Pith. sign in

REVIEW 5 major objections 5 minor 37 references

A low-contrast QR-shaped thermal trigger can silently steer infrared vision-language models toward attacker-chosen concepts while preserving visual similarity.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 06:54 UTC pith:RIIFGVTS

load-bearing objection Novel attack idea with a clean method, but the IR-VLM premise is asserted rather than demonstrated and the evaluation is too thin to back the headline claims. the 5 major comments →

arxiv 2607.29445 v1 pith:RIIFGVTS submitted 2026-07-31 cs.CV cs.AI

QR-Structured Thermal Triggers for Targeted Semantic Attacks on Infrared Vision-Language Models

Xiang Chen , Yingying Zhao , Chao Li , Jiaju Han , Ben Zhang , Ang Li , Jiahuan Long , Yiwei Wei
show 2 more authors
Jiujiang Guo Chengyin Hu
This is my paper
classification cs.CV cs.AI
keywords infrared vision-language modelstargeted semantic attackQR-structured triggerthermal perturbationblack-box adversarial attackopen-vocabulary classificationcross-task transferabilityCLIP-style encoders
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that a QR-code-shaped thermal pattern, rendered with cold, neutral, and hot modules and optimized without gradients or model access, can redirect an infrared vision-language model's image-text alignment toward a target concept while looking nearly identical to the original thermal frame. If true, open-vocabulary infrared perception—used in night driving, surveillance, and search-and-rescue—can be manipulated by a compact structured carrier, not just a generic patch. The claim is supported by targeted zero-shot classification experiments across four CLIP-style encoders, with a macro-average attack success rate of 34.28%, and by transfer of the same perturbations to image captioning and VQA, where outputs drift toward the target.

Core claim

QR-STT constructs a low-contrast thermal trigger by preserving a QR code's fixed functional regions—finder patterns, timing, format-related regions, and quiet zone—and optimizing only the editable modules, each assigned a cold, neutral, or hot thermal state. A three-stage gradient-free search over zone placement, module topology, and rendering parameters (position, scale, rotation, intensity, blur, roundness), followed by greedy module-flip refinement, steers a frozen CLIP-style IR-VLM so that the target text becomes top-ranked while source evidence is suppressed. Perturbations optimized only for classification also transfer to held-out captioning and VQA models, producing target-consistent

What carries the argument

The central object is the QR-structured thermal trigger: a version-1 QR carrier whose fixed functional regions act as a structural scaffold and whose editable modules carry a ternary thermal state (cold/neutral/hot). The construction reduces the attack to a constrained mixed discrete-continuous optimization over module topology and rendering parameters, searched by a progressive gradient-free solver. The source-to-target objective forces the target similarity to exceed both the source and the strongest competing class by margins, while topology and SSIM regularizers keep the trigger sparse and visually subtle.

Load-bearing premise

Two premises carry the result: the four CLIP backbones genuinely align infrared imagery as true IR-VLMs, and a trigger rendered digitally at 224x224 faithfully represents a physical thermal object; if either fails, the measured attack success need not hold in the real world.

What would settle it

Capture a real low-contrast QR thermal pattern with an infrared camera at varied distances and angles, feed the frames to the same four encoders, and check top-1 target attack success; if it collapses toward baseline while SSIM stays high, the digital-rendering-to-physical proxy is invalid. Separately, inspect the adaptation details of the 'infrared-adapted' backbones; if they are ordinary RGB CLIP encoders fed infrared frames without thermal-domain fine-tuning, the claimed IR-VLM attack surface is not established.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A training-free, black-box attack can achieve meaningful targeted success on CLIP-style zero-shot classification without gradient access, reaching 34.28% macro-average ASR versus roughly 14% for the strongest structured baseline.
  • The effect is not confined to classification: adversarial images optimized for classification lower clean-reference preservation in image captioning and VQA across six generative models, indicating embedding-level steering propagates to generation.
  • Module-topology search is the largest contributor to attack success, while stealth rendering (blur, low contrast, rounded modules) is the largest contributor to visual similarity; the fixed QR scaffold also contributes.
  • Attackability varies by backbone: EVA-CLIP ViT-G/14 is comparatively more robust, while OpenCLIP ViT-B/16 and OpenAI CLIP ViT-L/14 are more vulnerable.
  • Performance improves with trigger scale, active-module ratio, thermal intensity, and query budget, with saturating returns at larger settings.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If a QR-STT pattern survives real thermal-sensor physics, QR-shaped thermal stickers or emitters could become physical attack vectors for infrared autonomous systems; a digital-to-physical validation is the decisive next test.
  • The QR scaffold's separability suggests that other high-structure symbolic carriers, such as barcodes or fiducial markers, may serve as similar interpretable attack surfaces; QR-STT is one instance of a broader principle.
  • Because the attacked encoders are CLIP-style and modality-agnostic, similar low-contrast structured patterns might steer visible-spectrum vision-language alignment as well, though visual-stealth constraints would differ.
  • Since downstream caption/VQA models inherit CLIP encoders, defenses that robustify image-text alignment against structured triggers could simultaneously reduce cross-task semantic drift.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes QR-STT, a black-box, training-free targeted semantic attack against infrared vision-language models (IR-VLMs). The attack uses a QR-code carrier whose fixed functional regions are preserved while internal modules are assigned cold, neutral, or hot thermal states; a three-stage gradient-free search optimizes geometry, rendering parameters, and module topology. The objective encourages target alignment, suppresses the source class, and regularizes QR structure and visual distortion. Experiments on four CLIP-style encoders report a macro-average attack success rate of 34.28%, outperforming grid, spline, and hot/cold block baselines, and adversarial images optimized for classification are shown to reduce clean-reference/source-preservation rates in six captioning and VQA models.

Significance. If substantiated, the paper identifies a previously unexplored attack surface: a structured, low-contrast, interpretable thermal carrier that steers open-vocabulary image-text alignment and transfers across classification, captioning, and VQA without model training or gradient access. The method is clearly specified and the comparison against structured infrared baselines is appropriate. However, the central empirical premise—that the tested models are genuinely infrared-adapted IR-VLMs—is currently unsupported, the evaluation is based on a very small dataset with no statistical error bars, and the trigger is only rendered digitally. These issues must be resolved before the claimed threat to deployed infrared perception can be accepted. With a strengthened evaluation, the contribution would be valuable to the adversarial ML and thermal perception communities.

major comments (5)
  1. [Experimental Setup, first paragraph] The paper asserts that 'all deployed VLMs are infrared-adapted for thermal inputs' solely by reference to Jiang et al. (2024), but lists four standard public RGB CLIP checkpoints (OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14, EVA-CLIP ViT-G/14, OpenAI CLIP ViT-L/14) and provides no infrared fine-tuning dataset, procedure, checkpoint hashes, or infrared-specific validation. If these encoders are stock RGB CLIP, then Table 1 measures an RGB-domain attack on thermal inputs, not the robustness of an IR-VLM. This is load-bearing for the title and abstract. The authors must either supply verifiable details of the IR adaptation and validate that the models are indeed infrared-adapted, or rerun the evaluation on publicly available IR-VLMs.
  2. [Tables 1–3 and 'Data and models'] The evaluation uses a 30-class infrared test set with 10 images per class and retains only correctly predicted samples. No final sample count per model is reported, all numbers are single-run, and no confidence intervals, standard deviations, or significance tests are given. With such small per-cell counts, the reported difference between QR-STT (e.g., 34.28%) and the best baseline (13.87%) could correspond to only a handful of samples. The claim that QR-STT is 'best on all 12 backbone–target pairs' needs per-pair N, multiple optimization runs/seeds, and statistical comparison.
  3. [Eq. (7) and Implementation Details] The trigger is rendered digitally by clipping x_i + W(R(M_edit;h);g) to [0,1] at 224×224 resolution. There is no thermal camera transfer function, sensor noise, optical blur, emissivity model, or physical fabrication and re-capture. The paper therefore demonstrates a digital perturbation of infrared images, not a physical 'thermal trigger' that would survive deployment. This mismatch should be acknowledged explicitly, or the claims should be restricted to the digital domain unless physical realizability is tested.
  4. [Tables 2–3 and GPT-5 evaluation] The metric 'clean-reference/source-preservation rate' is never defined. Lower values are interpreted as greater semantic deviation, but a low preservation rate could also mean the generated captions/answers became incoherent or unrelated, rather than target-consistent. Since the attack claims targeted semantic steering, the evaluation should report target-consistency rates (e.g., fraction of outputs mentioning or aligned with the target concept), not only deviation from the clean reference. The GPT-5 judge protocol also needs human agreement numbers or a validation set.
  5. [Equations (8)–(13) and Implementation Details] The objective contains many free parameters whose values are not reported: m, m_s, β, λ_top, λ_vis, η_tv, μ_s, δ_max, γ_min, τ−, τ+, ρ0, and the query budgets per stage. Without these values the optimization cannot be reproduced, and it is unclear whether the visual constraints are active or vacuous. A full hyperparameter table and the active/inactive status of the hinge terms should be included.
minor comments (5)
  1. [Abstract / Figure 1] The abstract claims 'low-contrast' triggers, but no quantitative contrast metric is defined. Consider reporting a contrast measure in addition to SSIM and mean absolute perturbation.
  2. [Experimental Setup] The sentence 'The main evaluation metrics are targeted attack success rate (ASR) and SSIM' is not matched by any quantitative SSIM table in the text; SSIM appears only in the ablation figure. Either report the SSIM numbers or remove the claim.
  3. [Data and models] The 'clean-correct filtering' step is not quantified. The authors should report how many of the 300 images were excluded for each backbone, as this directly affects the sample size and the comparability of ASR across models.
  4. [Image Captioning and VQA Robustness] The six 'infrared-tuned generative IR-VLMs' are named only by their generic architecture names (LLaVA, OpenFlamingo, BLIP-2, InstructBLIP) without any details of their infrared adaptation. This makes it impossible to verify whether they are truly IR-tuned or just standard models run on infrared frames.
  5. [Related Work] Several references are dated 2026, which is unusual for a 2026 arXiv submission. Please verify that all citations are correct and not misattributed.

Circularity Check

0 steps flagged

No significant circularity: the attack objective and reported success metric share the same definition, which is standard for adversarial attacks; no fitted constant is renamed as a prediction.

full rationale

The paper's derivation chain is an optimization procedure, not a derivation of predictions from fitted constants. The objective L_sem in Eq. (9) explicitly enforces target-over-source and target-over-competitor margins, and the evaluation criterion in Eq. (3) is the argmax of the same similarity scores. This is the standard relationship between an attack loss and attack success; it is definitional in the sense that the attack optimizes the quantity it reports, but that is not circular reasoning because the paper does not present the resulting ASR as an independently derived prediction. Hyperparameters (margins, thresholds, weights, active ratio, population sizes) are hand-chosen and not claimed to be derived. The one load-bearing empirical premise—that the four CLIP backbones are infrared-adapted—is asserted via 'Following Jiang et al. (2024), all deployed VLMs are infrared-adapted for thermal inputs' with no adaptation details, and the generative models are described as 'infrared-tuned' while citing standard RGB LLaVA/BLIP-2/OpenFlamingo. This is a missing-support/correctness risk, not circularity: no equation reduces to its own input, no fitted parameter is renamed as a prediction, and no uniqueness or ansatz is imported from a self-citation. The claim that QR-STT 'reliably redirects' is an empirical result on the optimized test set, not a restatement of the objective. Therefore the circularity score is 0.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

The central claim is empirical, so the ledger is dominated by domain assumptions rather than derived constants. The loss function contains several hand-chosen margins and weights, but none are presented as predictions; they are standard attack hyperparameters. The more serious entries are the unverified assumptions that frozen CLIP-style encoders are valid IR-VLMs, that a 300-image filtered set is representative, and that GPT-5 judge scores are reliable evidence of target-consistent drift.

free parameters (5)
  • Objective margins and weights (m, m_s, β, λ_top, λ_vis, η_tv, μ_s, δ_max, γ_min) = not reported numerically
    Hand-selected hyperparameters in Eqs. (8)-(13) control the balance between target alignment, source suppression, topology regularization, and visual distortion; only some are swept in Fig. 5.
  • Decoding thresholds τ− and τ+ = not reported
    Eq. (6) maps relaxed module variables to ternary cold/neutral/hot states; threshold values shape the final discrete topology and are not reported.
  • Active-module ratio ρ0 = not reported
    Eq. (11) targets a desired fraction of cold/hot modules; Fig. 5 shows sensitivity but the default value is not stated.
  • QR geometry and rendering parameters (scale, intensity, blur, roundness) = not reported globally
    These are per-sample optimized variables in Stage 3 and also affect the attack; no fixed default values are given.
  • Population sizes and generation counts = 40/50/60 and 12/16/20 generations
    The 'default fast setting' in Implementation Details specifies these budget choices, but there is no convergence analysis justifying them.
axioms (4)
  • domain assumption CLIP-style 'infrared-adapted' encoders operate on thermal images in the same image-text alignment space as RGB CLIP.
    Problem Setup and Experimental Setup assume frozen CLIP-style IR-VLMs with a valid image-text embedding for infrared inputs; no adaptation details are provided, so the validity of the embedding for thermal data is taken for granted.
  • domain assumption A 30-class infrared test set with 10 images per class, filtered to correctly classified samples, is representative of IR-VLM deployment.
    Experimental Setup describes the dataset only as a 30-class infrared set with 10 images per class and no citation for the source; the clean-correct filter further restricts it, making generalization claims fragile.
  • domain assumption GPT-5 as judge faithfully measures target-consistent semantic drift in captions and VQA outputs.
    The captioning/VQA evaluation relies on an LLM-as-a-judge protocol (Zheng et al. 2023) with GPT-5, but no validation of judge accuracy, agreement, or target-consistency scoring is reported.
  • domain assumption Digital rendering at 224×224 resolution is a faithful proxy for physical thermal trigger behavior.
    Implementation Details state 'Thermal carriers are rendered at 224×224 resolution'; the paper contains no physical sensor or camera experiments, so the thermal infrared domain is only simulated.

pith-pipeline@v1.3.0-daily-deepseek · 10510 in / 11362 out tokens · 116980 ms · 2026-08-03T06:54:53.932774+00:00 · methodology

0 comments
read the original abstract

Infrared vision-language models (IR-VLMs) extend thermal perception to open-vocabulary classification, image captioning, and visual question answering. However, their robustness to structured thermal perturbations and the stability of cross-modal semantic alignment remain insufficiently studied. We propose QR-Structured Thermal Triggers (QR-STT), a stealthy, training-free, black-box framework for targeted semantic steering of IR-VLMs. QR-STT preserves the functional regions of a QR pattern while optimizing its internal modules, each of which is assigned a cold, neutral, or hot thermal state. The framework jointly searches module topology and rendering parameters, including position, scale, rotation, intensity, blur, and roundness. A three-stage gradient-free procedure with greedy module-flip refinement efficiently handles the mixed discrete and continuous search space. The objective promotes alignment with an attacker-selected target, suppresses source-class evidence, and regularizes QR structure and visual similarity. Experiments on multiple CLIP-style encoders show that QR-STT consistently redirects image-text alignment toward chosen concepts while maintaining visual stealth. Perturbations optimized for classification also transfer to image captioning and VQA, causing target-consistent semantic drift in generated outputs. These results identify QR-structured thermal patterns as an interpretable attack surface for language-driven infrared perception and highlight the need for robustness evaluation against structured cross-task semantic attacks.

Figures

Figures reproduced from arXiv: 2607.29445 by Ang Li, Ben Zhang, Chao Li, Chengyin Hu, Jiahuan Long, Jiaju Han, Jiujiang Guo, Xiang Chen, Yingying Zhao, Yiwei Wei.

Figure 1
Figure 1. Figure 1: A QR-structured trigger redirects the image–text [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of QR-STT. Given a clean infrared image and an attacker-specified target label, QR-STT constructs a [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Qualitative targeted-classification examples of QR-STT. Clean infrared samples and their original predictions are [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Qualitative transfer examples of QR-STT on image captioning and VQA. (A) Adversarial samples induce target [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Hyperparameter sensitivity of QR-STT across trigger scale, active ratio, thermal intensity, and optimization budget, [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Component ablation of QR-STT. (a) Targeted [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

37 extracted references · 2 linked inside Pith

  1. [1]

    Proceedings of the 38th International Conference on Machine Learning , pages =

    Learning Transferable Visual Models from Natural Language Supervision , author =. Proceedings of the 38th International Conference on Machine Learning , pages =

  2. [2]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Reproducible Scaling Laws for Contrastive Language-Image Learning , author =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  3. [3]

    The Twelfth International Conference on Learning Representations , year =

    Demystifying CLIP Data , author =. The Twelfth International Conference on Learning Representations , year =

  4. [4]

    arXiv preprint arXiv:2303.15389 , year =

    EVA-CLIP: Improved Training Techniques for CLIP at Scale , author =. arXiv preprint arXiv:2303.15389 , year =

    Pith/arXiv arXiv

  5. [5]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

    Sigmoid Loss for Language Image Pre-Training , author =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  6. [6]

    Infrared-

    Jiang, Shixin and Chen, Zerui and Liang, Jiafeng and Zhao, Yanyan and Liu, Ming and Qin, Bing , booktitle =. Infrared-

  7. [7]

    Cao, Zhe and Zhang, Jin and Zhang, Ruiheng , booktitle =

  8. [8]

    and Pajarinen, Joni , journal =

    Moshtaghi, Seyed-Mohsen and Khajavi, Siavash H. and Pajarinen, Joni , journal =

  9. [9]

    Zhang, Tao and Hong, Yuyang and Xia, Yang and Ding, Kun and Zhang, Zeyu and Wang, Ying and Xiang, Shiming and Pan, Chunhong , journal =

  10. [10]

    Advances in Neural Information Processing Systems , volume =

    Visual Instruction Tuning , author =. Advances in Neural Information Processing Systems , volume =

  11. [11]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year =

    Improved Baselines with Visual Instruction Tuning , author =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , year =

  12. [12]

    Awadalla, Anas and Gao, Irena and Gardner, Josh and Hessel, Jack and Hanafy, Yusuf and Zhu, Wanrong and Marathe, Kalyani and Bitton, Yonatan and Gadre, Samir and Sagawa, Shiori and Jitsev, Jenia and Kornblith, Simon and Koh, Pang Wei and Ilharco, Gabriel and Wortsman, Mitchell and Schmidt, Ludwig , journal =

  13. [13]

    Li, Junnan and Li, Dongxu and Savarese, Silvio and Hoi, Steven , booktitle =

  14. [14]

    Dai, Wenliang and Li, Junnan and Li, Dongxu and Tiong, Anthony Meng Huat and Zhao, Junqi and Wang, Weisheng and Li, Boyang and Fung, Pascale and Hoi, Steven , booktitle =

  15. [15]

    arXiv preprint arXiv:1712.09665 , year =

    Adversarial Patch , author =. arXiv preprint arXiv:1712.09665 , year =

    Pith/arXiv arXiv

  16. [16]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Physically Adversarial Infrared Patches with Learnable Shapes and Locations , author =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  17. [17]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Infrared Adversarial Car Stickers , author =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  18. [18]

    Wei, Hui and Wang, Zhixiang and Jia, Xuemei and Zheng, Yinqiang and Tang, Hao and Satoh, Shin'ichi and Wang, Zheng , booktitle =

  19. [19]

    Neural Networks , volume =

    Adversarial Infrared Blocks: A Multi-View Black-Box Attack to Thermal Infrared Detectors in Physical World , author =. Neural Networks , volume =

  20. [20]

    Neural Networks , volume =

    Adversarial Infrared Curves: An Attack on Infrared Pedestrian Detectors in the Physical World , author =. Neural Networks , volume =

  21. [21]

    Tiliwalidi, Kalibinuer and Hu, Chengyin and Lu, Guangxi and Jia, Ming and Shi, Weiwen , journal =

  22. [22]

    Information Sciences , volume =

    Adversarial Infrared Catmull-Rom Spline: A Black-Box Attack on Infrared Pedestrian Detectors in the Physical World , author =. Information Sciences , volume =

  23. [23]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

    Set-Level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-Training Models , author =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  24. [24]

    Yin, Ziyi and Ye, Muchao and Zhang, Tianrong and Du, Tianyu and Zhu, Jinguo and Liu, Han and Chen, Jinghui and Wang, Ting and Ma, Fenglong , booktitle =

  25. [25]

    Advances in Neural Information Processing Systems , volume =

    On Evaluating Adversarial Robustness of Large Vision-Language Models , author =. Advances in Neural Information Processing Systems , volume =

  26. [26]

    Zhang, Jiaming and Ye, Junhong and Ma, Xingjun and Li, Yige and Yang, Yunfan and Chen, Yunhao and Sang, Jitao and Yeung, Dit-Yan , booktitle =

  27. [27]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Chain of Attack: On the Robustness of Vision-Language Models against Transfer-Based Adversarial Attacks , author =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  28. [28]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

    When Lighting Deceives: Exposing Vision-Language Models' Illumination Vulnerability through Illumination Transformation Attack , author =. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages =

  29. [29]

    International Conference on Learning Representations , year =

    Decision-Based Adversarial Attacks: Reliable Attacks against Black-Box Machine Learning Models , author =. International Conference on Learning Representations , year =

  30. [30]

    Proceedings of the European Conference on Computer Vision , pages =

    Square Attack: A Query-Efficient Black-Box Adversarial Attack Based on Random Search , author =. Proceedings of the European Conference on Computer Vision , pages =

  31. [31]

    Journal of Global Optimization , volume =

    Differential Evolution -- A Simple and Efficient Heuristic for Global Optimization over Continuous Spaces , author =. Journal of Global Optimization , volume =

  32. [32]

    and Zhang, Hao and Gonzalez, Joseph E

    Zheng, Lianmin and Chiang, Wei-Lin and Sheng, Ying and Zhuang, Siyuan and Wu, Zhanghao and Zhuang, Yonghao and Lin, Zi and Li, Zhuohan and Li, Dacheng and Xing, Eric P. and Zhang, Hao and Gonzalez, Joseph E. and Stoica, Ion , booktitle =. Judging

  33. [33]

    IEEE Transactions on Image Processing , volume =

    Image Quality Assessment: From Error Visibility to Structural Similarity , author =. IEEE Transactions on Image Processing , volume =

  34. [34]

    2015 , howpublished =

    2015

  35. [35]

    Nie, Sen and Zhang, Jie and Yan, Jianxin and Shan, Shiguang and Chen, Xilin , booktitle =

  36. [36]

    Hu, Kai and Yu, Weichen and Zhang, Li and Robey, Alexander and Zou, Andy and Hu, Haoqi and Xu, Chengming and Fredrikson, Matt , booktitle =

  37. [37]

    2026 , doi =

    Guo, Qi and Jia, Xiaojun and Pang, Shanmin and Qin, Simeng and Wang, Lin and Jia, Ju and Liu, Yang and Guo, Qing , booktitle =. 2026 , doi =

    2026