Pith. sign in

REVIEW 4 major objections 5 minor 39 references

NCCR: to Evaluate the Robustness of Neural Networks and Adversarial Examples

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A network's robustness—and whether an input is adversarial—can be read from how much its neuron activations change under random perturbation.

desk verdict A plausible robustness metric in search of a precise definition, whose own JSMA results contradict the paper's universal 'adversarial examples are always less robust' claim. read the letter →

arxiv 2507.21483 v2 pith:C34V3O4V submitted 2025-07-29 cs.CR cs.AI

Shi Pu , Fu Song , Wenjie Wang This is my paper · ORCID
classification cs.CRcs.AI
keywords NCCRneuroncoveragechangerateadversarialexampledetectionrobustnessevaluationbackdoorattackrandomperturbationspeakerrecognitionimage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces a metric, the neuron cover change rate (NCCR), that measures how much a network's internal neuron activations shift when a small random perturbation is added to an input. The authors claim that a network with a low NCCR is genuinely robust, and that this single random-perturbation measurement ranks models without needing to run attacks. They further claim that adversarial examples are always less robust than clean examples, so an input with an NCCR far above the clean baseline is almost certainly adversarial. On image and speaker-recognition benchmarks the resulting detector reaches near-perfect AUROC, and a strong-perturbation variant separates backdoored inputs. If correct, this gives a fast, attack-independent robustness score and detector.

What carries the argument

The central object is the neuron cover change rate, a scalar built from the activation pattern of the network: record $F(x)$, the outputs of all neurons for input $x$; add small random noise $\epsilon$ to get $x'$; then NCCR is the $\ell^2$-norm distance between $F(x')$ and $F(x)$. It replaces static neuron coverage with a perturbation-sensitivity measure, and it carries the entire argument: low NCCR for a model means stability, high NCCR for an input means the input sits in a fragile region, and comparing an input's NCCR to a clean-example baseline is what turns the scalar into a detector. For backdoor detection, the same scalar is computed with a deliberately large perturbation so that any trigger is destroyed, which inverts the ordering and makes poisoned examples stand out.

What would settle it

Generate adversarial examples with a strong attack such as C&W at high confidence and measure their NCCR at the paper's perturbation size; if a non-negligible fraction of them has NCCR below the upper range of clean examples, the premise that adversarial examples are always less robust is false and the detector cannot be universal.

Watch

Extended reading notes

Core claim

The central claim is that robustness is readable from internal activation change under random noise: for a trained network $F$ and input $x$, add a small random perturbation $\epsilon$ to get $x'$, and define NCCR as the change in the set of neuron outputs $F(x)$ versus $F(x')$, measured with the $\ell^2$ norm. A robust network keeps neuron activations nearly fixed, so its NCCR is low; a fragile network or a fragile input yields high NCCR. The paper reports that on MNIST, CIFAR-10, ImageNet, and LibriSpeech, adversarially trained models show lower NCCR than naturally trained ones, adversarial examples show higher NCCR than clean examples (with AUROC close to 1.0 against FGSM, PGD, C&W, DeepFool, JSMA, and speaker-domain attacks), and backdoored images, once perturbed strongly enough to destroy the trigger, separate cleanly from benign images. The authors conclude that NCCR simultaneously evaluates model robustness, flags adversarial inputs, and detects backdoor triggers.

Load-bearing premise

The whole detector rests on the premise that every adversarial example lies closer to a decision boundary than every clean example and therefore is always less robust under random perturbation.

Editorial extensions

If this is right

  • Model robustness can be ranked without running any attack: a single random-perturbation NCCR separates naturally trained from adversarially trained networks.
  • A low-cost classifier on NCCR values detects FGSM, PGD, C&W, DeepFool, and JSMA adversarial examples with AUROC close to 1.0 on MNIST, CIFAR-10, and ImageNet.
  • The same measurement transfers to speaker recognition, detecting PGD, C&W, and FAKEBOB attacks on LibriSpeech better than the two compared baselines.
  • Using a large perturbation so that triggers are destroyed, NCCR clustering separates BadNets, Blended, SIG, and ReFool backdoored inputs with F1 scores near 1.0.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If NCCR's separation holds under adaptive attacks, it could serve as a cheap model-agnostic filter deployed before inference, an extension the paper does not test.
  • The paper's observation that same-label inputs have similar neuron activations suggests NCCR might also detect out-of-distribution or mislabeled samples, though the paper does not claim this.
  • Because NCCR depends on perturbation size, a natural extension is an epsilon-sweep profile rather than a single scalar, which could reveal how robustness changes across perturbation scales.
  • The near-100% detection accuracy may degrade on attacks specifically optimized to keep examples far from decision boundaries, a regime the paper does not evaluate.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces a metric called Neuron Coverage Change Rate (NCCR), defined in prose as the change in outputs of selected neurons when an input is perturbed with random noise. It claims that NCCR can rank the robustness of neural networks, detect adversarial examples because 'adversarial examples are always less robust' than clean ones, and detect backdoor triggers. Experiments are reported on MNIST, CIFAR-10, ImageNet, GTSRB, and LibriSpeech, with AUROC and F1 comparisons against several baselines.

Significance. The NCCR idea is attractive because a single random-perturbation measurement could in principle yield a fast, attack-independent robustness estimate and a cheap detector. The paper has strengths: it spans image and speaker domains, compares against multiple baselines, and uses public datasets and tools. However, the central claim is not supported. The paper never gives a precise definition of NCCR, and its own JSMA results and backdoor analysis directly contradict the 'always less robust' premise. The detection method is a supervised classifier trained on known adversarial and clean examples, so it cannot establish the universal robustness-ordering property by itself. As framed, the contribution overgeneralizes from the attack families where random noise happens to separate the distributions.

major comments (4)
  1. [Section 3.2] The definition of NCCR is given only in prose: 'we add a random perturbation ε to x' and 'the degree of change in F(x′) relative to F(x) is called NCCR.' No formula is provided for F(x), no neuron subset is specified, no perturbation distribution is given, and no statement explains how the scalar NCCR is computed from the vector-valued activations. The experiments later state that the l2-norm was used, but the dimensionality, normalization, and aggregation over the ten perturbation sets are not described. This makes the metric and all reported numeric results non-reproducible.
  2. [Section 5.1, Tables 3 and 4] The paper's own data falsify the claim that adversarial examples are always less robust under the random perturbation used for NCCR. In Table 3 (Env1, CIFAR-10), classifiers trained on FGSM, PGD, or Combine obtain AUROC 0.8931, 0.9002, and 0.9103 on JSMA, while the same classifiers exceed 0.99 on FGSM, PGD, C&W, and DeepFool. Table 4 shows the same pattern (e.g., 0.9054 on CIFAR-10 and 0.9341–0.9415 on ImageNet). The text concedes that performance is 'generally modest' because JSMA is an l0 attack while the NCCR perturbation is random l2 noise. This shows that the robustness deficit is not a property of adversarial inputs as such but of the match between the attack's norm and the random perturbation. The claimed attack-independent, near-perfect detection therefore fails for a standard attack family.
  3. [Section 6.1, Figure 4] The backdoor analysis directly contradicts the universal premise stated in the abstract. The paper concedes that BadNets poisoned examples 'can be very far from the decision boundary' and 'are significantly more robust than clean examples' under small perturbations, and that the ordering inverts only when ε=256 is used, which 'completely destroys' the image content. This is an ad hoc assumption that a sufficiently large perturbation will destroy any trigger, with no justification for the required perturbation magnitude. At ε=256 the threat model is no longer the imperceptible-trigger backdoor described earlier, so the detection result is not an instance of the paper's stated 'always less robust' principle.
  4. [Section 5, detection methodology] The detection pipeline trains a classifier D on NCCR values of pre-generated adversarial and clean examples. This is a supervised classifier fitted to known attack families, not an independent demonstration that a robustness deficit is universal or attack-independent. Moreover, Baseline 3 [39] is exactly the robustness-ordering detection principle on which the paper relies, so the experiments compare the new NCCR measure against a baseline of the same family rather than validating the 'always less robust' premise. The sentence in the abstract that detection works 'as adversarial examples are always less robust' is therefore an unsupported premise rather than a conclusion established by the experiments.
minor comments (5)
  1. [Section 3.2] A formal definition would greatly help reproducibility, for example NCCR(x; ε, S) = Eδ~N(0,ε)[ ||FS(x+δ) − FS(x)||p ] with S the chosen neuron subset and p the norm; the current prose leaves all of these choices implicit.
  2. [Tables 1, 2, 5 and Figure 4] There are several typos: 'PDG' should be 'PGD', 'CIAR-10' should be 'CIFAR-10', 'F AKEBOB' appears in Table 5, and 'Exexamples' appears in the Figure 4 caption.
  3. [Figure 4] The caption labels (a) ε=8 and (b) ε=256, but the text says 'From 4b it is clear that the NCCR of the poisoned example is lower ... when ε is very small' and '4a shows that the NCCR ... is significantly higher ... when ε is large enough.' These references appear to be swapped.
  4. [Tables 3 and 4] The caption says the baseline is a row, but the baselines are shown as columns (BL1/BL2 and BL3); the presentation should be clarified so the reader can see which baseline result is the best in each group.
  5. [Section 8] The 'To Do' section explicitly lists unfinished items: showing experimental results in more detail, reporting time cost, and discussing the effect difference of the two speaker-recognition models. These items should be completed before the paper can be considered complete, especially since the speaker-recognition results are claimed as a contribution.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the NCCR metric is an empirical sensitivity measure, the detectors are conventional supervised/clustering evaluations, and the only self-citation [39] is prior external evidence; the 'always less robust' overclaim is a correctness concern rather than a circular derivation.

full rationale

The paper defines NCCR as the change in neuron outputs under random perturbation, and the claim that lower NCCR indicates higher robustness is an empirical correlation validated against natural, adversarially trained, and Madry models (Section 4, Tables 1-2), not a theorem derived from the definition. The adversarial detector is a supervised classifier trained on NCCR values of clean and adversarial examples and then evaluated on held-out attacks (Section 5.1); this is standard empirical evaluation, not a fitted parameter renamed as a prediction. The backdoor detector explicitly avoids supervised training and instead uses clustering (Section 6.1), and its choice of a large perturbation (epsilon=256) is stated as a design choice to destroy triggers rather than hidden as a prediction. The only self-citation is [39] (Zhao et al., with author Fu Song overlapping), used to motivate why adversarial examples have lower robustness; this is a prior external empirical result, not an unverified premise derived from the present paper's own equations, so it does not constitute circularity. The paper's own JSMA results (Tables 3-4, AUROC roughly 0.90 for classifiers not trained on JSMA) show that the universal 'adversarial examples are always less robust' premise does not hold under l2 random noise for l0 attacks; this is an overgeneralization or correctness risk, not a circularity. Overall, the central derivation chain is self-contained as an empirical evaluation pipeline, and no step reduces by construction to its own inputs.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim depends on several hand-chosen hyperparameters (epsilon, replicas, neuron subset) and on domain assumptions about robustness ordering and trigger destruction, none of which are independently validated.

free parameters (4)
  • epsilon (perturbation magnitude) = 0.3 (MNIST), 8/255 (CIFAR-10), 8 and 256 (backdoor experiments)
    Chosen by hand; NCCR values and detection thresholds depend critically on this scale. No sensitivity analysis is provided.
  • number of perturbed replicas = 10
    Ten Gaussian noise draws per input are used to estimate NCCR; the number affects variance of the estimate and is not justified.
  • neuron subset = unspecified ('specifically chosen neurons')
    The paper does not state which neurons are included in the NCCR computation; the metric's value depends on this choice.
  • classifier architecture and training details = 3-layer MLP with 1792 parameters
    The detection classifier is a simple MLP; no training hyperparameters, initialization, or validation splits are given.
assumptions (4)
  • domain assumption Adversarial examples are less robust than clean examples because they are near decision boundaries.
    Stated in Section 5 and cited to [39], which is the authors' own prior work. The detector's threshold and the backdoor method rely on this ordering.
  • domain assumption A robust network should produce similar neuron activation patterns for an input and its small random perturbation.
    This is the core heuristic behind NCCR, introduced in Sections 3.1 and 4. It is not proven, only observed in experiments.
  • domain assumption Inputs with the same label activate similar neurons, and different labels activate different neurons.
    Motivates NCCR and is supported by the stratification in Figure 1, but no statistical test is given.
  • ad hoc to paper A sufficiently large random perturbation will destroy any backdoor trigger.
    Section 6.1 assumes epsilon=256 is enough to 'completely destroy' triggers; this is not validated across trigger sizes and placements.

how reviews work

0 comments
Cite this review

Pith. "Pith review of NCCR: to Evaluate the Robustness of Neural Networks and Adversarial Examples." pith.science (2026). https://pith.science/paper/C34V3O4V

@misc{pith2026250721483,
  author       = {Pith},
  title        = {Pith review of: NCCR: to Evaluate the Robustness of Neural Networks and Adversarial Examples},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/C34V3O4V}},
  note         = {Machine review of arXiv:2507.21483}
}
read the original abstract

Neural networks have received a lot of attention recently, and related security issues have come with it. Many studies have shown that neural networks are vulnerable to adversarial examples that have been artificially perturbed with modification, which is too small to be distinguishable by human perception. Different attacks and defenses have been proposed to solve these problems, but there is little research on evaluating the robustness of neural networks and their inputs. In this work, we propose a metric called the neuron cover change rate (NCCR) to measure the ability of deep learning models to resist attacks and the stability of adversarial examples. NCCR monitors alterations in the output of specifically chosen neurons when the input is perturbed, and networks with a smaller degree of variation are considered to be more robust. The results of the experiment on image recognition and the speaker recognition model show that our metrics can provide a good assessment of the robustness of neural networks or their inputs. It can also be used to detect whether an input is adversarial or not, as adversarial examples are always less robust.

Figures

Figures reproduced from arXiv: 2507.21483 by the authors.

Figure 1
Figure 1. Neuron activation A noticeable stratification phenomenon is observed in all three figures, indicating that images with the same classification produce highly s imilar outputs on the same neuron within the neural network. Moreover, for all images, variations in the output of neurons can be observed, and situations where Neuron Coverage approaches 100% are absent. 3.2 Definition of NCCR To address deficiencies in neur… view at source ↗
Figure 2
Figure 2. NCCR of models with varying robustness 5 [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Comparison of NCCR between Clean Examples and Adversarial Examples [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: NCCR Comparison of the Poisoned and Clean Exexamples under Different Perturbations [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Overall NCCR Comparison when ϵ=256 NCCR difference. From 4b it is clear that the NCCR of the poisoned example is lower than that of the clean example when ϵis very small, but the NCCR order of magnitude is 10−3 , so the difference is not large. When ϵis large enough to…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 29 canonical work pages

  1. [39]

    Attack as defense: Characterizing adversarial examples using robustness

    Zhe Zhao, Guangke Chen, Jingyi Wang, Yiwei Yang, Fu Song, and Jun Sun. Attack as defense: Characterizing adversarial examples using robustness. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis , pages 42–55, 2021. 15

    work page 2021

  2. [1]

    Audiomnist: exploring explainable artificial intelligence for audio analysis on a simple benchmark

    S¨ oren Becker, Johanna Vielhaben, Marcel Ackermann, Klaus-Robert M¨ uller, Sebastian La- puschkin, and Wojciech Samek. Audiomnist: exploring explainable artificial intelligence for audio analysis on a simple benchmark. Journal of the Franklin Institute , 361(1):418–428, 2024. 12

    work page 2024

  3. [2]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) , pages 39–57. Ieee, 2017

    work page 2017

  4. [3]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728 , 2018

    arXiv 2018

  5. [4]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 , 2017

    arXiv 2017

  6. [5]

    On the detection of adaptive adversarial attacks in speaker verification systems

    Zesheng Chen. On the detection of adaptive adversarial attacks in speaker verification systems. IEEE Internet of Things Journal , 10(18):16271–16283, 2023

    work page 2023

  7. [6]

    Front- end factor analysis for speaker verification

    Najim Dehak, Patrick J Kenny, R´ eda Dehak, Pierre Dumouchel, and Pierre Ouellet. Front- end factor analysis for speaker verification. IEEE Transactions on Audio, Speech, and Language Processing, 19(4):788–798, 2010

    work page 2010

  8. [7]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

Show all 39 references
  1. [8]

    Formal verification of piece-wise linear feed-forward neural networks

    Ruediger Ehlers. Formal verification of piece-wise linear feed-forward neural networks. In Au- tomated Technology for Verification and Analysis: 15th International Symposium, ATV A 2017, Pune, India, October 3–6, 2017, Proceedings 15 , pages 269–286. Springer, 2017

    2017

  2. [9]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th annual computer security applications conference, pages 113–125, 2019

    2019

  3. [10]

    Ai2: Safety and robustness certification of neural networks with abstract inter- pretation

    Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen, Petar Tsankov, Swarat Chaudhuri, and Martin Vechev. Ai2: Safety and robustness certification of neural networks with abstract inter- pretation. In 2018 IEEE symposium on security and privacy (SP) , pages 3–18. IEEE, 2018

    2018

  4. [11]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  5. [12]

    Badnets: Evaluating back- dooring attacks on deep neural networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating back- dooring attacks on deep neural networks. Ieee Access, 7:47230–47244, 2019

    2019

  6. [13]

    Fabrice Harel-Canada, Lingxiao Wang, Muhammad Ali Gulzar, Quanquan Gu, and Miryung Kim. Is neuron coverage a meaningful measure for testing deep neural networks? In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Found...

    2020

  7. [14]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770–778, 2016

    2016

  8. [15]

    Adversarial example defense: Ensembles of weak defenses are not strong

    Warren He, James Wei, Xinyun Chen, Nicholas Carlini, and Dawn Song. Adversarial example defense: Ensembles of weak defenses are not strong. In 11th USENIX workshop on offensive technologies (WOOT 17) , 2017

    2017

  9. [16]

    An overview of text-independent speaker recognition: From features to supervectors

    Tomi Kinnunen and Haizhou Li. An overview of text-independent speaker recognition: From features to supervectors. Speech communication, 52(1):12–40, 2010

    2010

  10. [17]

    Physgan: Generating physical-world-resilient adversarial examples for autonomous driving

    Zelun Kong, Junfeng Guo, Ang Li, and Cong Liu. Physgan: Generating physical-world-resilient adversarial examples for autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 14254–14263, 2020

    2020

  11. [18]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 13

    2009

  12. [19]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security , pages 99–112. Chapman and Hall/CRC, 2018

    2018

  13. [20]

    The mnist database of handwritten digits

    Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/ , 1998

    1998

  14. [21]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 , 2017

    2017 arXiv

  15. [22]

    Distributed representa- tions of words and phrases and their compositionality

    Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg S Corrado, and Jeff Dean. Distributed representa- tions of words and phrases and their compositionality. Advances in neural information processing systems, 26, 2013

    2013

  16. [23]

    Universal adversarial perturbations

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1765–1773, 2017

    2017

  17. [24]

    Librispeech: an asr corpus based on public domain audio books

    Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khudanpur. Librispeech: an asr corpus based on public domain audio books. In 2015 IEEE international conference on acoustics, speech and signal processing (ICASSP) , pages 5206–5210. IEEE, 2015

    2015

  18. [25]

    Distillation as a defense to adversarial perturbations against deep neural networks

    Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP) , pages 582–597. IEEE, 2016

    2016

  19. [26]

    Deepxplore: Automated whitebox testing of deep learning systems

    Kexin Pei, Yinzhi Cao, Junfeng Yang, and Suman Jana. Deepxplore: Automated whitebox testing of deep learning systems. In proceedings of the 26th Symposium on Operating Systems Principles , pages 1–18, 2017

    2017

  20. [27]

    Foolbox: A python toolbox to benchmark the robustness of machine learning models

    Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox: A python toolbox to benchmark the robustness of machine learning models. arXiv preprint arXiv:1707.04131 , 2017

    2017 arXiv

  21. [28]

    Deep learning in medical image analysis

    Dinggang Shen, Guorong Wu, and Heung-Il Suk. Deep learning in medical image analysis. Annual review of biomedical engineering , 19:221–248, 2017

    2017

  22. [29]

    An abstract domain for certifying neural networks

    Gagandeep Singh, Timon Gehr, Markus P¨ uschel, and Martin Vechev. An abstract domain for certifying neural networks. Proceedings of the ACM on Programming Languages , 3(POPL):1–30, 2019

    2019

  23. [30]

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Bench- marking machine learning algorithms for traffic sign recognition. Neural networks , 32:323–332, 2012

    2012

  24. [31]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013

    2013 arXiv

  25. [32]

    Evaluating robustness of neural networks with mixed integer programming

    Vincent Tjeng, Kai Xiao, and Russ Tedrake. Evaluating robustness of neural networks with mixed integer programming. arXiv preprint arXiv:1711.07356 , 2017

    2017 arXiv

  26. [33]

    Dissector: Input validation for deep learning applications by crossing-layer dissection

    Huiyan Wang, Jingwei Xu, Chang Xu, Xiaoxing Ma, and Jian Lu. Dissector: Input validation for deep learning applications by crossing-layer dissection. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering , pages 727–738, 2020

    2020

  27. [34]

    Adversarial sample detection for deep neural network through model mutation testing

    Jingyi Wang, Guoliang Dong, Jun Sun, Xinyu Wang, and Peixin Zhang. Adversarial sample detection for deep neural network through model mutation testing. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) , pages 1245–1256. IEEE, 2019

    2019

  28. [35]

    Towards fast computation of certified robustness for relu networks

    Lily Weng, Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsieh, Luca Daniel, Duane Boning, and Inderjit Dhillon. Towards fast computation of certified robustness for relu networks. In International Conference on Machine Learning , pages 5276–5285. PMLR, 2018. 14

    2018

  29. [36]

    Evaluating the robustness of neural networks: An extreme value theory approach

    Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, and Luca Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. In International Conference on Learning Representations , 2018

    2018

  30. [37]

    Adversarial sample detection for speaker verification by neural vocoders

    Haibin Wu, Po-Chun Hsu, Ji Gao, Shanshan Zhang, Shen Huang, Jian Kang, Zhiyong Wu, Helen Meng, and Hung-Yi Lee. Adversarial sample detection for speaker verification by neural vocoders. In ICASSP 2022-2022 IEEE international conference on acoustics, speech and signal processin...

    2022

  31. [38]

    Droid-sec: deep learning in android malware detection

    Zhenlong Yuan, Yongqiang Lu, Zhaoguo Wang, and Yibo Xue. Droid-sec: deep learning in android malware detection. In Proceedings of the 2014 ACM conference on SIGCOMM , pages 371–372, 2014

    2014

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.