Pith. sign in

REVIEW 3 major objections 5 minor 53 references

Block Stretch and Shrink (BSS), a block-level stretch-and-shrink input transformation, substantially achieves the highest adversarial transferability among state-of-the-art input transformation-based attacks under a unified number scale.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 20:55 UTC pith:UT6AIYYD

load-bearing objection BSS is a plausible new input-transformation operator, but its headline transferability gains are undercut by hyperparameters tuned on the same evaluation models. the 3 major comments →

arxiv 2511.17688 v2 pith:UT6AIYYD submitted 2025-11-21 cs.LG cs.AI

Enhancing Adversarial Transferability through Block Stretch and Shrink

Quan Liu , Feng Ye , Chenhao Lu , Shuming Zhen , Guanliang Huang , Lunzhe Chen , Xudong Ke This is my paper
classification cs.LG cs.AI
keywords adversarial transferabilityinput transformation attackblack-box attackblock stretch and shrinkattention heatmapMI-FGSMunified number scaleImageNet
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that a new input transformation, Block Stretch and Shrink (BSS), improves adversarial transferability beyond existing methods. BSS divides an image into blocks using constrained random segmentation, then independently stretches or shrinks each block along both spatial dimensions. This produces transformed views that simultaneously diversify attention heatmaps and preserve global semantic structure. When gradients are aggregated over these views with MI-FGSM, the resulting perturbations fool held-out CNNs and vision transformers more often than BSR, SIA, DeCoWA, and OPS when all methods use the same number of transformed inputs. The paper also argues that transformation-based attacks should be evaluated under a unified number scale to make comparisons fair.

Core claim

On its own terms, the paper's central claim is that BSS, a block-level stretch-and-shrink input transformation, substantially achieves the highest transferability among state-of-the-art input transformation-based attacks (OPS, SIA, BSR, DeCoWA) in black-box settings. The method segments an image into blocks using constrained random points, enforces boundary and inter-point distances to preserve semantic content, and applies random stretch/shrink factors to each block, normalized to preserve total dimension, via bilinear interpolation, sequentially along height and width. Feeding the resulting transformed views into MI-FGSM for gradient aggregation yields adversarial perturbations that transf

What carries the argument

The central object is the Block Stretch and Shrink (BSS) transformation operator. It comprises a constrained random segmentation module and a block-level stretch/shrink module. The transformation is the key mechanism: by randomly warping blocks independently along both dimensions while keeping global boundaries and semantic layout intact, it induces a richer set of attention heatmaps than prior operators. The paper attributes the transferability gain to this simultaneous preservation of global semantics and diversification of model attention.

Load-bearing premise

The paper's reported advantage depends on the assumption that the hyperparameters db=35, dp=40, r=1, M=2, chosen by maximizing average attack success on the same six CNNs and five ViTs used for the final evaluation, will generalize to unseen target models; if those values are overfit to the evaluation set, the transferability gap over baselines may not hold outside this setup.

What would settle it

Run BSS and the baselines on a held-out set of target models (e.g., ConvNeXt, EfficientNet, or models with different input resolutions) using the authors' fixed hyperparameters and N=21, and check whether BSS's average success rate still exceeds the best baseline by the margin reported. If it does not, the claim of superior transferability is specific to the chosen model zoo.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If BSS is correct, practitioners can generate black-box adversarial examples with fewer transformed inputs per step, since BSS shows large gains at low number scales (N=10–37).
  • The unified number scale evaluation framework implies that published comparisons among transformation-based attacks may have been confounded by different numbers of transformed inputs, and future comparisons should fix N to isolate operator quality.
  • BSS transferability extends to vision transformers and defended models, suggesting block-level local scaling is a robust source of gradient diversity.
  • The ablation result that constrained segmentation and dual-dimension processing work synergistically indicates the design principle: preserving semantic integrity while introducing local scale variation.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the mechanism is general, combining BSS's block-level stretch/shrink with other operators (such as scale or translation invariance) may further improve transferability, since their gradient diversity sources could compose.
  • The constrained random segmentation (with boundary and inter-point distances) resembles low-discrepancy point sets; replacing uniform random sampling with stratified or quasi-random sampling could stabilize results at small N without tuning db and dp.
  • Because BSS operates locally, it may be especially effective on object-centric datasets with small semantic regions; testing on medical or remote-sensing images could reveal whether the semantic-preservation constraint matters more there.
  • The paper's unified number-scale argument suggests that re-benchmarking prior methods at their originally reported number scales might shrink apparent gaps; this is an editorial suggestion, not a paper claim.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Block Stretch and Shrink (BSS), a new input-transformation operator for improving adversarial transferability. BSS segments an image using constrained random points, then applies block-wise stretch/shrink along both spatial dimensions, generating a set of transformed inputs whose losses are averaged during MI-FGSM optimization. The authors claim BSS substantially outperforms existing transformation-based attacks (BSR, SIA, DeCoWA, OPS) on a 1000-image ImageNet subset across six CNN and five ViT target models, and additionally advocate evaluating transformations under a unified 'number scale' for fair comparison. The manuscript also presents ablations of the constrained point selection and dual-dimensional processing.

Significance. If the empirical claims held, BSS would be a simple and effective new transformation operator, and the proposed standardized number-scale evaluation would be a useful methodological contribution to the adversarial transferability literature. The method is easy to implement and its motivation from attention diversity and semantic preservation is plausible. However, the evidence presented is compromised by a selection-on-evaluation protocol and lacks statistical robustness, so the significance of the claimed improvement cannot currently be assessed.

major comments (3)
  1. [§4.5, Fig. 5] The four BSS hyperparameters (db=35, dp=40, r=1, M=2) are selected by maximizing the average attack success rate on the same six CNNs and five ViTs that constitute the evaluation sets in Tables 1, 3, and Figure 4. This makes the test set a validation set. Baselines use published settings without a comparable tuning budget, so the reported margins in §4.3 may be a selection artifact rather than a genuine advantage. The authors must separate model selection from evaluation, e.g., by tuning on a disjoint held-out set of models, or by reporting full parameter sweeps without cherry-picking on the final test models.
  2. [§4.1, Tables 1–3] All results are single-run point estimates on a fixed 1000-image subset with random seed 42. No confidence intervals, multiple seeds, or statistical tests are reported. Given the variance typical in adversarial transferability experiments, the claim that BSS 'substantially achieves the highest transferability' (Section 4.3) is not statistically supported by the data as presented. At minimum, the authors should provide results over multiple seeds or bootstrap confidence intervals for the reported success rates.
  3. [§4.2, §4.5] The text refers to 'Figure ??' for the unified-number-scale experiments and for the ablation parameter sweeps. These figures are missing from the submitted manuscript. Without them, the reader cannot inspect the actual number-scale curves or the hyperparameter selection procedure, which are central to the two main contributions. This is a completeness problem that prevents verification of the core empirical claims and must be fixed in revision.
minor comments (5)
  1. [§3.2] Typo: 'Firgure 2' should be 'Figure 2'.
  2. [§3.4.2] The text says 'block lever stretch and shrink'; 'lever' is likely 'level'. Also 'trasfored' should be 'transformed'.
  3. [§3.4.2, Eq. (7)–(8)] The normalization in Eq. (7) and the rounding in Eq. (8) are described, but the adjustment procedure (adj) is described only in words. A precise algorithmic description or pseudo-code would improve reproducibility.
  4. [§4.1] The 'Parameter Settings' mention random seed 42; please specify whether this seed controls the image selection, the segmentation point sampling, or both.
  5. [References] Several references lack page numbers or venue details (e.g., [5], [23], [31]); please ensure a consistent, complete reference format.

Circularity Check

0 steps flagged

No significant circularity: BSS is an empirical input-transformation proposal; its transferability claim is benchmarked against external baselines and is not defined by its own equations or self-citations.

full rationale

The paper does not contain a formal derivation whose conclusion is fed back into its assumptions. The BSS transformation is defined by independent equations (3)-(9): constrained random segmentation points and block-level stretch/shrink with bilinear interpolation, followed by standard MI-FGSM optimization over N transformed copies. The motivating 'diverse attention heatmaps + preserved global semantics' criterion is inherited from external prior work (BSR [23], DeCoWA [24]) with no author overlap, so no self-citation is load-bearing. The reported attack success rates are measured against fixed external baselines (BSR, SIA, DeCoWA, OPS) on an ImageNet subset, giving an independent empirical benchmark. The only notable concern is methodological rather than circular: Section 4.5 selects hyperparameters (db=35, dp=40, r=1, M=2) by average attack success on the same six CNNs and five ViTs later used in Tables 1-3 and Figure 5, which risks test-set overfitting and unfair comparison to untuned baselines. But this is a validity/selection issue, not a definitional reduction: the superiority claim is not equivalent by construction to the fitting objective, and no equation equates the output to the input. There is also no imported uniqueness theorem and no ansatz smuggled via citation. Hence no circularity step meets the required evidence bar.

Axiom & Free-Parameter Ledger

4 free parameters · 3 axioms · 0 invented entities

The central claim rests on the empirical evaluation, which depends on four hyperparameters tuned on the evaluation set, and on the prior assumption that attention diversity plus semantic preservation is the correct lens. No mathematical derivation or independent evidence is provided.

free parameters (4)
  • db = 35
    Minimum distance from segmentation points to image boundary; selected in Section 4.5 by maximizing transferability on the same evaluation models.
  • dp = 40
    Minimum distance between segmentation points; selected in Section 4.5.
  • r = 1
    Range-to-center ratio controlling stretch/shrink factor spread; selected in Section 4.5.
  • M = 2
    Number of segmentation point pairs (blocks = M+1=3); selected in Section 4.5.
axioms (3)
  • domain assumption Diverse attention heatmaps combined with preserved global semantics produce high-transferability perturbations
    Adopted from [23,24] in Section 3.2; BSS is designed to achieve both, but the paper provides no independent proof of this causal link.
  • domain assumption The 1000-image ImageNet subset is representative for comparing attack methods
    Section 4.1 describes the dataset; no power analysis or multiple seeds are provided.
  • standard math Bilinear interpolation is differentiable and gradients through it are meaningful
    Used in the stretch/shrink module, Eq. (8); standard, but no gradient checks are presented.

pith-pipeline@v1.3.0-alltime-deepseek · 12360 in / 9782 out tokens · 83374 ms · 2026-08-03T20:55:50.078766+00:00 · methodology

0 comments
read the original abstract

Input transformation-based attacks improve adversarial transferability by aggregating gradients over transformed inputs. Existing analyses mainly explain their efficacy from image diversity, semantic preservation, attention variance or hypothesis space augmentation, yet overlook the critical role of model frontend responses. In this paper, we revisit transformation-based attacks from an implicit ensemble perspective: each transformation can be viewed as a pre-processing operator before the surrogate model, inducing a distinct frontend response for gradient aggregation. Based on this view, we propose FRO, a Frontend Response-Oriented input transformation method that enriches such responses through two complementary operators. The Local Scaling Operator perturbs local content sampling via block-wise stretch-and-shrink operations, while the Projection Operator modifies global spatial organization through coherent perspective deformation. Together, they produce structured transformed views to optimize transferable adversarial perturbations. Experiments on an ImageNet subset show that FRO consistently improves black-box transferability across diverse CNN and Vision Transformer models. We further analyze the effect of implicit ensemble size and evaluate different transformation-based methods under a unified ensemble scale, demonstrating the superiority of designing input transformations from the perspective of front-end response ensembles.

Figures

Figures reproduced from arXiv: 2511.17688 by Chenhao Lu, Feng Ye, Guanliang Huang, Lunzhe Chen, Quan Liu, Shuming Zhen, Xudong Ke.

Figure 1
Figure 1. Figure 1: The input image and its transformed versions generated by different methods. Except for BSS and OPS, [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Attention heatmaps of the transformed images generated by BSS, OPS, DeCoWA, and BSR, computed on [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: This figure shows the specific principle of Block Stretch and Shrink. After adding perturbation [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Attack success rates (%) of different attack methods in different number scale on five CNNs and five ViTs [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Average attack success rates (%) on six CNNs and five ViTs models under different parameter configurations, [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

53 extracted references · 16 linked inside Pith

  1. [1]

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks.Communications of the ACM, 60:84 – 90, 2012

    2012

  2. [2]

    Girshick, and Ali Farhadi

    Joseph Redmon, Santosh Kumar Divvala, Ross B. Girshick, and Ali Farhadi. You only look once: Unified, real-time object detection.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 779–788, 2015

    2016

  3. [3]

    Fully convolutional networks for semantic segmentation

    Evan Shelhamer, Jonathan Long, and Trevor Darrell. Fully convolutional networks for semantic segmentation. 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3431–3440, 2014. 10 APREPRINT- NOVEMBER25, 2025

    2015

  4. [4]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world.ArXiv, abs/1607.02533, 2016

    Pith/arXiv arXiv 2016

  5. [5]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/1412.6572, 2014

    Pith/arXiv arXiv 2014

  6. [6]

    Finding physical adversarial examples for autonomous driving with fast and differentiable image compositing

    Jinghan Yang, Adith Boloor, Ayan Chakrabarti, Xuan Zhang, and Yevgeniy V orobeychik. Finding physical adversarial examples for autonomous driving with fast and differentiable image compositing. 2020

    2020

  7. [7]

    Understanding adversarial attacks on deep learning based medical image analysis systems.ArXiv, abs/1907.10456, 2019

    Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Understanding adversarial attacks on deep learning based medical image analysis systems.ArXiv, abs/1907.10456, 2019

    Pith/arXiv arXiv 1907

  8. [8]

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K. Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition.Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016

    2016

  9. [9]

    Discovering adversarial examples with momentum.ArXiv, abs/1710.06081, 2017

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Discovering adversarial examples with momentum.ArXiv, abs/1710.06081, 2017

    Pith/arXiv arXiv 2017

  10. [10]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks.2017 IEEE Symposium on Security and Privacy (SP), pages 39–57, 2016

    2017

  11. [11]

    Berkay Celik, and Ananthram Swami

    Nicolas Papernot, Patrick Mcdaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings.2016 IEEE European Symposium on Security and Privacy (EuroS&P), pages 372–387, 2015

    2016

  12. [12]

    Rodr’iguez

    Yixiang Wang, Jiqiang Liu, Xiaolin Chang, Jianhua Wang, and Ricardo J. Rodr’iguez. Di-aa: An interpretable white-box attack for fooling deep neural networks.ArXiv, abs/2110.07305, 2021

    Pith/arXiv arXiv 2021

  13. [14]

    Delving into transferable adversarial examples and black-box attacks.ArXiv, abs/1611.02770, 2016

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Xiaodong Song. Delving into transferable adversarial examples and black-box attacks.ArXiv, abs/1611.02770, 2016

    Pith/arXiv arXiv 2016

  14. [15]

    Goodfellow, Somesh Jha, Z

    Nicolas Papernot, Patrick Mcdaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning.Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, 2016

    2017

  15. [16]

    Transferattack https://github.com/trustworthy-ai-group/transferattack, 2023

    Xiaosen Wang, Zeyuan Yin, Zeliang Zhang, Kunyu Wang, Zhijin Ge, and Yuyang Luo. Transferattack https://github.com/trustworthy-ai-group/transferattack, 2023. GitHub repository

    2023

  16. [17]

    Zhankai Li, Weiping Wang, Jie Li, Kai Chen, and Shigeng Zhang. Foolmix: Strengthen the transferability of adversarial examples by dual-blending and direction update strategy.IEEE Transactions on Information Forensics and Security, 19:5286–5300, 2024

    2024

  17. [18]

    Pixel2Feature attack (P2FA): Rethinking the perturbed space to enhance adversarial transferability

    Renpu Liu, Hao Wu, Jiawei Zhang, Xin Cheng, Xiangyang Luo, Bin Ma, and Jinwei Wang. Pixel2Feature attack (P2FA): Rethinking the perturbed space to enhance adversarial transferability. In Aarti Singh, Maryam Fazel, Daniel Hsu, Simon Lacoste-Julien, Felix Berkenkamp, Tegan Maharaj, Kiri Wagstaff, and Jerry Zhu, editors, Proceedings of the 42nd International...

    2025

  18. [19]

    Harnessing the computation redundancy in vits to boost adversarial transferability

    Jiani Liu, Zhiyuan Wang, Zeliang Zhang, Chao Huang, Susan Liang, Yunlong Tang, and Chenliang Xu. Harnessing the computation redundancy in vits to boost adversarial transferability. 2025

    2025

  19. [20]

    Ensemble diversity facilitates adversarial transferability

    Bowen Tang, Zheng Wang, Yi Bin, Qi Dou, Yang Yang, and Heng Tao Shen. Ensemble diversity facilitates adversarial transferability. In2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24377–24386, 2024

    2024

  20. [21]

    Diffusion models for imperceptible and transferable adversarial attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 47(2):961–977, 2025

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 47(2):961–977, 2025

    2025

  21. [22]

    Boosting adversarial transferability through augmentation in hypothesis space

    Yu Guo, Weiquan Liu, Qingshan Xu, Shijun Zheng, Shujun Huang, Yu Zang, Siqi Shen, Chenglu Wen, and Cheng Wang. Boosting adversarial transferability through augmentation in hypothesis space. In2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 19175–19185, 2025

    2025

  22. [23]

    Boosting adversarial transferability by block shuffle and rotation.2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24336–24346, 2023

    Kunyu Wang, Xu He, Wenxuan Wang, and Xiaosen Wang. Boosting adversarial transferability by block shuffle and rotation.2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24336–24346, 2023. 11 APREPRINT- NOVEMBER25, 2025

    2024

  23. [24]

    Boosting adversarial transferability across model genus by deformation-constrained warping

    Qinliang Lin, Cheng Luo, Zenghao Niu, Xilin He, Weicheng Xie, Yuanbo Hou, Linlin Shen, and Siyang Song. Boosting adversarial transferability across model genus by deformation-constrained warping. InAAAI Conference on Artificial Intelligence, 2024

    2024

  24. [25]

    Erhan, Ian J

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, D. Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks.CoRR, abs/1312.6199, 2013

    Pith/arXiv arXiv 2013

  25. [26]

    Hopcroft

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks.arXiv: Learning, 2019

    2019

  26. [27]

    Improving transferability of adversarial examples with input diversity.2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2725–2734, 2018

    Cihang Xie, Zhishuai Zhang, Jianyu Wang, Yuyin Zhou, Zhou Ren, and Alan Loddon Yuille. Improving transferability of adversarial examples with input diversity.2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2725–2734, 2018

    2019

  27. [28]

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks.2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4307–4316, 2019

    2019

  28. [29]

    Admix: Enhancing the transferability of adversarial attacks

    Xiaosen Wang, Xu He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 16138–16147, 2021

    2021

  29. [30]

    Zhang, and S

    Zheng Yuan, J. Zhang, and S. Shan. Adaptive image transformations for transfer-based adversarial attack.ArXiv, abs/2111.13844, 2021

    Pith/arXiv arXiv 2021

  30. [31]

    Structure invariant transformation for better adversarial transferability.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 4584–4596, 2023

    Xiaosen Wang, Zeliang Zhang, and Jianping Zhang. Structure invariant transformation for better adversarial transferability.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 4584–4596, 2023

    2023

  31. [32]

    Learning to transform dynamically for better adversarial transferability.2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24273–24283, 2024

    Rongyi Zhu, Zeliang Zhang, Susan Liang, Zhuo Liu, and Chenliang Xu. Learning to transform dynamically for better adversarial transferability.2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24273–24283, 2024

    2024

  32. [33]

    Ensemble adversarial training: Attacks and defenses.ArXiv, abs/1705.07204, 2017

    Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick Mcdaniel. Ensemble adversarial training: Attacks and defenses.ArXiv, abs/1705.07204, 2017

    Pith/arXiv arXiv 2017

  33. [34]

    Feature squeezing: Detecting adversarial examples in deep neural networks.ArXiv, abs/1704.01155, 2017

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks.ArXiv, abs/1704.01155, 2017

    Pith/arXiv arXiv 2017

  34. [35]

    Defense against adversarial attacks using high-level representation guided denoiser.2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1778–1787, 2017

    Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Jun Zhu, and Xiaolin Hu. Defense against adversarial attacks using high-level representation guided denoiser.2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1778–1787, 2017

    2018

  35. [36]

    Cohen, Elan Rosenfeld, and J

    Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing. ArXiv, abs/1902.02918, 2019

    Pith/arXiv arXiv 1902

  36. [37]

    Zico Kolter

    Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training.ArXiv, abs/2001.03994, 2020

    Pith/arXiv arXiv 2001

  37. [38]

    A self-supervised approach for adversarial robustness.2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 259–268, 2020

    Muzammal Naseer, Salman Hameed Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Murat Porikli. A self-supervised approach for adversarial robustness.2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 259–268, 2020

    2020

  38. [39]

    Lundberg and Su-In Lee

    Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. InNeural Information Processing Systems, 2017

    2017

  39. [40]

    Learning deep features for discriminative localization.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2921–2929, 2015

    Bolei Zhou, Aditya Khosla, Àgata Lapedriza, Aude Oliva, and Antonio Torralba. Learning deep features for discriminative localization.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2921–2929, 2015

    2016

  40. [41]

    Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Batra

    Ramprasaath R. Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization.International Journal of Computer Vision, 128:336 – 359, 2016

    2016

  41. [42]

    Data augmentation instead of explicit regularization.ArXiv, abs/1806.03852, 2018

    Alex Hernandez-Garcia and Peter König. Data augmentation instead of explicit regularization.ArXiv, abs/1806.03852, 2018

    Pith/arXiv arXiv 2018

  42. [43]

    Khoshgoftaar

    Connor Shorten and Taghi M. Khoshgoftaar. A survey on image data augmentation for deep learning.Journal of Big Data, 6:1–48, 2019

    2019

  43. [44]

    Zhang, Shaoqing Ren, and Jian Sun

    Kaiming He, X. Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2015

    2016

  44. [45]

    Weinberger

    Gao Huang, Zhuang Liu, and Kilian Q. Weinberger. Densely connected convolutional networks.2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2261–2269, 2016. 12 APREPRINT- NOVEMBER25, 2025

    2017

  45. [46]

    Rethinking the inception architecture for computer vision.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2818–2826, 2015

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2818–2826, 2015

    2016

  46. [47]

    Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He

    Saining Xie, Ross B. Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks.2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 5987–5995, 2016

    2017

  47. [48]

    Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A. Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning.ArXiv, abs/1602.07261, 2016

    Pith/arXiv arXiv 2016

  48. [49]

    An image is worth 16x16 words: Transformers for image recognition at scale.ArXiv, abs/2010.11929, 2020

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale.ArXiv, abs/2010.11929, 2020

    Pith/arXiv arXiv 2010

  49. [50]

    Rethinking spatial dimensions of vision transformers.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 11916–11925, 2021

    Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spatial dimensions of vision transformers.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 11916–11925, 2021

    2021

  50. [51]

    Visformer: The vision-friendly transformer.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 569–578, 2021

    Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian. Visformer: The vision-friendly transformer.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 569–578, 2021

    2021

  51. [52]

    Swin transformer: Hierarchical vision transformer using shifted windows.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 9992–10002, 2021

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 9992–10002, 2021

    2021

  52. [53]

    Going deeper with image transformers.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 32–42, 2021

    Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Herv’e J’egou. Going deeper with image transformers.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 32–42, 2021

    2021

  53. [54]

    Towards deep learning models resistant to adversarial attacks.ArXiv, abs/1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.ArXiv, abs/1706.06083, 2017. 13

    Pith/arXiv arXiv 2017