. J. Black, “Opendr: An approximate differen- tiable renderer,” inECCV. Springer, 2014, pp. 154–169

    2014

  66. [74]

    A versatile scene model with differentiable visibility applied to generative pose estimation,

    H. Rhodin, N. Robertini, C. Richardt, H.-P . Seidel, and C. Theobalt, “A versatile scene model with differentiable visibility applied to generative pose estimation,” inICCV, 2015, pp. 765–773

    2015

  67. [75]

    Omniobject3d: Large- vocabulary 3d object dataset for realistic perception, reconstruction and generation,

    T. Wu, J. Zhang, X. Fu, Y. Wang, J. Ren, L. Pan, W. Wu, L. Yang, J. Wang, C. Qian, D. Lin, and Z. Liu, “Omniobject3d: Large- vocabulary 3d object dataset for realistic perception, reconstruction and generation,” inCVPR, 2023

    2023

  68. [76]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” inCVPR, 2009, pp. 248– 255

    2009

  69. [77]

    Openai gym,

    G. Brockman, V . Cheung, L. Pettersson, J. Schneider, J. Schul- man, J. Tang, and W. Zaremba, “Openai gym,”arXiv preprint arXiv:1606.01540, 2016

    2016 arXiv

  70. [78]

    Meshadv: Adversarial meshes for visual recognition,

    C. Xiao, D. Yang, B. Li, J. Deng, and M. Liu, “Meshadv: Adversarial meshes for visual recognition,” inCVPR, 2019, pp. 6891–6900

    2019

  71. [79]

    Swin transformer: Hierarchical vision transformer using shifted windows,

    Z. Liu, Y. Lin, Y. Cao, H. Hu, Y. Wei, Z. Zhang, S. Lin, and B. Guo, “Swin transformer: Hierarchical vision transformer using shifted windows,”ICCV, pp. 9992–10 002, 2021

    2021

  72. [80]

    Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,

    Y. Zhao, H. Zhu, R. Liang, Q. Shen, S. Zhang, and K. Chen, “Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,” inCCS, 2019, pp. 1989–2004

    2019

  73. [81]

    Universal adversarial perturbations,

    S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P . Frossard, “Universal adversarial perturbations,” inCVPR, 2017, pp. 86–94. IEEE TRANSACTIONS ON PATTERN ANAL YSIS AND MACHINE INTELLIGENCE 16

    2017

  74. [82]

    Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,

    Z. Hu, W. Chu, X. Zhu, H. Zhang, B. Zhang, and X. Hu, “Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,” inCVPR, 2023, pp. 16 975–16 984

    2023

  75. [83]

    ultralytics/yolov5: v5. 0-yolov5-p6 1280 models, aws, supervise. ly and youtube integrations,

    G. Jocher, A. Stoken, J. Borovec, A. Chaurasia, L. Changyu, A. Hogan, J. Hajek, L. Diaconu, Y. Kwon, Y. Defretinet al., “ultralytics/yolov5: v5. 0-yolov5-p6 1280 models, aws, supervise. ly and youtube integrations,”Zenodo, 2021

    2021

  76. [84]

    The im algorithm: a variational approach to information maximization,

    D. Barber and F. Agakov, “The im algorithm: a variational approach to information maximization,”in NeurIPS, vol. 16, no. 320, p. 201, 2004

    2004

  77. [85]

    Lecture notes on information theory,

    Y. Polyanskiy and Y. Wu, “Lecture notes on information theory,” Lecture Notes for ECE563 (UIUC) and, vol. 6, no. 2012-2016, p. 7, 2014

    2012

  78. [86]

    Large-scale celebfaces attributes (celeba) dataset,

    Z. Liu, P . Luo, X. Wang, and X. Tang, “Large-scale celebfaces attributes (celeba) dataset,”Retrieved August, vol. 15, no. 2018, p. 11, 2018

    2018

  79. [87]

    Arcface: Additive angular margin loss for deep face recognition,

    J. Deng, J. Guo, X. Niannan, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition,” inCVPR, 2019

    2019

  80. [88]

    Adam: A method for stochastic optimiza- tion,

    D. P . Kingma and J. Ba, “Adam: A method for stochastic optimiza- tion,”arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  81. [89]

    Estimating or prop- agating gradients through stochastic neurons for conditional computation,

    Y. Bengio, N. L ´eonard, and A. Courville, “Estimating or prop- agating gradients through stochastic neurons for conditional computation,”arXiv preprint arXiv:1308.3432, 2013

    2013 arXiv

  82. [90]

    Adversarial manip- ulation of deep representations,

    S. Sabour, Y. Cao, F. Faghri, and D. J. Fleet, “Adversarial manip- ulation of deep representations,”arXiv preprint arXiv:1511.05122, 2015

    2015 arXiv

  83. [91]

    Training deep nets with sublinear memory cost,

    T. Chen, B. Xu, C. Zhang, and C. Guestrin, “Training deep nets with sublinear memory cost,”arXiv preprint arXiv:1604.06174, 2016

    2016 arXiv

  84. [92]

    Ms-celeb-1m: A dataset and benchmark for large-scale face recognition,

    Y. Guo, L. Zhang, Y. Hu, X. He, and J. Gao, “Ms-celeb-1m: A dataset and benchmark for large-scale face recognition,” inECCV. Springer, 2016, pp. 87–102

    2016

  85. [93]

    Fooling automated surveil- lance cameras: adversarial patches to attack person detection,

    S. Thys, W. Van Ranst, and T. Goedem´e, “Fooling automated surveil- lance cameras: adversarial patches to attack person detection,” in CVPR workshops, 2019, pp. 0–0. IEEE TRANSACTIONS ON PATTERN ANAL YSIS AND MACHINE INTELLIGENCE 17 APPENDIXA PROOFS ANDADDITIONALTHEORY A.1 Pro...

    2019

  86. [94]

    The results presented in Table C.1 demonstrate that the learned 3D prior over FFHQ enables remarkably high- quality single-view geometry recovery

    cosine similarity score between pairs of views of the face rendered from random camera poses and its original image from CelebA. The results presented in Table C.1 demonstrate that the learned 3D prior over FFHQ enables remarkably high- quality single-view geometry recovery. C...

  87. [95]

    shape completion

    The recurrent inference procedure is presented sequentially in this section for simplicity. IEEE TRANSACTIONS ON PATTERN ANAL YSIS AND MACHINE INTELLIGENCE 21 max p Es0∼ρ0L(yτ,y) +c·∥π({A(o i,p;s i)}τ i=0;ϕ)∥ 2 2, with{ yτ,bτ}=f({A(o i,p;s i)}τ i=0;θ) s.t.p∈[0,1] Hp×Wp×C, (C.3...

  88. [96]

    The final dataset has 176 classes, with 4409 objects for training and 1192 objects for testing. We use Pytorch3D (https://github.com/facebookresearch/pytorch3d) as the simulation engine since it provides efficient API for batch rendering and a differential pipeline for impleme...

  89. [97]

    For DOA † [8], we follow its training paradigm to fine-tune the same Swin-Small Transformer backbone used by REIN-EAD on the training set of dynamic OmniObject3D

    using the same code with FR task. For DOA † [8], we follow its training paradigm to fine-tune the same Swin-Small Transformer backbone used by REIN-EAD on the training set of dynamic OmniObject3D. Specifically, we utilize PGD with learning rate α= 8/255 and number of iteration...

  90. [98]

    The learning rate and the number of iterations for both methods are set atN= 500andα= 8/255

    to generate a single adversarial patch for all the vehicles in the dataset, which is able to hide any vehicles from the detector. The learning rate and the number of iterations for both methods are set atN= 500andα= 8/255. Attack in the hidden layer.As the EAD module is plugge...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.