Pith. sign in

REVIEW 3 major objections 6 minor 47 references

A vision transformer that selects foveated tokens in one pass gains accuracy, cuts compute, and resists attacks without special training.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-13 02:42 UTC pith:CSE3DS3U

load-bearing objection Solid single-pass foveated token selection with real accuracy–MAC–robustness numbers on ImageNet100; the robustness story is mostly the multi-scale FOV module, not the binary gate, and the evaluation is still too narrow for the claim as written. the 3 major comments →

arxiv 2607.09480 v1 pith:CSE3DS3U submitted 2026-07-10 cs.CV cs.LGcs.NE

Foveation-Guided Dynamic Token Selection for Robust and Efficient Vision Transformers

Ibrahim Batuhan Akkaya , Kishaan Jeeveswaran , Bahram Zonooz , Elahe Arani This is my paper
classification cs.CV cs.LGcs.NE
keywords Vision TransformerFoveated VisionDynamic Token SelectionAdversarial RobustnessHuman Visual SystemEfficient InferenceFixation Budget
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that vision transformers can borrow two human-vision habits—foveated multi-scale sampling and selective fixation—to become both cheaper and harder to fool. The authors build FDT by adding a foveation module that builds multi-scale query/key/value embeddings and a fixation module that, under a budget, decides which tokens actually enter attention. Those decisions happen inside each transformer block in a single feed-forward pass, so the model does not need iterative gaze loops or extra gaze encoders. On ImageNet100, a 50% fixation budget yields slightly higher clean accuracy than the DeiT-S baseline while cutting average multiply-accumulate operations by about a third, and the same models show large gains against adversarial attacks, natural corruptions, and a tinted-image shortcut, even though they were never trained for those threats. The practical claim is that adaptive, biologically motivated token selection can deliver an accuracy-efficiency-robustness trade-off that static full-token transformers do not.

Core claim

FDT shows that embedding foveation (multi-scale token features) and discrete fixation (budgeted binary token selection) inside every transformer block lets a DeiT-style model raise clean accuracy, cut expected MACs, and improve adversarial, corruption, and shortcut robustness on ImageNet100 without adversarial or corruption training, all in one feed-forward pass.

What carries the argument

The Foveated Dynamic Transformer: a foveation module that builds multi-scale Q/K/V via successive depthwise-separable convolutions, plus a fixation module that produces a binary map (Gumbel-Softmax in training, logit comparison at inference) so multi-head attention runs only on fixated tokens under an explicit budget loss.

Load-bearing premise

The paper treats ImageNet100 results against a DeiT-only baseline, measured in expected MACs, as enough to support its efficiency and robustness claims, even though the authors note that MAC savings may not become real wall-clock speedups.

What would settle it

Retrain and evaluate the same FDT and DeiT architectures on full ImageNet-1K (or another standard large-scale set) under identical protocols, and check whether the 50%-budget accuracy edge, ~35% MAC reduction, and ~27% average adversarial gain still appear; if they vanish or reverse, the central claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes the Foveated Dynamic Transformer (FDT), which inserts a multi-scale foveation module (depthwise-separable convolutions producing multi-resolution Q/K/V via channel splits, Eqs. 1–4) and a binary fixation module (linear logits + Gumbel-Softmax hard decisions at train time, deterministic comparison at inference, Eqs. 5–6) into each DeiT block. Only fixated tokens enter MHSA; processed and unprocessed tokens are merged (Eq. 9) under an ℓ2 budget loss (Eq. 12). On ImageNet100 the authors report that FDT-S at β=0.5 reaches 81.9% clean top-1 (vs DeiT-S 80.9%) with 34.57% fewer average MACs, plus average adversarial gains of ~27% and modest gains on ImageNet100-C and a tinted-shortcut protocol, without adversarial or corruption training. Budget sweeps, model-size variants, qualitative fixation/attention maps, and feature-inversion examples are provided.

Significance. If the efficiency–robustness trade-off holds under stronger controls, FDT would be a useful HVS-inspired addition to the dynamic-token literature: single-pass binary selection with multi-scale features, explicit budget control, and robustness that does not require adversarial training. Strengths include clear equations for FOV/FIX/masked MHSA, three-seed means±std, extensive attack and corruption tables, and an honest Limitations section that flags the MAC–latency gap and the non-biological character of simultaneous multi-fixation. The work is therefore of interest for adaptive vision transformers, but its current causal attribution and experimental scope limit the strength of the claim as stated.

major comments (3)
  1. Table 2 shows that FDT1.0 (full budget, no selection) already lifts Adv. Acc. from DeiT’s 26.3% to 32.5% and clean Acc. to 84.5%, while FDT0.5 reaches only 33.3% Adv. Acc. with lower clean Acc. than FDT1.0. The multi-scale FOV module (Eqs. 2–4) therefore appears to carry most of the robustness effect; binary fixation mainly trades accuracy for MACs. The abstract and §1/§5 attribute resilience primarily to “fixation and foveation” / “foveation-guided dynamic token selection.” A matched-capacity ablation that isolates FOV (e.g., multi-scale QKV without gating) versus FIX, and a non-foveated dynamic baseline (DynamicViT-style pruning on the same DeiT-S backbone), is needed to support the causal claim.
  2. All quantitative claims (clean Acc., 34.57% MAC reduction, ~27% adversarial lift, ImageNet100-C, shortcut) are reported only on the 100-class ImageNet100 subset with DeiT as the sole baseline (§4, Tables 2–3, E.6, F.8). The load-bearing premise that these gains generalize is therefore under-supported. At minimum, ImageNet-1k numbers for the main operating point (or a clear statement that claims are restricted to ImageNet100) and one additional dynamic-token or multi-scale baseline are required before the efficiency-and-robustness claims can be taken at the strength stated in the abstract.
  3. Limitations §6 correctly notes that token re-arrangement, channel splits and concat/merge make the foveation pipeline memory-bound, so MACs need not equal wall-clock latency. The abstract and §4.3 nevertheless lead with “reducing multiply-accumulate operations by 34.57%” as the efficiency claim. Either report measured latency on a standard GPU/CPU stack for the β=0.5 operating point, or rephrase the efficiency claim throughout so that it is explicitly “expected MACs” and does not imply deployable speed-up.
minor comments (6)
  1. Fig. 5 reports percentage improvements (e.g., 227%) without stating the exact averaging formula; clarify whether the 27% average is unweighted over the 12 attacks + GN and whether clean accuracy is excluded (as the caption suggests).
  2. Eq. (6) vs. Gumbel-Softmax training surrogate: state explicitly that attack evaluation uses the deterministic FIX path (as Appendix D does) so that train/test discrepancy is transparent in the main text.
  3. Notation: K and S are overloaded (rearrangement vs. channel split); a short symbol table would help.
  4. Fig. 9 circle sizes are fixed for legibility; the caption already notes this, but the main text still speaks of “focus intensity,” which can be misread as encoding probability.
  5. Related Work could more sharply contrast FDT’s single-pass binary gate with FoveaTer’s iterative fixation and DynamicViT’s continuous scores; the distinction is present but scattered.
  6. Typos / style: “processinformationfrommultiplefixationpointsbycombiningthe” (p. 4), missing spaces in several figure captions, and “Eff. Fix.” column header could be expanded once.

Circularity Check

0 steps flagged

No circularity: empirical architecture paper whose accuracy, MAC, and robustness claims are measured on held-out ImageNet100 / ImageNet100-C / attack suites, not derived by redefining the target.

full rationale

FDT is an empirical vision-transformer design paper. The load-bearing claims (clean Acc. 81.9% vs DeiT-S 80.9% at 50% budget, 34.57% MAC reduction, ~27% average adversarial lift, natural-corruption and shortcut gains) are obtained by training with a chosen fixation budget β plus CE + L_Budget and evaluating on held-out validation, ImageNet100-C, and a fixed attack suite. β is an operating-point hyperparameter (Eq. 12–13), not a parameter fitted to the reported metrics and then re-presented as a prediction. The FOV multi-scale construction (Eqs. 1–4) and FIX binary map (Eqs. 5–6, Gumbel-Softmax training, hard merge Eq. 9) are architectural definitions; they do not make the measured robustness or accuracy true by construction. There is no uniqueness theorem, no self-citation that forces the central result, and no renaming of a known empirical pattern as a first-principles derivation. Causal attribution of robustness to fixation versus multi-scale foveation capacity is an experimental-design question (visible in Table 2 FDT1.0 vs FDT0.5), not a circular reduction of output to input. The paper is therefore self-contained against external benchmarks; circularity score is 0.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 2 invented entities

Load-bearing content is architectural design plus empirical training choices, not a formal derivation. Free parameters are the budget and loss weight that define the operating point; axioms are standard ViT/training assumptions and the soft-to-hard gate surrogate; invented entities are the FOV and FIX modules as engineered components without independent biological validation.

free parameters (4)
  • fixation budget β
    Target fraction of tokens selected per block; chosen by hand (default 0.5) and swept; directly defines the accuracy–compute trade-off the central claim cites.
  • budget loss weight λ
    Balances cross-entropy against L_Budget; controls how hard the model is forced to meet β; not derived, set for training stability/performance.
  • foveation levels Lfov (=3) and channel split C/3
    Fixed design choice that sets multi-scale depth and how Q/K/V channels are allocated; not learned from first principles.
  • Gumbel-Softmax hard labeling (training surrogate)
    Temperature/hard-label settings for differentiable binary fixation; enables end-to-end training but is an implementation hyperparameter of the gate.
axioms (4)
  • domain assumption Standard DeiT/ViT training and architecture (MHSA, MLP, LN, AdamW, ImageNet-style classification) remain valid when only a subset of tokens is attended and then merged.
    Assumed throughout §3.3–3.4 and experiments; residual merge of unprocessed tokens is taken to preserve information flow.
  • ad hoc to paper Gumbel-Softmax hard decisions at train time approximate the deterministic logit comparison used at inference for fixation maps.
    §3.4 replaces Eq. (6) with Gumbel-Softmax for differentiability; train/test gate mismatch is accepted without formal bound.
  • domain assumption ImageNet100 (100-class subset) is a sufficient proxy for evaluating clean accuracy, corruption, and adversarial robustness claims relative to DeiT.
    All main tables use ImageNet100 / ImageNet100-C; transfer to ImageNet-1k is not shown.
  • domain assumption Expected MACs averaged over validation samples are a meaningful efficiency metric for dynamic token selection.
    Table 2 and abstract claim −34.57% MACs; Limitations notes this may not equal latency.
invented entities (2)
  • Foveation module (multi-scale DSC/PC QKV construction) no independent evidence
    purpose: Build multi-resolution query/key/value features analogous to foveated sampling for each token.
    Engineered module (§3.1); independent_evidence false as a biological mechanism—authors state it is HVS-inspired design, not eccentricity-faithful retina modeling.
  • Fixation module (linear binary gate + budgeted selection) no independent evidence
    purpose: Produce discrete per-token process/skip decisions and filter MHSA inputs.
    Core selection mechanism (§3.2–3.4); falsifiable only via task metrics inside this paper’s setup, not via external biological or theoretical prediction.

pith-pipeline@v1.1.0-grok45 · 38265 in / 3529 out tokens · 43053 ms · 2026-07-13T02:42:53.654659+00:00 · methodology

0 comments
read the original abstract

The human visual system (HVS) employs foveated sampling and eye movements to achieve efficient perception, conserving both metabolic energy and computational resources. Drawing inspiration from this robustness and adaptability, we introduce the Foveated Dynamic Transformer (FDT), a foveation-guided dynamic token-selection architecture that integrates these mechanisms into a vision transformer framework. The FDT exhibits strong resilience to various types of noise and adversarial attacks, despite not being explicitly trained for such challenges. This inherent robustness is achieved through the use of fixation and foveation modules: the fixation module identifies fixation points to filter out irrelevant information, while the foveation module generates foveated embeddings with multi-scale information. At the 50% fixation-budget setting, FDT achieves higher accuracy than DeiT-S (81.9% vs. 80.9%) while reducing multiply-accumulate operations by 34.57%, highlighting one operating point on its accuracy-efficiency trade-off. These attributes position FDT as an HVS-inspired step toward artificial neural networks that combine adaptive computation with improved resilience.

Figures

Figures reproduced from arXiv: 2607.09480 by Bahram Zonooz, Elahe Arani, Ibrahim Batuhan Akkaya, Kishaan Jeeveswaran.

Figure 1
Figure 1. Figure 1: Illustration comparing the fixations of the human visual system (left; Yarbus [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Schematic of the Foveated Dynamic Transformer (FDT), our novel approach inspired by the HVS. FDT integrates fixation and foveation mechanisms within a single processing pass, eliminating the need for iterative passes. Input tokens undergo foveation via the FOV module, sampling features at varying resolutions and yielding foveated query, key, and value vectors. The FIX module then uses these vectors to iden… view at source ↗
Figure 3
Figure 3. Figure 3: Foveation module comprises three depthwise-separable foveation levels with progressively larger receptive fields. It processes auxiliary and patch tokens using depthwise (DC) separable convolutions and pointwise (PC) convolutions. The module then splits and merges these features to form foveated-query, -key, and -value features, incorporating multi-scale information [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Fixation module utilizes multi-resolution information from the foveated-query token qfov through a single linear layer, generating logits for the binary decision of identifying fixation points. The resulting fixation map then filters the foveated features for processing within the MHSA module. Finally, we merge and concatenate the auxiliary and patch splits from the three foveation levels in the channel di… view at source ↗
Figure 5
Figure 5. Figure 5: Adversarial robustness. FDT achieves a significant performance improvement, [PITH_FULL_IMAGE:figures/full_fig_p016_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Robustness to shortcut learning. Actual performance of each model is displayed [PITH_FULL_IMAGE:figures/full_fig_p020_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Feature inversion using the ‘Deep Image Prior’ method for DeiT-S and FDT-S [PITH_FULL_IMAGE:figures/full_fig_p022_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Visual comparison of easy and hard samples with their computational requirements [PITH_FULL_IMAGE:figures/full_fig_p024_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Visualization of fixation points, blockwise fixation order, fixation maps, and [PITH_FULL_IMAGE:figures/full_fig_p026_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 21 linked inside Pith

  1. [1]

    Dodge, L

    S. Dodge, L. Karam, A study and comparison of human and deep learning recognition performance under visual distortions, in: 2017 26th international conference on computer communication and networks (ICCCN), IEEE, 2017, pp. 1–7

    2017

  2. [2]

    Azulay, Y

    A. Azulay, Y. Weiss, Why do deep convolutional networks generalize so poorly to small image transformations?, Journal of Machine Learning Research 20 (2019) 1–25. URL:http://jmlr.org/papers/v20/19-519. html

    2019

  3. [3]

    Szegedy, W

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfel- low, R. Fergus, Intriguing properties of neural networks, in: Y. Bengio, Y. LeCun (Eds.), 2nd International Conference on Learning Represen- tations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL:http://arxiv.org/abs/1312.6199

    Pith/arXiv arXiv 2014

  4. [4]

    Carlini, D

    N. Carlini, D. Wagner, Towards evaluating the robustness of neural 27 networks, in: 2017 ieee symposium on security and privacy (sp), Ieee, 2017, pp. 39–57

    2017

  5. [5]

    C. A. Curcio, K. R. Sloan, R. E. Kalina, A. E. Hendrickson, Human photoreceptor topography, Journal of comparative neurology 292 (1990) 497–523

    1990

  6. [6]

    L. Itti, C. Koch, Computational modelling of visual attention, Nature reviews neuroscience 2 (2001) 194–203

    2001

  7. [7]

    N. D. Bruce, J. K. Tsotsos, Saliency, attention, and visual search: An information theoretic approach, Journal of vision 9 (2009) 5–5

    2009

  8. [8]

    V. Mnih, N. Heess, A. Graves, et al., Recurrent models of visual attention, Advances in neural information processing systems 27 (2014)

    2014

  9. [9]

    Akbas, M

    E. Akbas, M. P. Eckstein, Object detection through search with a foveated visual system, PLoS computational biology 13 (2017) e1005743

    2017

  10. [10]

    Thavamani, M

    C. Thavamani, M. Li, N. Cebron, D. Ramanan, Fovea: Foveated im- age magnification for autonomous navigation, in: Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 15539–15548

    2021

  11. [11]

    Yarbus, B

    A. Yarbus, B. Haigh, L. Riggs, Eye movements and vision. plenum press new york (1967)

    1967

  12. [12]

    Freeman, E

    J. Freeman, E. P. Simoncelli, Metamers of the ventral stream, Nature neuroscience 14 (2011) 1195–1201. 28

    2011

  13. [13]

    Jonnalagadda, W

    A. Jonnalagadda, W. Wang, M. P. Eckstein, Foveater: Foveated trans- former for image classification, arXiv preprint arXiv:2105.14173 (2021)

    Pith/arXiv arXiv 2021

  14. [14]

    Y. Rao, W. Zhao, B. Liu, J. Lu, J. Zhou, C.-J. Hsieh, Dynamicvit: Efficient vision transformers with dynamic token sparsification, 2021. URL:https://arxiv.org/abs/2106.02034.arXiv:2106.02034

    Pith/arXiv arXiv 2021

  15. [15]

    Lukanov, P

    H. Lukanov, P. König, G. Pipa, Biologically inspired deep learning model for efficient foveal-peripheral vision, Frontiers in Computational Neuroscience 15 (2021)

    2021

  16. [16]

    Martínez, L

    J. Martínez, L. A. Robles, A new foveal cartesian geometry approach used for object tracking., SPPRA 6 (2006) 133–139

    2006

  17. [17]

    B. Wang, D. Mayo, A. Deza, A. Barbu, C. Conwell, On the use of cortical magnificationandsaccadesasbiologicalproxiesfordataaugmentation, in: SVRHM 2021 Workshop @ NeurIPS, 2021. URL:https://openreview. net/forum?id=Rpazl253IHb

    2021

  18. [18]

    J. Li, S. Xue, Y. Su, Gaze-guided learning: Avoiding shortcut bias in visual classification, 2025. URL:https://arxiv.org/abs/2504.05583. arXiv:2504.05583

    Pith/arXiv arXiv 2025

  19. [19]

    A. Deza, T. Konkle, Emergent properties of foveated perceptual systems, arXiv preprint arXiv:2006.07991 (2020)

    Pith/arXiv arXiv 2006

  20. [20]

    J. Mao, Y. Shen, J. Guo, Y. Yao, X. Hua, Efficient token compression for vision transformer with spatial information preserved, 2025. URL: https://arxiv.org/abs/2503.23455.arXiv:2503.23455. 29

    Pith/arXiv arXiv 2025

  21. [21]

    L. Yu, W. Xiang, X-pruner: explainable pruning for vision transformers,

  22. [22]

    arXiv:2303.04935

    URL: https://arxiv.org/abs/2303.04935. arXiv:2303.04935

    Pith/arXiv arXiv

  23. [23]

    S. Kim, S. Shen, D. Thorsley, A. Gholami, W. Kwon, J. Hassoun, K. Keutzer, Learned token pruning for transformers, 2022. URL:https: //arxiv.org/abs/2107.00910.arXiv:2107.00910

    Pith/arXiv arXiv 2022

  24. [24]

    Y. Wang, Z. Chen, H. Jiang, S. Song, Y. Han, G. Huang, Adaptive focus for efficient video recognition, 2021. URL:https://arxiv.org/ abs/2105.03245.arXiv:2105.03245

    Pith/arXiv arXiv 2021

  25. [25]

    Y. Tang, K. Han, Y. Wang, C. Xu, J. Guo, C. Xu, D. Tao, Patch slimming for efficient vision transformers, 2022. URL:https://arxiv. org/abs/2106.02852.arXiv:2106.02852

    Pith/arXiv arXiv 2022

  26. [26]

    H. Wang, B. Dedhia, N. K. Jha, Zero-tprune: Zero-shot token pruning through leveraging of the attention graph in pre-trained transformers,

  27. [27]

    arXiv:2305.17328

    URL: https://arxiv.org/abs/2305.17328. arXiv:2305.17328

    Pith/arXiv arXiv

  28. [28]

    Zhang, L

    Y. Zhang, L. Wei, N. Freris, Synergistic patch pruning for vision trans- former: unifying intra-& inter-layer patch importance, in: The Twelfth International Conference on Learning Representations, 2024

    2024

  29. [29]

    Zheng, W

    D. Zheng, W. Dong, H. Hu, X. Chen, Y. Wang, Less is more: Focus at- tention for efficient detr, in: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 6674–6683

    2023

  30. [30]

    Hendrycks, T

    D. Hendrycks, T. Dietterich, Benchmarking neural network robustness to common corruptions and perturbations, 2019. URL:https://arxiv. org/abs/1903.12261.arXiv:1903.12261. 30

    Pith/arXiv arXiv 2019

  31. [31]

    Geirhos, J.-H

    R. Geirhos, J.-H. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, F. A. Wichmann, Shortcut learning in deep neural net- works, Nature Machine Intelligence 2 (2020) 665–673

    2020

  32. [32]

    Simonyan, A

    K. Simonyan, A. Vedaldi, A. Zisserman, Deep inside convolutional networks: Visualising image classification models and saliency maps, arXiv preprint arXiv:1312.6034 (2013)

    Pith/arXiv arXiv 2013

  33. [33]

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, D. Batra, Grad-cam: Visual explanations from deep networks via gradient-based localization, in: Proceedings of the IEEE international conference on computer vision, 2017, pp. 618–626

    2017

  34. [34]

    Ulyanov, A

    D. Ulyanov, A. Vedaldi, V. Lempitsky, Deep image prior, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 9446–9454

    2018

  35. [35]

    Engstrom, A

    L. Engstrom, A. Ilyas, S. Santurkar, D. Tsipras, B. Tran, A. Madry, Adversarial robustness as a prior for learned representations, arXiv preprint arXiv:1906.00945 (2019)

    Pith/arXiv arXiv 1906

  36. [36]

    Abnar, W

    S. Abnar, W. Zuidema, Quantifying attention flow in transformers, arXiv preprint arXiv:2005.00928 (2020)

    Pith/arXiv arXiv 2005

  37. [37]

    Touvron, M

    H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, H. Jégou, Training data-efficient image transformers & distillation through atten- tion, in: International Conference on Machine Learning, PMLR, 2021, pp. 10347–10357. 31

    2021

  38. [38]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv:1706.06083 (2017)

    Pith/arXiv arXiv 2017

  39. [39]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, arXiv preprint arXiv:1412.6572 (2014)

    Pith/arXiv arXiv 2014

  40. [40]

    Zhang, Y

    H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, M. Jordan, Theoretically principled trade-off between robustness and accuracy, in: International conference on machine learning, PMLR, 2019, pp. 7472–7482

    2019

  41. [41]

    E. Wong, L. Rice, J. Z. Kolter, Fast is better than free: Revisiting adversarial training, arXiv preprint arXiv:2001.03994 (2020)

    Pith/arXiv arXiv 2001

  42. [42]

    X. Liu, Y. Li, C. Wu, C.-J. Hsieh, Adv-bnn: Improved adversarial defense through robust bayesian neural network, arXiv preprint arXiv:1810.01279 (2018)

    Pith/arXiv arXiv 2018

  43. [43]

    Tramèr, A

    F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, P. Mc- Daniel, Ensemble adversarial training: Attacks and defenses, arXiv preprint arXiv:1705.07204 (2017)

    Pith/arXiv arXiv 2017

  44. [44]

    Croce, M

    F. Croce, M. Hein, Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks, in: International conference on machine learning, PMLR, 2020, pp. 2206–2216

    2020

  45. [45]

    Kurakin, I

    A. Kurakin, I. J. Goodfellow, S. Bengio, Adversarial examples in the physical world, in: Artificial intelligence safety and security, Chapman and Hall/CRC, 2018, pp. 99–112. 32

    2018

  46. [46]

    Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, J. Li, Boosting adversarial attacks with momentum, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 9185– 9193

    2018

  47. [47]

    Kim, Torchattacks: A pytorch repository for adversarial attacks, arXiv preprint arXiv:2010.01950 (2020)

    H. Kim, Torchattacks: A pytorch repository for adversarial attacks, arXiv preprint arXiv:2010.01950 (2020). 33 Appendix Appendix A. Broader Impact The introduction of the Foveated Dynamic Transformer (FDT) represents a step toward more adaptive artificial vision systems, offering enhanced ro- bustness and efficiency in the evaluated ImageNet100 settings. ...

    Pith/arXiv arXiv 2010