Pith. sign in

REVIEW 3 major objections 2 minor 48 references

TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attacks

T0 review · 3 major / 2 minor · reviewed 2026-06-27 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A two-stage frequency decoupling framework separates optimization for heterogeneous adversarial threats to achieve more balanced robustness.

desk verdict TaFD adds a clustering-plus-conditional-conv pipeline to split heterogeneous threats in frequency space, but the separability claim is the weakest part and needs direct checks. read the letter →

arxiv 2606.17540 v1 pith:E2NMLKRC submitted 2026-06-16 cs.CV

Mengda Xie , Yiling He , Meie Fang This is my paper · ORCID
classification cs.CV
keywords adversarialrobustnessfrequencydomainheterogeneousattacksjointtrainingspectralclusteringdecoupledoptimizationimageclassificationthreatidentification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that joint adversarial training suffers from gradient incompatibility between different attack types such as norm-bounded and semantic perturbations. It shows these threats display separable spectral characteristics in the frequency domain that support unsupervised clustering into latent domains. TaFD first clusters attack spectral prototypes to discover these domains and trains a lightweight classifier for inference-time identification, then applies frequency-conditional convolutions that learn domain-specific spectral masks and route inputs to corresponding expert subnetworks. This divide-and-conquer approach is validated on CIFAR-10, CIFAR-100 and Tiny-ImageNet using both ResNet and MobileViT, yielding higher average robust accuracy than joint training or other frequency baselines while preserving clean accuracy. A sympathetic reader would care because it directly addresses the negative transfer problem that has limited multi-threat defenses.

What carries the argument

Frequency-Conditional Convolution that learns threat-domain-specific spectral masks and routes each sample to the corresponding expert, enforcing structural parameter separation.

What would settle it

If unsupervised clustering of attack spectral prototypes produces domains where frequency-conditional routing yields no improvement in average robust accuracy over standard joint adversarial training on the same benchmarks, the central claim would be falsified.

Watch

Extended reading notes

Core claim

TaFD reformulates joint adversarial training as a frequency-domain divide-and-conquer paradigm: unsupervised clustering of attack spectral prototypes identifies latent threat domains, a lightweight classifier predicts the domain at inference, and Frequency-Conditional Convolution learns threat-specific spectral masks that route each sample to an expert module, enforcing parameter separation and alleviating optimization conflicts.

Load-bearing premise

Conflicting threats exhibit separable spectral characteristics in the frequency domain that can be discovered via unsupervised clustering of attack spectral prototypes.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 2 minor

Summary. The manuscript proposes Threat-aware Frequency Decoupling (TaFD), a two-stage framework for multi-threat adversarial robustness. It uses first-order gradient analysis to formalize gradient incompatibility in joint adversarial training (JAT) under heterogeneous threats (ℓ_p-bounded vs. semantic), observes that these threats exhibit separable spectral characteristics in the frequency domain, and introduces unsupervised clustering of attack spectral prototypes to discover latent threat domains. A lightweight classifier is trained for inference-time domain identification, after which a Frequency-Conditional Convolution applies threat-specific spectral masks and routes samples to corresponding experts. Experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet using ResNet and MobileViT report an approximately 11% improvement in average robust accuracy over JAT and frequency-domain baselines while preserving leading clean accuracy.

Significance. If the core assumption that unsupervised clustering of spectral prototypes reliably discovers and generalizes separable threat domains holds, TaFD would offer a concrete mechanism for mitigating negative transfer in multi-threat settings beyond standard JAT. The combination of gradient-based motivation and empirical results across three datasets and two architectures constitutes a substantive contribution to the literature on heterogeneous adversarial defenses, provided the clustering step can be shown to be the source of the reported gains rather than an auxiliary fitting procedure.

major comments (3)
  1. [Abstract] Abstract: The central claim that conflicting threats exhibit separable spectral characteristics discoverable via unsupervised clustering of attack spectral prototypes is load-bearing for attributing the 11% robust-accuracy gain to the proposed divide-and-conquer paradigm. The manuscript provides no description of the clustering algorithm, the construction of spectral prototypes, the number of clusters, the feature representation used, or any validation metric (e.g., intra/inter-cluster distances or alignment with attack-type labels). Without these details it is impossible to determine whether the discovered domains correspond to the heterogeneous threats or whether the framework reduces to JAT plus routing overhead.
  2. [Section 2] Section 2 (first-order gradient analysis): The paper states that gradient incompatibility is formalized and that decoupled optimization is shown to be necessary, yet no explicit equations, derivations, or quantitative measures of incompatibility (e.g., cosine similarity of gradients across threat types) are supplied. This absence leaves the theoretical motivation for the two-stage framework unsupported by verifiable analysis.
  3. [Experiments] Experimental section and tables: The reported 11% average robust-accuracy improvement is presented without statistical significance tests, standard deviations across multiple random seeds, or ablation studies that isolate the contribution of the Frequency-Conditional Convolution and clustering step from hyperparameter tuning or the base JAT procedure. In addition, it is unclear whether the number of clusters or clustering features were selected post-hoc on the test set.
minor comments (2)
  1. [Abstract] The term 'Frequency-Conditional Convolution' is introduced without a precise mathematical definition or diagram showing how the conditional masks are generated and applied.
  2. [Method] Notation for spectral prototypes and threat-domain identifiers should be introduced consistently with a single symbol table or early section to avoid ambiguity when reading the method description.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive and detailed feedback. We address each major comment point-by-point below, providing clarifications and committing to revisions where the manuscript can be strengthened without misrepresenting our contributions.

read point-by-point responses

  1. Referee: [Abstract] Abstract: The central claim that conflicting threats exhibit separable spectral characteristics discoverable via unsupervised clustering of attack spectral prototypes is load-bearing for attributing the 11% robust-accuracy gain to the proposed divide-and-conquer paradigm. The manuscript provides no description of the clustering algorithm, the construction of spectral prototypes, the number of clusters, the feature representation used, or any validation metric (e.g., intra/inter-cluster distances or alignment with attack-type labels). Without these details it is impossible to determine whether the discovered domains correspond to the heterogeneous threats or whether the framework reduces to JAT plus routing overhead.

    Authors: We agree the abstract is too concise on these points. Section 3.2 of the manuscript specifies k-means clustering (k=2) on spectral prototypes constructed from the magnitude of the FFT of adversarial perturbations, using channel-averaged spectra as features. We will revise the abstract to include a one-sentence summary of the clustering procedure and add silhouette scores plus alignment metrics with attack labels to the main text or supplementary material to substantiate separability. revision: yes

  2. Referee: [Section 2] Section 2 (first-order gradient analysis): The paper states that gradient incompatibility is formalized and that decoupled optimization is shown to be necessary, yet no explicit equations, derivations, or quantitative measures of incompatibility (e.g., cosine similarity of gradients across threat types) are supplied. This absence leaves the theoretical motivation for the two-stage framework unsupported by verifiable analysis.

    Authors: Section 2 presents the gradient incompatibility analysis via the expected inner product of gradients from different threat types. We will expand this section in revision to include the explicit equations for the cosine similarity metric, the derivation steps establishing negative transfer, and tabulated quantitative incompatibility values measured on the training data. revision: yes

  3. Referee: [Experiments] Experimental section and tables: The reported 11% average robust-accuracy improvement is presented without statistical significance tests, standard deviations across multiple random seeds, or ablation studies that isolate the contribution of the Frequency-Conditional Convolution and clustering step from hyperparameter tuning or the base JAT procedure. In addition, it is unclear whether the number of clusters or clustering features were selected post-hoc on the test set.

    Authors: We will add standard deviations over three random seeds and paired t-test results to all tables in the revision. Ablation studies isolating the clustering and Frequency-Conditional Convolution components (currently in supplementary material) will be integrated into the main experimental section. The number of clusters was chosen via validation-set silhouette analysis prior to test evaluation; we will explicitly state the selection protocol and confirm no test-set leakage occurred. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: derivation is self-contained empirical framework

full rationale

The paper's chain begins with a first-order gradient analysis formalizing incompatibility, an observational claim of separable spectral characteristics, and an unsupervised clustering step to discover domains; none of these reduce by construction to fitted outputs or self-citations. The reported robustness gains are presented as empirical benchmark results rather than predictions forced by internal definitions or renamings. No load-bearing equation or premise collapses to its own inputs, and the two-stage framework is motivated externally by the stated observation rather than tautologically.

Assumptions & free parameters 0 free parameters · 0 assumptions · 1 invented entities

The central claim rests on the unverified premise that attack spectral prototypes form distinct clusters that generalize to unseen attacks and that a lightweight classifier can reliably identify the domain at inference time; no free parameters or invented entities are quantified in the abstract.

invented entities (1)
  • Frequency-Conditional Convolution
    purpose: Learns threat-domain-specific spectral masks and routes samples to corresponding experts
    Introduced as the core routing mechanism in the two-stage framework

how reviews work

0 comments
Cite this review

Pith. "Pith review of TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attacks." pith.science (2026). https://pith.science/paper/E2NMLKRC

@misc{pith2026260617540,
  author       = {Pith},
  title        = {Pith review of: TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/E2NMLKRC}},
  note         = {Machine review of arXiv:2606.17540}
}
abstract

Multi-threat robustness remains a fundamental challenge in deep learning. Although joint adversarial training (JAT) is widely adopted, it suffers from negative transfer under heterogeneous threats, particularly between $\ell_p$-bounded and semantic attacks. Through first-order gradient analysis, we formalize this as gradient incompatibility and theoretically establish the necessity of decoupled optimization. We further reveal that these conflicting threats exhibit separable spectral characteristics in the frequency domain. Motivated by this observation, we propose Threat-aware Frequency Decoupling (TaFD), a two-stage defense framework that reformulates JAT as a frequency-domain divide-and-conquer paradigm. TaFD first discovers latent threat domains via unsupervised clustering of attack spectral prototypes and trains a lightweight classifier for inference-time threat domain identification. Conditioned on the prediction, TaFD employs a Frequency-Conditional Convolution that learns threat-domain-specific spectral masks and routes each sample to the corresponding expert, enforcing structural parameter separation and alleviating optimization conflicts. We validate TaFD on three representative image-classification benchmarks (CIFAR-10, CIFAR-100, and Tiny-ImageNet) and on two representative architectures (the convolutional ResNet and the hybrid-transformer MobileViT). Extensive results demonstrate that TaFD achieves more balanced robustness against heterogeneous attacks than existing JAT and frequency-domain baselines, improving average robust accuracy by approximately 11\% over the strongest baseline while maintaining leading clean accuracy.

Figures

Figures reproduced from arXiv: 2606.17540 by the authors.

Figure 1
Figure 1. Trade-offs in joint adversarial training (Top) and [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Spatial vs. frequency domain separability on CIFAR [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Geometric illustration of negative transfer at a [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Overview of the TaFD Defense Framework. TaFD employs a two-stage Diagnosis–Dispatch architecture. Stage 1 [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Robustness of TaFD under adaptive attacks jointly [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Effect of the number of threat domains 𝐾 on TaFD performance and training cost. The left panel shows average robust accuracy (Avg-RA) and clean accuracy, while the right panel shows training GPU memory usage and training time. 6 Discussion Computational Overhead. TaFD …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 2 canonical work pages

  1. [1]

    Anish Athalye, Nicholas Carlini, and David A. Wagner. 2018. Obfuscated Gra- dients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples. InProceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsmässan, Stockholm, Sweden, July 10-15, 2018 (Proceedings of Machine Learning Research, Vol. 80). PMLR...

    2018

  2. [2]

    Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A. Forsyth

  3. [3]

    In8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020

    Unrestricted Adversarial Examples via Semantic Manipulation. In8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net

    2020

  4. [4]

    Nicholas Carlini and David A. Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017. IEEE Computer Society, 39–57

    2017

  5. [5]

    Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. 2023. Content-based Unrestricted Adversarial Attack. InAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Informa- tion Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023

    2023

  6. [6]

    Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. InProceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event (Proceedings of Machine Learning Research, Vol. 119). PMLR, 2206–2216

    2020

  7. [7]

    Francesco Croce and Matthias Hein. 2022. Adversarial Robustness against Multi- ple and Single 𝑙_𝑝 -Threat Models via Quick Fine-Tuning of Robust Classifiers. InInternational Conference on Machine Learning. PMLR, 4436–4454

    2022

  8. [8]

    Xuelong Dai, Kaisheng Liang, and Bin Xiao. 2024. AdvDiff: Generating Un- restricted Adversarial Examples Using Diffusion Models. InComputer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part XLVI. 93–109

    2024

Show all 48 references
  1. [9]

    Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Alek- sander Madry. 2019. Exploring the Landscape of Spatial Robustness. InProceed- ings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA (Procee...

    2019

  2. [10]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings

    2015

  3. [11]

    Chuan Guo, Mayank Rana, Moustapha Cissé, and Laurens van der Maaten. 2018. Countering Adversarial Images using Input Transformations. In6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedi...

    2018

  4. [12]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep Residual Learning for Image Recognition. In2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016. IEEE Computer Society, 770–778

    2016

  5. [13]

    Hossein Hosseini and Radha Poovendran. 2018. Semantic Adversarial Examples. In2018 IEEE Conference on Computer Vision and Pattern Recognition Workshops, CVPR Workshops 2018, Salt Lake City, UT, USA, June 18-22, 2018. Computer Vision Foundation / IEEE Computer Society, 1614–1619

    2018

  6. [14]

    Yihao Huang, Liangru Sun, Qing Guo, Felix Juefei-Xu, Jiayi Zhu, Jincao Feng, Yang Liu, and Geguang Pu. 2023. ALA: Naturalness-aware Adversarial Lightness Attack. InProceedings of the 31st ACM International Conference on Multimedia, MM 2023, Ottawa, ON, Canada, 29 October 2023-...

    2023

  7. [15]

    Joel Janai, Fatma Güney, Aseem Behl, and Andreas Geiger. 2020. Computer Vision for Autonomous Vehicles: Problems, Datasets and State of the Art.Found. Trends Comput. Graph. Vis.12, 1-3 (2020), 1–308

    2020

  8. [16]

    Enyi Jiang and Gagandeep Singh. 2024. RAMP: Boosting Adversarial Robustness Against Multiple lp Perturbations for Universal Robustness. InAdvances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancou...

    2024

  9. [17]

    2009.Learning Multiple Layers of Features from Tiny Im- ages

    Alex Krizhevsky. 2009.Learning Multiple Layers of Features from Tiny Im- ages. Technical Report. Department of Computer Science, University of Toronto, Toronto, ON, Canada

    2009

  10. [18]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In5th International Conference on Learning Representa- tions, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings. OpenReview.net

    2017

  11. [19]

    Cassidy Laidlaw and Soheil Feizi. 2019. Functional Adversarial Attacks. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada. 10408–10418

    2019

  12. [20]

    Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. 2021. Perceptual Adversarial Robustness: Defense Against Unseen Threat Models. In9th International Confer- ence on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net

    2021

  13. [21]

    Ya Le and Xuan Yang. 2015. Tiny imagenet visual recognition challenge.CS 231N7, 7 (2015), 3

    2015

  14. [22]

    Fengpeng Li, Kemou Li, Haiwei Wu, Jinyu Tian, and Jiantao Zhou. 2024. DAT: Im- proving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain. InAdvances in Neural Information Processing Systems 38: Annual Con- ference on Neural Information Processing Syste...

    2024

  15. [23]

    Geert Litjens, Thijs Kooi, Babak Ehteshami Bejnordi, Arnaud Arindra Adiyoso Setio, Francesco Ciompi, Mohsen Ghafoorian, Jeroen A. W. M. van der Laak, Bram van Ginneken, and Clara I. Sánchez. 2017. A survey on deep learning in medical image analysis.Medical Image Anal.42 (2017), 60–88

    2017

  16. [24]

    Aishan Liu, Shiyu Tang, Xinyun Chen, Lei Huang, Haotong Qin, Xianglong Liu, and Dacheng Tao. 2024. Towards Defending Multiple ℓ p-Norm Bounded Adversarial Perturbations via Gated Batch Normalization.Int. J. Comput. Vis. 132, 6 (2024), 1881–1898

    2024

  17. [25]

    Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. 2019. Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 860–868

    2019

  18. [26]

    Divyam Madaan, Jinwoo Shin, and Sung Ju Hwang. 2021. Learning to Generate Noise for Multi-Attack Robustness. InProceedings of the 38th International Confer- ence on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event (Proceedings of Machine Learning Research, Vol. 139)...

    2021

  19. [27]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, ...

    2018

  20. [28]

    Pratyush Maini, Eric Wong, and Zico Kolter. 2020. Adversarial robustness against the union of multiple perturbation models. InInternational Conference on Machine Learning. PMLR, 6640–6650

    2020

  21. [29]

    Sachin Mehta and Mohammad Rastegari. 2022. MobileViT: Light-weight, General- purpose, and Mobile-friendly Vision Transformer. InThe Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29,

    2022

  22. [30]

    Zhong-Han Niu and Yu-Bin Yang. 2023. Defense against adversarial attacks with efficient frequency-adaptive compression and reconstruction.Pattern Recognition 138 (2023), 109382

    2023

  23. [31]

    Omid Poursaeed, Tianxing Jiang, Harry Yang, Serge Belongie, and Ser-Nam Lim. 2021. Robustness and generalization via generative adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 15711– 15720

    2021

  24. [32]

    Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li

  25. [33]

    InComputer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XIV

    SemanticAdv: Generating Adversarial Examples via Attribute-Conditioned Image Editing. InComputer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XIV. 19–37

    2020

  26. [34]

    Dickerson, Christoph Studer, Larry S

    Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. 2019. Adversarial training for free!. InAdvances in Neural Information Processing Systems 32: Annual Conference on Neural Information Proces...

    2019

  27. [35]

    Ali Shahin Shamsabadi, Ricardo Sánchez-Matilla, and Andrea Cavallaro. 2020. ColorFool: Semantic Adversarial Colorization. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, W A, USA, June 13-19,

    2020

  28. [36]

    Mengda Xie, Yiling He, and Meie Fang

    Computer Vision Foundation / IEEE, 1148–1157. Mengda Xie, Yiling He, and Meie Fang

  29. [37]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Confe...

    2014

  30. [38]

    Florian Tramèr and Dan Boneh. 2019. Adversarial Training and Robustness for Multiple Perturbations. InAdvances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada...

    2019

  31. [39]

    Zico Kolter

    Eric Wong, Leslie Rice, and J. Zico Kolter. 2020. Fast is better than free: Revisiting adversarial training. In8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net

    2020

  32. [40]

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song

  33. [41]

    In6th International Confer- ence on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings

    Spatially Transformed Adversarial Examples. In6th International Confer- ence on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings

    2018

  34. [42]

    Jiancong Xiao, Liusha Yang, Yanbo Fan, Jue Wang, and Zhi-Quan Luo. 2025. Understanding adversarial robustness against on-manifold adversarial examples. Pattern Recognit.159 (2025), 111071

    2025

  35. [43]

    Mengda Xie, Yiling He, Zhan Qin, and Meie Fang. 2025. RetouchUAA: Uncon- strained Adversarial Attack via Realistic Image Retouching.IEEE Trans. Circuits Syst. Video Technol.35, 3 (2025), 2586–2602

    2025

  36. [44]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. 2019. Theoretically Principled Trade-off between Robustness and Accuracy. InProceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long B...

    2019

  37. [45]

    Lilin Zhang, Ning Yang, Yanchao Sun, and Philip S. Yu. 2024. Provable Unre- stricted Adversarial Training Without Compromise With Generalizability.IEEE Trans. Pattern Anal. Mach. Intell.46, 12 (2024), 8302–8319

    2024

  38. [46]

    Zhendong Zhang, Cheolkon Jung, and Xiaolong Liang. 2019. Adversarial defense by suppressing high-frequency components.arXiv preprint arXiv:1908.06566 (2019)

    2019

  39. [47]

    Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2017. Generating natural adver- sarial examples.arXiv preprint arXiv:1710.11342(2017)

    2017 arXiv

  40. [48]

    Zhengyu Zhao, Zhuoran Liu, and Martha A. Larson. 2023. Adversarial Image Color Transformations in Explicit Color Filter Space.IEEE Trans. Inf. Forensics Secur.18 (2023), 3185–3197. A Open Science To facilitate reproducibility and support the open science initia- tive, we enume...

    2023

Pith tools

Reviewed June 27, 2026 · model on record in the stance chip above.