Pith. sign in

REVIEW 5 major objections 5 minor 36 references

Improving Adversarial Robustness Through Adaptive Learning-Driven Multi-Teacher Knowledge Distillation

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Training a student only on clean images can teach it to withstand four different adversarial attacks, by learning from several adversarially trained teachers whose per-image influence is set by cosine similarity.

desk verdict A plausible incremental ARD scheme with unvalidated adaptive weighting and weak evaluation; worth a referee only after major revisions. read the letter →

arxiv 2507.20996 v1 pith:A32QLCJ4 submitted 2025-07-28 cs.CV

Hayat Ullah , Syed Muhammad Talha Zaidi , Arslan Munir This is my paper
classification cs.CV
keywords adversarialrobustnessknowledgedistillationmulti-teacheradaptivelearningattacksconvolutionalneuralnetworksimageperturbationclean-datatraining
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a student CNN trained only on clean images can acquire strong resistance to adversarial attacks when it is supervised by several teacher CNNs that were adversarially trained against different attack types. The proposed MTKD-AR method trains four clones of a lightweight CNN, one against FGSM, one against FFGSM, one against RFGSM, and one against PGD, and then distills their combined knowledge into a single student using a distillation loss in which each teacher's contribution is reweighted per input image. The per-input weights are computed from the cosine similarity between the student's current logits (raw class scores) and each teacher's logits, which the paper treats as a live measure of teacher reliability. If the claim holds, adversarial robustness can be transferred without ever exposing the student to perturbed data, avoiding the main computational cost of adversarial training and making robust models cheaper to deploy on small devices. On MNIST-Digits and Fashion-MNIST, the distilled student keeps accuracy in the high 80s to low 90s across all four attacks at perturbation magnitudes up to 0.3, while each single-teacher model drops sharply on attacks it was not trained to handle.

What carries the argument

The load-bearing mechanism is the adaptive teacher-weighting adapter. For each input image, the student logits v (raw class scores) and each teacher's logits z_i are compared by cosine similarity; the score is mapped through 1 + similarity and normalized across teachers, yielding a weight vector that is recomputed at every training step. The distillation target is the element-wise weighted combination of the teachers' soft predictions, produced by a temperature-controlled softmax, and the total loss is a weighted sum of a KL divergence between the student and that target and a cross-entropy loss against the ground-truth label. The weighting is what distinguishes the method from a static ensemble: a teacher that aligns with the current student on a given input dominates that input's distillation signal.

What would settle it

Evaluate the distilled student against a white-box attack type that is absent from the teacher pool, such as the C&W or DeepFool attack, at the same perturbation budgets used in the paper: if accuracy falls to near-random levels, the claim that robustness generalizes beyond the four training attacks is contradicted.

Watch

Extended reading notes

Core claim

The central claim is that adversarially pre-trained teachers can transfer robustness to a student trained entirely on clean data, and that the transfer works because the student is not bound to an unweighted average of teacher opinions. Four clones of a lightweight CNN are adversarially trained, one per attack, and then frozen as teachers. For each input image, the adapter computes the cosine similarity between the student's raw output scores and each teacher's raw output scores, shifts the scores by one, normalizes them into a weight vector, and forms a weighted soft target from the teachers' temperature-smoothed probability vectors. The student's total loss is the temperature-scaled KL divergence between its own soft prediction and this weighted target, plus a cross-entropy term against the true label, with α balancing the two. The paper reports that the student retains high accuracy on all four attack types simultaneously, and keeps a large share of that accuracy even at perturbation magnitudes (0.2 and 0.3) beyond the 0.1 used in teacher training; each single-teacher model, in contrast, keeps high accuracy only on the attack it was trained against. In the paper's framing, the adaptive weighting is what prevents inaccurate or irrelevant teacher predictions from misleading the student during distillation.

Load-bearing premise

The load-bearing premise is that the cosine similarity between the student's current output scores and a teacher's output scores measures that teacher's prediction precision for the current image, as the paper calls it; early in training the student is random, no evidence links this agreement to correctness, and if it fails the adaptive weights can amplify an unreliable teacher.

Editorial extensions

If this is right

  • Adversarial robustness can be conferred on a student without adversarial data at training time, shifting the expensive perturbation generation to a one-time teacher-training phase.
  • Lightweight models, which often benefit little from direct adversarial training, can inherit multi-attack defense from a small pool of specialized teachers.
  • The reported accuracy under perturbation magnitudes larger than the teachers were trained on suggests the distilled robustness is not brittle to a specific epsilon.
  • Single-teacher distillation is shown to be insufficient for multi-attack defense, supporting the need for a teacher pool plus input-dependent weighting.
  • The framework provides a practical path to robustness in resource-constrained environments, where full adversarial training may be infeasible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If cosine-similarity weighting truly tracks teacher reliability, the teacher pool could be diversified by architecture or failure mode rather than by attack type, which might generalize to attacks the pool was never designed against.
  • The self-referential nature of the weights (the student is scored against its own evolving predictions) could create a feedback loop that locks the student onto early agreements; a moving-average or annealed weight would be a direct test of that risk.
  • Because the reported experiments use 28×28 grayscale datasets with ten classes, a natural next step is to check whether the same weighting mechanism holds on high-resolution, large-vocabulary tasks where logit geometry is very different.
  • The method could be combined with certified defenses or with teachers trained on different perturbation norms, potentially yielding robustness certificates that cover a wider attack surface than any single teacher.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. This paper proposes MTKD-AR, a multi-teacher adversarial robustness distillation framework in which several clones of a CNN are adversarially trained on FGSM, FFGSM, RFGSM, and PGD perturbations, and a student model is trained on clean data only using a weighted combination of the teachers' soft targets. The weighting is computed online from the cosine similarity between the student's logits and each teacher's logits. The authors report that the student attains robust accuracy comparable to or better than the individual adversarially trained teachers across the four attack types on MNIST-Digits and Fashion-MNIST, including at perturbation magnitudes larger than those used in teacher training, and they release code at https://github.com/iscaas/MTKD-AR.

Significance. If the central claim holds, the paper offers a practical way to obtain adversarial robustness in a small student model without generating adversarial examples, which would reduce the computational cost of robust training. The multi-teacher adaptive weighting idea is, however, the main novelty, and the paper does not currently demonstrate that this mechanism is what drives the reported gains. The experiments are limited to two low-resolution datasets and four white-box attacks, with no comparison to prior ARD methods or to a uniform-weight multi-teacher baseline. The paper does provide a public implementation and evaluates clean and robust accuracy across multiple epsilon levels, which are positive elements for reproducibility.

major comments (5)
  1. [IV.B.1, Eq. (11)] Section IV.B.1, Eq. (11): the adaptive weight is computed as the cosine similarity between student logits v and teacher logits z_i, yet the paper repeatedly calls this 'prediction performance' and 'reliability' (e.g., Abstract and Section IV.B.1). Cosine similarity of logits measures student–teacher agreement, not teacher correctness; with a randomly initialized student at the start of distillation the weights are noisy and depend on the very student being trained, creating a feedback loop that can amplify an already-agreeing teacher rather than a robust one. The authors should (a) add an ablation with uniform teacher weighting, (b) show that the weights correlate with teacher accuracy on attacked inputs rather than only clean inputs, and (c) report the stability of the weights at initialization. Without (a), Tables V and VI do not establish that adaptive weighting, rather than ordinary multi-teacher averaging, produces the reported robustness.
  2. [IV.B.2, Eq. (14)] Section IV.B.2, Eq. (14): the distillation loss is written as KLD(p(1,n) * W(1,n), q), but p(1,n) is defined in Eq. (9) as a single summed distribution over all teachers, while W(1,n) is a per-teacher weight vector; the elementwise product is therefore dimensionally mismatched (class dimension versus teacher dimension). Listing 2 correctly computes the weighted prediction as Σ_i teachers_predictions[i] * normalized_teachers_weights[i], but the equation and the listing are inconsistent, and Eq. (14) uses σ (sigmoid) while the text describes a temperature-controlled softmax. The loss must be defined precisely and consistently with the code.
  3. [VI, Tables V–VI] Section VI (Tables V–VI): the student is evaluated on the same four attack types that were used to build the teacher pool, so the reported robustness is in-sample with respect to attack type; the only held-out dimension is perturbation magnitude (ϵ = 0.2, 0.3), which is a small generalization step. The abstract's claim of withstanding 'different adversarial attacks' and the text's claim of generalization to 'unseen perturbations' require evaluation against held-out attacks such as DeepFool, C&W, or AutoAttack.
  4. [Tables I, II, III, V, VI] Tables I, III, and V: the clean-data accuracy of the same baseline CNNW_OKD on MNIST-Digits is reported as 99.05, 98.89, and 97.66, respectively; Table II is headed 'MNIST-Digits Dataset Results' although the surrounding text and the data (clean accuracy 91.41) describe Fashion-MNIST; Tables V and VI call the proposed method 'MTKD-ADR' instead of 'MTKD-AR'; and the proposed method's PGD accuracy at ϵ = 0.1 is 89.82 in Table IV but 90.82 in Table VI. Numbers obtained under the same protocol should be identical, and the authors must reconcile them and report error bars over multiple runs.
  5. [VI] Section VI: the only baselines are the unperturbed-network distillation (CNNW_OKD) and single-teacher distillation (WKD-1T). There is no comparison to prior ARD methods such as Goldblum et al. [19] or Zhu et al. [22], and there is no uniform-multi-teacher baseline. Without these, the claimed advantage of MTKD-AR over the state of the art is not established, and the adaptive mechanism is not isolated.
minor comments (5)
  1. [IV.B.1, Eqs. (12)–(13)] The summation notation in tθ(1,n) and tθ'(1,n) is distracting; the equations can be written more simply as tθ_i = 1 + t_similarity_i and tθ'_i = tθ_i / Σ_j tθ_j.
  2. [Abstract and Section V] The paper alternates between 'MNIST-Fashion' and 'Fashion-MNIST'; the dataset name should be used consistently throughout.
  3. [Listing 1] The caption of Listing 1 contains the typo 'Pseudocod'; it should be 'Pseudocode'.
  4. [IV.B.2, Eq. (14)] Eq. (14) should specify the KLD direction (forward or reverse) and whether the weighted target distribution is renormalized after multiplication by W.
  5. [Section II] The related work discussion is brief and does not mention recent ARD variants such as Robust Soft Label Adversarial Distillation (RSLAD), which would help position the contribution relative to the current literature.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the robustness claim is empirically evaluated against held-out perturbation magnitudes and does not reduce to its inputs by construction.

full rationale

The paper's central claim is that a clean-data student distilled from adversarially trained teachers acquires robustness to FGSM, FFGSM, RFGSM, and PGD. The derivation is an algorithm, not a mathematical reduction: teachers are trained on adversarial examples, and the student is trained on clean data with a weighted distillation loss. The reported robust accuracies are empirical outcomes, not quantities forced by the loss definition. The held-out dimension (epsilon = 0.2 and 0.3, versus teachers trained at epsilon = 0.1) provides an independent, non-circular check. The adaptive weights in Eqs. 11-13 are computed from student-teacher cosine similarity rather than from ground-truth reliability; this is a construct-validity limitation of the 'prediction precision' label, and the weights are self-referential to the student's current logits, but this does not make the robustness numbers equivalent to the method's inputs by construction. There are no load-bearing self-citations, no imported uniqueness theorems, and no fitted parameters relabeled as predictions. Evaluation on the same attack types used to create the teacher pool limits generalization claims, but it is a standard in-sample transfer test, not a circular derivation.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The method rests on the domain assumption that adversarial robustness learned by teachers can be transferred via output logits to a clean-data student, and on the unvalidated assumption that cosine similarity between student and teacher logits selects the most reliable teacher. The loss balance alpha and temperature are hand-set but unreported.

free parameters (2)
  • alpha (loss balance) = not reported
    Weights the student CE loss against the distillation loss (Eq. 16). Its value controls the accuracy-robustness trade-off but is never reported or swept.
  • temperature tau = not reported
    Appears in the distillation loss (Eq. 14) to soften teacher outputs, but the actual softmax/sigmoid implementation is unclear and the value is not given.
assumptions (3)
  • domain assumption Knowledge distilled from adversarially trained teachers transfers robustness to a student trained on clean data.
    Invoked throughout Section IV; the paper provides no derivation, only empirical evidence on two datasets.
  • domain assumption Cosine similarity between student and teacher logits is a reliable measure of teacher prediction reliability.
    Stated in Section IV.B.1 without validation; the paper conflates agreement with the student with prediction precision.
  • standard math Standard definitions of adversarial attacks (FGSM, PGD, etc.) and their threat models.
    Used in Section III for problem formulation, borrowed from the cited literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving Adversarial Robustness Through Adaptive Learning-Driven Multi-Teacher Knowledge Distillation." pith.science (2026). https://pith.science/paper/A32QLCJ4

@misc{pith2026250720996,
  author       = {Pith},
  title        = {Pith review of: Improving Adversarial Robustness Through Adaptive Learning-Driven Multi-Teacher Knowledge Distillation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A32QLCJ4}},
  note         = {Machine review of arXiv:2507.20996}
}
read the original abstract

Convolutional neural networks (CNNs) excel in computer vision but are susceptible to adversarial attacks, crafted perturbations designed to mislead predictions. Despite advances in adversarial training, a gap persists between model accuracy and robustness. To mitigate this issue, in this paper, we present a multi-teacher adversarial robustness distillation using an adaptive learning strategy. Specifically, our proposed method first trained multiple clones of a baseline CNN model using an adversarial training strategy on a pool of perturbed data acquired through different adversarial attacks. Once trained, these adversarially trained models are used as teacher models to supervise the learning of a student model on clean data using multi-teacher knowledge distillation. To ensure an effective robustness distillation, we design an adaptive learning strategy that controls the knowledge contribution of each model by assigning weights as per their prediction precision. Distilling knowledge from adversarially pre-trained teacher models not only enhances the learning capabilities of the student model but also empowers it with the capacity to withstand different adversarial attacks, despite having no exposure to adversarial data. To verify our claims, we extensively evaluated our proposed method on MNIST-Digits and Fashion-MNIST datasets across diverse experimental settings. The obtained results exhibit the efficacy of our multi-teacher adversarial distillation and adaptive learning strategy, enhancing CNNs' adversarial robustness against various adversarial attacks.

Figures

Figures reproduced from arXiv: 2507.20996 by the authors.

Figure 1
Figure 1. The brief visual overview and workflow of our pro [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Detailed graphical overview of our proposed framework, depicting the overall workflow of adaptive learning-driven [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Pictorial overview of the proposed adaptive learning [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

36 extracted references · 23 canonical work pages

  1. [19]

    Adversarially robust distillation,

    M. Goldblum, L. Fowl, S. Feizi, and T. Goldstein, “Adversarially robust distillation,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 04, 2020, pp. 3996–4003

    work page 2020

  2. [22]

    Reliable adversarial distillation with unreliable teachers,

    J. Zhu, J. Yao, B. Han, J. Zhang, T. Liu, G. Niu, J. Zhou, J. Xu, and H. Yang, “Reliable adversarial distillation with unreliable teachers,” arXiv preprint arXiv:2106.04928, 2021

    arXiv 2021

  3. [1]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

    2016

  4. [2]

    Fast r-cnn,

    R. Girshick, “Fast r-cnn,” in Proceedings of the IEEE international conference on computer vision, 2015, pp. 1440–1448

    work page 2015

  5. [3]

    Deep speech 2: End-to-end speech recognition in english and mandarin,

    D. Amodei, S. Ananthanarayanan, R. Anubhai, J. Bai, E. Battenberg, C. Case, J. Casper, B. Catanzaro, Q. Cheng, G. Chen et al., “Deep speech 2: End-to-end speech recognition in english and mandarin,” in International conference on machine learning. PMLR, 2016, pp. 173– 182

    work page 2016

  6. [4]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  7. [5]

    Explaining and harnessing adversarial examples. proceedings of the 3rd international conference on learning representations, iclr 2015,

    I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples. proceedings of the 3rd international conference on learning representations, iclr 2015,” 2015

    work page 2015

  8. [6]

    Counter- ing adversarial images using input transformations,

    C. Guo, M. Rana, M. Cisse, and L. Van Der Maaten, “Counter- ing adversarial images using input transformations,” arXiv preprint arXiv:1711.00117, 2017

    arXiv 2017

Show all 36 references
  1. [7]

    Defense against adversarial attacks using high-level representation guided denoiser,

    F. Liao, M. Liang, Y . Dong, T. Pang, X. Hu, and J. Zhu, “Defense against adversarial attacks using high-level representation guided denoiser,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1778–1787

    2018

  2. [8]

    Characterizing adversar- ial subspaces using local intrinsic dimensionality,

    X. Ma, B. Li, Y . Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey, “Characterizing adversar- ial subspaces using local intrinsic dimensionality,” arXiv preprint arXiv:1801.02613, 2018

    2018 arXiv

  3. [9]

    A simple unified framework for detecting out-of-distribution samples and adversarial attacks,

    K. Lee, K. Lee, H. Lee, and J. Shin, “A simple unified framework for detecting out-of-distribution samples and adversarial attacks,” Advances in neural information processing systems, vol. 31, 2018

    2018

  4. [10]

    Certified adversarial robustness via randomized smoothing,

    J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in international conference on machine learning. PMLR, 2019, pp. 1310–1320

    2019

  5. [11]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  6. [12]

    Adversarial robustness through local linearization,

    C. Qin, J. Martens, S. Gowal, D. Krishnan, K. Dvijotham, A. Fawzi, S. De, R. Stanforth, and P. Kohli, “Adversarial robustness through local linearization,” Advances in Neural Information Processing Systems, vol. 32, 2019

    2019

  7. [13]

    Theoretically principled trade-off between robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in International conference on machine learning. PMLR, 2019, pp. 7472–7482

    2019

  8. [14]

    Improving adversarial robustness requires revisiting misclassified examples,

    Y . Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving adversarial robustness requires revisiting misclassified examples,” in International conference on learning representations, 2019

    2019

  9. [15]

    Magnet: a two-pronged defense against adver- sarial examples,

    D. Meng and H. Chen, “Magnet: a two-pronged defense against adver- sarial examples,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 135–147

    2017

  10. [16]

    Image super- resolution as a defense against adversarial attacks,

    A. Mustafa, S. H. Khan, M. Hayat, J. Shen, and L. Shao, “Image super- resolution as a defense against adversarial attacks,” IEEE Transactions on Image Processing, vol. 29, pp. 1711–1724, 2019

    2019

  11. [17]

    Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression,

    N. Das, M. Shanbhogue, S.-T. Chen, F. Hohman, L. Chen, M. E. Kounavis, and D. H. Chau, “Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression,” arXiv preprint arXiv:1705.02900, 2017. 11

    2017 arXiv

  12. [18]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in International conference on machine learning. PMLR, 2018, pp. 274–283

    2018

  13. [20]

    Improving adversarial robustness via channel-wise activation suppressing,

    Y . Bai, Y . Zeng, Y . Jiang, S.-T. Xia, X. Ma, and Y . Wang, “Improving adversarial robustness via channel-wise activation suppressing,” arXiv preprint arXiv:2103.08307, 2021

    2021 arXiv

  14. [21]

    Robust overfitting may be mitigated by properly learned smoothening,

    T. Chen, Z. Zhang, S. Liu, S. Chang, and Z. Wang, “Robust overfitting may be mitigated by properly learned smoothening,” in International Conference on Learning Representations, 2020

    2020

  15. [23]

    Ensemble adversarial training: Attacks and defenses,

    F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” arXiv preprint arXiv:1705.07204, 2017

    2017 arXiv

  16. [24]

    Exploring model robustness with adaptive networks and improved adversarial training,

    Z. Xu, A. Shafahi, and T. Goldstein, “Exploring model robustness with adaptive networks and improved adversarial training,” arXiv preprint arXiv:2006.00387, 2020

    2006 arXiv

  17. [25]

    Adversarial attacks and de- fences competition,

    A. Kurakin, I. Goodfellow, S. Bengio, Y . Dong, F. Liao, M. Liang, T. Pang, J. Zhu, X. Hu, C. Xie et al., “Adversarial attacks and de- fences competition,” in The NIPS’17 Competition: Building Intelligent Systems. Springer, 2018, pp. 195–231

    2018

  18. [26]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 2574–2582

    2016

  19. [27]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp). Ieee, 2017, pp. 39–57

    2017

  20. [28]

    Adversarial risk and the dangers of evaluating against weak attacks,

    J. Uesato, B. O’donoghue, P. Kohli, and A. Oord, “Adversarial risk and the dangers of evaluating against weak attacks,” in International Conference on Machine Learning. PMLR, 2018, pp. 5025–5034

    2018

  21. [29]

    Do wider neural networks really help adversarial robustness?

    B. Wu, J. Chen, D. Cai, X. He, and Q. Gu, “Do wider neural networks really help adversarial robustness?” Advances in Neural Information Processing Systems, vol. 34, pp. 7054–7067, 2021

    2021

  22. [30]

    Unlabeled data improves adversarial robustness,

    Y . Carmon, A. Raghunathan, L. Schmidt, J. C. Duchi, and P. S. Liang, “Unlabeled data improves adversarial robustness,” Advances in neural information processing systems, vol. 32, 2019

    2019

  23. [31]

    Improving the general- ization of adversarial training with domain adaptation,

    C. Song, K. He, L. Wang, and J. E. Hopcroft, “Improving the general- ization of adversarial training with domain adaptation,” arXiv preprint arXiv:1810.00740, 2018

    2018 arXiv

  24. [32]

    Adversarial weight perturbation helps robust generalization,

    D. Wu, S.-T. Xia, and Y . Wang, “Adversarial weight perturbation helps robust generalization,” Advances in Neural Information Processing Systems, vol. 33, pp. 2958–2969, 2020

    2020

  25. [33]

    Uncovering the limits of adversarial training against norm-bounded adversarial examples,

    S. Gowal, C. Qin, J. Uesato, T. Mann, and P. Kohli, “Uncovering the limits of adversarial training against norm-bounded adversarial examples,” arXiv preprint arXiv:2010.03593, 2020

    2010 arXiv

  26. [34]

    Adversarial training for free!

    A. Shafahi, M. Najibi, M. A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!” Advances in Neural Information Processing Systems, vol. 32, 2019

    2019

  27. [35]

    A kernelized manifold mapping to diminish the effect of adversarial perturbations,

    S. A. Taghanaki, K. Abhishek, S. Azizi, and G. Hamarneh, “A kernelized manifold mapping to diminish the effect of adversarial perturbations,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 11 340–11 349

    2019

  28. [36]

    Improving adversarial ro- bustness via promoting ensemble diversity,

    T. Pang, K. Xu, C. Du, N. Chen, and J. Zhu, “Improving adversarial ro- bustness via promoting ensemble diversity,” in International Conference on Machine Learning. PMLR, 2019, pp. 4970–4979

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.