Pith. sign in

REVIEW 2 major objections 2 minor 94 references

MAC uses multi-view adaptive counterattacks to strengthen CLIP against adversarial attacks at test time without tuning.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.3

2026-06-27 22:26 UTC pith:TPUI5UKT

load-bearing objection MAC adds multi-view views plus soft per-view weighting to TTC, but the abstract gives no details on how corruption is estimated or whether the gains hold under strong attacks. the 2 major comments →

arxiv 2606.06938 v1 pith:TPUI5UKT submitted 2026-06-05 cs.CV

When CLIP Sees More, It Fights Back Harder: Multi-View Guided Adaptive Counterattacks for Test-Time Adversarial Robustness

Sunoh Kim , Daeho Um This is my paper
classification cs.CV
keywords adversarial robustnessCLIPtest-time counterattackmulti-viewvision-language modelszero-shot recognitionadaptive weighting
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces Multi-view guided Adaptive Counterattack (MAC) to fix fragility in prior test-time counterattack methods for CLIP models under strong attacks. It builds augmented views of the input, refines their embeddings through counterattacks, and applies soft weighting scaled to each view's estimated corruption degree before aggregation. This yields more reliable predictions while keeping inference fast and memory-light. A sympathetic reader would care because CLIP enables broad zero-shot use yet remains vulnerable to perturbations, and MAC offers a practical, tuning-free fix that scales across many datasets.

Core claim

MAC constructs augmented views of an input image to obtain diverse embeddings, performs counterattacks to refine corrupted embeddings of views, adaptively scales the counterattack intensity for each view based on its estimated corruption degree using corruption-aware soft weighting, and aggregates the adaptively counterattacked views to yield a robust final prediction.

What carries the argument

Multi-view guided Adaptive Counterattack (MAC) with corruption-aware soft weighting on augmented views

Load-bearing premise

Constructing augmented views and estimating per-view corruption degree allows reliable adaptive scaling of counterattack intensity that outperforms hard-gating under strong attacks.

What would settle it

Experiments on standard benchmarks that show MAC failing to improve robust accuracy over TTC when facing strong adversarial attacks would falsify the central claim.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • MAC substantially improves robustness compared to prior TTC methods under strong attacks across 20 datasets.
  • It preserves high inference speed and memory efficiency with its tuning-free design.
  • The approach handles diverse attack scenarios effectively.
  • Adaptive soft weighting enables better handling of varying corruption severity than hard-gating.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • MAC could be applied to other vision-language models that share CLIP's zero-shot setup and robustness limitations.
  • The multi-view adaptive strategy might combine with other test-time adaptation methods for compounded gains in deployed systems.
  • Real-world applications using CLIP for classification could gain reliability in adversarial environments without requiring model changes.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 2 minor

Summary. The paper proposes Multi-view guided Adaptive Counterattack (MAC) to improve CLIP's test-time adversarial robustness. Building on Test-time Counterattack (TTC), MAC constructs augmented views of an input, performs counterattacks on the views' embeddings, estimates each view's corruption degree to apply soft-weighted adaptive scaling of counterattack intensity (instead of TTC's noise-driven hard-gating), and aggregates the refined views for the final prediction. The method is presented as tuning-free and efficient; experiments on 20 datasets under diverse attacks are claimed to show substantial robustness gains while preserving inference speed and memory use.

Significance. If the per-view corruption estimation and soft weighting prove reliable and outperform hard-gating under strong attacks without new failure modes, the work would offer a practical, training-free advance for zero-shot VLM robustness. The open-sourced code at the cited GitHub link is a clear strength supporting reproducibility.

major comments (2)
  1. [Method (likely §3)] The central claim that multi-view construction plus corruption-aware soft weighting yields better robustness than TTC's hard-gating rests on the reliability of the per-view corruption-degree estimator. The manuscript must specify the exact inputs, formula, and any safeguards against estimation error (e.g., attack sensitivity of the estimator itself) in the method section; without this, it is impossible to verify that the adaptive mechanism does not collapse under the strong attacks highlighted in the abstract.
  2. [Experiments section] Table or figure reporting quantitative results (e.g., accuracy under PGD or AutoAttack of varying strength): the abstract asserts "substantial improvements" across 20 datasets, but load-bearing evidence requires explicit numbers, attack norms, dataset splits, and direct comparisons to TTC and other baselines to substantiate the claim that adaptive scaling is the decisive factor.
minor comments (2)
  1. Clarify notation for the soft-weighting function and aggregation step; ensure all symbols are defined before first use.
  2. The efficiency claims (speed and memory) should be supported by explicit timing/memory measurements on the same hardware used for baselines.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. We address the two major comments point-by-point below. Both concerns can be resolved by expanding the method description and strengthening the experimental presentation in a revised manuscript.

read point-by-point responses

  1. Referee: [Method (likely §3)] The central claim that multi-view construction plus corruption-aware soft weighting yields better robustness than TTC's hard-gating rests on the reliability of the per-view corruption-degree estimator. The manuscript must specify the exact inputs, formula, and any safeguards against estimation error (e.g., attack sensitivity of the estimator itself) in the method section; without this, it is impossible to verify that the adaptive mechanism does not collapse under the strong attacks highlighted in the abstract.

    Authors: We agree that the per-view corruption-degree estimator requires a more explicit specification to support verification of the adaptive mechanism. The current manuscript describes the estimator at a high level in Section 3 but does not provide the precise inputs, mathematical formula, or explicit safeguards. We will revise the method section to include these details (exact inputs consisting of view embeddings and text embeddings, the formula, and any bounding or averaging steps used as safeguards) together with a short discussion of estimator behavior under strong attacks. This revision will directly address the concern. revision: yes

  2. Referee: [Experiments section] Table or figure reporting quantitative results (e.g., accuracy under PGD or AutoAttack of varying strength): the abstract asserts "substantial improvements" across 20 datasets, but load-bearing evidence requires explicit numbers, attack norms, dataset splits, and direct comparisons to TTC and other baselines to substantiate the claim that adaptive scaling is the decisive factor.

    Authors: The manuscript already contains tables in Section 4 that report accuracy numbers under PGD and AutoAttack (with specified norms and standard dataset splits) together with direct comparisons to TTC and other baselines across the 20 datasets. To make the contribution of the soft-weighting component more transparent and to strengthen the evidence that adaptive scaling is decisive, we will add a dedicated ablation table or figure in the revision that isolates the effect of corruption-aware soft weighting versus hard-gating, including the corresponding numerical results. revision: yes

Circularity Check

0 steps flagged

No significant circularity; method builds on external TTC with independent components

full rationale

The paper describes MAC as an extension of cited TTC work using multi-view augmentation, per-view corruption estimation, and soft weighting, presented as distinct algorithmic steps without any equations, fitted parameters, or self-citations that reduce the central claim to its inputs by construction. The abstract and description supply no self-definitional loops, renamed predictions, or load-bearing self-citations; the derivation remains self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract provides no explicit free parameters, axioms, or invented entities; the method is described as tuning-free.

pith-pipeline@v0.9.1-grok · 5749 in / 981 out tokens · 20067 ms · 2026-06-27T22:26:07.774310+00:00 · methodology

0 comments
read the original abstract

Vision-language models such as CLIP have achieved remarkable zero-shot recognition capabilities, yet their robustness against adversarial perturbations remains limited. Test-time counterattack (TTC) was recently proposed to improve CLIP's robustness by perturbing an input image to steer it away from a corrupted state during inference. However, TTC remains fragile under strong attacks because its counterattack relies on a directly corrupted original view and employs a noise-driven hard-gating scheme that cannot adapt to varying corruption severity. To address these limitations, we introduce Multi-view guided Adaptive Counterattack (MAC), which performs counterattacks for multi-view with corruption-aware soft weighting. Specifically, MAC first constructs augmented views of an input image to obtain diverse embeddings. It then performs counterattacks to refine corrupted embeddings of views. Next, MAC adaptively scales the counterattack intensity for each view based on its estimated corruption degree. Finally, the adaptively counterattacked views are aggregated to yield a robust final prediction. Extensive experiments across 20 datasets and diverse attack scenarios demonstrate that MAC substantially improves robustness while preserving high inference speed and memory efficiency with its tuning-free design. Our code is available at https://github.com/sunoh-kim/MAC.

Figures

Figures reproduced from arXiv: 2606.06938 by Daeho Um, Sunoh Kim.

Figure 1
Figure 1. Figure 1: Comparison of test-time defense methods for CLIP un [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Comparison under weak (PGD-1 with a small perturba [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Pipeline of the proposed MAC framework. MAC enhances CLIP’s adversarial robustness by leveraging multiple augmented [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Mean corruption degree measured on the ImageNet [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Visualization of clean, adversarial, and counterattacked embeddings from six ImageNet classes. Compared to TTC, our MAC re [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Analysis with respect to key hyperparameters: (a) threshold [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Ablation study of the multi-view guided counterattack, [PITH_FULL_IMAGE:figures/full_fig_p008_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Ablation study of the corruption-aware soft weighting, [PITH_FULL_IMAGE:figures/full_fig_p008_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Comparison of the mean corruption degree of our MAC and the mean noise-driven deviation of TTC [ [PITH_FULL_IMAGE:figures/full_fig_p012_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Analysis of the temperature parameter τtemp, averaged over ten fine-grained recognition datasets. Moderate temperature values yield stable and near-optimal performance, while large tem￾peratures reduce adaptivity and degrade overall performance. driven deviation as a binary trigger: only images with devi￾ation below a fixed threshold are counterattacked. To examine how faithfully each metric reflects actu… view at source ↗
Figure 11
Figure 11. Figure 11: Qualitative visualization of MAC’s visual preservation. For each example, we show four visual states: the clean image, the [PITH_FULL_IMAGE:figures/full_fig_p015_11.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

94 extracted references · 3 canonical work pages · 2 internal anchors

  1. [1]

    Combating adver- saries with anti-adversaries

    Motasem Alfarra, Juan C P ´erez, Ali Thabet, Adel Bibi, Philip HS Torr, and Bernard Ghanem. Combating adver- saries with anti-adversaries. InAAAI, 2022. 3

    2022

  2. [2]

    Square attack: a query-efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flam- marion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. InECCV,

  3. [3]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples. InICML, 2018. 7, 2

    2018

  4. [4]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. InICML,

  5. [5]

    Recent advances in adversarial training for adversarial ro- bustness

    Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial ro- bustness. InIJCAI, 2021. 2

    2021

  6. [6]

    Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation

    Yoshua Bengio, Nicholas L ´eonard, and Aaron Courville. Estimating or propagating gradients through stochastic neurons for conditional computation.arXiv preprint arXiv:1308.3432, 2013. 7, 2

    work page internal anchor Pith review Pith/arXiv arXiv 2013

  7. [7]

    Food-101–mining discriminative components with random forests

    Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101–mining discriminative components with random forests. InECCV, 2014. 5, 1

    2014

  8. [8]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In2017 ieee symposium on security and privacy (sp), 2017. 2, 7

    2017

  9. [9]

    Multi-cache enhanced prototype learning for test- time generalization of vision-language models

    Xinyu Chen, Haotian Zhai, Can Zhang, Xiupeng Shi, and Ruirui Li. Multi-cache enhanced prototype learning for test- time generalization of vision-language models. InICCV,

  10. [10]

    Describing textures in the wild

    Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. InCVPR, 2014. 5, 1

    2014

  11. [11]

    An analysis of single-layer networks in unsupervised feature learning

    Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In AISTATS, 2011. 5, 1

    2011

  12. [12]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. InICML,

  13. [13]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. InICML, 2020. 2, 7

    2020

  14. [14]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. InCVPR, 2009. 5, 1 6

    2009

  15. [15]

    Learning gener- ative visual models from few training examples: An incre- mental bayesian approach tested on 101 object categories

    Li Fei-Fei, Rob Fergus, and Pietro Perona. Learning gener- ative visual models from few training examples: An incre- mental bayesian approach tested on 101 object categories. In CVPR workshop, 2004. 5, 1

    2004

  16. [16]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. InICLR,

  17. [17]

    Caltech- 256 object category dataset

    Gregory Griffin, Alex Holub, Pietro Perona, et al. Caltech- 256 object category dataset. Technical report, Technical Report 7694, California Institute of Technology Pasadena,

  18. [18]

    Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 2019. 5, 1

    2019

  19. [19]

    Augmix: A simple data processing method to improve robustness and uncertainty

    Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. InICLR, 2020. 6, 1

    2020

  20. [20]

    The many faces of robust- ness: A critical analysis of out-of-distribution generalization

    Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kada- vath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, et al. The many faces of robust- ness: A critical analysis of out-of-distribution generalization. InICCV, 2021. 5, 1

    2021

  21. [21]

    Natural adversarial examples

    Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Stein- hardt, and Dawn Song. Natural adversarial examples. In CVPR, 2021. 5, 1

    2021

  22. [22]

    Cosmic: Clique- oriented semantic multi-space integration for robust clip test- time adaptation

    Fanding Huang, Jingyan Jiang, Qinting Jiang, Hebei Li, Faisal Nadeem Khan, and Zhi Wang. Cosmic: Clique- oriented semantic multi-space integration for robust clip test- time adaptation. InCVPR, 2025. 3

    2025

  23. [23]

    Black-box adversarial attacks with limited queries and information

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. InICML, 2018. 2

    2018

  24. [24]

    Test-time prompt tuning for zero-shot depth comple- tion

    Chanhwi Jeong, Inhwan Bae, Jin-Hwi Park, and Hae-Gon Jeon. Test-time prompt tuning for zero-shot depth comple- tion. InICCV, 2025. 3

    2025

  25. [25]

    Scaling up visual and vision-language representation learning with noisy text supervision

    Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoc Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision-language representation learning with noisy text supervision. InICML, 2021. 1

    2021

  26. [26]

    Efficient test-time adaptation of vision-language models

    Adilbek Karmanov, Dayan Guan, Shijian Lu, Abdulmotaleb El Saddik, and Eric Xing. Efficient test-time adaptation of vision-language models. InCVPR, 2024. 3

    2024

  27. [27]

    Swag-net: Semantic word-aware graph network for temporal video grounding

    Sunoh Kim, Taegil Ha, Kimin Yun, and Jin Young Choi. Swag-net: Semantic word-aware graph network for temporal video grounding. InACM CIKM, 2022. 2

    2022

  28. [28]

    Gaussian mixture proposals with pull- push learning scheme to capture diverse events for weakly supervised temporal video grounding

    Sunoh Kim, Jungchan Cho, Joonsang Yu, YoungJoon Yoo, and Jin Young Choi. Gaussian mixture proposals with pull- push learning scheme to capture diverse events for weakly supervised temporal video grounding. InAAAI, 2024. 1

    2024

  29. [29]

    Learnable negative proposals using dual-signed cross- entropy loss for weakly supervised video moment localiza- tion

    Sunoh Kim, Daeho Um, HyunJun Choi, and Jin Young Choi. Learnable negative proposals using dual-signed cross- entropy loss for weakly supervised video moment localiza- tion. InMM, 2024. 2

    2024

  30. [30]

    Finding opti- mal video moment without training: Gaussian boundary op- timization for weakly supervised video grounding.IEEE Transactions on Multimedia, 2026

    Sunoh Kim, Kimin Yun, and Daeho Um. Finding opti- mal video moment without training: Gaussian boundary op- timization for weakly supervised video grounding.IEEE Transactions on Multimedia, 2026. 2

    2026

  31. [31]

    3d object representations for fine-grained categorization

    Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for fine-grained categorization. In ICCV workshops, 2013. 5, 1

    2013

  32. [32]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 5, 1

    2009

  33. [33]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. InArtificial intel- ligence safety and security. Chapman and Hall/CRC, 2018. 2

    2018

  34. [34]

    One prompt word is enough to boost adversarial robustness for pre-trained vision-language models

    Lin Li, Haoyan Guan, Jianing Qiu, and Michael Spratling. One prompt word is enough to boost adversarial robustness for pre-trained vision-language models. InCVPR, 2024. 1, 3

    2024

  35. [35]

    Language-driven anchors for zero-shot ad- versarial robustness

    Xiao Li, Wei Zhang, Yining Liu, Zhanhao Hu, Bo Zhang, and Xiaolin Hu. Language-driven anchors for zero-shot ad- versarial robustness. InCVPR, 2024. 1

    2024

  36. [36]

    Visual instruction tuning

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. InNeurIPS, 2023. 1

    2023

  37. [37]

    Visualiz- ing data using t-sne.Journal of machine learning research,

    Laurens van der Maaten and Geoffrey Hinton. Visualiz- ing data using t-sne.Journal of machine learning research,

  38. [38]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. InICLR, 2018. 2, 3, 4, 6

    2018

  39. [39]

    Fine-Grained Visual Classification of Aircraft

    Subhransu Maji, Esa Rahtu, Juho Kannala, Matthew Blaschko, and Andrea Vedaldi. Fine-grained visual classi- fication of aircraft.arXiv preprint arXiv:1306.5151, 2013. 5, 1

    work page internal anchor Pith review Pith/arXiv arXiv 2013

  40. [40]

    Understanding zero-shot adversarial robust- ness for large-scale models

    Chengzhi Mao, Scott Geng, Junfeng Yang, Xin Wang, and Carl V ondrick. Understanding zero-shot adversarial robust- ness for large-scale models. InICLR, 2023. 1, 3

    2023

  41. [41]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. InCVPR, 2016. 2

    2016

  42. [42]

    Universal adversarial perturba- tions

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturba- tions. InCVPR, 2017. 2

    2017

  43. [43]

    Diffusion models for ad- versarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for ad- versarial purification. InICML, 2022. 2

    2022

  44. [44]

    Automated flower classification over a large number of classes

    Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. InIn- dian conference on computer vision, graphics & image pro- cessing, 2008. 5, 1

    2008

  45. [45]

    The limitations of deep learning in adversarial settings

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In2016 IEEE European symposium on security and privacy (Eu- roS&P), 2016. 2

    2016

  46. [46]

    Cats and dogs

    Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, and CV Jawahar. Cats and dogs. InCVPR, 2012. 5, 1 7

    2012

  47. [47]

    Enhancing adversarial robustness via test-time transforma- tion ensembling

    Juan C P ´erez, Motasem Alfarra, Guillaume Jeanneret, Laura Rueda, Ali Thabet, Bernard Ghanem, and Pablo Arbel ´aez. Enhancing adversarial robustness via test-time transforma- tion ensembling. InICCV, 2021. 3

    2021

  48. [48]

    Learn- ing transferable visual models from natural language super- vision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learn- ing transferable visual models from natural language super- vision. InICML, 2021. 1, 3, 5, 6, 7, 4

    2021

  49. [49]

    Zero-shot text-to-image generation

    Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea V oss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. InICML, 2021. 1

    2021

  50. [50]

    Do imagenet classifiers generalize to im- agenet? InICML, 2019

    Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to im- agenet? InICML, 2019. 5, 1

    2019

  51. [51]

    Overfitting in ad- versarially robust deep learning

    Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in ad- versarially robust deep learning. InICML, 2020. 2

    2020

  52. [52]

    Photorealistic text-to-image diffusion models with deep language understanding

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. InNeurIPS, 2022. 1

    2022

  53. [53]

    Provably robust deep learning via adversarially trained smoothed clas- sifiers

    Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed clas- sifiers. InNeurIPS, 2019. 2

    2019

  54. [54]

    Denoised smoothing: A provable defense for pretrained classifiers

    Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers. InNeurIPS, 2020

    2020

  55. [55]

    Defense-gan: Protecting classifiers against adversarial at- tacks using generative models

    Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial at- tacks using generative models. InICLR, 2018. 2

    2018

  56. [56]

    Robust clip: Unsupervised ad- versarial fine-tuning of vision embeddings for robust large vision-language models

    Christian Schlarmann, Naman Deep Singh, Francesco Croce, and Matthias Hein. Robust clip: Unsupervised ad- versarial fine-tuning of vision embeddings for robust large vision-language models. InICML, 2024. 1, 3

    2024

  57. [57]

    Improving robustness against common corruptions by covariate shift adaptation

    Steffen Schneider, Evgenia Rusak, Luisa Eck, Oliver Bring- mann, Wieland Brendel, and Matthias Bethge. Improving robustness against common corruptions by covariate shift adaptation. InNeurIPS, 2020. 2

    2020

  58. [58]

    Adversarial training for free! InNeurIPS, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! InNeurIPS, 2019. 2

    2019

  59. [59]

    O-tpt: Orthogonality constraints for calibrating test-time prompt tuning in vision-language models

    Ashshak Sharifdeen, Muhammad Akhtar Munir, Sanoojan Baliah, Salman Khan, and Muhammad Haris Khan. O-tpt: Orthogonality constraints for calibrating test-time prompt tuning in vision-language models. InCVPR, 2025. 3

    2025

  60. [60]

    Jail- break in pieces: Compositional adversarial attacks on multi- modal language models

    Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. Jail- break in pieces: Compositional adversarial attacks on multi- modal language models. InICLR, 2023. 3

    2023

  61. [61]

    R-tpt: Improving adversarial robustness of vision-language models through test-time prompt tuning

    Lijun Sheng, Jian Liang, Zilei Wang, and Ran He. R-tpt: Improving adversarial robustness of vision-language models through test-time prompt tuning. InCVPR, 2025. 2, 3, 5, 6, 7

    2025

  62. [62]

    Test- time prompt tuning for zero-shot generalization in vision- language models

    Manli Shu, Weili Nie, De-An Huang, Zhiding Yu, Tom Goldstein, Anima Anandkumar, and Chaowei Xiao. Test- time prompt tuning for zero-shot generalization in vision- language models. InNeurIPS, 2022. 2, 3

    2022

  63. [63]

    Clip models are few-shot learners: Empirical studies on vqa and visual entailment

    Haoyu Song, Li Dong, Wei-Nan Zhang, Ting Liu, and Furu Wei. Clip models are few-shot learners: Empirical studies on vqa and visual entailment. InACL, 2022. 1, 2

    2022

  64. [64]

    A dataset of 101 human action classes from videos in the wild.Center for Research in Computer Vision, 2012

    Khurram Soomro, Amir Roshan Zamir, and Mubarak Shah. A dataset of 101 human action classes from videos in the wild.Center for Research in Computer Vision, 2012. 5, 1

    2012

  65. [65]

    One pixel attack for fooling deep neural networks.IEEE Transactions on Evolutionary Computation, 2019

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks.IEEE Transactions on Evolutionary Computation, 2019. 2

    2019

  66. [66]

    Test-time training with self- supervision for generalization under distribution shifts

    Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexei Efros, and Moritz Hardt. Test-time training with self- supervision for generalization under distribution shifts. In ICML, 2020. 3

    2020

  67. [67]

    In- triguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. In- triguing properties of neural networks. InICLR, 2014. 2, 3

    2014

  68. [68]

    Tesla: Test-time self-learning with au- tomatic adversarial augmentation

    Devavrat Tomar, Guillaume Vray, Behzad Bozorgtabar, and Jean-Philippe Thiran. Tesla: Test-time self-learning with au- tomatic adversarial augmentation. InCVPR, 2023. 3

    2023

  69. [69]

    On the zero-shot adversarial robustness of vision-language models: A truly zero-shot and training-free approach

    Baoshun Tong, Hanjiang Lai, Yan Pan, and Jian Yin. On the zero-shot adversarial robustness of vision-language models: A truly zero-shot and training-free approach. InCVPR, 2025. 3

    2025

  70. [70]

    Tent: Fully test-time adaptation by entropy minimization

    Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Ol- shausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. InICLR, 2021. 3

    2021

  71. [71]

    Learning robust global representations by penalizing local predictive power

    Haohan Wang, Songwei Ge, Zachary Lipton, and Eric P Xing. Learning robust global representations by penalizing local predictive power. InNeurIPS, 2019. 5, 1

    2019

  72. [72]

    Con- tinual test-time domain adaptation

    Qin Wang, Olga Fink, Luc Van Gool, and Dengxin Dai. Con- tinual test-time domain adaptation. InCVPR, 2022. 3

    2022

  73. [73]

    Pre- trained model guided fine-tuning for zero-shot adversarial robustness

    Sibo Wang, Jie Zhang, Zheng Yuan, and Shiguang Shan. Pre- trained model guided fine-tuning for zero-shot adversarial robustness. InCVPR, 2024. 1, 3

    2024

  74. [74]

    Tapt: Test-time adversarial prompt tuning for robust inference in vision-language models

    Xin Wang, Kai Chen, Jiaming Zhang, Jingjing Chen, and Xingjun Ma. Tapt: Test-time adversarial prompt tuning for robust inference in vision-language models. InCVPR, 2025. 2, 3, 6, 7, 1

    2025

  75. [75]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. InICLR, 2020. 2

    2020

  76. [76]

    arXiv preprint arXiv:2106.04938 , year=

    Boxi Wu, Heng Pan, Li Shen, Jindong Gu, Shuai Zhao, Zhifeng Li, Deng Cai, Xiaofei He, and Wei Liu. At- tacking adversarial attacks as a defense.arXiv preprint arXiv:2106.04938, 2021. 2, 3

    work page arXiv 2021

  77. [77]

    Adversarial weight perturbation helps robust generalization

    Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. InNeurIPS,

  78. [78]

    Sun database: Large-scale scene recognition from abbey to zoo

    Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. InIEEE computer soci- ety conference on computer vision and pattern recognition, pages 3485–3492. IEEE, 2010. 5, 1

    2010

  79. [79]

    Improving transferabil- 8 ity of adversarial examples with input diversity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferabil- 8 ity of adversarial examples with input diversity. InCVPR,

  80. [80]

    Chain of attack: On the robustness of vision-language models against transfer-based adversarial attacks

    Peng Xie, Yequan Bie, Jianda Mao, Yangqiu Song, Yang Wang, Hao Chen, and Kani Chen. Chain of attack: On the robustness of vision-language models against transfer-based adversarial attacks. InCVPR, 2025. 2

    2025

Showing first 80 references.