Pith. sign in

REVIEW 2 major objections 4 minor 83 references

Adversarial purification works by restoring the patch relationships that noise distorts inside an attentive mask reconstructor.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-07-11 18:53 UTC pith:VJRUXDLX

load-bearing objection Useful data-free purification that turns attentive-mask sensitivity into SOTA numbers; theory is suggestive but the surrogate step is correlational, not causal. the 2 major comments →

arxiv 2607.04474 v1 pith:VJRUXDLX submitted 2026-07-05 cs.CR

AMRM-Pure: Semantic-Preserving Adversarial Purification

Zhihao Dou , Zhiqiang Gao , Dongfei Cui , Weida Wang , Qinjian Zhao , Dinggen Zhang , Jun Yan , Zeke Xie
show 1 more author
Shufei Zhang
This is my paper
classification cs.CR
keywords adversarial purificationattention matrix variationmasked autoencoderMaskDiTsemantic preservationAMRMadaptive attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that adversarial noise is especially damaging because it warps the semantic relations among image patches, and that this warping is visible as large changes in the attention matrices of attentive mask reconstruction models (AMRMs) such as MAE and MaskDiT. Because those models are highly sensitive to such changes, simply minimizing their reconstruction loss with projected gradient descent on the input is enough to drive the attention pattern back toward the clean regime and thereby purify the image. The same principle is applied to both a plain MAE and a diffusion-based MaskDiT, and a second-stage fine-tune that adds classification loss further strengthens the semantic consistency of the purified outputs. Experiments under strong adaptive attacks show that the resulting AMRM-Pure pipelines set new robust-accuracy records on CIFAR-10/100, SVHN and ImageNet without requiring extra training data.

Core claim

Adversarial perturbations induce large attention-matrix variation (AMV) inside attentive mask reconstructors; the reconstruction loss of those models is a lower-bounded function of AMV and can therefore be minimized directly on the input to restore inter-patch semantics and remove the attack.

What carries the argument

Attention Matrix Variation (AMV) and its tractable surrogate: PGD minimization of AMRM reconstruction loss (Eq. 3), justified by the theoretical link that L_rec^adv is bounded below by clean L_rec plus a positive multiple of decoder AMV (Theorem 3.2).

Load-bearing premise

That the reconstruction loss of a frozen attentive mask model is a faithful proxy for the unavailable clean attention pattern, so that simply descending that loss restores the original patch relationships.

What would settle it

Measure decoder AMV and reconstruction loss on a held-out set of adaptive adversarial examples after the claimed purification steps; if AMV does not fall in lock-step with loss, or if robust accuracy collapses once full-gradient adaptive attacks are allowed to target the joint purifier-classifier system, the central surrogate claim fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Any attentive mask reconstructor (MAE-style or diffusion-based) can be turned into a purification engine simply by PGD-minimizing its own reconstruction loss on the input.
  • Fine-tuning that purifier with a small amount of classification loss further reduces residual AMV and raises both clean and robust accuracy.
  • The same AMV-sensitivity argument supplies a diagnostic: if a new attack fails to inflate AMV, it is unlikely to break the purification defense.
  • On large-resolution data (ImageNet) the MAE variant becomes faster than diffusion purification while remaining competitive in robust accuracy.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If AMV is the true vulnerability, then defenses that only match global feature distributions may leave residual patch-level semantic damage that a subsequent attentive reconstructor can still exploit.
  • The same reconstruction-loss objective could be used as a cheap, training-free detector of adversarial examples: unusually high L_rec on a frozen MAE would flag an input as attacked.
  • Non-attentive mask models (plain CNN inpainters) should not inherit the same purification power; a controlled comparison would isolate attention as the necessary ingredient.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper studies adversarial purification through the lens of inter-patch semantic relations captured by attentive mask reconstruction models (AMRMs). It shows theoretically (Theorems 3.1–3.2) and empirically (Figs. 3–4, 7) that adversarial noise induces large attention-matrix variation (AMV) that lower-bounds reconstruction loss of MAE/MaskDiT. On this basis it proposes AMRM-Pure: iterative PGD minimization of the AMRM reconstruction loss (Eqs. 3–4) as a tractable surrogate for restoring clean attention, plus a two-stage classification-loss fine-tuning procedure that yields the RAMRM variants. The method is instantiated on MAE and MaskDiT and evaluated under strong adaptive attacks (PGD200+EOT20 with full gradients, AutoAttack) on CIFAR-10/100, SVHN and ImageNet, reporting new state-of-the-art robust accuracies (Tables 1–4, 6) without extra training data.

Significance. If the claimed mechanism holds, the work supplies a new, theoretically motivated purification principle that is complementary to diffusion-based feature-space alignment and that demonstrably improves robust accuracy under adaptive white-box evaluation. Strengths include explicit (if approximate) derivations of the AMV lower bounds, matching empirical trends of AMV versus reconstruction loss, a convergence argument for the purification iterates (Theorem H.1), and extensive adaptive-attack experiments across four datasets and two AMRM architectures. The data-free SOTA numbers under PGD+EOT and AutoAttack are of clear practical interest to the adversarial-robustness community.

major comments (2)
  1. Eq. (3) treats min L_rec as a faithful surrogate for the unavailable clean-attention objective of Eq. (2). Theorem 3.2 only supplies a lower bound L_adv_rec ≥ (1/2)L_rec + (positive multiple of decoder AMV) - c_rec. Minimizing the left-hand side therefore does not force the AMV term to zero; decreases can be absorbed by the reconstruction-bias term or by encoder-feature drift invisible to the decoder-attention bound. The supporting Assumption 2 (L-Lipschitz continuity of the map from per-layer attentions to final decoder attention) and the kernel approximation of softmax used in Theorem 3.1 are never verified for the concrete MAE/MaskDiT architectures or for the adversarial regime δ=8/255. Consequently the joint decline of L_rec and AMV in Fig. 4(d–f) remains correlational. A direct measurement of ||atten(x_den)-atten(x)||_2 (or an ablation that freezes encoder features) is needed to clo
  2. The evaluation protocol is strong (PGD200+EOT20 with full gradients, AutoAttack), yet the paper reports only 512 randomly selected test images per dataset (Sec. 5.1). For ImageNet and for the claimed SOTA margins (e.g., Table 1: 62.13 % vs. 55.76 % under ℓ_∞), this sample size is too small to establish statistical reliability; standard deviations are deferred to an unreleased supplement. Full-test-set numbers or at least bootstrap confidence intervals on the reported robust accuracies are required before the SOTA claim can be accepted at face value.
minor comments (4)
  1. Notation for the robust variants is inconsistent: the abstract and Sec. 4.2 introduce both RAMRM-PureMAE and RAMRM-PureMaskDiT, yet the text occasionally writes “RAMRM-PureMaskDiT” for the MAE case and “RMaskDiT” elsewhere.
  2. Fig. 1 caption and the surrounding paragraph refer to “AutoAttack” reconstructions, but the main adaptive evaluation later switches to PGD+EOT; a short clarification that the figure is illustrative would avoid confusion.
  3. Hyper-parameter tables (Tables 18–19) list decaying step sizes marked by asterisks; the precise decay schedule should be stated in the main text or algorithm box.
  4. Several citations appear with duplicated author names or incomplete venues (e.g., “in 2017 ieee symposium… in 2017 IEEE Symposium…”); a pass over the bibliography is needed.

Circularity Check

0 steps flagged

No circularity: the purification objective, AMV lower bound, and SOTA claims rest on independent theory plus external adaptive attacks, not on self-referential definitions or fitted quantities renamed as predictions.

full rationale

The derivation chain begins from the observation that adversarial noise induces attention-matrix variation (AMV) in AMRMs (MAE/MaskDiT). Theorem 3.1 lower-bounds ||A_adv - A|| via a kernel approximation of softmax and a latent shift δ^t; Theorem 3.2 then lower-bounds reconstruction loss L_adv_rec by (1/2)L_rec plus a positive multiple of decoder AMV minus a bias term (under Lipschitz Assumption 2). The purification method (Eq. 3) treats min_Δ L_rec(x_adv+Δ) as a tractable surrogate for the unavailable clean-attention objective (Eq. 2). This is an approximation justified by the lower bound and by the empirical co-decline of L_rec and AMV in Fig. 4(d–f); it is not an identity that forces the reported robust accuracies by construction. The subsequent PGD iterations (Eq. 4), the optional classification-loss fine-tuning (Eqs. 6–7), and the final numbers (Tables 1–4, 6) are evaluated against external adaptive attacks (PGD200+EOT20, AutoAttack with full gradients) that are defined independently of the method’s parameters. No equation equates a fitted constant to a claimed prediction, no uniqueness theorem is imported from overlapping authors to forbid alternatives, and no known empirical pattern is merely renamed. The surrogate gap noted by the skeptic is a possible correctness concern, not a circular reduction. Consequently the paper is self-contained against its external benchmarks and receives a circularity score of 0.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 2 invented entities

The central claim rests on a small set of modeling assumptions needed for the AMV lower bounds, a handful of free hyper-parameters that control the purification trajectory, and two named algorithmic constructs (AMRM-Pure and its robust fine-tuned variants). No new physical entities are postulated; the free parameters are ordinary optimization knobs whose values are reported.

free parameters (4)
  • purification step size λ and clipping threshold η
    Chosen per dataset (Table 18); control the PGD trajectory that realizes Eq. 4 and therefore the final purified image.
  • number of purification iterations S
    Dataset-specific (Table 19); determines how far the reconstruction-loss minimization proceeds.
  • mask ratio ρ
    Set between 0.20–0.50 depending on model and dataset (Table 19); directly affects which patches enter the attention computation and therefore the measured AMV.
  • fine-tuning epochs and learning-rate schedule for RAMRM variants
    100 epochs (MAE) / 25 epochs (MaskDiT) on CIFAR/SVHN, fewer on ImageNet; chosen to improve semantic consistency but not derived from first principles.
axioms (4)
  • domain assumption Existence of a pseudo-inverse encoder f_g such that ||g(f_g(a))−a||₂ ≤ c_rec for non-degenerate decoder g (Assumption 1).
    Borrowed from prior MAE theory (Zhang et al. 2022) and used to relate reconstruction loss to attention alignment in the proof of Theorem 3.2.
  • domain assumption The map from per-layer decoder attention matrices to the final attention matrix is L-Lipschitz (Assumption 2).
    Invoked to convert the sum of per-layer AMVs into a bound on the overall attention difference that appears in Theorem 3.2.
  • ad hoc to paper Softmax attention can be replaced by a positive-definite kernel approximation for the purpose of the AMV lower bound (Theorem 3.1).
    Standard technique (Performers / FourierFormer) but the concrete Taylor expansion and coefficient collection are tailored to obtain the claimed sensitivity statement.
  • domain assumption Reconstruction loss of a well-trained MAE is weakly convex in a neighborhood of clean inputs (used in convergence Theorem H.1).
    Supported by cited loss-landscape studies of MAE; required for the O(1/S) convergence claim of the purification iterates.
invented entities (2)
  • Attention Matrix Variation (AMV) independent evidence
    purpose: Quantitative measure of how adversarial noise distorts inter-patch semantic relations inside an AMRM.
    Defined as ||A_adv − A||₂; the entire purification objective is justified by showing that AMV is both sensitive and tightly linked to reconstruction loss.
  • AMRM-Pure / RAMRM-Pure no independent evidence
    purpose: The concrete purification algorithms that minimize reconstruction loss (optionally after classifier fine-tuning).
    Named algorithmic constructs that instantiate the theoretical insight; their performance is the main empirical claim.

reviewed 2026-07-11 · how reviews work

0 comments
Cite this review

Pith. "Pith review of AMRM-Pure: Semantic-Preserving Adversarial Purification." pith.science (2026). https://pith.science/paper/VJRUXDLX

@misc{pith2026260704474,
  author       = {Pith},
  title        = {Pith review of: AMRM-Pure: Semantic-Preserving Adversarial Purification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VJRUXDLX}},
  note         = {Machine review of arXiv:2607.04474}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Adversarial purification is a defense technique that employs generative models to remove adversarial perturbations. Current methods often rely on powerful generators, typically diffusion models, and focus on reducing the gap between adversarial and clean samples in the feature space, while overlooking semantic correlation within a single sample. To address this issue, we explore adversarial purification from the perspective of preserving semantic relationships among image patches. We employ an Attentive Mask Reconstruction Model (AMRM), which shows superior performance. Our theoretical and experimental analysis reveals that AMRM is highly sensitive to adversarial noise, as such noise significantly distorts patch relationships. Based on this observation, we propose AMRM-Pure, a purification framework that denoises adversarial inputs by preserving patch-level semantics, and formulate this process as a tractable optimization problem with respect to the input. To further enhance robustness, we finetune AMRM-Pure with classification loss to strengthen semantic consistency. We apply our insight to two AMRM architectures, including Mask Autoencoder (MAE) and MaskDiT. Extensive experiments confirm the effectiveness of our method, establishing new state-of-the-art performance across multiple benchmarks.

Figures

Figures reproduced from arXiv: 2607.04474 by Dinggen Zhang, Dongfei Cui, Jun Yan, Qinjian Zhao, Shufei Zhang, Weida Wang, Zeke Xie, Zhihao Dou, Zhiqiang Gao.

Figure 1
Figure 1. Figure 1: (a) Original image, (b) Masked image, (c) Clean image reconstruction from MAE, (d) Adversarial example [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the proposed AMRM-Pure. 2024) introduced contrastive guidance in diffusion mod￾els to enhance purification while preserving semantics. The adversarial purification method can be combined with other machine learning paradigms. For example, the framework of Self-supervised Online Adversarial Purification (SOAP) (Shi et al., 2021) achieves notable results by integrating self-supervised tasks durin… view at source ↗
Figure 3
Figure 3. Figure 3: The first column, Figure (a) represents the Mask Matrix. The second column, Figure (b) illustrates [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Trends of MAE reconstruction loss and attention matrix variation under AutoAttack and during [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Sensitivity analysis C.10.1 Is non-attentive MRM effective? To investigate whether non-attentive MRMs are effective, we adopt a CNN-based architecture similar to MAE, namely Context Encoders (CE) (Pathak et al., 2016), and propose CE-Pure in a manner analogous to AMRM￾PureMAE. We show their results in [PITH_FULL_IMAGE:figures/full_fig_p018_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Impact of purification iterations on the AMV using CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p019_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: The relationship between the trends of MaskDit loss, AMV, and perturbation. [PITH_FULL_IMAGE:figures/full_fig_p020_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: The first column, Fig. (a) and (e), represents the Mask Matrix. The second column, Fig. (b) and (f), [PITH_FULL_IMAGE:figures/full_fig_p021_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

83 extracted references · 5 linked inside Pith

  1. [1]

    arXiv preprint arXiv:2405.18042 , year=

    Visualizing the loss landscape of Self-supervised Vision Transformer , author=. arXiv preprint arXiv:2405.18042 , year=

    Pith/arXiv arXiv

  2. [2]

    Langley , title =

    P. Langley , title =. Proceedings of the 17th International Conference on Machine Learning (ICML 2000) , address =. 2000 , pages =

    2000

  3. [3]

    T. M. Mitchell. The Need for Biases in Learning Generalizations. 1980

    1980

  4. [4]

    Advances in neural information processing systems , volume=

    Adversarial examples are not bugs, they are features , author=. Advances in neural information processing systems , volume=

  5. [5]

    Internal Conference on Machine Learning , year=

    Diffusion Models Demand Contrastive Guidance for Adversarial Purification to Advance , author=. Internal Conference on Machine Learning , year=

  6. [6]

    European Conference on Computer Vision , pages=

    -robustness and beyond: Unleashing efficient adversarial training , author=. European Conference on Computer Vision , pages=. 2022 , organization=

    2022

  7. [7]

    erceptual adversarial robustness: Defense413 against unseen threat models , year=

    Perceptual adversarial robustness: Defense against unseen threat models , author=. erceptual adversarial robustness: Defense413 against unseen threat models , year=

  8. [8]

    Advances in Neural Information Processing Systems , volume=

    Do adversarially robust imagenet models transfer better? , author=. Advances in Neural Information Processing Systems , volume=

  9. [9]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    Robust evaluation of diffusion-based adversarial purification , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  10. [10]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Frequency-driven imperceptible adversarial attack on semantic similarity , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  11. [11]

    Advances in neural information processing systems , volume=

    Are transformers more robust than cnns? , author=. Advances in neural information processing systems , volume=

  12. [12]

    International Conference on Learning Representations , year=

    Towards Deep Learning Models Resistant to Adversarial Attacks , author=. International Conference on Learning Representations , year=

  13. [13]

    International Conference on Learning Representations , year=

    Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization , author=. International Conference on Learning Representations , year=

  14. [14]

    British Machine Vision Conference , year=

    Semantic Adversarial Attacks via Diffusion Models , author=. British Machine Vision Conference , year=

  15. [15]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    Deep residual learning for image recognition , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

  16. [16]

    arXiv preprint arXiv:1903.00073 , year=

    On the effectiveness of low frequency perturbations , author=. arXiv preprint arXiv:1903.00073 , year=

    Pith/arXiv arXiv 1903

  17. [17]

    Adversarial Guided Diffusion Models for Adversarial Purification , author=

  18. [18]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    Deepfool: a simple and accurate method to fool deep neural networks , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

  19. [19]

    British Machine Vision Conference 2016 , year=

    Wide Residual Networks , author=. British Machine Vision Conference 2016 , year=

    2016

  20. [20]

    International Joint Conference on Artificial Intelligence , year=

    Demiguise attack: Crafting invisible semantic adversarial perturbations with perceptual similarity , author=. International Joint Conference on Artificial Intelligence , year=

  21. [21]

    M. J. Kearns , title =

  22. [22]

    Machine Learning: An Artificial Intelligence Approach, Vol. I. 1983

    1983

  23. [23]

    R. O. Duda and P. E. Hart and D. G. Stork. Pattern Classification. 2000

    2000

  24. [24]

    Suppressed for Anonymity , author=

  25. [25]

    Newell and P

    A. Newell and P. S. Rosenbloom. Mechanisms of Skill Acquisition and the Law of Practice. Cognitive Skills and Their Acquisition. 1981

    1981

  26. [26]

    A. L. Samuel. Some Studies in Machine Learning Using the Game of Checkers. IBM Journal of Research and Development. 1959

    1959

  27. [27]

    International Conference on Learning Representations , year=

    Explaining and harnessing adversarial examples , author=. International Conference on Learning Representations , year=

  28. [28]

    n International Conference on Learning Representations , year=

    Adversarial machine learning at scale , author=. n International Conference on Learning Representations , year=

  29. [29]

    International Conference on Learning Representations , year=

    Ensemble adversarial training: Attacks and defenses , author=. International Conference on Learning Representations , year=

  30. [30]

    International conference on machine learning , pages=

    Theoretically principled trade-off between robustness and accuracy , author=. International conference on machine learning , pages=

  31. [31]

    International conference on machine learning , pages=

    Synthesizing robust adversarial examples , author=. International conference on machine learning , pages=

  32. [32]

    International Conference on Learning Representations , year=

    Fast is better than free: Revisiting adversarial training , author=. International Conference on Learning Representations , year=

  33. [33]

    Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy , pages=

    Using single-step adversarial training to defend iterative adversarial examples , author=. Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy , pages=

  34. [34]

    Advances in Neural Information Processing Systems , volume=

    Improving robustness using generated data , author=. Advances in Neural Information Processing Systems , volume=

  35. [35]

    International conference on machine learning , pages=

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples , author=. International conference on machine learning , pages=. 2018 , organization=

    2018

  36. [36]

    International conference on machine learning , pages=

    Using pre-training can improve model robustness and uncertainty , author=. International conference on machine learning , pages=. 2019 , organization=

    2019

  37. [37]

    2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=

    Single-step adversarial training with dropout scheduling , author=. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=. 2020 , organization=

    2020

  38. [38]

    International Conference on Machine Learning , year=

    Better diffusion models further improve adversarial training , author=. International Conference on Machine Learning , year=

  39. [39]

    arXiv preprint arXiv:2103.01946 , year=

    Fixing data augmentation to improve adversarial robustness , author=. arXiv preprint arXiv:2103.01946 , year=

    Pith/arXiv arXiv

  40. [40]

    International Conference on Learning Representations , year=

    Robust learning meets generative models: Can proxy distributions improve adversarial robustness? , author=. International Conference on Learning Representations , year=

  41. [41]

    International Conference on Learning Representations , year=

    Defense-gan: Protecting classifiers against adversarial attacks using generative models , author=. International Conference on Learning Representations , year=

  42. [42]

    International Conference on Learning Representations , year=

    Pixeldefend: Leveraging generative models to understand and defend against adversarial examples , author=. International Conference on Learning Representations , year=

  43. [43]

    International Conference on Machine Learning , pages=

    Adversarial purification with score-based generative models , author=. International Conference on Machine Learning , pages=. 2021 , organization=

    2021

  44. [44]

    International Conference on Machine Learning , year=

    Diffusion models for adversarial purification , author=. International Conference on Machine Learning , year=

  45. [45]

    International Conference on Learning Representations , year=

    Score-based generative modeling through stochastic differential equations , author=. International Conference on Learning Representations , year=

  46. [46]

    International Conference on Learning Representations , year=

    Online adversarial purification based on self-supervision , author=. International Conference on Learning Representations , year=

  47. [47]

    Advances in neural information processing systems , volume=

    Choose a transformer: Fourier or galerkin , author=. Advances in neural information processing systems , volume=

  48. [48]

    International Conference on Machine Learning , pages=

    Robustness and accuracy could be reconcilable by (proper) definition , author=. International Conference on Machine Learning , pages=. 2022 , organization=

    2022

  49. [49]

    and Wagner, D

    Carlini, N. and Wagner, D. , journal=. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP) , year=

    2017

  50. [50]

    Physical Adversarial Examples for Object Detectors , journal =

    Dawn Song and Kevin Eykholt and Ivan Evtimov and Earlence Fernandes and Bo Li and Amir Rahmati and Florian Tram. Physical Adversarial Examples for Object Detectors , journal =. 2018 , address =

    2018

  51. [51]

    International Conference on Computer Vision , year=

    Adversarial examples for semantic image segmentation , author=. International Conference on Computer Vision , year=

  52. [52]

    2015 IEEE international conference on data mining , pages=

    A unified gradient regularization family for adversarial examples , author=. 2015 IEEE international conference on data mining , pages=

    2015

  53. [53]

    Machine learning , volume=

    Robustness and generalization , author=. Machine learning , volume=. 2012 , publisher=

    2012

  54. [54]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Masked autoencoders are scalable vision learners , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  55. [55]

    EEE/CVF International Conference on Computer Vision , year=

    Diffusion Models as Masked Autoencoders , author=. EEE/CVF International Conference on Computer Vision , year=

  56. [56]

    International Conference on Learning Representations , year=

    Rethinking attention with performers , author=. International Conference on Learning Representations , year=

  57. [57]

    2009 , publisher=

    Learning multiple layers of features from tiny images , author=. 2009 , publisher=

    2009

  58. [58]

    NIPS workshop on deep learning and unsupervised feature learning , volume=

    Reading digits in natural images with unsupervised feature learning , author=. NIPS workshop on deep learning and unsupervised feature learning , volume=. 2011 , organization=

    2011

  59. [59]

    2009 IEEE conference on computer vision and pattern recognition , pages=

    Imagenet: A large-scale hierarchical image database , author=. 2009 IEEE conference on computer vision and pattern recognition , pages=. 2009 , organization=

    2009

  60. [60]

    arXiv preprint arXiv:2302.14431 , year=

    Efficient Masked Autoencoders with Self-Consistency , author=. arXiv preprint arXiv:2302.14431 , year=

    Pith/arXiv arXiv

  61. [61]

    Advances in Neural Information Processing Systems , volume=

    How mask matters: Towards theoretical understandings of masked autoencoders , author=. Advances in Neural Information Processing Systems , volume=

  62. [62]

    arXiv preprint arXiv:2202.03670 , year=

    How to understand masked autoencoders , author=. arXiv preprint arXiv:2202.03670 , year=

    Pith/arXiv arXiv

  63. [63]

    IEEE Transactions on Neural Networks and Learning Systems , year=

    Improving pretrained language model fine-tuning with noise stability regularization , author=. IEEE Transactions on Neural Networks and Learning Systems , year=

  64. [64]

    International Conference on Machine Learning , pages=

    Eliminating adversarial noise via information discard and robust representation restoration , author=. International Conference on Machine Learning , pages=. 2023 , organization=

    2023

  65. [65]

    ICLR , year=

    Denoising masked autoencoders help robust classification , author=. ICLR , year=

  66. [66]

    Advances in Neural Information Processing Systems , volume=

    Beyond pretrained features: noisy image modeling provides adversarial defense , author=. Advances in Neural Information Processing Systems , volume=

  67. [67]

    ECAI 2024 , pages=

    Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Information , author=. ECAI 2024 , pages=. 2024 , publisher=

    2024

  68. [68]

    ICML , year=

    Robust classification via a single diffusion model , author=. ICML , year=

  69. [69]

    ICLR , year=

    ADBM: Adversarial diffusion bridge model for reliable adversarial purification , author=. ICLR , year=

  70. [70]

    The Thirteenth International Conference on Learning Representations , year=

    Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective , author =. The Thirteenth International Conference on Learning Representations , year=

  71. [71]

    Advances in Neural Information Processing Systems , volume=

    Enhancing adversarial robustness via score-based optimization , author=. Advances in Neural Information Processing Systems , volume=

  72. [72]

    European conference on computer vision , pages=

    Square attack: a query-efficient black-box adversarial attack via random search , author=. European conference on computer vision , pages=. 2020 , organization=

    2020

  73. [73]

    International Conference on Machine Learning , pages=

    Minimally distorted adversarial examples with a fast adaptive boundary attack , author=. International Conference on Machine Learning , pages=. 2020 , organization=

    2020

  74. [74]

    International conference on machine learning , pages=

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks , author=. International conference on machine learning , pages=. 2020 , organization=

    2020

  75. [75]

    Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , pages=

    Rays: A ray searching method for hard-label adversarial attack , author=. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , pages=

  76. [76]

    Transactions on Machine Learning Research , issn=

    Fast Training of Diffusion Models with Masked Transformers , author=. Transactions on Machine Learning Research , issn=

  77. [77]

    , author=

    Visualizing data using t-SNE. , author=. Journal of machine learning research , volume=

  78. [78]

    2014 , publisher=

    An easy guide to factor analysis , author=. 2014 , publisher=

    2014

  79. [79]

    Advances in neural information processing systems , volume=

    Attention is all you need , author=. Advances in neural information processing systems , volume=

  80. [80]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    Context encoders: Feature learning by inpainting , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

Showing first 80 references.

This paper was first reviewed by grok-4.5 on July 11, 2026.