Pith. sign in

REVIEW 3 major objections 6 minor 22 references

An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline

T0 review · 3 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes an automated, modular evaluation pipeline that quantifies how much private training data model inversion attacks can leak from image classifiers, scoring risk across four accuracy-based dimensions.

desk verdict Genuinely novel pipeline for MIA risk scoring, but the privacy-loss claim rests on unvalidated proxies and one experiment fine-tunes evaluators on the private data. read the letter →

arxiv 2509.04214 v1 pith:35HBZS7H submitted 2025-09-04 cs.CR

Tyler Shumaker , Jessica Carpenter , David Saranchak , Nathaniel D. Bastian This is my paper · ORCID
classification cs.CR
keywords modelinversionattackprivacyriskquantificationdevelopmentaltestandevaluationvisionlanguagemodelszero-shotclassificationweightedcompositeaccuracylossimagemilitarymachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Machine learning models deployed in military settings can be interrogated by model inversion attacks (MIAs) that reconstruct private training data, but existing test-and-evaluation practice lacks automated, scalable ways to quantify how much privacy is actually lost. This paper proposes a modular developmental test and evaluation (DT&E) pipeline that repeatedly runs MIAs against a target classifier, captions each reconstruction with a vision-language model (VLM), and scores the result along four adversarial risk dimensions: quality loss, feature loss, label loss, and model stealing loss. These four accuracy-based scores are combined into a single weighted composite accuracy loss (WCAL) that bins the target model into low, medium, or high risk. The authors demonstrate the pipeline on STL-10 and a military vehicle dataset, finding that model architecture changes vulnerability (VGG16 high risk, ResNet50 low), that 10 reconstructions per class suffice, and that fine-tuning GAN priors and VLMs to the target domain increases measured leakage. If validated, the pipeline would let stakeholders compare models for deployment on concrete privacy-leak risk rather than subjective visual inspection.

What carries the argument

The load-bearing mechanism is a four-stage modular pipeline: (1) a target classifier; (2) a model inversion attack, here feature visualization with a GAN prior or generative model inversion (GMI), run repeatedly to produce reconstructed images per class; (3) a VLM (CLIP, BLIP2, or InstructBLIP) that captions each reconstruction and supports zero-shot text and image classification; and (4) an evaluation model trained on disjoint public data, optionally fine-tuned into a proxy model on the reconstructions. The four risk dimensions are computed from these components and combined through the weighted composite accuracy loss formula WCAL = sum(ω_k r_k), which is what turns raw reconstruction accu

What would settle it

Run the pipeline on a target model trained on class labels that have been shuffled relative to the images (so no real class-typical visual features exist). If the four loss values, especially quality and feature loss, stay high because reconstructions are saved only when the target model classifies them correctly, then the scores are tracking the selection criterion rather than private training-data leakage. A second check: split a single class's training images into two subgroups, one with a private visual attribute, and test whether reconstruction accuracy for the private subgroup exceeds ch

Watch

Extended reading notes

Core claim

The central claim is that privacy loss from model inversion can be quantified automatically by treating four accuracy-based measures as adversarial risk dimensions, then averaging them into a single score. The four dimensions are: quality loss, the classification accuracy of reconstructed images under an evaluation model trained on public data disjoint from the target's training set; feature loss, the accuracy with which a VLM's zero-shot text classification of image captions recovers possible class labels; label loss, the accuracy of zero-shot classification that assigns a high-confidence class label to each reconstructed group; and model stealing loss, the accuracy of a proxy model obtaine

Load-bearing premise

The whole risk score rests on the assumption that the classification accuracy of a reconstructed image under an external evaluation model or VLM faithfully measures how much private training data leaked; the paper itself notes the evaluation does not capture true visual semantics.

Editorial extensions

If this is right

  • Model architecture materially changes inversion risk: in the paper's experiments VGG16 consistently falls into high risk while ResNet50 falls into low risk, so architecture choice should be part of pre-deployment privacy review.
  • Increasing the number of reconstructed images per class beyond a small number (10) does not raise any of the four loss values, so assessments can be run with small reconstruction budgets at lower compute cost.
  • Fine-tuning the GAN prior and the VLMs on domain-specific public data substantially increases all measured losses, meaning domain-adapted attacks reveal more leakage than generic ones.
  • The WCAL score gives a single comparable risk number that can bin any image classifier into low/medium/high leakage risk without human interpretation of reconstructed images.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the accuracy-based metrics are accepted as leakage proxies, the same pipeline architecture could be applied to other data modalities (e.g., audio or tabular) by swapping the VLM and evaluation model, since the four loss definitions do not depend on image-specific details.
  • A testable extension: use the pipeline to compare the four loss dimensions against a direct privacy ground truth, such as a dataset where one class contains private subgroups; if the pipeline's risk score tracks subgroup reconstruction accuracy, it would validate the metric; if not, it would isolate what the classifier accuracy is actually measuring.
  • The paper's own caveat that the evaluation 'does not capture true visual semantics' suggests the quality and feature losses may partly reflect class-typical public features selected by the attack's save criterion; extending the pipeline with per-image semantic similarity (e.g., retrieval against training-like images) could separate genuine private-data leakage from generic class resemblance.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper presents an automated, modular pipeline for developmental test and evaluation (DT&E) of model inversion attack (MIA) risk in image classifiers. The pipeline applies an MIA (feature visualization with a GAN prior, or GMI) to a target model, produces reconstructed images, captions them with a vision-language model (VLM), and computes four risk metrics: quality loss (evaluation-model classification accuracy), feature loss (VLM zero-shot text classification on captions), label loss (VLM zero-shot image classification), and model stealing loss (proxy model accuracy). These are combined into a weighted composite accuracy loss (WCAL) using equal weights in the experiments, and models are binned into low/medium/high risk categories. Experiments vary target architectures (VGG16, MobileNetV2, ResNet50), number of reconstructions (10/50/100), MIA type (FV, GMI), VLM type (BLIP2, InstructBLIP), and dataset (STL-10 and a military vehicle dataset). The results show architecture-dependent risk, with VGG16 consistently rated high-risk and ResNet50 low-risk, and the military-vehicle experiments report increased losses after fine-tuning the GAN, BLIP, and CLIP on the target's training data.

Significance. If the proposed metrics are valid, the paper addresses a genuine gap: there are few automated, scalable MIA risk assessment frameworks, and none that integrate VLMs for interpretation. The modular design and the four-dimensional decomposition are useful engineering contributions, and the experimental breadth across architectures, attacks, VLMs, and datasets is commendable. However, the central claim that the four accuracy-based losses 'quantify privacy loss' is not yet established. The losses are classification accuracies relabeled as losses, none is validated against an accepted privacy-leakage benchmark, and the paper itself concedes in Section III-D that the evaluation 'does not capture true visual semantics.' Since WCAL is a weighted average of these unvalidated accuracies, the risk scores and low/medium/high classifications rest on a construct-validity assumption that is load-bearing and currently unsupported. The work shows promise as a tool prototype, but the privacy-loss interpretation requires stronger evidence before it can support operational DT&E decisions.

major comments (3)
  1. [Section II-B1 and Section III-D] The quality loss metric is defined as the classification accuracy of an external evaluation model on reconstructed images, and it is asserted that 'higher accuracy indicates a higher information loss.' This assertion is never validated against a ground-truth privacy metric. Section III-D explicitly states that 'this MIA evaluation does not capture true visual semantics' and that quality loss values are high partly because the pipeline saves reconstructed images only when they are correctly categorized against the target model. This selection criterion means the quality-loss numbers reflect the attack's alignment with the target's decision boundary, not necessarily the recovery of specific private training instances. As quality loss is one of the four components of WCAL (Eq. 1), the composite risk score is not established as a measure of privacy loss. The authors should validate quality l
  2. [Section I.C and Section III-D (Experiment 4)] The paper states in Section I.C that when an evaluation model is used to assess MIA accuracy, its training dataset is independent of the target model's training dataset. Yet in Section III-D, the second trial of Experiment 4 fine-tunes the GAN, BLIP, and CLIP on the very same military-vehicle dataset used to train the target model, explicitly 'to capture the highest-risk assessment.' This violates the stated independence assumption and introduces circularity: evaluators that have already seen the private data will score reconstructions highly regardless of what the target model actually leaked. The observed increase in losses after fine-tuning is therefore not evidence of increased leakage from the target. The paper should either use public-data-only priors and evaluators in the main results, or clearly relabel the second trial as an upper-bound adversary with private-data access and com
  3. [Section II-B (all four metrics) and Eq. (1)] All four loss dimensions are classification accuracies (of an InceptionV3 evaluation model, VLM zero-shot text classification, VLM zero-shot image classification, and a proxy model) that are relabeled as losses. The paper does not compare these scores to any existing MIA evaluation metric, such as the methodology discussed in reference [22], nor to a ground-truth measure of training-data exposure. Without such validation, the risk thresholds (55% and 65%) and the conclusions that VGG16 is 'high risk' and ResNet50 is 'low risk' are not supported as statements about privacy loss; they are statements about classifier agreement among the target, evaluation, and VLM models. A validation experiment correlating each dimension and WCAL with an established privacy metric on a common set of models/attacks is needed to support the central claim.
minor comments (6)
  1. [Section II (structure)] The subsection numbering is inconsistent: after Section II-B, the text jumps to subsections D, E, F, and G, and no Section II-C appears. Section II-A also uses A/B/C/D labels for pipeline stages, which conflicts with the main subsection numbering. Please renumber for clarity.
  2. [Eq. (1)] The equation for WCAL appears as 'WCAL = 4X k=1' in the submitted text, with the summation index and limits not properly typeset. Please ensure the equation is rendered in standard mathematical notation.
  3. [References] Reference [9] (He et al., ResNet) lists the arXiv identifier 1801.04381, which is the same as reference [8] for MobileNetV2. The ResNet paper's arXiv identifier is 1512.03385. Please correct this.
  4. [Section II-G] The risk thresholds for low (<55%), medium (55-65%), and high (>65%) risk are introduced without justification or sensitivity analysis. Since these thresholds directly determine the qualitative risk labels, a brief rationale or a robustness check varying the thresholds would strengthen the presentation.
  5. [Section III (experimental setup)] The paper promises 95% confidence intervals for all experiments, but several reported values in Experiment 3 (e.g., VGG feature loss 75.0%, label loss 90.0%) are given without intervals. Please report intervals consistently across all results.
  6. [General (reproducibility)] The paper does not provide a code repository, random seeds, or complete details of the GMI configurations beyond iteration counts and thresholds. Given that the pipeline is the main contribution, more implementation detail or a public release would aid independent verification.

Circularity Check

2 steps flagged · score 6.0 of 10

Partial circularity: Experiment 4 fine-tunes evaluators on the target's private training data, and quality loss is inflated by a target-correct selection rule.

  1. fitted input called prediction [Section III-D (Experiment 4: Application to a Military Dataset), paragraphs 3-5]
    "To demonstrate how distilling and incorporating prior knowledge can improve MIA success, we fine-tuned the GAN used as the prior in the FV attack, as well as the BLIP and CLIP models used for feature loss and label loss evaluation. ... we utilize training data for the following experiments. ... These increases show that the fine-tuning of the GANs and VLMs allow more information to be leaked by the target model."

    Feature loss and label loss are defined as VLM classification/captioning accuracy on reconstructed images. Fine-tuning BLIP and CLIP on the same military-vehicle dataset used to train the target model mechanically raises their accuracy on reconstructions resembling that dataset, independent of what the target model actually leaked. The reported increase in loss is therefore a direct consequence of fitting the evaluators to the private data, not an independent measurement of increased information leakage from the target. This also contradicts the paper's own independence requirement in Section I-C: 'we ensure that the training dataset for the evaluation model and the training dataset that was used to train the target model are independent.'

  2. self definitional [Section III-D (Experiment 4: Application to a Military Dataset), paragraph 3]
    "The quality loss values are high because the process of creating the reconstructed images saves images that are correctly categorized against the target model. While this results in good accuracy against the evaluation model, the difference in loss scores reinforces the observation that this MIA evaluation does not capture true visual semantics [22]."

    Quality loss is defined as evaluation-model accuracy on reconstructed images. The pipeline saves only reconstructions that the target model classifies correctly, and the evaluation model is trained on the same classification task, so target-correct reconstructions will often also be evaluation-correct. The high quality-loss value is thus partly an artifact of the selection rule built into the definition of the metric, rather than evidence of private-training-data leakage. The paper's own sentence exhibits this reduction: the saving rule 'results in good accuracy against the evaluation model,' so the metric measures alignment with the target's decision boundary more than recovery of specific private instances.

full rationale

The paper's derivation chain is not globally circular: Experiments 1-3 use stock VLMs and an evaluation model trained on data disjoint from the target's training set, so those architecture, attack, and VLM comparisons have independent content. The construct-validity assumption in Section II-B1 (higher evaluation accuracy = higher information loss) is a validity threat rather than a circularity per se. However, two concrete construction effects create partial circularity in the reported risk scores. First, the quality-loss metric is inflated by design because only reconstructions correctly categorized by the target model are saved, directly raising the evaluation-model accuracy that defines quality loss. Second, Experiment 4 fine-tunes the GAN, BLIP, and CLIP on the target's private training data and then attributes the resulting increases in loss to the target model leaking more information; because the evaluators themselves have now seen the private data, the increase reduces to the fine-tuning procedure rather than to measured target leakage. These two effects contaminate some of the evidence for the central claim that the pipeline quantifies privacy loss, but they do not make the entire framework reducible to its inputs. The paper's own admission in Section III-D that 'this MIA evaluation does not capture true visual semantics' supports this assessment. No load-bearing self-citation chain is present. Overall score: 6.

Assumptions & free parameters 4 free parameters · 6 assumptions · 1 invented entities

The pipeline depends on hand-set design choices (equal risk weights, 55%/65% thresholds, GMI configurations, NearMiss parameters) and on several domain assumptions about what classifier accuracy on reconstructed images means for privacy. No new physical or mathematical entities are introduced; WCAL is a composite scoring construct rather than an independent observable.

free parameters (4)
  • Risk weights omega_k = 0.25 each (equal weights)
    WCAL in Eq. (1) is a weighted average of the four risk dimensions; equal weights are chosen by hand with no sensitivity analysis, and the weights directly change the composite score and risk bin.
  • WCAL risk thresholds = low <55%, medium 55-65%, high >65%
    The thresholds for binning models into low, medium, and high risk are set by hand without calibration to any external privacy metric.
  • GMI configuration parameters = iterations 5000/7500/10000; selectivity thresholds 0.7/0.8
    The three GMI configurations were selected to produce visually salient reconstructions rather than by an objective optimization criterion; results and attack time depend heavily on these choices.
  • NearMiss undersampling parameters = version=1, neighbors=3, feature size=32x32
    Used for the imbalanced military vehicle dataset; this design choice affects target model accuracy and all downstream risk metrics.
assumptions (6)
  • domain assumption Higher classification accuracy of reconstructed images by an independent evaluation model indicates higher information loss from the target model's private training data.
    Underlies quality loss in Section II-B1. The paper does not validate this against an external privacy metric and later cites [22] to note the evaluation may not capture true visual semantics.
  • domain assumption Reconstructed images that strongly activate a target model's internal layer or class node are meaningful proxies for private training examples.
    Section II-A3 states the output is 'a reconstructed image that strongly activates a specific internal layer of the target model,' and the pipeline treats such images as evidence of training-data leakage.
  • domain assumption VLM captions and zero-shot labels of reconstructed images reveal the target model's class structure or task.
    Underlies feature loss and label loss in Sections II-B2 and II-B3. The assumption is that VLM semantic interpretation corresponds to the model's actual classes, which may fail for fine-grained or domain-specific classes.
  • domain assumption An adversary can approximate the target task by training on public data plus reconstructed images, and proxy model accuracy on the private training set is a valid measure of model stealing.
    Underlies model stealing loss in Section II-B4. This assumes transfer from reconstructions to private training data and that using the private training set as ground truth is a realistic test, even though a real adversary would not have access to it.
  • domain assumption The target model's test dataset can be used to train an evaluation model that represents an adversary's capability without leaking target training data.
    Section II-B1 says 'the target model's test dataset can be used to obtain a model with similar performance.' The test set is disjoint from the training set, but it is still from the same data distribution, which may overstate adversary capability.
  • domain assumption An equal-weight arithmetic combination of the four risk dimensions produces a meaningful composite privacy risk score.
    Eq. (1) defines WCAL as a weighted average. There is no justification that the four accuracy-based dimensions are commensurable or that equal weighting is appropriate for decision-making.
invented entities (1)
  • Weighted Composite Accuracy Loss (WCAL)
    purpose: A single aggregate score intended to quantify overall privacy risk from model inversion attacks.
    WCAL is defined in Eq. (1) as a weighted average of four accuracy-based metrics. It has no external calibration or falsifiable handle tying it to actual privacy compromise; risk bins are arbitrary.

how reviews work

0 comments
Cite this review

Pith. "Pith review of An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline." pith.science (2026). https://pith.science/paper/35HBZS7H

@misc{pith2026250904214,
  author       = {Pith},
  title        = {Pith review of: An Automated, Scalable Machine Learning Model Inversion Assessment Pipeline},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/35HBZS7H}},
  note         = {Machine review of arXiv:2509.04214}
}
read the original abstract

Machine learning (ML) models have the potential to transform military battlefields, presenting a large external pressure to rapidly incorporate them into operational settings. However, it is well-established that these ML models are vulnerable to a number of adversarial attacks throughout the model deployment pipeline that threaten to negate battlefield advantage. One broad category is privacy attacks (such as model inversion) where an adversary can reverse engineer information from the model, such as the sensitive data used in its training. The ability to quantify the risk of model inversion attacks (MIAs) is not well studied, and there is a lack of automated developmental test and evaluation (DT&E) tools and metrics to quantify the effectiveness of privacy loss of the MIA. The current DT&E process is difficult because ML model inversions can be hard for a human to interpret, subjective when they are interpretable, and difficult to quantify in terms of inversion quality. Additionally, scaling the DT&E process is challenging due to many ML model architectures and data modalities that need to be assessed. In this work, we present a novel DT&E tool that quantifies the risk of data privacy loss from MIAs and introduces four adversarial risk dimensions to quantify privacy loss. Our DT&E pipeline combines inversion with vision language models (VLMs) to improve effectiveness while enabling scalable analysis. We demonstrate effectiveness using multiple MIA techniques and VLMs configured for zero-shot classification and image captioning. We benchmark the pipeline using several state-of-the-art MIAs in the computer vision domain with an image classification task that is typical in military applications. In general, our innovative pipeline extends the current model inversion DT&E capabilities by improving the effectiveness and scalability of the privacy loss analysis in an automated fashion.

Figures

Figures reproduced from arXiv: 2509.04214 by the authors.

Figure 1
Figure 1. An Automated Model Inversion DT&E Framework. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Pipeline Evaluation Metrics. accuracy indicates greater information leakage of the training data through the target model, which indicates a greater ability for an adversary to steal the target model. This metric, also known as the Knowledge Extraction Score [5], measures the extracted discriminative information about distinct classes. D. VLM Captioning: Reconstructed image captions are used in two ways for pipeline… view at source ↗
Figure 2
Figure 2. In Experiment 4, we use a vehicle classification dataset [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figures from the paper (5 more)
Figure 3
Figure 3. Figure 3: Metric Trends Across Image Counts and Architectures. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]
Figure 4
Figure 4. Figure 4: Weighted Composite Accuracy Loss Across Image Counts. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Representative Data Reconstructions for STL-10 Classes. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Different Model Inversion Attack Results. [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: VLM Comparison Across Model Architectures. [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 15 canonical work pages

  1. [22]

    Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment

    S. S. Ho, H. Liu, A. Suri, Z. Fu, S. Jha, and K. Chaudhuri, “Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment,” 2025. [Online]. Available: https://arxiv.org/abs/2505.03519

    work page Pith review arXiv 2025

  2. [1]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’15. Association for Computing Machinery, 2015, pp. 1322–1333. [Online]. Available: https://doi.org/10.1145/2810103.2813677

    arXiv 2015

  3. [2]

    Response Wide Shut: Surprising Observations in Basic Vision Language Model Capabilities

    S. Chandhok, O. Vantzos, E. Strack, and Y . Bitton, “Response Wide Shut: Surprising Observations in Basic Vision Language Model Capabilities,” 2024. [Online]. Available: https://arxiv.org/abs/2408.06721

    work page Pith review arXiv 2024

  4. [3]

    An Attack-Based Evaluation Method for Differentially Private Learning Against Model Inversion Attack,

    C. Park, D. Hong, and C. Seo, “An Attack-Based Evaluation Method for Differentially Private Learning Against Model Inversion Attack,” in IEEE Access , 2019. [Online]. Available: https://doi.org/10.1109/ACCESS.2019.2938759

    work page arXiv 2019

  5. [4]

    Checkpoint for bart-large after being trained on the MultiNLI (MNLI) dataset

    Meta, “Checkpoint for bart-large after being trained on the MultiNLI (MNLI) dataset.” https://huggingface.co/facebook/bart-large-mnli, 2025

    work page 2025

  6. [5]

    Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield But Also a Catalyst for Model Inversion Attacks,

    Z. He, C. Gui, A. Suri, C. Meehan, K. Chaudhuri, and S. Jha, “Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield But Also a Catalyst for Model Inversion Attacks,” in The Twelfth International Conference on Learning Representations (ICLR) , 2024. [Online]. Available: https://openreview.net/forum?id=V2zk3y5d2e

    work page 2024

  7. [6]

    Rethinking the inception architecture for computer vision,

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” in IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016. [Online]. Available: doi: 10.1109/CVPR.2016.308

    doi:10.1109/cvpr.2016.308 2016

  8. [7]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    arXiv 2014

Show all 22 references
  1. [9]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” arXiv preprint arXiv:1801.04381 , 2018

    2018 arXiv

  2. [10]

    Visualizing and understanding convolu- tional networks,

    M. D. Zeiler and R. Fergus, “Visualizing and understanding convolu- tional networks,” in European Conference on Computer Vision (ECCV) . Springer, 2014, pp. 818–833

    2014

  3. [11]

    The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks,

    Y . Zhang, Z. Chen, Z.-Y . Kuo, and J. Z. Wang, “The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 2447–2456

    2020

  4. [12]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever, “Learning transferable visual models from natural language supervision,” arXiv preprint arXiv:2103.00020 , 2021

    2021 arXiv

  5. [13]

    BLIP-2: bootstrapping language-image pre-training with frozen image encoders and large language models,

    J. Li, D. Li, S. Savarese, and S. Hoi, “BLIP-2: bootstrapping language-image pre-training with frozen image encoders and large language models,” in ICML’23: Proceedings of the 40th International Conference on Machine Learning , 2023. [Online]. Available: https://dl.acm.org/doi...

    2023

  6. [14]

    InstructBLIP: towards general- purpose vision-language models with instruction tuning,

    W. Dai, J. Li, D. Li, A. M. H. Tiong, J. Zhao, W. Wang, B. Li, P. Fung, and S. Hoi, “InstructBLIP: towards general- purpose vision-language models with instruction tuning,” in NIPS ’23: Proceedings of the 37th International Conference on Neural Information Processing System , ...

    2023

  7. [15]

    An analysis of single-layer networks in unsupervised feature learning,

    A. Coates, H. Lee, and A. Y . Ng, “An analysis of single-layer networks in unsupervised feature learning,” in Proceedings of the Fourteenth Inter- national Conference on Artificial Intelligence and Statistics (AISTATS) , vol. 15, 2011, pp. 215–223

    2011

  8. [16]

    ImageNet: A Large-Scale Hierarchical Image Database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “ImageNet: A Large-Scale Hierarchical Image Database,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2009, pp. 248–255

    2009

  9. [17]

    Military Vehicles Dataset,

    lab-v2, “Military Vehicles Dataset,” https://huggingface.co/datasets/lab- v2/military vehicles, 2023

    2023

  10. [18]

    Lucid library adapted for PyTorch,

    Lim Swee Kiat, “Lucid library adapted for PyTorch,” https://github.com/greentfrapp/lucent, 2021

    2021

  11. [19]

    Error detection and constraint recovery in hierarchical multi-label classification without prior knowledge,

    J. S. Kricheli, K. V o, A. Datta, S. Ozgur, and P. Shakarian, “Error detection and constraint recovery in hierarchical multi-label classification without prior knowledge,” in The 33rd ACM International Conference on Information and Knowledge Managemen (CIKM ’24) . Association ...

    2024

  12. [20]

    kNN Approach to Unbalanced Data Distributions: A Case Study involving Information Extraction,

    J. Zhang and I. Mani, “kNN Approach to Unbalanced Data Distributions: A Case Study involving Information Extraction,” in Proceedings of the ICML’2003 Workshop on Learning from Imbalanced Datasets , 2003. [Online]. Available: https://www.site.uottawa.ca/ nat/Workshop2003/jzhang.pdf

    2003

  13. [21]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” ArXiv, vol. abs/2010.11929, 2020. [Onli...

    2010 arXiv

  14. [23]

    BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generation,

    Salesforce, “BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generation,” https://huggingface.co/Salesforce/blip-image-captioning-base, 2022

    2022

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.