Pith. sign in

REVIEW 5 major objections 6 minor 46 references

MAIA: An Inpainting-Based Approach for Music Adversarial Attacks

T0 review · 5 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MAIA claims that regenerating a song's most decision-relevant segments with a generative inpainting model fools music classifiers more reliably and less audibly than noise-based attacks.

desk verdict Novel inpainting-based attack framework with an untested importance-analysis component and several fixable inconsistencies; deserves serious review but needs major revision. read the letter →

arxiv 2509.04980 v1 pith:QPVFRC55 submitted 2025-09-05 cs.SD cs.LGeess.AS

Yuxuan Liu , Peihong Zhang , Rui Sang , Zhixin Li , Shengchen Li This is my paper
classification cs.SDcs.LGeess.AS
keywords musicadversarialattackgenerativeinpaintingimportanceanalysisGrad-CAMcoversongidentificationgenreclassificationwhite-boxblack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces MAIA, an adversarial attack for music classifiers that first locates the audio segments a model leans on most and then regenerates those segments with a generative inpainting model, steering the regenerated content to flip or degrade the model's prediction. The claim is that this combination—importance-guided selection plus inpainting constrained to a realistic music manifold—outperforms gradient-based attacks (PGD, C&W) and black-box query attacks (NES, ZOO) in success rate while leaving smaller perceptual footprints on FAD, LSD, and human listening scores. If the claim holds, current cover-song identification and genre-classification systems are vulnerable to a semantically coherent, query-based attack that needs no gradient access.

What carries the argument

Importance-driven adversarial inpainting: a pipeline that (1) ranks audio segments by how much silencing them lowers the model's confidence in the true label, (2) selects the top segments as the attack region, and (3) reconstructs that region with a generative inpainting model (GACELA) whose output is iteratively optimized against the classifier. In the white-box variant the optimization uses sign-gradient updates confined to the mask followed by re-inpainting, which projects the perturbation back onto a realistic music manifold; in the black-box variant CMA-ES optimizes the inpainting latent code using only model queries.

What would settle it

Run MAIA with the same inpainting model and query budget but with randomly selected segments instead of importance-ranked ones; if attack success rate stays within the reported range, the coarse-to-fine importance analysis is not the mechanism behind the attack's effectiveness.

Watch

Extended reading notes

Core claim

On the paper's own evidence, MAIA selects the time-frequency regions the target model relies on most (via Grad-CAM in white-box settings, via a coarse-to-fine zero-masking query procedure in black-box settings), then reconstructs those exact regions with the GACELA inpainting model while optimizing the regenerated content against the classifier. The reported results beat all four baselines on both tasks: white-box attack success reaches 92.8% on CoverHunter (SHS100K) and 93.5% on IDS-NMR (GTZAN), black-box success reaches 80.1% and 77.9%, CoverHunter mAP drops from 0.845 to 0.488, IDS-NMR accuracy drops from 0.828 to 0.466, and the attacked audio scores lower FAD and LSD and higher listening

Load-bearing premise

The load-bearing premise is that the segments whose silencing drops the model's confidence most are also the best places to regenerate adversarially; the paper assumes this link but never tests it against random segment choice.

Editorial extensions

If this is right

  • Current cover-song identification and genre-classification models can be reliably fooled with local, music-coherent edits rather than whole-signal noise (Table 1: ASR up to 93.5% white-box, 80.1% black-box).
  • The black-box variant runs on model queries alone, so the same attack would apply to deployed MIR services where gradients and weights are hidden.
  • Because the disturbance is confined to regenerated segments, standard perceptual metrics and listening tests rate the adversarial audio as closer to the original than PGD/C&W and NES/ZOO outputs.
  • Defenses that detect additive noise or large global perturbations may miss this attack; robust training would need to account for semantically coherent region swaps.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The importance-selection step is the least tested link: an ablation swapping importance-guided masks for random masks of equal size would show whether selection or the inpainting constraint does the work. The paper does not run this test.
  • The generative-manifold projection suggests these attacks may transfer to other classifiers better than noise-based attacks, since the perturbation is a plausible musical event rather than input-specific residue—transferability is not evaluated.
  • If confirmed on a wider range of tasks (e.g., instrument recognition, mood classification), the coarse-to-fine query procedure could serve as a generic probe for locating decision-relevant structure in music models.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This manuscript presents MAIA, a two-stage adversarial attack for music. First, an importance analysis identifies critical audio segments: Grad-CAM in the white-box case, and a coarse-to-fine query-based zero-masking procedure in the black-box case (Sections 2.1.1 and 2.1.2). Second, those segments are re-synthesized with a pretrained GACELA inpainting model while optimizing an objective that combines reconstruction fidelity and attack loss (white-box) or CMA-ES over the latent code (black-box). Experiments on CoverHunter/SHS100K and IDS-NMR/GTZAN compare against PGD, C&W, NES, and ZOO using ASR, mAP/accuracy, FAD, LSD, and a subjective listening test. The paper claims MAIA outperforms all baselines in attack success and perceptual quality in both settings.

Significance. The potential contribution is real: a semantic, inpainting-based attack that preserves musical coherence and operates in query-based black-box settings would be a useful addition to the MIR robustness literature. The paper includes a listening test and uses an established inpainting model, which is a strength relative to purely noise-based attacks. However, the three core supports for the central claim are not yet established: (i) importance-driven selection is not isolated from the inpainting mechanism; (ii) the reported headline numbers are inconsistent; and (iii) key hyperparameters are tuned on the same data used for evaluation. If these are addressed, the framework could be an interesting contribution; in the current form, the evidence is suggestive but not conclusive.

major comments (5)
  1. [Section 2.1, Table 1] The paper never tests whether importance analysis is responsible for MAIA's performance. No ablation compares importance-selected masks to random masks of equal number/duration, or to a whole-signal mask, under the same inpainting pipeline. The black-box importance scores (Eqs. 4 and 6) measure sensitivity to zero-masking, but the attack uses semantic inpainting; the connection between 'silencing is important' and 'adversarial inpainting is effective' is asserted, not demonstrated. This is load-bearing because Section 4.5 attributes MAIA's advantage to 'importance-driven adversarial inpainting.' Please add ablations with random segment selection and, if possible, oracle/gradient-based selection.
  2. [Section 4.5 vs Table 1] The prose reports MAIA-WB ASRs of 93.5% (CSI) and 94.5% (MGC), while Table 1 reports 92.8% and 93.5%. The listening score in the text (4.0) is the CSI column value, not the MGC value (3.8). Please correct the inconsistency and state which numbers are final.
  3. [Sections 3.2.1 and 4.4] The grid search over λ_rec and λ_att selects values based on 'attack success rate and perceptual metrics' on the evaluation data, with no validation split. Since the same data produce both the chosen weights and the reported ASR/FAD/LSD/MOS, the comparison in Table 1 is at risk of overfitting. Please specify a validation split, report the chosen λ values, and list the remaining hyperparameters (top-p%, Tukey shape, coarse chunk duration, refinement rounds T, sub-chunks M, top-r segments, CMA-ES settings) for reproducibility.
  4. [Section 3.2.1, Algorithm 1] The reconstruction loss in Eq. (10) is written as L_rec(x_inp^(k), x), and Algorithm 1 line 5 uses d(x_inp,x), but d is never defined. The text says L_rec 'leverages the loss functions inherent to the inpainting model G_θ' without specifying which losses (e.g., L1, spectral, GAN discriminator). Without this, the objective and the reported trade-off between ASR and distortion are not reproducible.
  5. [Section 4.3, Table 1] The baselines PGD, C&W, NES, and ZOO are not described in terms of perturbation budgets, query counts, or mask constraints, so it is unclear whether the comparison is fair. For example, are the white-box baselines allowed the same number of iterations and the same restriction to a subset of time-frequency positions? Please report the exact budgets and implementation details; otherwise the superiority claim in Section 4.5 may reflect an unequal resource allocation rather than an algorithmic advantage.
minor comments (6)
  1. [Section 2.1.2] The text contains a duplicated sentence ('This ensures a continuous waveform after masking.') and a sentence fragment: 'We marked these high-intensity areas as the candidate adversarial zone, which we' is immediately followed by 'Initial Partition.will subsequently modify...'.
  2. [Equation (1)] The pooling variable (x,y) is not defined; x is also used for the input signal elsewhere. The normalization factor Z is described only as 'e.g., number of spatial locations'.
  3. [References, [16]] The text attributes a prosody-based attack (SMACK) to Yu et al., but reference [16] is 'SMACK: Decoupling source language details from verifier implementations' by Rakamarić and Emmi, which is a software-verification paper unrelated to audio attacks.
  4. [Section 3.1] The text says 'two state-of-the-art inpainting models—GACELA' but only one model is described; please correct the wording.
  5. [Section 4.5] The abbreviations MAIA-WB and MAIA-BB are used without being introduced in the text.
  6. [Section 4.2, Table 1] Listening-test details are incomplete: no number of trials, no confidence intervals, no inter-rater agreement, and no statistical significance tests. As a result, the MOS differences (e.g., 3.8 vs 4.0) cannot be interpreted. Table 1 also lacks standard deviations for the objective metrics.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MAIA's reported attack metrics are measured against external baselines; the untested importance-selection premise is a validity concern, not a circular one.

full rationale

The paper's pipeline (importance analysis in Section 2.1, adversarial inpainting in Section 3, evaluation in Section 4) does not derive any headline quantity from a fitted constant or from a self-citation. The importance masks are computed either by Grad-CAM (Eqs. 1-2) or by zero-masking loss differences (Eqs. 4 and 6), and the attack then optimizes an inpainting-based loss (Eq. 10) and reports measured ASR, mAP/accuracy, FAD, LSD, and MOS. No equation reduces to its own input: the zero-masking importance score is not the same operation as the inpainting attack, and the attack success is not defined as the importance score. The hyperparameters lambda_rec and lambda_att are grid-searched 'based on attack success rate and perceptual metrics' (Sections 3.2.1 and 4.4), which is a validation/leakage risk because no held-out split is stated, but the reported ASR is a measured outcome rather than a renamed parameter; the lambdas do not by construction force the ASR values. The paper contains no load-bearing self-citations: references such as GACELA, Grad-CAM, and CMA-ES are independent external works. The main weakness is the untested importance assumption (no ablation comparing importance-selected masks against random masks), but that is a missing ablation / premise-support issue, not circularity. Thus no circular step is exhibited, and the appropriate score is 0.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The ledger is dominated by tuning knobs and untested domain assumptions rather than invented entities. The most consequential entries are the silencing-saliency proxy (axiom 1) and the assumption that adversarially re-inpainted audio stays on the musical manifold (axiom 2); both carry the method's claimed advantages and neither is ablated. Several free parameters are never reported (top-p threshold, refinement depth, CMA-ES configuration, chosen lambdas), which is also a reproducibility problem. No new physical or model-level entities are introduced, so the invented-entities ledger is empty.

free parameters (6)
  • lambda_rec, lambda_att = not reported (grid searched over {0.5, 1.0, 2.0})
    Trade-off weights between reconstruction fidelity and attack strength (Section 3.2.1, Section 4.4); tuned by grid search on ASR and perceptual metrics with no stated validation split, and the chosen values are never given.
  • Tukey window shape parameter = 0.1
    Hand-chosen smoothing taper for the zero-masking procedure (Section 2.1.2); no sensitivity analysis.
  • Coarse chunk duration = 0.5 s
    Chosen initial segmentation for the black-box importance analysis (Section 2.1.2); no justification or sensitivity analysis.
  • Top-p% of time-frequency bins (white-box mask) = unspecified
    The white-box selection threshold for marking candidate adversarial zones is never quantified (Section 2.1.1); the passage breaks off mid-sentence.
  • Refinement rounds T, sub-chunks M, top-r segments = unspecified
    Control the black-box importance search depth and how many segments get inpainted (Section 2.1.2); no values given, and query-budget allocation between importance analysis and CMA-ES attack is undefined.
  • CMA-ES configuration = unspecified
    Latent dimension, population size, and iteration count for the black-box optimization (Section 3.2.2) are unstated, although the query budget is capped at 1000 (Section 4.4).
assumptions (6)
  • domain assumption Silencing-importance (loss drop when a segment is muted) is a valid proxy for where adversarial modification will be most effective.
    Core premise of the importance analysis (Section 2.1); never validated, e.g., against random segment selection.
  • domain assumption GACELA's inpaintings of the masked region remain musically coherent when the region is adversarially perturbed and repeatedly re-inpainted.
    The whole perceptual-quality argument rests on the inpainting prior dominating the adversarial updates (Section 3.2, Algorithm 1).
  • domain assumption Grad-CAM heatmaps over mel-spectrogram time-frequency bins correspond to modifiable, musically meaningful audio regions.
    Adaptation of an image-domain saliency tool to music (Section 2.1.1); no evidence that top heatmap bins map to effective attack locations.
  • domain assumption CoverHunter can be treated as a classifier with a true label y and a scalar loss L(M(x), y) for untargeted attack.
    Cover song identification is a retrieval task (query-to-database matching), and the paper never defines y, the loss, or 'misclassification' for it (Section 4.1.1).
  • domain assumption CMA-ES in GACELA's latent space can find effective perturbations within a 1000-query budget.
    Central to the black-box attack (Section 3.2.2); no evidence that the latent space is well-behaved for optimization, and the latent dimension is unspecified.
  • standard math Standard optimization and statistical tools (gradient descent with sign updates, CMA-ES, MOS listening tests) work as assumed.
    Background methods taken from the literature (Sections 3.2 and 4.2).

how reviews work

0 comments
Cite this review

Pith. "Pith review of MAIA: An Inpainting-Based Approach for Music Adversarial Attacks." pith.science (2026). https://pith.science/paper/QPVFRC55

@misc{pith2026250904980,
  author       = {Pith},
  title        = {Pith review of: MAIA: An Inpainting-Based Approach for Music Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QPVFRC55}},
  note         = {Machine review of arXiv:2509.04980}
}
read the original abstract

Music adversarial attacks have garnered significant interest in the field of Music Information Retrieval (MIR). In this paper, we present Music Adversarial Inpainting Attack (MAIA), a novel adversarial attack framework that supports both white-box and black-box attack scenarios. MAIA begins with an importance analysis to identify critical audio segments, which are then targeted for modification. Utilizing generative inpainting models, these segments are reconstructed with guidance from the output of the attacked model, ensuring subtle and effective adversarial perturbations. We evaluate MAIA on multiple MIR tasks, demonstrating high attack success rates in both white-box and black-box settings while maintaining minimal perceptual distortion. Additionally, subjective listening tests confirm the high audio fidelity of the adversarial samples. Our findings highlight vulnerabilities in current MIR systems and emphasize the need for more robust and secure models.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

46 extracted references · 44 canonical work pages

  1. [16]

    Byte- cover: Cover song identification via multi-loss train- ing,

    X. Du, Z. Yu, B. Zhu, X. Chen, and Z. Ma, “Byte- cover: Cover song identification via multi-loss train- ing,” inICASSP 2021-2021 IEEE International Con- ference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021, pp. 551–555

    work page 2021

  2. [1]

    MAIA: An Inpainting-Based Approach for Music Adversarial Attacks

    INTRODUCTION Music Information Retrieval (MIR) has evolved into a mul- tifaceted research domain, underpinning various applica- tions such as applications that range from genre classifi- cation [1] and instrument recognition [2] to cover song identification [3–5] and recommendation systems [6, 7]. As MIR algorithms become increasingly prevalent in both co...

    work page 2025

  3. [2]

    We design a black-box importance analysis method that identifies influential music segments through a coarse-to-fine query-based approach, enabling effec- tive adversarial attacks without requiring gradient access

    work page

  4. [3]

    This framework reconstructs critical audio segments with adversarial perturbations, ensuring musical coher- ence while effectively misleading target models

    We propose a novel adversarial attack framework, MAIA, based on importance-driven inpainting. This framework reconstructs critical audio segments with adversarial perturbations, ensuring musical coher- ence while effectively misleading target models

    work page

  5. [4]

    EXPERIMENTS In this section, we evaluate our proposedMusic Adver- sarial Inpainting Attack (MAIA)across two representative MIR tasks:Cover Song Identification(CSI) andMusic Genre Classification(MGC). Our experiments assess both the white-box and black-box variants of MAIA, comparing them against common baselines by evaluating their perfor- mance using bot...

    work page

  6. [5]

    We perform extensive objective and subjective eval- uations to comprehensively benchmark MAIA at- tack success rate and perceptual quality across MIR tasks

    work page

  7. [6]

    In practical terms, modi- fying only the most influential time-frequency regions can reduce the extent of injected noise, thereby decreasing per- ceptual artifacts

    MUSIC ADVERSARIAL INPAINTING ATTACK FRAMEWORK 2.1 Importance Analysis A key objective of adversarial attacks in Music Informa- tion Retrieval (MIR) is to introduce minimal yet effective perturbations that are hard for both detection algorithms and human listeners to notice. In practical terms, modi- fying only the most influential time-frequency regions c...

    work page

  8. [7]

    ADVERSARIAL INPAINTING After identifying the most influential segments for the tar- get attacked modelM, we proceed to adversarially in- paint the top-ranked segments. Our goal is to recon- struct these critical regions in such a way that the resulting track both degrades the prediction confidence ofMand remains perceptually coherent to the human ear. In ...

    work page

Show all 46 references
  1. [8]

    We then process each segment sequentially, prioritizing those with the highest impact

    Importance-Guided Segment ProcessingBased on the importance scores obtained from prior analysis, we sort the music segments in descending order of their sig- nificance to the target attacked model prediction. We then process each segment sequentially, prioritizing those with t...

  2. [9]

    Adversarial Inpainting for Each SegmentFor each selected segment, we perform the following steps: 1.InitializationUtilize the pretrained music inpaint- ing modelG θ to perform standard inpainting on the masked important regionm, generating the initial inpainted audio: x(0) inp...

  3. [10]

    Query-efficient adversarial attack with low perturbation against end-to-end speech recognition systems,

    S. Wang, Z. Zhang, G. Zhu, X. Zhang, Y . Zhou, and J. Huang, “Query-efficient adversarial attack with low perturbation against end-to-end speech recognition systems,”IEEE Transactions on Information Forensics and Security, vol. 18, pp. 351–364, 2022

    2022

  4. [11]

    CONCLUSIONS We have presented MAIA, a Music Adversarial Inpaint- ing Attack framework that employs importance-driven seg- ment selection and inpainting-based perturbations in both white-box and black-box settings. By focusing on the most influential regions, MAIA achieves high...

  5. [12]

    BG2024027), the Suzhou Science and Technol- ogy Development Planning Programme (Gusu Innovation and Entrepreneurship Leading Talents Program, Grant No

    ACKNOWLEDGEMENTS This work was supported by the Jiangsu Science and Technology Programme (Major Special Programme, Grant No. BG2024027), the Suzhou Science and Technol- ogy Development Planning Programme (Gusu Innovation and Entrepreneurship Leading Talents Program, Grant No. ...

  6. [13]

    Low-resource music genre classification with cross- modal neural model reprogramming,

    Y .-N. Hung, C.-H. H. Yang, P.-Y . Chen, and A. Lerch, “Low-resource music genre classification with cross- modal neural model reprogramming,” inICASSP 2023- 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2023, pp. 1–5

    2023

  7. [14]

    Music instrument recogni- tion using deep convolutional neural networks,

    A. Solanki and S. Pandey, “Music instrument recogni- tion using deep convolutional neural networks,”Inter- national Journal of Information Technology, vol. 14, no. 3, pp. 1659–1668, 2022

    2022

  8. [15]

    This inno- vative integration of human perception provides a unique perspective, although its dependence on subjective evalua- tions could limit generalizability

    introduced a perception-aware attack framework that reverse-engineers human perception using regression anal- ysis, optimizing perturbations to minimize perceived devi- ations while maintaining attack effectiveness. This inno- vative integration of human perception provides a ...

    2025 arXiv

  9. [17]

    Byte- cover2: Towards dimensionality reduction of latent embedding for efficient cover song identification,

    X. Du, K. Chen, Z. Wang, B. Zhu, and Z. Ma, “Byte- cover2: Towards dimensionality reduction of latent embedding for efficient cover song identification,” in ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2022, pp. 616–620

    2022

  10. [18]

    Bytecover3: Accurate cover song identifica- tion on short queries,

    X. Du, Z. Wang, X. Liang, H. Liang, B. Zhu, and Z. Ma, “Bytecover3: Accurate cover song identifica- tion on short queries,” inICASSP 2023-2023 IEEE In- ternational Conference on Acoustics, Speech and Sig- nal Processing (ICASSP). IEEE, 2023, pp. 1–5

    2023

  11. [19]

    An emotional recommender system for music,

    V . Moscato, A. Picariello, and G. Sperli, “An emotional recommender system for music,”IEEE Intelligent Sys- tems, vol. 36, no. 5, pp. 57–68, 2020

    2020

  12. [20]

    Explainability in mu- sic recommender systems,

    D. Afchar, A. Melchiorre, M. Schedl, R. Hennequin, E. Epure, and M. Moussallam, “Explainability in mu- sic recommender systems,”AI Magazine, vol. 43, no. 2, pp. 190–208, 2022

    2022

  13. [21]

    On end-to-end white-box adversarial attacks in music information re- trieval

    K. Prinz, A. Flexer, and G. Widmer, “On end-to-end white-box adversarial attacks in music information re- trieval.”Transactions of the International Society for Music Information Retrieval, vol. 4, no. 1, pp. 93–105, 2021

    2021

  14. [22]

    Adver- sarial attacks on copyright detection systems,

    P. Saadatpanah, A. Shafahi, and T. Goldstein, “Adver- sarial attacks on copyright detection systems,” inInter- national Conference on Machine Learning. PMLR, 2020, pp. 8307–8315

    2020

  15. [23]

    Devil’s whisper: A general approach for physical adversarial attacks against com- mercial black-box speech recognition devices,

    Y . Chen, X. Yuan, J. Zhang, Y . Zhao, S. Zhang, K. Chen, and X. Wang, “Devil’s whisper: A general approach for physical adversarial attacks against com- mercial black-box speech recognition devices,” in29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 2667–2684

    2020

  16. [24]

    Towards evaluating the ro- bustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the ro- bustness of neural networks,” in2017 IEEE Symposium on Security and Privacy (SP). IEEE, 2017, pp. 39–57

    2017

  17. [25]

    Mind the box:l_1-apgd for sparse adversarial attacks on image classifiers,

    F. Croce and M. Hein, “Mind the box:l_1-apgd for sparse adversarial attacks on image classifiers,” inIn- ternational Conference on Machine Learning. PMLR, 2021, pp. 2201–2211

    2021

  18. [26]

    Deep learning and music adversaries,

    C. Kereliuk, B. L. Sturm, and J. Larsen, “Deep learning and music adversaries,”IEEE Transactions on Multi- media, vol. 17, no. 11, pp. 2059–2071, 2015

  19. [27]

    Perception-aware attack: Creating adversarial music via reverse-engineering human perception,

    R. Duan, Z. Qu, S. Zhao, L. Ding, Y . Liu, and Z. Lu, “Perception-aware attack: Creating adversarial music via reverse-engineering human perception,” inPro- ceedings of the 2022 ACM SIGSAC conference on com- puter and communications security, 2022, pp. 905– 919

    2022

  20. [28]

    SMACK: Decoupling source language details from verifier implementa- tions,

    Z. Rakamari ´c and M. Emmi, “SMACK: Decoupling source language details from verifier implementa- tions,” inComputer Aided Verification: 26th Interna- tional Conference, CAV 2014, Held as Part of the Vi- enna Summer of Logic, VSL 2014, Vienna, Austria, July 18-22, 2014. Proceed...

    2014

  21. [29]

    Frequency-driven imperceptible adversarial attack on semantic similarity,

    C. Luo, Q. Lin, W. Xie, B. Wu, J. Xie, and L. Shen, “Frequency-driven imperceptible adversarial attack on semantic similarity,” in2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE Computer Society, 2022, pp. 15 294–15 303

    2022

  22. [30]

    Ex- plainable artificial intelligence (xai): What we know and what is left to attain trustworthy artificial intelli- gence,

    S. Ali, T. Abuhmed, S. El-Sappagh, K. Muhammad, J. M. Alonso-Moral, R. Confalonieri, R. Guidotti, J. Del Ser, N. Díaz-Rodríguez, and F. Herrera, “Ex- plainable artificial intelligence (xai): What we know and what is left to attain trustworthy artificial intelli- gence,”Informa...

    2023

  23. [31]

    Learning deep features for discriminative localization,

    B. Zhou, A. Khosla, A. Lapedriza, A. Oliva, and A. Torralba, “Learning deep features for discriminative localization,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 2921–2929

    2016

  24. [32]

    Network in network,

    M. Lin, “Network in network,”arXiv preprint arXiv:1312.4400, 2013

    2013 arXiv

  25. [33]

    Grad-cam: Visual explana- tions from deep networks via gradient-based localiza- tion,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explana- tions from deep networks via gradient-based localiza- tion,” inProceedings of the IEEE International Confer- ence on Computer Vision (ICCV), 2017, pp. 618–626

    2017

  26. [34]

    Is ob- ject localization for free?-weakly-supervised learning with convolutional neural networks,

    M. Oquab, L. Bottou, I. Laptev, and J. Sivic, “Is ob- ject localization for free?-weakly-supervised learning with convolutional neural networks,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2015, pp. 685–694

    2015

  27. [35]

    Pytorch library for cam methods,

    J. Gildenblat and contributors, “Pytorch library for cam methods,” https://github.com/jacobgil/ pytorch-grad-cam, 2021

    2021

  28. [36]

    GACELA: A generative adversarial con- text encoder for long audio inpainting of music,

    A. Marafioti, P. Majdak, N. Holighaus, and N. Per- raudin, “GACELA: A generative adversarial con- text encoder for long audio inpainting of music,” IEEE Journal of Selected Topics in Signal Processing, vol. 15, no. 1, pp. 120–131, 2020

    2020

  29. [37]

    A comparative study of large-scale variants of cma-es,

    K. Varelas, A. Auger, D. Brockhoff, N. Hansen, O. A. ElHara, Y . Semet, R. Kassab, and F. Barbaresco, “A comparative study of large-scale variants of cma-es,” in Parallel Problem Solving from Nature–PPSN XV: 15th International Conference, Coimbra, Portugal, Septem- ber 8–12, 2...

    2018

  30. [38]

    Coverhunter: Cover song identification with refined attention and alignments,

    F. Liu, D. Tuo, Y . Xu, and X. Han, “Coverhunter: Cover song identification with refined attention and alignments,” in2023 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 2023, pp. 1080–1085

    2023

  31. [39]

    Key-invariant convolu- tional neural network toward efficient cover song iden- tification,

    X. Xu, X. Chen, and D. Yang, “Key-invariant convolu- tional neural network toward efficient cover song iden- tification,” in2018 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 2018, pp. 1–6

    2018

  32. [40]

    The GTZAN Dataset: Its contents, its faults, their effects on evaluation, and its future use,

    B. L. Sturm, “The GTZAN Dataset: Its contents, its faults, their effects on evaluation, and its future use,” arXiv preprint arXiv:1306.1461, 2013

    2013 arXiv

  33. [41]

    MERT: Acoustic music understanding model with large-scale self-supervised training,

    Y . Li, R. Yuan, G. Zhang, Y . Ma, X. Chen, H. Yin, C. Xiao, C. Lin, A. Ragni, E. Benetos, N. Gyenge, R. Dannenberg, R. Liu, W. Chen, G. Xia, Y . Shi, W. Huang, Z. Wang, Y . Guo, and J. Fu, “MERT: Acoustic music understanding model with large-scale self-supervised training,” i...

    2024

  34. [42]

    Fréchet Audio Distance: A reference-free metric for evaluating music enhancement algorithms,

    K. Kilgour, M. Zuluaga, D. Roblek, and M. Shar- ifi, “Fréchet Audio Distance: A reference-free metric for evaluating music enhancement algorithms,” inPro- ceedings of Interspeech, 2019

    2019

  35. [43]

    Distance measures for speech processing,

    A. Gray and J. Markel, “Distance measures for speech processing,”IEEE Transactions on Acoustics, Speech, and Signal Processing, vol. 24, no. 5, pp. 380–391, 1976

    1976

  36. [44]

    Universal adversarial at- tack via enhanced projected gradient descent,

    Y . Deng and L. J. Karam, “Universal adversarial at- tack via enhanced projected gradient descent,” in2020 IEEE International Conference on Image Processing (ICIP). IEEE, 2020, pp. 1241–1245

    2020

  37. [45]

    Natural evolution strate- gies,

    D. Wierstra, T. Schaul, T. Glasmachers, Y . Sun, J. Pe- ters, and J. Schmidhuber, “Natural evolution strate- gies,”The Journal of Machine Learning Research, vol. 15, no. 1, pp. 949–980, 2014

    2014

  38. [46]

    Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substitute models,

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substitute models,” inProceedings of the 10th ACM workshop on artificial intelligence and security, 2017, pp. 15–26

    2017

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.