Pith. sign in

REVIEW 6 major objections 4 minor 53 references

By training a feature extractor to map an image and its adversarially perturbed versions to the same representation, this paper claims to raise accuracy under FGSM, PGD, and C&W attacks by 40–53% relative to an untrained backbone.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 06:59 UTC pith:GXFF3AAW

load-bearing objection The headline numbers don't hold up: mismatched epsilons, internally inconsistent percentages, and a novelty claim contradicted by the paper's own citations. the 6 major comments →

arxiv 2510.27249 v2 pith:GXFF3AAW submitted 2025-10-31 cs.CV

C-LEAD: Contrastive Learning for Enhanced Adversarial Defense

Suklav Ghosh , Sonal Kumar , Arijit Sur This is my paper
classification cs.CV
keywords contrastive learningadversarial defenseadversarial trainingrepresentation learningFGSMPGDC&W attackCIFAR-10
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that contrastive learning can serve as adversarial defense: instead of adding adversarial examples to a classifier's training set with labels, it treats clean images and their PGD/C&W-attacked versions as positive pairs in an InfoNCE-style loss and perturbed versions of other images as negatives. The encoder is trained self-supervised in this way, then frozen, and only a linear classifier is fine-tuned. The authors report that this raises model accuracy under FGSM, PGD, and C&W attacks by roughly 40%, 53%, and 41% over the untrained backbone, with deeper ResNets gaining more. If true, this would mean a defense that needs attack-generated samples only during pretraining and that transfers to unseen gradient-based attacks such as FGSM. The quantitative claim is conditional on attack-budget details that the paper does not report.

Core claim

The paper claims that modifying contrastive learning's pair sampling—using multiple adversarial perturbations (PGD and C&W) of the same image as positive pairs and perturbed versions of different images as negatives—makes an encoder map clean and attacked images to nearby representations. Fine-tuning only a linear classifier on top of the frozen encoder then yields accuracy under FGSM, PGD, and C&W attacks that is much higher than the untrained backbone; for example, ResNet50 FGSM accuracy rises from 18.47% to 55.28% at epsilon 0.03, PGD from 15.59% to 68.67%, and C&W from 16.40% to 59.85%. The paper reports average gains of 40%, 53%, and 41% for the three attacks across architectures, and i

What carries the argument

The load-bearing mechanism is an InfoNCE-style contrastive loss with temperature scaling, applied to a ResNet encoder with a projection head. Positive pairs are an original image paired with its PGD-perturbed version and its C&W-perturbed version; negative pairs are perturbed versions of different images. This loss pulls the representation of each image close to its attacked variants while pushing it away from other images' attacked variants. After this adversarial contrastive pretraining, the backbone is frozen and a single linear layer is fine-tuned for classification, so any robustness must be carried by the learned feature representation itself.

Load-bearing premise

The reported gains rest on the unstated training-time attack budget being at least as strong as the test attacks—the paper never gives the epsilon, step count, or iterations used to generate the PGD and C&W training pairs, and the baseline is tested at smaller epsilon values than the trained model—so without that number the 40–53% improvements cannot be read as robustness to the same attack strength. Additionally, the improvement is attributed to the contrastive loss itself,

What would settle it

Train the same encoder with the same PGD/C&W perturbed pairs but replace the contrastive loss with a simple mean-squared-error pull between clean and perturbed features; if that model matches C-LEAD's robustness, contrastive negative sampling is not the load-bearing component. Also, publish the training attack budget and rerun the experiment with training epsilon equal to the test epsilon of 0.08; if accuracy under PGD at that budget does not exceed the untrained backbone, the central robustness claim fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A linear classifier on the frozen C-LEAD backbone inherits some adversarial robustness without requiring adversarial training of the classifier itself.
  • Deeper models benefit more: ResNet50 shows the largest robustness jumps, while ResNet18 improves only 10–15%, suggesting capacity limits how much the contrastive objective can help.
  • The method shows partial transfer to an attack not used during training: FGSM accuracy still improves despite training only on PGD and C&W perturbed pairs.
  • The robustness gains appear across multiple attack types and epsilon values, which the authors take as evidence that the learned representations are more resilient rather than overfit to one perturbation family.
  • Compared with existing adversarial training methods on the paper's reported settings, the proposed model is competitive or better on PGD and C&W accuracy, though the authors note it may fall short of methods that add preprocessing or model modifications.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because the method only uses PGD and C&W as positive-pair perturbations, it is essentially adversarial data augmentation guided by a contrastive objective; the FGSM transfer suggests that gradient-based attacks of similar geometry may be resisted even if not seen in training.
  • A decisive control would be to keep the exact same perturbed pairs but replace the contrastive loss with a simpler pull-toward-clean-objective; if that matches C-LEAD's robustness, the contrastive negative sampling is not the active ingredient.
  • The comparison table uses different epsilon conventions (epsilon=8 for prior methods versus 0.03/0.08 in the main table), so readers should convert budgets before treating the reported numbers as directly comparable robustness levels.
  • A natural stress test would be to apply C-LEAD to larger-scale datasets or to attacks with different perturbation budgets; if the embedding-invariance story is right, robustness should degrade only gradually as the test budget grows past the training budget.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

6 major / 4 minor

Summary. The paper proposes C-LEAD, an adversarial-defense method based on contrastive learning. Positive pairs are formed from a clean image and its PGD/CW-perturbed versions, while negatives are perturbed versions of other images. A ResNet encoder is pretrained with a contrastive loss, then frozen, and a linear classifier is fine-tuned on CIFAR-10. The authors report FGSM/PGD/CW robustness improvements of 40/53/41% and compare against PGD-AT, TRADES, and related methods.

Significance. If the method worked as described, it would provide a label-free alternative to standard adversarial training and would strengthen the case for contrastive pretraining as a robustness mechanism. The paper makes code publicly available, which is a positive step. However, as written, the central empirical claim is not supported: the evaluation table is confounded, the headline percentages are not derivable from the reported numbers, the training attack budget is unspecified, and no ablation isolates the contribution of the contrastive loss. These issues make the current manuscript unsuitable for publication and require a full experimental revision.

major comments (6)
  1. [Table 1 / Section 4.3] The evaluation columns are not matched. Baseline accuracies are reported at epsilon 0.03 and 0.06, while trained-model accuracies are reported at epsilon 0.03 and 0.08. Thus the second comparison mixes attack strength with the effect of training. For example, ResNet-18 PGD at epsilon=0.03 goes from 12.60% to 31.27%, but the corresponding comparison at the second epsilon uses 10.34% vs 27.61% at different budgets. No like-for-like improvement can be computed from these columns.
  2. [Abstract / Contributions / Table 1] The claimed improvements of 40%, 53%, and 41% do not reproduce from Table 1. Using the matched epsilon=0.03 columns, ResNet-18 absolute differences are 7.40 pp (FGSM), 18.67 pp (PGD), and 11.75 pp (CW); ResNet-50 gives 36.81, 53.08, and 43.45 pp. No consistent relative or absolute calculation yields the stated 40/53/41 figures. The paper's central quantitative claim is therefore not supported by the data in the table.
  3. [Algorithm 1 / Section 4.2] The training-time attack configuration is never specified. Algorithm 1 line 5 only states 'PGD, CW <- Obtain two perturbed versions'; Section 4.2 lists optimizer, batch size, learning rate, and temperature, but not the epsilon, number of PGD iterations, step size, or CW parameters used to generate the training positives. Without this information, the reader cannot determine whether the training perturbations are stronger than or comparable to the test attacks, and the method cannot be reproduced or interpreted.
  4. [Section 4.3 / Table 2] The comparison against existing adversarial training methods is not controlled. Table 2 mixes different models, attack budgets, and numbers taken from different papers, and it states epsilon=8 while Table 1 uses epsilon values of 0.03-0.08 without conversion. More importantly, the only baseline in Table 1 is a clean model with no adversarial training; there is no ablation with vanilla contrastive learning or with standard supervised PGD-AT under the same frozen-backbone linear-probe protocol. Thus the specific contribution of the adversarial contrastive pair objective is not isolated.
  5. [Eq. (2)] The printed contrastive loss is not a valid InfoNCE formulation. The first log term's denominator is standard, but the second log term is written as log[ exp(sim(x_orig,x_CW)/tau) / (sum_j exp(sim(x_orig,x_j)/tau) + exp(sim(x_orig,x_CW^-)/tau)) ], where x_CW^- is never defined, the denominator is asymmetric with the numerator, and the negative term overlaps with the positive index. The loss as printed is ambiguous and cannot be implemented, making the method's objective unverifiable.
  6. [Section 3.2 vs Section 4.3] The status of FGSM is internally contradictory. Earlier sections say perturbed versions are generated using 'FGSM, PGD, and CW,' and the introduction lists FGSM as one of the attack mechanisms considered. Section 4.3, however, describes FGSM as an 'unseen attack' and uses it to claim generalization to unseen attacks. This contradiction affects the paper's generalization claim and must be resolved.
minor comments (4)
  1. [Throughout] Typos and inconsistent notation should be corrected: 'CIF AR-10' should be 'CIFAR-10'; 'finetunning' in Algorithm 1; 'Resnet 18/34/50' should be 'ResNet'; 'T able 1'; and inconsistent use of 'C&W' vs 'CW'.
  2. [Section 4.3, Table 2] Table 2 colors the 'first, second, and third-best performances' in red, green, and blue, but the table has no legend or explanation of which methods are being ranked. In addition, the closing paragraph of Section 4.3 concedes that the proposed models 'may fall short' of state-of-the-art; this should be reconciled with the contribution claims and the color-coded comparisons.
  3. [Introduction / Related Work] The claim that adversarial defense via contrastive learning is 'previously unexplored' is overstated given references [41] and [53], which study adversarial contrastive learning. The authors should situate C-LEAD relative to these existing works and clarify the novelty.
  4. [Section 4.3] The text states 'the results demonstrate an average improvement of 40%' but does not specify how this average is computed. Given the inconsistencies in Table 1, the averaging procedure and whether it is relative or absolute should be stated explicitly.

Circularity Check

0 steps flagged

No circularity: C-LEAD is an empirical robustness study whose reported gains are measured against attacks, not derived from the loss by construction; the only self-citation is not load-bearing.

full rationale

This is an empirical systems paper, not a mathematical derivation, so there is no equation in which an output is defined to be an input or a fitted parameter is renamed as a prediction. The contrastive loss in Eq. 2 defines the training objective, and Table 1 measures the resulting backbone's accuracy under adversarial attacks; the robustness numbers are experimental outcomes, not analytic consequences of the loss. The paper's own admitted limitations (Section 4.3: models 'may fall short in terms of accuracy when compared to state-of-the-art models') and its omitted training attack budgets are reproducibility/consistency concerns, not circularity. The only self-citation, reference [19], is cited for the background claim that contrastive learning is a widely studied approach and is not load-bearing for the central result. There are also internal inconsistencies (Table 1 compares baseline and trained models under different epsilon columns, and the claimed +40/53/41% figures do not match the table), but these are correctness/reporting issues. No specific circular step can be exhibited, so the circularity score is 0.

Axiom & Free-Parameter Ledger

8 free parameters · 4 axioms · 0 invented entities

The central empirical claim rests on unspecified training attack settings, a single dataset, and no ablation to separate contrastive learning from adversarial augmentation. These are not invented entities, but they are unsupported assumptions the paper does not test.

free parameters (8)
  • temperature tau = 0.1
    Temperature in the InfoNCE loss; chosen by hand, no sensitivity analysis.
  • batch size (contrastive) = 512
    Training batch size for the contrastive phase; the conclusion claims smaller batches improve results but no ablation is shown.
  • learning rate / optimizer = 0.4, SGD momentum 0.9
    Optimizer settings for contrastive training; no tuning details or sensitivity analysis.
  • pretraining epochs = not reported
    The number of epochs for adversarial contrastive training is never stated, yet it directly controls the learned representations and robustness.
  • fine-tuning epochs = not reported
    The number of fine-tuning epochs is not given.
  • training attack budget (epsilon) = not reported
    The perturbation budget used to generate PGD/CW training examples is never specified; this is central to the method's robustness claims.
  • PGD/CW steps for training = not reported
    Iteration counts and step sizes for PGD and CW during training are omitted.
  • test attack configurations = eps 0.03/0.06/0.08, steps unspecified
    Evaluation uses eps 0.03, 0.06, and 0.08, but no step counts or CW parameters are given; also the choice of eps for baseline vs trained is inconsistent.
axioms (4)
  • domain assumption CIFAR-10 is a representative benchmark for evaluating adversarial robustness
    All results are on CIFAR-10; no other dataset is tested.
  • domain assumption PGD and C&W attacks generated during training are sufficient to induce robustness against the same attack families at test time
    The method trains only on PGD and C&W perturbed images and then evaluates on FGSM/PGD/C&W; no theoretical or empirical justification for this transfer is provided.
  • domain assumption The contrastive objective with adversarial positives transfers to downstream classification via a linear probe
    A frozen backbone plus linear head is assumed to capture task-relevant robust features.
  • domain assumption A normally-trained ResNet is an appropriate baseline for 'without training'
    The 'w/o training' column uses a model trained with standard cross-entropy, not a defense baseline; comparison against adversarial training baselines is done only on different architectures/regimes.

pith-pipeline@v1.3.0-alltime-deepseek · 8645 in / 13518 out tokens · 103424 ms · 2026-08-04T06:59:18.240356+00:00 · methodology

0 comments
read the original abstract

Deep neural networks (DNNs) have achieved remarkable success in computer vision tasks such as image classification, segmentation, and object detection. However, they are vulnerable to adversarial attacks, which can cause incorrect predictions with small perturbations in input images. Addressing this issue is crucial for deploying robust deep-learning systems. This paper presents a novel approach that utilizes contrastive learning for adversarial defense, a previously unexplored area. Our method leverages the contrastive loss function to enhance the robustness of classification models by training them with both clean and adversarially perturbed images. By optimizing the model's parameters alongside the perturbations, our approach enables the network to learn robust representations that are less susceptible to adversarial attacks. Experimental results show significant improvements in the model's robustness against various types of adversarial perturbations. This suggests that contrastive loss helps extract more informative and resilient features, contributing to the field of adversarial robustness in deep learning. The code is publicly made available on GitHub in the following link: https://github.com/suklav/C_Lead .

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

53 extracted references · 20 linked inside Pith

  1. [1]

    SN Computer Science4(3), 256 (2023)

    Ranga, S., Nageswara Guptha, M.: Log anomaly detection using sequential con- volution neural networks and dual-lstm model. SN Computer Science4(3), 256 (2023)

    2023

  2. [2]

    SN Computer Science2(3), 154 (2021)

    Sarker, I.H.: Deep cybersecurity: a comprehensive overview from neural network and deep learning perspective. SN Computer Science2(3), 154 (2021)

    2021

  3. [3]

    In: Bengio, Y., LeCun, Y

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: Bengio, Y., LeCun, Y. (eds.) 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings (2014). http://arxiv.org/abs/1312.6199

    Pith/arXiv arXiv 2014

  4. [4]

    In: Advances in Neural Information Processing Systems, pp

    Zhang, H., Yu, Y., Javanmardi, M., Li, W., Liu, W., Sun, J.: Theoretically principled trade-off between robustness and accuracy. In: Advances in Neural Information Processing Systems, pp. 10209–10220 (2019)

    2019

  5. [5]

    Tram` er, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P.: Ensemble adversarial training: Attacks and defenses (2020)

    2020

  6. [6]

    In: International Conference on Machine Learning, pp

    Madaan, D., Shin, J., Hwang, S.J.: Adversarial neural pruning with latent vul- nerability suppression. In: International Conference on Machine Learning, pp. 6575–6585 (2020). PMLR 11

    2020

  7. [7]

    In: Proceedings of the Ieee Conference on Computer Vision and Pattern Recognition, pp

    Zheng, S., Song, Y., Leung, T., Goodfellow, I.: Improving the robustness of deep neural networks via stability training. In: Proceedings of the Ieee Conference on Computer Vision and Pattern Recognition, pp. 4480–4488 (2016)

    2016

  8. [8]

    arXiv preprint arXiv:1903.12261 (2019)

    Hendrycks, D., Dietterich, T.: Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261 (2019)

    Pith/arXiv arXiv 1903

  9. [9]

    Advances in Neural Information Processing Systems32(2019)

    Yin, D., Gontijo Lopes, R., Shlens, J., Cubuk, E.D., Gilmer, J.: A fourier per- spective on model robustness in computer vision. Advances in Neural Information Processing Systems32(2019)

    2019

  10. [10]

    In: International Conference on Learning Representations (2015)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: International Conference on Learning Representations (2015)

    2015

  11. [11]

    In: International Conference on Learning Representations (2018)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2018)

    2018

  12. [12]

    In: International Conference on Learning Represen- tations (2018)

    Gidaris, S., Singh, P., Komodakis, N.: Unsupervised representation learning by predicting image rotations. In: International Conference on Learning Represen- tations (2018)

    2018

  13. [13]

    In: European Conference on Computer Vision, pp

    Noroozi, M., Favaro, P.: Unsupervised learning of visual representations by solving jigsaw puzzles. In: European Conference on Computer Vision, pp. 69–84. Springer, ??? (2016)

    2016

  14. [14]

    In: Proceedings of the 37th International Conference on Machine Learning (2020)

    Chen, T., Kornblith, S., Norouzi, M., Hinton, G.: A simple framework for contrastive learning of visual representations. In: Proceedings of the 37th International Conference on Machine Learning (2020)

    2020

  15. [15]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (2020)

    He, K., Fan, H., Wu, Y., Xie, S., Girshick, R.: Momentum contrast for unsuper- vised visual representation learning. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (2020)

    2020

  16. [16]

    Noroozi, M., Favaro, P.: Unsupervised learning of visual representations by solving jigsaw puzzles (2017) arXiv:1603.09246 [cs.CV]

    Pith/arXiv arXiv 2017

  17. [17]

    In: Advances in Neural Information Processing Systems, pp

    Carmon, Y., Belinkov, Y., Lavi, T., Goyal, V., Duchi, J., Hertz, T., Ziv, A.: Unla- beled data improves adversarial robustness. In: Advances in Neural Information Processing Systems, pp. 118–129 (2019)

    2019

  18. [18]

    In: European Conference on Computer Vision (2020)

    Tian, Y., Krishnan, D., Isola, P.: Contrastive multiview coding. In: European Conference on Computer Vision (2020)

    2020

  19. [19]

    In: Proceedings of the Thirteenth Indian Conference on Computer Vision, Graphics 12 and Image Processing (2023)

    Kumar, W.K., Paidimarri, M., Sur, A.: A globally-connected and trainable hierar- chical fine-attention generative adversarial network based adversarial defense. In: Proceedings of the Thirteenth Indian Conference on Computer Vision, Graphics 12 and Image Processing (2023). Association for Computing Machinery

    2023

  20. [20]

    In: 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’05), vol

    Chopra, S., Hadsell, R., LeCun, Y.: Learning a similarity metric discriminatively, with application to face verification. In: 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’05), vol. 1, pp. 539–546 (2005)

    2005

  21. [21]

    Journal of Machine Learning Research10(9), 207–244 (2009)

    Weinberger, K.Q., Saul, L.K.: Distance metric learning for large margin nearest neighbor classification. Journal of Machine Learning Research10(9), 207–244 (2009)

    2009

  22. [22]

    CoRRabs/1503.03832(2015)

    Schroff, F., Kalenichenko, D., Philbin, J.: Facenet: A unified embedding for face recognition and clustering. CoRRabs/1503.03832(2015)

    Pith/arXiv arXiv 2015

  23. [23]

    CoRRabs/1807.03748(2018)

    Oord, A., Li, Y., Vinyals, O.: Representation learning with contrastive predictive coding. CoRRabs/1807.03748(2018)

    Pith/arXiv arXiv 2018

  24. [24]

    CoRRabs/1904.03436(2019)

    Ye, M., Zhang, X., Yuen, P.C., Chang, S.-F.: Unsupervised embedding learning via invariant and spreading instance feature. CoRRabs/1904.03436(2019)

    Pith/arXiv arXiv 1904

  25. [25]

    arXiv preprint arXiv:1911.05722 (2019)

    He, K., Fan, H., Wu, Y., Xie, S., Girshick, R.: Momentum contrast for unsuper- vised visual representation learning. arXiv preprint arXiv:1911.05722 (2019)

    Pith/arXiv arXiv 1911

  26. [26]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2020)

    Misra, I., Maaten, L.: Self-supervised learning of pretext-invariant representa- tions. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2020)

    2020

  27. [27]

    CoRRabs/1704.06888(2017)

    Sermanet, P., Lynch, C., Hsu, J., Levine, S.: Time-contrastive networks: Self- supervised learning from multi-view observation. CoRRabs/1704.06888(2017)

    Pith/arXiv arXiv 2017

  28. [28]

    In: Garnett, R., Lee, D.D., Luxburg, U., Guyon, I., Sugiyama, M

    Hy¨ arinen, A., Morioka, H.: Unsupervised feature extraction by time-contrastive learning and nonlinear ica. In: Garnett, R., Lee, D.D., Luxburg, U., Guyon, I., Sugiyama, M. (eds.) Advances in Neural Information Processing Systems, vol. NIPS 2016, pp. 3772–3780. Neural Information Processing Systems Foundation, United States (2016)

    2016

  29. [29]

    CoRR abs/1902.09229(2019)

    Arora, S., Khandeparkar, H., Khodak, M., Plevrakis, O., Saunshi, N.: A the- oretical analysis of contrastive unsupervised representation learning. CoRR abs/1902.09229(2019)

    Pith/arXiv arXiv 1902

  30. [30]

    CoRRabs/1603.08561(2016)

    Misra, I., Zitnick, C.L., Hebert, M.: Unsupervised learning using sequential verification for action recognition. CoRRabs/1603.08561(2016)

    Pith/arXiv arXiv 2016

  31. [31]

    arXiv preprint arXiv:1907.13625 (2020) 13

    Tschannen, M., Djolonga, J., Rubenstein, P.K., Gelly, S., Lucic, M.: On mutual information maximization for representation learning. arXiv preprint arXiv:1907.13625 (2020) 13

    Pith/arXiv arXiv 1907

  32. [32]

    In: Teh, Y.W., Titterington, M

    Gutmann, M., Hy¨ arinen, A.: Noise-contrastive estimation: A new estimation prin- ciple for unnormalized statistical models. In: Teh, Y.W., Titterington, M. (eds.) Proceedings of the Thirteenth International Conference on Artificial Intelligence and Statistics, vol. 9, pp. 297–304. PMLR, Chia Laguna Resort, Sardinia, Italy (2010)

    2010

  33. [33]

    In: Lee, D., Sugiyama, M., Luxburg, U., Guyon, I., Garnett, R

    Sohn, K.: Improved deep metric learning with multi-class n-pair loss objective. In: Lee, D., Sugiyama, M., Luxburg, U., Guyon, I., Garnett, R. (eds.) Advances in Neural Information Processing Systems, vol. 29. Curran Associates, Inc., ??? (2016)

    2016

  34. [34]

    CoRRabs/1706.07567(2017)

    Wu, C.-Y., Manmatha, R., Smola, A.J., Kr¨ ahenb¨ uhl, P.: Sampling matters in deep embedding learning. CoRRabs/1706.07567(2017)

    Pith/arXiv arXiv 2017

  35. [35]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (2019)

    Suh, Y., Han, B., Kim, W., Lee, K.M.: Stochastic class-based hard example min- ing for deep metric learning. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (2019)

    2019

  36. [36]

    CoRRabs/1704.01285(2017)

    Kumar, B.G.V., Harwood, B., Carneiro, G., Reid, I.D., Drummond, T.: Smart mining for deep metric learning. CoRRabs/1704.01285(2017)

    Pith/arXiv arXiv 2017

  37. [37]

    CoRR abs/1805.03642(2018)

    Bose, A.J., Ling, H., Cao, Y.: Adversarial contrastive estimation. CoRR abs/1805.03642(2018)

    Pith/arXiv arXiv 2018

  38. [38]

    Bose, A.J., Ling, H., Cao, Y.: Compositional hard negatives for visual semantic embeddings via an adversary (2018)

    2018

  39. [39]

    CoRRabs/1712.07107(2017) 1712.07107

    Yuan, X., He, P., Zhu, Q., Bhat, R.R., Li, X.: Adversarial examples: Attacks and defenses for deep learning. CoRRabs/1712.07107(2017) 1712.07107

    Pith/arXiv arXiv 2017

  40. [40]

    CoRRabs/1810.00069(2018)

    Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., Mukhopadhyay, D.: Adversarial attacks and defences: A survey. CoRRabs/1810.00069(2018)

    Pith/arXiv arXiv 2018

  41. [41]

    Advances in Neural Information Processing Systems33, 17081–17093 (2020)

    Ho, C.-H., Nvasconcelos, N.: Contrastive learning with adversarial examples. Advances in Neural Information Processing Systems33, 17081–17093 (2020)

    2020

  42. [42]

    CoRRabs/1611.01236(2016)

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial machine learning at scale. CoRRabs/1611.01236(2016)

    Pith/arXiv arXiv 2016

  43. [43]

    CoRRabs/1607.02533(2016)

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. CoRRabs/1607.02533(2016)

    Pith/arXiv arXiv 2016

  44. [44]

    3352–3363 (2019)

    Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J., Studer, C., Davis, L.S., Taylor, G., Goldstein, T.: Adversarial training for free! In: Advances in Neural Information Processing Systems, pp. 3352–3363 (2019)

    2019

  45. [45]

    arXiv preprint arXiv:2003.02484 (2020) 14

    Lee, S., Lee, H.-G., Yoon, S.: Adversarial vertex mixup: Toward better adversar- ially robust generalization. arXiv preprint arXiv:2003.02484 (2020) 14

    Pith/arXiv arXiv 2003

  46. [46]

    In: Advances in Neural Information Processing Systems (NeurIPS) (2019)

    Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., Madry, A.: Adversar- ial examples are not bugs, they are features. In: Advances in Neural Information Processing Systems (NeurIPS) (2019)

    2019

  47. [47]

    In: Advances in Neural Information Processing Systems (NeurIPS), pp

    Volpi, R., Namkoong, H., Sener, O., Duchi, J.C., Murino, V., Savarese, S.: Gen- eralizing to unseen domains via adversarial data augmentation. In: Advances in Neural Information Processing Systems (NeurIPS), pp. 5334–5344 (2018)

    2018

  48. [48]

    arXiv preprint arXiv:1911.09665 (2019)

    Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A.L., Le, Q.V.: Adversarial examples improve image recognition. arXiv preprint arXiv:1911.09665 (2019)

    Pith/arXiv arXiv 1911

  49. [49]

    Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

    2009

  50. [50]

    Jia, X., Zhang, Y., Wu, B., Ma, K., Wang, J., Cao, X.: Las-at: Adversarial training with learnable attack strategy (2022)

    2022

  51. [51]

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks (2019)

    2019

  52. [52]

    Zhang, J., Xu, X., Han, B., Niu, G., Cui, L., Sugiyama, M., Kankanhalli, M.: Attacks which do not kill training make adversarial learning stronger (2020)

    2020

  53. [53]

    In: Proceedings of the AAAI Conference on Artificial Intelligence (2022) 15

    Zhu, W., Shang, H., Lv, T., Liao, C., Yang, S., Liu, J.: Adversarial contrastive self-supervised learning. In: Proceedings of the AAAI Conference on Artificial Intelligence (2022) 15

    2022