Pith. sign in

REVIEW 5 major objections 6 minor 139 references

This paper claims that a post-hoc, forget-only unlearning procedure that targets feature-space clustering—adding input noise, suppressing forget-class confidence, and entropically diversifying outputs—can erase both predictive and represent

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-07-31 23:27 UTC pith:BVGCRLCX

load-bearing objection Useful idea undermined by a clustering attack that doesn't actually test for recoverable class identity, plus sloppy reporting; worth a careful look after major revisions. the 5 major comments →

arxiv 2607.23934 v1 pith:BVGCRLCX submitted 2026-07-27 cs.LG

DECAF: De-Clustering for Adaptive Representational Unlearning

Anjie Le , Can Peng , Hongcheng Guo , J. Alison Noble This is my paper
classification cs.LG
keywords machine unlearningrepresentational unlearningclustering attackfeature-space forgettingpost-hoc unlearningforget-only settingCIFAR-10entropy regularization
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper is trying to establish that standard accuracy-based evaluations of machine unlearning are insufficient: even when a model misclassifies forget-set samples, those samples' penultimate-layer features often remain tightly clustered, so an unsupervised clustering attack can recover the forgotten class. It proposes DECAF, a forget-only post-hoc method that directly disrupts this cluster structure through input noise, confidence suppression, and entropy-based output diversification. If the reported results hold, DECAF achieves near-total forgetting (0.10% forget accuracy) while retaining 79.4% retain accuracy, with an aggregated unlearning score (AUS) of 0.88 that beats fine-tuning, gradient ascent, and even retraining. The practical payoff is that reliable on-demand unlearning in continually deployed models could be done in under 10 seconds using only the data to be forgotten, without needing the retain set or full retraining.

Core claim

On CIFAR-10 with ResNet-18, DECAF attains 0.10% forget-class accuracy, 79.4% retain accuracy, and an AUS of 0.88, surpassing all other unlearning baselines, including the retrain-from-scratch gold standard (AUS 0.86). In cluster-based analysis, DECAF disrupts the forget set's latent structure so that its features in the penultimate layer are no longer separable by clustering algorithms (Silhouette, Calinski-Harabasz, Davies-Bouldin), whereas fine-tuning, masked small gradient, and gradient ascent leave recoverable clusters behind. The paper's central claim is that unlearning should be evaluated at the representation level, not just at the classifier output level, and that a forget-only metho

What carries the argument

The DECAF objective combines three mechanisms that each attack a complementary property of cluster geometry: Gaussian input noise (epsilon ~ N(0, sigma^2 I)) increases intra-class dispersion; confidence suppression L_target = mean softmax probability on the ground-truth forget class weakens class-aligned representations; and entropy-based output diversification L_diversity = -sum_c pbar_c log pbar_c, with pbar the batch-average prediction, prevents forgotten samples from collapsing into a new surrogate cluster. The full loss L_DECAF = L_target - lambda L_diversity is optimized via SGD on the forget set alone. The paper also introduces a clustering-based evaluation suite (Silhouette, Calinski

Load-bearing premise

The evaluation assumes that clustering quality metrics on penultimate-layer features, computed with k=9 and k=10 and the best clustering algorithm selected, are a valid proxy for whether an adversary can actually recover the forgotten class; if low clustering quality does not prevent class recoverability, the central declustering claim is not established.

What would settle it

Train a linear probe or nearest-centroid classifier on DECAF-processed penultimate-layer features of the forget set (using labels only for evaluation) and measure whether forget-class identity can be recovered above chance; if it can, the claim that DECAF breaks the residual cluster is falsified. Alternatively, run a k-means attack with k=10 on those features and check whether mutual information between cluster assignments and true forget-class labels remains at chance level.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Unlearning evaluation should include representation-level clustering diagnostics; methods that score well on forget accuracy can still leave the forget class recoverable in latent space.
  • Forget-only, sub-10-second updates make on-demand removal in continually deployed models practical, removing the need for retain-set access during adaptation.
  • The reported AUS of 0.88, higher than retrain-from-scratch at 0.86, suggests targeted representational disruption can be a more efficient path to good forgetting-utility trade-offs than full retraining.
  • DECAF's near-zero forget accuracy (0.10%) with 79.4% retain accuracy indicates that strong forgetting and retained utility are not in fixed tension for forget-only methods.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Inference: the clustering-attack framing implies an audit procedure for deployed models: an inspector with access to only the forget set could probe for residual cluster separability; DECAF's reported metrics imply such probes should fail, but the paper does not test against an adaptive adversary who knows DECAF's objective.
  • Inference: DECAF requires the forget-class label y_i for confidence suppression, so its direct applicability is to class-level forget requests; unlabelled or feature-level forget requests would need an unsupervised analogue of the target term.
  • Inference: the entropy-diversification term may change class overlap in ways that affect later continual learning; testing whether dispersed forget representations re-cluster after subsequent fine-tuning would reveal the durability of the forgetting.
  • Inference: DECAF is a heuristic rather than certified unlearning, so privacy guarantees should be framed as empirical resistance; combining it with a certification mechanism could close the gap between attack-resistance and provable removal.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This paper argues that many approximate unlearning methods leave the forget set's penultimate-layer features clustered even when classification accuracy on the forget set is low, enabling a simple clustering attack. It proposes DECAF, a post-hoc forget-only method that combines Gaussian input perturbation (Eq. 1), confidence suppression (Eq. 2), and entropy-based output diversification (Eq. 3) in the objective L_target - λ L_diversity (Eq. 4). On CIFAR-10 with ResNet-18, the paper reports 0.10% forget accuracy, 79.4% retain accuracy, an AUS of 0.88, and runtime 9.55 s, and uses clustering metrics (Silhouette, CH, DB) plus 'Safe?' labels in Table 1 to argue that DECAF disrupts residual feature structure. The central claim is that a forget-only post-hoc method can achieve representational unlearning comparably to retraining at a fraction of the cost.

Significance. If the central claim could be established, DECAF would be a practically attractive result: it is forget-only, simple, about 100× faster than retraining, and accompanied by public code. The paper also raises a useful evaluation point—accuracy-based forgetting metrics can miss residual feature-space structure—and proposes a cluster-based diagnostic to address it. The three-component design is interpretable, and the ablation study (Table 3) gives each component a role. However, the current evidence for the central declustering claim is not yet sufficient: the clustering attack is not set up to test what it claims, the 'Safe?' labels are not auditable, and all headline numbers come from single runs with omitted hyperparameters. These issues are fixable, but they affect the main claim.

major comments (5)
  1. [§2.2–§2.3, Table 1] The 'Safe?' column is not tied to the reported clustering metrics. At k=10, DECAF (Silhouette 0.183, CH 1283.5, DB 1.700) and FT (0.179, 1267.5, 1.726) are nearly identical, yet DECAF is marked ✓ and FT ✗. FCS has the strongest cluster structure by all three metrics (Silhouette 0.205, CH 1414.0, DB 1.610) yet is also marked ✓, while Retrain is marked ✓ with the lowest Silhouette/CH values. No threshold or attack-success criterion is stated, so the binary safety labels cannot be audited. Because the paper's central claim is that DECAF 'prevents re-clustering,' this table is load-bearing; the authors must define the clustering attack (e.g., clustering combined features and measuring agreement with true class labels) and derive the labels from it, with error bars.
  2. [§2.2, §4.1] The clustering evaluation is run only on Zf, the penultimate-layer features of the forget set. Since Df is a single class (Sec. 4.1), clustering Zf with k=9 or k=10 cannot test whether the forgotten class forms a separable cluster relative to the retained classes; it can only detect arbitrary substructure within one class. A meaningful clustering attack should cluster the union of forget and retain features (or a background set) and measure whether the forget-class identity is recoverable. As it stands, the proposed diagnosis does not support the claimed failure mode or the success of DECAF in disrupting it.
  3. [§4, Tables 2–3] All quantitative results are single-run, with no standard errors or confidence intervals. The main hyperparameters of DECAF—λ in Eq. (4), noise scale σ in Eq. (1), number of epochs, learning rate, and batch size—are not reported. With no error bars, claims such as 'AUS of 0.88, higher than all baselines and even surpassing retrain (0.86)' and forget accuracy 0.10% cannot be distinguished from noise. The authors should report mean ± std over multiple seeds and give the exact hyperparameters for reproducibility.
  4. [§4.1–§4.2, Table 2] AUS and AIN are used as headline metrics, but neither is defined in the paper; AUS is only cited to (Cotogni et al., 2024; Li et al., 2025) and AIN to (Chundawat et al., 2023). The MIA setup (attack model, training protocol, threshold) is also not described. Without these definitions, the 'surpassing all baselines' claim is not reproducible. Please provide the exact formulas or formal definitions, either in the main text or an appendix.
  5. [§3 vs §4.1] The formulation of L_target in Eq. (2) directly minimizes the model's softmax probability on the ground-truth forget class, which is precisely the quantity behind the Forget Acc column in Table 2. Thus DECAF's low forget accuracy is expected by construction. The paper's stronger claim—representational unlearning—must be supported by the clustering analysis. Because the clustering analysis currently has the issues described above, the current evidence does not yet demonstrate that DECAF removes feature-space structure rather than merely optimizing the evaluated metrics. An independent test, such as the repaired clustering attack, is needed.
minor comments (6)
  1. [Table 1] The caption and column headers are contradictory: the caption says lower Silhouette/CH and higher DB after unlearning indicate disrupted clustering, while the table header prints '↑' for Silhouette and CH and '↓' for DB. Please standardize the notation.
  2. [Figure 2] The t-SNE plots color points by predicted labels, but no legend is given; the single mention of 'dark blue' is not identifiable. Add a legend and, ideally, quantify the visual claim with a metric rather than relying on inspection.
  3. [§2.1] The notation z = ϕ_{θ'}(x) for penultimate-layer features is used without defining θ' as the post-unlearning parameters. Please define it explicitly.
  4. [References] Several references contain typos (e.g., Carlini et al. has a stray 'dec.' and Bommasani et al. has a duplicated year). Please proofread the bibliography.
  5. [§4.1] Choosing one random class as Df without reporting the seed or the class index prevents reproducibility. State which class was used and all random seeds.
  6. [Eq. (3)] The diversity objective is computed over a minibatch, making behavior sensitive to batch size. Since batch size is not reported, the objective is not fully specified.

Circularity Check

0 steps flagged

No circular derivation identified: DECAF is an empirical combination of objectives; the evaluation aligns with its training goal but not by construction, and the author self-citation is not load-bearing.

full rationale

DECAF makes no first-principles derivation or prediction claim; it proposes a post-hoc objective (Eq. 4: LDECAF = L_target - lambda L_diversity) and measures standard unlearning and clustering metrics. The forget accuracy reported (0.10%) is measured on Df, the same set used to minimize L_target (Eq. 2), so strong performance on that specific metric is partly an expected result of the training objective rather than an independent confirmation. This is a training/evaluation alignment common to forget-only unlearning and is disclosed in the setup; it is not a hidden reuse of the evaluation quantity as an input to a fitted prediction. The clustering metrics (Silhouette, CH, DB) are not directly optimized by DECAF, so the central 'declustering' claim is not equivalent to the loss by construction. The only self-citation (Le et al., 2025, POUR) appears in the related work and is not used to justify DECAF's design or to import a theorem. Table 1's 'Safe?' labels are not derivable from the three reported metrics in a stated way, which is an auditability weakness in the empirical evidence, but it is a validity concern, not a circularity. No load-bearing self-citation, uniqueness-theorem import, or ansatz-smuggling step is present.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The central claim rests on the assumption that clustering metrics measure information erasure, and on several unreported hyperparameters. No new physical or architectural entities are introduced.

free parameters (3)
  • diversity weight lambda
    Controls the balance between target suppression and entropy diversification in Eq. (4); value not reported, and Table 3 shows the method is sensitive to it.
  • input noise scale sigma
    Controls Gaussian noise magnitude in Eq. (1); value not reported, and ablation shows removing noise changes forget accuracy and MIA.
  • optimization hyperparameters (epochs, learning rate, batch size)
    Not stated in the paper; required to reproduce the 9.55s runtime and the reported accuracies.
axioms (4)
  • domain assumption Clustering quality of penultimate-layer features is a valid measure of residual memorization
    Used throughout Section 2 to equate lower silhouette/CH and higher DB with better forgetting; no downstream attack accuracy is reported to validate this mapping.
  • ad hoc to paper Gaussian input perturbation increases intra-class dispersion without destroying utility
    Assumed in Section 3 and Eq. (1); no theoretical or independent empirical justification beyond the single CIFAR-10 experiment.
  • ad hoc to paper Entropy regularization prevents re-clustering into surrogate classes
    Assumed in Section 3 and Eq. (3); the ablation shows a mixed effect, and no direct cluster-geometry evidence is provided for this mechanism.
  • domain assumption Softmax probability suppression weakens class-discriminative directions in the penultimate layer
    Standard intuition invoked in Eq. (2) and Section 3, but the paper does not verify the effect on penultimate-layer geometry directly.

pith-pipeline@v1.3.0-alltime-deepseek · 7779 in / 11174 out tokens · 107560 ms · 2026-07-31T23:27:36.030299+00:00 · methodology

0 comments
read the original abstract

Machine unlearning, which aims to remove the influence of specific training data from a trained model, is a key requirement for privacy, accountability, and adaptive deployment. We argue that many unlearning methods are vulnerable to a simple clustering attack, which can recover class structure in an unsupervised manner, limiting their suitability for continual deployment where removal requests must be handled reliably on demand. To address this, we propose DECAF (DE-Clustering for Adaptive Forgetting), a post-hoc method that operates only on the forget set and is designed to break the cluster. DECAF combines input noise, confidence suppression, and entropy-based output diversification to disrupt the residual feature-space structure associated with forgotten data. On CIFAR-10 with ResNet-18, DECAF attains 0.10% forget-class accuracy, 79.4% retain accuracy, and an AUS of 0.88, surpassing all other baselines. In cluster-based analysis, it attains performance comparable to that of unlearning methods that use the full training set, while being significantly more efficient. Code: https://github.com/ale256/representation_unlearning.

Figures

Figures reproduced from arXiv: 2607.23934 by Anjie Le, Can Peng, Hongcheng Guo, J. Alison Noble.

Figure 1
Figure 1. Figure 1: DECAF overview. Given a pretrained model and a forget set Df , DECAF performs post-hoc unlearning using only Df . Inputs are perturbed with noise, passed through the model, and optimized with target suppression and entropy-based diversity, LDECAF = Ltarget − λLdiversity. samples remain clustered in latent space despite reduced classification accuracy. This suggests that these approaches primarily suppress … view at source ↗
Figure 2
Figure 2. Figure 2: t-SNE visualization of penultimate-layer features, where different colors indicate different predicted labels. The original model exhibits well-separated clusters. After fine-tuning, the forget class (dark blue) remains clustered, indicating residual structure. In contrast, DECAF disperses the forget-class representations [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

139 extracted references · 34 linked inside Pith

  1. [1]

    S&P , year=

    Machine unlearning , author=. S&P , year=

  2. [2]

    IEEE Transactions on Information Forensics and Security , volume=

    Zero-shot machine unlearning , author=. IEEE Transactions on Information Forensics and Security , volume=. 2023 , publisher=

    2023

  3. [3]

    NeurIPS , year=

    Making ai forget you: Data deletion in machine learning , author=. NeurIPS , year=

  4. [4]

    S&P , year=

    Towards making systems forget with machine unlearning , author=. S&P , year=

  5. [5]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    ESC: Erasing Space Concept for Knowledge Deletion , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  6. [6]

    arXiv preprint arXiv:2012.07805 , year=

    Extracting Training Data from Large Language Models.(Dec , author=. arXiv preprint arXiv:2012.07805 , year=

    Pith/arXiv arXiv 2012

  7. [7]

    Proceedings of the 2021 ACM conference on fairness, accountability, and transparency , pages=

    On the dangers of stochastic parrots: Can language models be too big? , author=. Proceedings of the 2021 ACM conference on fairness, accountability, and transparency , pages=

    2021

  8. [8]

    2021 , note=

    Personal Information Protection Law of the People's Republic of China , author=. 2021 , note=

    2021

  9. [9]

    IEEE Transactions on Neural Networks and Learning Systems , year=

    Machine unlearning: Taxonomy, metrics, applications, challenges, and prospects , author=. IEEE Transactions on Neural Networks and Learning Systems , year=

  10. [10]

    arXiv preprint arXiv:2511.19339 , year=

    POUR: A Provably Optimal Method for Unlearning Representations via Neural Collapse , author=. arXiv preprint arXiv:2511.19339 , year=

    Pith/arXiv arXiv

  11. [11]

    2018 , url=

    California Consumer Privacy Act of 2018 , author=. 2018 , url=

    2018

  12. [12]

    arXiv preprint arXiv:2108.07258 , year=

    On the opportunities and risks of foundation models , author=. arXiv preprint arXiv:2108.07258 , year=

    Pith/arXiv arXiv

  13. [13]

    A Practical Guide, 1st Ed., Cham: Springer International Publishing , year=

    The eu general data protection regulation (gdpr) , author=. A Practical Guide, 1st Ed., Cham: Springer International Publishing , year=

  14. [14]

    INFOCOM , year=

    Backdoor defense with machine unlearning , author=. INFOCOM , year=

  15. [15]

    AISTATS , year=

    Fair machine unlearning: Data removal while mitigating disparities , author=. AISTATS , year=

  16. [16]

    CVPR , year=

    Erasing concepts from diffusion models , author=. CVPR , year=

  17. [17]

    AAAI , year=

    Amnesiac machine learning , author=. AAAI , year=

  18. [18]

    ICML , year=

    Deltagrad: Rapid retraining of machine learning models , author=. ICML , year=

  19. [19]

    Machine Learning , year=

    Machine unlearning: Linear filtration for logit-based classifiers , author=. Machine Learning , year=

  20. [20]

    ICML , year=

    Machine unlearning for random forests , author=. ICML , year=

  21. [21]

    Cluster Computing , year=

    A novel online incremental and decremental learning algorithm based on variable support vector machine , author=. Cluster Computing , year=

  22. [22]

    arXiv preprint arXiv:2106.15093 , year=

    Certifiable machine unlearning for linear models , author=. arXiv preprint arXiv:2106.15093 , year=

    Pith/arXiv arXiv

  23. [23]

    EuroS&P , year=

    Unrolling sgd: Understanding factors influencing machine unlearning , author=. EuroS&P , year=

  24. [24]

    CVPR , year=

    Mlcapsule: Guarded offline deployment of machine learning as a service , author=. CVPR , year=

  25. [25]

    NSDI , year=

    MLaaS in the wild: Workload analysis and scheduling in Large-Scale heterogeneous GPU clusters , author=. NSDI , year=

  26. [26]

    , title =

    Xu, Heng and Zhu, Tianqing and Zhang, Lefeng and Zhou, Wanlei and Yu, Philip S. , title =. ACM Comput. Surv. , year =

  27. [27]

    arXiv preprint arXiv:2209.02299 , year=

    A survey of machine unlearning , author=. arXiv preprint arXiv:2209.02299 , year=

    Pith/arXiv arXiv

  28. [28]

    CVPR , year=

    Eternal sunshine of the spotless net: Selective forgetting in deep networks , author=. CVPR , year=

  29. [29]

    AAAI , year=

    Fast machine unlearning without retraining through selective synaptic dampening , author=. AAAI , year=

  30. [30]

    NeurIPS , year=

    Towards unbounded machine unlearning , author=. NeurIPS , year=

  31. [31]

    TNNLS , year=

    Fast yet effective machine unlearning , author=. TNNLS , year=

  32. [32]

    arXiv preprint arXiv:2403.08254 , year=

    Machine Unlearning: Taxonomy, Metrics, Applications, Challenges, and Prospects , author=. arXiv preprint arXiv:2403.08254 , year=

    Pith/arXiv arXiv

  33. [33]

    AAAI , year=

    Learning to unlearn: Instance-wise unlearning for pre-trained classifiers , author=. AAAI , year=

  34. [34]

    Economics , year=

    The economics of personal data and the economics of privacy , author=. Economics , year=

  35. [35]

    arXiv preprint arXiv:2404.00506 , year=

    Label-agnostic forgetting: A supervision-free unlearning in deep models , author=. arXiv preprint arXiv:2404.00506 , year=

    Pith/arXiv arXiv

  36. [36]

    arXiv preprint arXiv:1503.02531 , year=

    Distilling the Knowledge in a Neural Network , author=. arXiv preprint arXiv:1503.02531 , year=

    Pith/arXiv arXiv

  37. [37]

    arXiv preprint arXiv:1412.6550 , year=

    Fitnets: Hints for thin deep nets , author=. arXiv preprint arXiv:1412.6550 , year=

    Pith/arXiv arXiv

  38. [38]

    CVPR , year=

    Decoupled knowledge distillation , author=. CVPR , year=

  39. [39]

    CVPR , year=

    Distilling object detectors with fine-grained feature imitation , author=. CVPR , year=

  40. [40]

    arXiv preprint arXiv:1910.01108 , year=

    DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter , author=. arXiv preprint arXiv:1910.01108 , year=

    Pith/arXiv arXiv 1910

  41. [41]

    arXiv preprint arXiv:2202.00512 , year=

    Progressive distillation for fast sampling of diffusion models , author=. arXiv preprint arXiv:2202.00512 , year=

    Pith/arXiv arXiv

  42. [42]

    IJCV , year=

    Knowledge distillation: A survey , author=. IJCV , year=

  43. [43]

    AAAI , year=

    Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher , author=. AAAI , year=

  44. [44]

    CVPR , year=

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models , author=. CVPR , year=

  45. [45]

    ICCV , year=

    Erasing concepts from diffusion models , author=. ICCV , year=

  46. [46]

    CVPR , year=

    Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary , author=. CVPR , year=

  47. [47]

    arXiv preprint arXiv:2310.12508 , year=

    Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation , author=. arXiv preprint arXiv:2310.12508 , year=

    Pith/arXiv arXiv

  48. [48]

    Technical report , year=

    Learning multiple layers of features from tiny images , author=. Technical report , year=

  49. [49]

    CS 231N , year=

    Tiny imagenet visual recognition challenge , author=. CS 231N , year=

  50. [50]

    CVPR , year=

    Deep residual learning for image recognition , author=. CVPR , year=

  51. [51]

    ICCV , year=

    Swin transformer: Hierarchical vision transformer using shifted windows , author=. ICCV , year=

  52. [52]

    arXiv preprint arXiv:2010.11929 , year=

    An image is worth 16x16 words: Transformers for image recognition at scale , author=. arXiv preprint arXiv:2010.11929 , year=

    Pith/arXiv arXiv 2010

  53. [53]

    arXiv preprint arXiv:1409.1556 , year=

    Very deep convolutional networks for large-scale image recognition , author=. arXiv preprint arXiv:1409.1556 , year=

    Pith/arXiv arXiv

  54. [54]

    AISTATS , year=

    Approximate data deletion from machine learning models , author=. AISTATS , year=

  55. [55]

    USENIX Security , year=

    On the necessity of auditable algorithmic definitions for machine unlearning , author=. USENIX Security , year=

  56. [56]

    S&P , year=

    Membership inference attacks against machine learning models , author=. S&P , year=

  57. [57]

    CVPR , year=

    Continual forgetting for pre-trained vision models , author=. CVPR , year=

  58. [58]

    arXiv preprint arXiv:2302.04222 , year=

    Shan, Shawn and Cryan, Jenna and Wenger, Emily and Zheng, Haitao and Hanocka, Rana and Zhao, Ben Y , title=. arXiv preprint arXiv:2302.04222 , year=

    Pith/arXiv arXiv

  59. [59]

    Kate Crawford and Trevor Paglen , title=

  60. [60]

    NeurIPS , year=

    Laion-5b: An open large-scale dataset for training next generation image-text models , author=. NeurIPS , year=

  61. [61]

    FG , year=

    Vggface2: A dataset for recognising faces across pose and age , author=. FG , year=

  62. [62]

    ICCV , year=

    Grad-cam: Visual explanations from deep networks via gradient-based localization , author=. ICCV , year=

  63. [63]

    , author=

    Visualizing data using t-SNE. , author=. JMLR , year=

  64. [64]

    USENIX , year =

    Systematic Evaluation of Privacy Risks of Machine Learning Models , author =. USENIX , year =

  65. [65]

    BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain , journal =

    Tianyu Gu and Brendan Dolan. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain , journal =

  66. [66]

    Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks , booktitle =

    Kang Liu and Brendan Dolan. Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks , booktitle =

  67. [67]

    ICLR , year =

    Yige Li and Xixiang Lyu and Nodens Koren and Lingjuan Lyu and Bo Li and Xingjun Ma , title =. ICLR , year =

  68. [68]

    NeurIPS , year =

    Ximing Qiao and Yukun Yang and Hai Li , title =. NeurIPS , year =

  69. [69]

    Encoder-Decoder with Atrous Separable Convolution for Semantic Image Segmentation , booktitle =

    Liang. Encoder-Decoder with Atrous Separable Convolution for Semantic Image Segmentation , booktitle =

  70. [70]

    Mark Everingham and Luc Van Gool and Christopher K. I. Williams and John M. Winn and Andrew Zisserman , title =. IJCV , year =

  71. [71]

    arXiv preprint arXiv:2503.21755 , year=

    VBench-2.0: Advancing Video Generation Benchmark Suite for Intrinsic Faithfulness , author=. arXiv preprint arXiv:2503.21755 , year=

    Pith/arXiv arXiv

  72. [72]

    CVPR , year=

    Imagenet: A large-scale hierarchical image database , author=. CVPR , year=

  73. [73]

    ISO4 , year=

    The mnist database of handwritten digit images for machine learning research [best of the web] , author=. ISO4 , year=

  74. [74]

    ICLR , year=

    Auto-encoding variational bayes , author=. ICLR , year=

  75. [75]

    NeurIPS , year=

    Learning structured output representation using deep conditional generative models , author=. NeurIPS , year=

  76. [76]

    MICCAI , year=

    U-net: Convolutional networks for biomedical image segmentation , author=. MICCAI , year=

  77. [77]

    Communications of the ACM , year=

    Generative adversarial networks , author=. Communications of the ACM , year=

  78. [78]

    NeurIPS , year=

    Denoising diffusion probabilistic models , author=. NeurIPS , year=

  79. [79]

    ICML , year=

    Zero-shot text-to-image generation , author=. ICML , year=

  80. [80]

    arXiv preprint arXiv:2111.13606 , year=

    Conditional image generation with score-based diffusion models , author=. arXiv preprint arXiv:2111.13606 , year=

    Pith/arXiv arXiv

Showing first 80 references.