Pith. sign in

REVIEW 5 major objections 4 minor 21 references

Robust DDoS-Attack Classification with 3D CNNs Against Adversarial Methods

T0 review · 5 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Trained on a mix of clean, FGSM, and PGD samples, a 3D CNN keeps DDoS adversarial accuracy above 93 percent while clean accuracy stays near 99 percent.

desk verdict A decent empirical paper whose abstract oversells: the robustness evidence covers only the two trained attacks at one epsilon, but the frame-wise analysis and honest limitations make it worth referee time. read the letter →

arxiv 2509.10543 v1 pith:WE3ZUGTJ submitted 2025-09-07 cs.CR cs.AIcs.LG

Landon Bragg , Nathan Dorsey , Josh Prior , John Ajit , Ben Kim , Nate Willis , Pablo Rivas This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords DDoSdetection3DCNNadversarialtraininghiveplotsFGSMPGDnetworktrafficclassificationspatiotemporalrepresentationlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that DDoS attacks can be detected robustly by treating network traffic as a short video: eight time-indexed hive-plot images, a visualization that places network flows on three axes, fed to a 3D convolutional neural network. A model trained on clean traffic alone classifies perfectly but collapses to roughly 50–55 percent accuracy under FGSM and PGD perturbations. Retraining on a minibatch that mixes clean samples, spatial augmentations, and FGSM/PGD adversarial examples lifts adversarial accuracy to over 93 percent while clean accuracy stays near 99 percent. The paper also claims that frames 3 and 4 already carry strong attack signals, so accurate early-alert detection is possible before an attack saturates the network.

What carries the argument

The load-bearing mechanism is the 3D convolution over eight-frame hive-plot sequences: each sequence is a 4D tensor (batch, channels, depth, height, width), and a 3D kernel slides over depth as well as space, so the model learns spatiotemporal patterns such as the onset and burst rhythm of an attack rather than treating frames independently. The second component is adversarial training as a saddle-point problem: the inner maximizer generates FGSM and PGD perturbations, the outer minimizer adjusts weights, and the minibatch composition balances clean, augmented, and attacked examples. The third is frame-wise evaluation, which replicates a single frame across depth to isolate the predictive information in each time step.

What would settle it

Retrain or fine-tune the adversarially trained model and evaluate it on a holdout of C&W or black-box attacks, or on FGSM/PGD with epsilons larger than the training values; if accuracy falls to the 50–55 percent range under any of these, the paper's claim of broad adversarial robustness would be refuted for that setting.

Watch

Extended reading notes

Core claim

The central claim is that a 3D CNN operating on eight-frame sequences of hive-plot traffic visualizations can be made robust to adversarial perturbation without giving up clean-sample performance. The evidence is a comparison between two training regimes on the same benchmark data: clean-only training reaches 100 percent accuracy on clean inputs but falls to 50 percent on augmented inputs and about 55 percent on FGSM- and PGD-perturbed inputs; adversarial training, with minibatches composed of 57 percent FGSM (epsilon 1.19), 23 percent PGD (epsilon 1.225, 40 steps), 12 percent augmented, and 8 percent clean samples, reaches 99 percent clean accuracy, 98.5 percent on augmented and PGD inputs, and 93.25 percent on FGSM inputs. Frame-wise evaluation shows accuracy rising with time and peaking in frames 3–5, which the authors interpret as enabling early detection with a latency reduction of nearly 60 percent when a confidence threshold is applied at frame 3.

Load-bearing premise

The reported robustness is measured on the same perturbation kinds and magnitudes used to compose the training batches; if a deployed adversary uses a different attack type or budget, the above-93-percent accuracy is not established by this study.

Editorial extensions

If this is right

  • A model trained on the mixed minibatch sustains accuracy above 93 percent on FGSM- and PGD-perturbed hive-plot sequences while clean accuracy remains at 99 percent.
  • Frame-wise analysis shows frames 3–5 carry the strongest predictive signal, so an alert threshold at frame 3 can detect over 97 percent of attacks while cutting average detection latency by roughly 60 percent.
  • Clean-only training is insufficient for deployment: the same architecture collapses to 50–55 percent accuracy on augmented and adversarially perturbed inputs despite perfect clean accuracy.
  • The paper's operational cost model estimates that the daily expected loss from false positives and missed attacks falls from about $113 to about $7.40 when the adversarially trained model replaces the clean-only model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the robustness figure is tied to the training minibatch's attack types and epsilons, a natural next experiment is to probe the same model with black-box transfer attacks, C&W, or adaptive attacks at different budgets; the paper itself lists these as untested.
  • The early-exit result suggests the network relies mostly on burst-onset structure by frame 3; a targeted attack that delays or reorders frames could test whether that temporal dependence is a genuine vulnerability or a benign prior.
  • If the visual encoding is the source of the robustness, the same mixed-minibatch recipe should transfer to other flow visualizations, such as low-dimensional embeddings of traffic features, so the approach could generalize beyond hive plots to settings where raw packet data are available.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes a DDoS-attack classifier that represents network traffic as 8-frame sequences of hive-plot images and classifies them with a 3D CNN. It compares two training regimes: clean-only training and adversarial training with a minibatch composed of 8% clean, 12% spatially augmented, 23% PGD-perturbed, and 57% FGSM-perturbed samples (Section 4.2). The authors report that clean-trained models achieve 100% accuracy on clean inputs but drop to 50–55% accuracy on augmented and adversarially perturbed inputs (Table 1), while adversarial training maintains accuracy above 93% across all tested conditions and near 99% on clean inputs (Table 2). They also perform frame-wise evaluation by replicating each single frame across the depth dimension, reporting that later frames, especially t3–t5, are most informative, and they propose an early-exit mechanism. The abstract's central claim is that the method 'lifts adversarial accuracy from 50–55% to over 93% while maintaining clean-sample performance.'

Significance. If the robustness claim held at the advertised level of generality, the paper would be a constructive empirical contribution to adversarial robustness in network-traffic classification: the combination of hive-plot spatiotemporal encoding, 3D CNNs, and mixed adversarial training is reasonable, the authors provide code, and the Limitations section is candid. However, the current evidence is considerably narrower than the abstract's claim. The 93%+ adversarial accuracy is demonstrated only for the exact FGSM and PGD attacks and the exact epsilon values used to construct the training minibatch; the 'gradient-free' attacks are data augmentations rather than adversarial methods; the clean-only baseline is an all-positive classifier; and the frame-wise evaluation discards temporal structure. These gaps are fixable with additional experiments and careful rephrasing, so the contribution could become solid, but as written the central claim overstates what is established.

major comments (5)
  1. [§4.2 and abstract] The headline claim that the method 'lifts adversarial accuracy from 50–55% to over 93%' is only supported for FGSM with ε=1.19 and PGD with ε=1.225, which are the same perturbation types and magnitudes that compose the adversarial-training minibatch (57% FGSM, 23% PGD; Section 4.2). The paper's own Limitations (§7) concedes that black-box, C&W, and adaptive attacks were not explored. Consequently, the abstract's phrase 'adversarial methods' overstates the generality of the result. Please either restrict the claim to the tested perturbation types and magnitudes, or add experiments that vary epsilon, evaluate transfer-based or black-box attacks, or include C&W/adaptive attacks.
  2. [Table 1] The clean-trained baseline in Table 1 is degenerate: for augmented, PGD, and FGSM conditions it reports recall 1.00 with precision 0.50–0.52 and accuracy 0.50–0.55, which is exactly the behavior of a classifier that predicts every sample as positive. The claimed 'lift from 50–55%' is therefore measured against a trivial all-positive baseline, not against a clean-trained model that genuinely discriminates between normal and attack traffic. Please replace this baseline with a clean-trained model that achieves nontrivial classification (e.g., via class-balanced training or a different decision threshold) and report balanced accuracy or F1 in addition to accuracy for all conditions.
  3. [§3, 'Gradient-Free Attacks'] Rotations, shear, zoom, and Gaussian noise are stochastic data augmentations, not adversarial or black-box attacks: they do not optimize any loss and are not crafted by an adversary. Labeling them 'gradient-free black-box attacks' in Section 3 conflates robustness to natural distribution shift with robustness to adversarial manipulation and inflates the significance of the augmented condition in Tables 2 and 3. Please rename this category and, if the paper claims gradient-free adversarial robustness, add a genuine black-box attack such as a transfer-based attack or a query-based attack.
  4. [§4.1, frame-wise evaluation] The frame-wise evaluation 'treats a single frame as a stand-alone input by repeating the single image across the depth dimension' to match the 3D CNN input shape. A temporally constant input cannot exercise the temporal modeling that distinguishes a 3D CNN from a 2D CNN, so Table 3 does not isolate the temporal informativeness of individual frames, and the abstract's statement that 'frames 3–4 offer strong predictive signals' is not supported as a property of the sequence model. Please validate this protocol against a 2D frame-level baseline or use genuine sequence truncation (e.g., the first k frames) to measure early-detection performance.
  5. [§4.2 and Tables 1–3] All quantitative results are point estimates from a single training run. Adversarial training with a random minibatch composition and stochastic augmentations is inherently run-to-run variable, so the differences between 0.9325 and 0.985 in Table 2 may not be statistically meaningful. Please report the mean and standard deviation over at least 3–5 seeds, or otherwise characterize the variance; without this, the precision of the reported robustness numbers cannot be assessed.
minor comments (4)
  1. [§2] In the sentence 'captured temporal correlations to better detection over traditional classification methods', 'to better detection over' should be 'to better detection than'.
  2. [§4.1] The dataset description gives image-level counts (16,000 images, 8,000 clean and 8,000 attack) but does not state how many 8-frame sequences these comprise or how the train/validation split was created. Please specify the number of sequences in each split so that the sample sizes behind the reported metrics are clear.
  3. [§6] The statement that 'qualitative analysis of confusion matrices suggests that spatial augmentations account for approximately 60% of the improvement' is unsupported because no confusion matrices or quantitative decomposition are presented. Please either show the analysis or remove the claim.
  4. [Fig. 1 and §3] The architecture description mentions three convolutional blocks and a fully connected layer but does not provide kernel sizes, channel counts, feature-map dimensions, or the exact input shape; please include these details for reproducibility.

Circularity Check

1 steps flagged · score 6.0 of 10

The central robustness result is measured on the same FGSM/PGD attacks and epsilon values used to compose the training minibatch, so the abstract's 'adversarial methods' claim is an in-distribution report rather than an independent prediction.

  1. fitted input called prediction [Section 4.2 (Experimental details) and Tables 1-2, supporting the abstract claim]
    "Specifically, 8% of the minibatch contained clean data, 12% consisted of randomly augmented examples (with random rotation up to ±18◦, shear up to ±11◦, zoom between 0.75 and 1.0, and Gaussian noise with standard deviation σ = 0.17), 23% were generated using the PGD attack with a step size α = 1.1, perturbation bound ε = 1.225, and 40 steps, and 57% were generated via FGSM with perturbation ε = 1.19."

    The headline claim 'lifts adversarial accuracy from 50–55% to over 93%' is evaluated on exactly the same perturbation generators and magnitudes used to build every training minibatch. Table 2 reports FGSM accuracy 0.9325 and PGD accuracy 0.985 on attacks with the identical ε values (FGSM ε=1.19; PGD ε=1.225, α=1.1, 40 steps) and the same augmentation parameters used at train time. Thus the result is an in-distribution evaluation of the training perturbation distribution, not a prediction of robustness to 'adversarial methods' generally. The 'lift' is relative to a clean-trained baseline that is near chance (precision 0.52, recall 1.00), and the paper's own Limitations section concedes black-box, C&W, and adaptive attacks were not tested.

full rationale

The load-bearing claim is the abstract's 'lifts adversarial accuracy from 50–55% to over 93%', supported by Table 2. The training protocol in §4.2 constructs each minibatch from 57% FGSM (ε=1.19), 23% PGD (ε=1.225, α=1.1, 40 steps), 12% augmented, and 8% clean data. The evaluation in Table 2 tests exactly FGSM and PGD with the same parameters and the same augmentation configuration. Therefore the 'adversarial accuracy' is a report on the training perturbation distribution; the 93.25% FGSM and 98.5% PGD numbers are in-distribution accuracy, not robustness to unseen adversarial methods. This is the specific reduction: the test input distribution equals the training input distribution by construction. The paper's own §7 Limitations concedes that black-box, C&W, and adaptive attacks were not explored, so the broad title and abstract claim overstates the evidence. The self-citations [6] and [14] are not separately scored as circular here: they supply the hive-plot encoding and the adversarial-training formulation, but the accuracy measurements are made in this paper. The frame-wise and clean results (e.g., 99% clean accuracy; frames 3-4 signal) have some independent content, but they are not the central 'over 93%' adversarial claim. Score 6 reflects partial circularity: the central claim reduces to a train/test distribution match, while some secondary results remain independently measured.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central claims rest on several hand-selected hyperparameters (minibatch composition, attack strengths, augmentation ranges) and on assumptions about the dataset, the hive-plot encoding, and the threat model. The robustness numbers are not parameter-free predictions; they depend on choices made in Section 4.2.

free parameters (8)
  • Adversarial minibatch composition = 8% clean, 12% augmented, 23% PGD, 57% FGSM
    Hand-selected mix; determines how much the model is exposed to each perturbation class and is central to the robustness gains (Section 4.2).
  • FGSM epsilon = 1.19
    Hand-selected attack magnitude used in both training and evaluation (Section 4.2).
  • PGD epsilon = 1.225
    Hand-selected perturbation bound for PGD (Section 4.2).
  • PGD step size = 1.1
    Hand-selected PGD step size (Section 4.2).
  • PGD steps = 40
    Hand-selected iteration count (Section 4.2).
  • Augmentation parameters = rotation <= +/-18 deg, shear <= +/-11 deg, zoom 0.75-1.0, Gaussian noise sigma=0.17
    Hand-selected ranges applied to 12% of each minibatch (Section 4.2).
  • Early-exit confidence threshold = 0.9
    Threshold used in the latency analysis to trigger early prediction at frame t3 (Section 6).
  • Operational cost constants = c_FP=$0.08, c_FN=$12.70
    Invented unit costs used in the daily-cost model; no source or uncertainty given (Section 6).
assumptions (5)
  • domain assumption The Marist College dataset of 16,000 hive-plot images is correctly labeled and representative of DDoS and normal traffic.
    The paper uses this benchmark without external validation of label quality or coverage (Section 4.1).
  • domain assumption Hive-plot visual encoding preserves the information needed to distinguish DDoS from normal traffic.
    The method relies on this encoding from prior work [14] without an information-theoretic justification (Section 3).
  • domain assumption FGSM, PGD, and the listed spatial augmentations represent the relevant class of adversarial methods for DDoS classifiers.
    The threat model is restricted to these attacks; the paper acknowledges this in Section 7 but the central robustness claim depends on this assumption.
  • ad hoc to paper Repeating a single frame across the depth dimension yields a valid input for evaluating frame-wise predictive power.
    This evaluation procedure is introduced in Section 4.1 and is not justified; the model was trained on full sequences, not replicated frames.
  • standard math 3D convolution, backpropagation, and AdamW optimization as implemented in PyTorch are correct and standard.
    Appendix equations (1)-(3) are standard; the paper does not derive them and relies on standard implementations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust DDoS-Attack Classification with 3D CNNs Against Adversarial Methods." pith.science (2026). https://pith.science/paper/WE3ZUGTJ

@misc{pith2026250910543,
  author       = {Pith},
  title        = {Pith review of: Robust DDoS-Attack Classification with 3D CNNs Against Adversarial Methods},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WE3ZUGTJ}},
  note         = {Machine review of arXiv:2509.10543}
}
read the original abstract

Distributed Denial-of-Service (DDoS) attacks remain a serious threat to online infrastructure, often bypassing detection by altering traffic in subtle ways. We present a method using hive-plot sequences of network data and a 3D convolutional neural network (3D CNN) to classify DDoS traffic with high accuracy. Our system relies on three main ideas: (1) using spatio-temporal hive-plot encodings to set a pattern-recognition baseline, (2) applying adversarial training with FGSM and PGD alongside spatial noise and image shifts, and (3) analyzing frame-wise predictions to find early signals. On a benchmark dataset, our method lifts adversarial accuracy from 50-55% to over 93% while maintaining clean-sample performance. Frames 3-4 offer strong predictive signals, showing early-stage classification is possible.

Figures

Figures reproduced from arXiv: 2509.10543 by the authors.

Figure 1
Figure 1. Model Architecture The distinguishing characteristic between a 3D CNN and a traditional 2D CNN like those used in [6] is the shape of the input and of the kernel used to perform convolution. In a 3D CNN, a 3D kernel is passed over a 3D input, capturing spatial patterns over not just 2 dimensions, height and width of some input matrix, but also depth (e.g., time, as in our case). This allows the model to learn spatio… view at source ↗
Figure 2
Figure 2. Sample time series of a DDoS attack on a honeypot target. To evaluate classifier performance across clean, augmented, and adversarial conditions, we report four standard metrics: accuracy, precision, recall, and area under the ROC curve (AUC). Each metric provides a distinct view of the model’s behavior under different testing regimes. Accuracy (Acc) measures the proportion of correctly classified samples across the… view at source ↗
Figure 3
Figure 3. Examples of the four input conditions used for evaluation: clean (left), aug￾mented (center-left), and adversarially perturbed using PGD (center-right) and FGSM (right). These images illustrate the visual distortion introduced by both natural aug￾mentations and adversarial perturbations. a ReduceLROnPlateau policy, with a reduction factor of 0.5 and a patience of 3 epochs. Early stopping was applied after three lear… view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

21 extracted references · 12 canonical work pages

  1. [1]

    Amato, F.: A novel framework for spatio-temporal prediction of environmental data using deep learning (2020).https://doi.org/10.48550/arxiv.2007.11836

    work page Pith review arXiv doi:10.48550/arxiv.2007.11836 2020

  2. [2]

    IEEE Transactions on Technology and Society3(3), 155–162 (2022).https://doi.org/10.1109/TTS

    Bonaci, T., Michael, K., Rivas, P., Robertson, L.J., Zimmer, M.: Emerging tech- nologies, evolving threats: Next-generation security challenges. IEEE Transactions on Technology and Society3(3), 155–162 (2022).https://doi.org/10.1109/TTS. 2022.3202323

    work page arXiv 2022

  3. [3]

    606–617 (2016).https://doi.org/10.1007/ 978-3-319-54660-5_54

    Chandran, K., Chakrabarti, A., Mani, M.: A spatio-temporal product life- cycle network representation pp. 606–617 (2016).https://doi.org/10.1007/ 978-3-319-54660-5_54

    work page 2016

  4. [4]

    5729–5738 (2017).https://doi.org/10

    Fernando, B., Bilen, H., Gavves, E., Gould, S.: Self-supervised video representation learning with odd-one-out networks pp. 5729–5738 (2017).https://doi.org/10. 1109/cvpr.2017.607

    work page 2017

  5. [5]

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples (2015),https://arxiv.org/abs/1412.6572

    arXiv 2015

  6. [6]

    In: 2020 11th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON)

    Guarino, M., Rivas, P., DeCusatis, C.: Towards adversarially robust ddos-attack classification. In: 2020 11th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON). pp. 0285–0291 (2020).https: //doi.org/10.1109/UEMCON51285.2020.9298167 14 L. Bragg et al

    arXiv 2020

  7. [7]

    5308–5317 (2016).https://doi.org/10.1109/cvpr

    Jain, A., Zamir, A., Savarese, S., Saxena, A.: Structural-rnn: deep learning on spatio-temporal graphs pp. 5308–5317 (2016).https://doi.org/10.1109/cvpr. 2016.573

    doi:10.1109/cvpr 2016

  8. [8]

    IEEE Transactions on Pattern Analysis and Machine Intelligence 35(1), 221–231 (2013).https://doi.org/10.1109/TPAMI.2012.59

    Ji, S., Xu, W., Yang, M., Yu, K.: 3d convolutional neural networks for human ac- tion recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence 35(1), 221–231 (2013).https://doi.org/10.1109/TPAMI.2012.59

    doi:10.1109/tpami.2012.59 2013

Show all 21 references
  1. [9]

    816–833 (2016).https://doi.org/10.1007/ 978-3-319-46487-9_50

    Liu, J., Shahroudy, A., Xu, D., Wang, G.: Spatio-temporal lstm with trust gates for 3d human action recognition pp. 816–833 (2016).https://doi.org/10.1007/ 978-3-319-46487-9_50

    2016

  2. [10]

    Madry, Makelov, Schmidt, Tsipras, Vladu: Towards deep learning models resistant to adversarial attacks (2019),https://arxiv.org/abs/1706.06083

    2019 arXiv

  3. [11]

    In: 2018 International Interdisciplinary PhD Work- shop (IIPhDW)

    Mikołajczyk, A., Grochowski, M.: Data augmentation for improving deep learning in image classification problem. In: 2018 International Interdisciplinary PhD Work- shop (IIPhDW). pp. 117–122 (2018).https://doi.org/10.1109/IIPHDW.2018. 8388338

    2018 doi

  4. [12]

    1–36 (2005).https://doi.org/10

    Pawlak, Z.: Flow graphs and data mining pp. 1–36 (2005).https://doi.org/10. 1007/11427834_1

    2005

  5. [13]

    Qiu, Z., Yao, T., Mei, T.: Learning spatio-temporal representation with pseudo-3d residual networks (2017).https://doi.org/10.1109/iccv.2017.590

    2017 doi

  6. [14]

    In: 2019 IEEE 10th Annual Ubiquitous Computing, Electronics & Mobile Communica- tion Conference (UEMCON)

    Rivas, P., DeCusatis, C., Oakley, M., Antaki, A., Blaskey, N., LaFalce, S., Stone, S.: Machine learning for ddos attack classification using hive plots. In: 2019 IEEE 10th Annual Ubiquitous Computing, Electronics & Mobile Communica- tion Conference (UEMCON). pp. 0401–0407 (201...

    2019

  7. [15]

    4489–4497 (2015).https: //doi.org/10.1109/iccv.2015.510

    Tran, D., Bourdev, L., Fergus, R., Torresani, L., Paluri, M.: Learning spatiotem- poral features with 3d convolutional networks pp. 4489–4497 (2015).https: //doi.org/10.1109/iccv.2015.510

    2015 doi

  8. [16]

    In: 2015 IEEE International Con- ference on Computer Vision (ICCV)

    Tran, D., Bourdev, L., Fergus, R., Torresani, L., Paluri, M.: Learning spatiotem- poral features with 3d convolutional networks. In: 2015 IEEE International Con- ference on Computer Vision (ICCV). pp. 4489–4497 (2015).https://doi.org/10. 1109/ICCV.2015.510

    2015

  9. [17]

    Wang, J., Jiao, J., Bao, L., He, S., Liu, Y., Liu, W.: Self-supervised spatio-temporal representation learning for videos by predicting motion and appearance statistics (2019).https://doi.org/10.1109/cvpr.2019.00413

    2019

  10. [18]

    Wang, S., Cao, J., Yu, P.: Deep learning for spatio-temporal data mining: a survey (2019).https://doi.org/10.48550/arxiv.1906.04928

    2019 doi arXiv

  11. [19]

    Yao, Y., Liu, C., Luo, D., Zhou, Y., Ye, Q.: Video playback rate perception for self-supervisedspatio-temporal representation learning (2020).https://doi.org/ 10.48550/arxiv.2006.11476

    2020 doi arXiv

  12. [20]

    2108.11575

    Zha, X., Zhu, W., Xun, L., Yang, S., Liu, J.: Shifted chunk transformer for spatio- temporal representational learning (2021).https://doi.org/10.48550/arxiv. 2108.11575

    2021 doi arXiv

  13. [21]

    Zhao, S., Shao, W., Chan, J., Salim, F.: Measuring disentangled generative spatio- temporal representation (2022).https://doi.org/10.48550/arxiv.2202.04821 A Appendix This appendix summarizes key methods and mathematical used throughout the paper, including adversarial attack ...

    2022 doi arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.