Pith. sign in

REVIEW 4 major objections 4 minor 31 references

Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LAMDA is a training method that uses frozen language prototypes to make traffic sign networks resistant to shadows, glare, and printed patches on every tested backbone and dataset, without adversarial training or inference overhead.

desk verdict Solid empirical training-time defense for traffic signs; the consistent-robustness claim holds for transfer-based attacks, but test-set hyperparameter selection and missing adaptive attacks are real caveats. read the letter →

arxiv 2608.08815 v1 pith:RDKY4VVZ submitted 2026-08-09 cs.LG

Pedram MohajerAnsari , Amir Salarpour , Mert D. Pesé This is my paper · ORCID
classification cs.LG
keywords trafficsignrecognitionphysicaladversarialattacksrobustnessvision-languagemodelsknowledgedistillationprototypealignmentautonomousdrivingdeeplearningdefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LAMDA is a training framework that aims to make traffic sign recognition networks resistant to physically realizable attacks — shadows, natural-light interference, and printed patches — without ever training on adversarial examples. It does so by fixing two banks of text prototypes, one built from VLM-generated visual descriptions of each sign class and one from class names, and using them as auxiliary supervision for a standard vision backbone. Across two datasets, four backbones, and three attack types, the paper reports that LAMDA is the only one of ten evaluated methods that improves accuracy on every attack–backbone–dataset combination, with gains up to +12.5 percentage points under shadow attacks and +13.2 under natural-light attacks. Clean accuracy is preserved or improved in seven of eight settings, and the text machinery is discarded at inference, so deployment cost is unchanged. The contribution is evidence that language-grounded supervision can buy physical-perturbation resistance that conventional defenses do not provide.

What carries the argument

Two fixed prototype banks are the load-bearing object: $\mathbf{E}^{\text{desc}} \in \mathbb{R}^{C\times D}$ built from averaged, $\ell_2$-normalized embeddings of VLM-generated one-sentence descriptions per class, and $\mathbf{E}^{\text{name}} \in \mathbb{R}^{C\times D}$ built from class names, both encoded once by a frozen text encoder and never updated. A two-layer MLP adapter projects the backbone feature $z$ into the text space as $\hat{t}$; the alignment loss runs cross-entropy on cosine-similarity logits $\hat{t}\mathbf{E}^{\text{desc}\top}/\tau$, while the prototype loss forms soft targets $\sigma(t_y \mathbf{E}^{\text{name}\top}/\tau_p)$ from the target class name's similarities and applies binary cross-entropy to the class head's logits. The total objective is $\mathcal{L}=\mathcal{L}_{\text{CE}}+\lambda\mathcal{L}_{\text{align}}+\mu\mathcal{L}_{\text{proto}}$, with the ablation identifying $\lambda=\mu=1$ as the strongest configuration. At inference the adapter and both banks are discarded, leaving a standard backbone and linear classifier.

What would settle it

Generate shadow, natural-light, and printed-patch attacks by optimizing directly against a LAMDA-trained model rather than against the fixed surrogate models gtsrb-cnn and lisa-cnn; if LAMDA's accuracy gains over the cross-entropy baseline shrink or reverse under those adaptive attacks, the paper's robustness claim would be falsified.

Watch

Extended reading notes

Core claim

The central discovery is that the semantic structure of language, transferred through frozen text prototypes, acts as a useful inductive bias for traffic sign classifiers. The paper argues that pushing image features toward the VLM description of the correct class (alignment loss) and softening the classifier's targets with class-name similarities (prototype loss) makes representations more resistant to physical perturbations, while neither loss alone matches the combination. The evidence is a systematic sweep: among ten methods evaluated under identical budgets, LAMDA is the only one with positive gains on every attack, every backbone, and both datasets, and in a physical experiment classification of an RP2-patched sign rises from 37.5% to 75%.

Load-bearing premise

The robustness gains are measured against adversarial examples generated for fixed surrogate models, not for the LAMDA-trained models themselves, so the claim is a transfer-based robustness result that could weaken under adaptive attackers.

Editorial extensions

If this is right

  • If the central claim holds, traffic sign classifiers can gain physical-perturbation resistance without adversarial training data, breaking the usual trade-off between clean accuracy and defense.
  • Because the adapter and text banks are dropped at inference, the method adds no latency or memory at deployment and can be adopted as a drop-in training recipe.
  • The reported pattern across architectures — larger shadow gains for CNNs, larger natural-light gains for transformers — suggests the language anchor helps both architecture families, just on different failure modes.
  • The physical RP2 experiment, moving correct classifications from 37.5% to 75% across four viewing distances, indicates that printed-patch attacks can be blunted by the same training change.
  • The weight ablation's message is that the two losses are complementary and super-additive: using both at equal strength beats either alone, giving practitioners a single default configuration.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The current evidence is transfer-based: attacks are optimized against fixed surrogate CNNs, not against LAMDA models, so the sharper test is whether the gains survive adaptive white-box attackers that backpropagate through the LAMDA-trained backbone.
  • Nothing in the method is traffic-sign-specific beyond the prototype texts, so the same two-bank recipe could be tried for lane markings, traffic lights, or pedestrian detection, where class names and short appearance descriptions are equally cheap to obtain.
  • The random-prototype ablation implies the language content, not merely a learned projection target, is what creates the shadow-attack gain; varying description specificity or using a weaker description generator would directly probe how much language quality matters.
  • Since inference runs a plain backbone, LAMDA could be stacked with input-transformation defenses such as JPEG compression or randomized smoothing, a combination the paper does not test but the architecture leaves open.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes LAMDA, a training framework for traffic sign recognition that builds two fixed prototype banks from VLM-generated sign descriptions and class names using a frozen OpenCLIP text encoder, and uses these banks to supervise a vision backbone through two auxiliary losses during training. At inference the adapter and prototype banks are discarded, leaving a standard backbone and classifier. The authors evaluate on GTSRB and a 16-class LISA subset across four backbones (ResNet-18, ResNet-34, Swin-T, ViT-B/16) and three physically realizable attacks (shadow, natural light, RP2 patch), claiming LAMDA is the only method among ten that improves robustness on every attacked split, with gains up to +12.5 pp under shadow attacks and +13.2 pp under natural-light attacks, while preserving or improving clean accuracy in seven of eight settings. The paper also reports ablations over loss weights and a physical RP2 patch experiment.

Significance. The core idea of using frozen language prototypes as a training-time regularizer for an inference-time-lightweight vision model is appealing and practically motivated, since it avoids adversarial training and adds no inference overhead. The evaluation is broad in scope: two datasets, four backbone architectures, three physical attack types, and nine comparison defenses, with code provided through a public repository. The method's potential value is real if the reported gains are reproducible and not artifacts of the evaluation protocol. However, the strength of the empirical claims currently exceeds what the evidence supports due to the methodological issues detailed below; these are fixable with additional experiments and a more careful framing.

major comments (4)
  1. [Section V and Tables III/IV] The (λ=1, µ=1) configuration is selected by grid search over the same benign and adversarial evaluation splits on which the final numbers are reported; no validation split is described anywhere in the manuscript. Because the reported gains for LAMDA are in-sample selections from eight configurations, the headline improvements of +12.5pp and +13.2pp may be optimistic. The authors should either perform weight selection on a held-out validation split and report test results for the chosen configuration, or report the full grid results with a clearly described selection rule.
  2. [Section IV and Section VII] All adversarial evaluations use examples generated once against fixed target models (gtsrb-cnn and lisa-cnn) and held fixed for all methods, which Section VII explicitly acknowledges is 'an inherently transfer-based setting.' Because LAMDA's inference-time model is a standard backbone plus head with no adapter or prototype banks, a white-box attacker can directly optimize perturbations against the deployed classifier. The paper's central claim, 'consistently improves robustness across all evaluated attacks, backbones, and datasets,' is therefore only established for transfer-based attacks. The authors should either evaluate adaptive attacks (e.g., PGD on the shadow/light parameterizations, or patch optimization) against the LAMDA-trained backbones, or explicitly restrict the claims to transfer-based robustness.
  3. [Tables III and IV] All reported numbers come from single runs with no seed counts, error bars, or significance tests. Many differences are a few tenths of a percentage point (e.g., +0.513pp benign on GTSRB Swin-T, +1.465pp AE-light on LISA ViT-B/16), so the reader cannot tell whether these differences are reproducible. The authors should report mean and standard deviation over at least three seeds for the main tables, and ideally for the ablation study.
  4. [Section VI] The real-world experiment is based on only 16 classifications (4 backbones × 4 distances) and includes no repetition, no multiple signs or patches, and no statistical analysis. The headline improvement from 37.5% to 75.0% corresponds to 6 vs. 12 correct out of 16; with a binomial or Fisher's exact test, this difference is not statistically significant at the 0.05 level. This evidence is too thin to support the general claim of improved physical RP2 robustness. Please provide more trials, additional signs or patches, or at least confidence intervals.
minor comments (4)
  1. [Section III, Eq. (6)] The prototype loss is written as BCE(o/τs, q); binary cross-entropy normally operates on probabilities, but o denotes logits. Please clarify whether a sigmoid is applied before the BCE or whether a logits-based BCE (e.g., BCEWithLogitsLoss) is intended.
  2. [Table II] The caption refers to 'Representative GTSRB/LISA sign images' but the table contains text descriptions rather than images; either include actual images or revise the caption.
  3. [Section IV] The term 'AE-light' is used without definition; the text later uses 'natural-light attack' and 'AE-light' interchangeably. Define the term at first use.
  4. [Section III] The paper states the method is 'motivated by the strong robustness we observe from VLMs on unseen adversarial inputs' but provides no evidence or citation for this observation; please add a reference or a preliminary experiment.

Circularity Check

0 steps flagged · score 2.0 of 10

No construction-level circularity: LAMDA's robustness gains are measured on external benchmarks with fixed target-model attacks, and the only self-citation is motivational rather than load-bearing.

full rationale

The paper's derivation chain is a training objective, not a first-principles prediction. LAMDA's losses (L = CE + lambda*L_align + mu*L_proto) supervise a backbone with fixed prototype banks from a frozen OpenCLIP text encoder; at inference the adapter and banks are discarded, and all reported accuracy values come from GTSRB and LISA evaluations under attacks generated once against fixed target models (gtsrb-cnn, lisa-cnn). None of these equations makes the reported robustness deltas equal to the loss definitions by construction, so the self-definitional, fitted-input, ansatz-smuggling, and renaming patterns do not apply. The only self-referential element is the motivating sentence in Section III, 'Motivated by the strong robustness we observe from VLMs on unseen adversarial inputs', citing the authors' own prior work [9]. That sentence is motivation, not a load-bearing inference: the mechanism is anchored by external components (OpenCLIP, NVILA) and evaluated on external benchmarks, so per the rules this self-citation is not circular. Section VII explicitly limits the claim: 'Physical attacks in our evaluation are generated against fixed target models rather than the deployed network, an inherently transfer-based setting. Extending the analysis to adaptive gradient-based attackers with direct access to the backbone is left to future work.' This is a scope limitation on the robustness claim, not a circular reduction. The test-set hyperparameter sweep that selects (lambda=1, mu=1) is a statistical selection issue, not circularity, because the reported numbers are not forced by the fitted weights in a definitional sense. Overall, the central claim has independent empirical content; the score reflects only the minor motivational self-citation.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

LAMDA introduces a training objective and a method for constructing prototype banks, not a new physical entity. The central empirical claims rest on domain assumptions about attack transferability and the value of language-based supervision, plus hyperparameters that are tuned on the evaluation splits.

free parameters (5)
  • lambda (alignment loss weight) = 1
    Selected by grid search over {0,1,2} on the evaluation splits in Section V; reported as the best configuration.
  • mu (prototype loss weight) = 1
    Selected together with lambda in the same grid search; the (1,1) pair is reported as strongest.
  • tau (alignment temperature) = not reported
    Defined in Section III but no numeric value is given; controls the sharpness of the alignment logits.
  • tau_p (prototype soft-target temperature) = not reported
    Defined for the sigmoid soft targets in Section III; no numeric value is reported.
  • tau_s (head logit temperature for prototype BCE) = not reported
    Used to scale head logits before the prototype BCE loss; value not reported.
assumptions (5)
  • domain assumption Language-grounded prototype directions improve adversarial robustness of TSR models.
    The entire mechanism assumes that aligning visual features with text prototypes transfers robustness; no theoretical proof is given, only empirical results.
  • domain assumption Adversarial examples generated against fixed target models transfer to LAMDA-trained models.
    Section VII explicitly leaves adaptive attackers with direct backbone access to future work, so the central evaluations depend on transferability.
  • domain assumption The physical attack simulators for shadows, natural light, and RP2 patches adequately represent real-world threats.
    The real-world validation covers a single sign and one patch type, so the broader simulation-to-real claim is assumed.
  • domain assumption Frozen OpenCLIP text embeddings and NVILA-generated descriptions provide stable and meaningful semantic anchors.
    The prototype banks are treated as reliable teachers without evidence that their semantic quality is sufficient across all classes.
  • standard math Standard cross-entropy, cosine similarity, and binary cross-entropy objectives behave as expected for this training setup.
    These are widely used operations; the paper relies on their standard properties without formal verification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles." pith.science (2026). https://pith.science/paper/RDKY4VVZ

@misc{pith2026260808815,
  author       = {Pith},
  title        = {Pith review of: Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RDKY4VVZ}},
  note         = {Machine review of arXiv:2608.08815}
}
read the original abstract

Traffic sign recognition (TSR) models based on deep neural networks achieve strong clean-data performance but remain vulnerable to physically realizable adversarial attacks, including shadow perturbations, natural-light interference, and printed patches. Existing defenses often improve robustness against one attack type while degrading performance on others, and can reduce clean accuracy. We propose LAMDA (Language-Anchored Model for Direction Alignment), a training framework that transfers language-grounded structure into TSR models without using adversarial examples or adding inference-time overhead. LAMDA builds two fixed prototype banks from VLM-generated sign descriptions and class names using a frozen OpenCLIP text encoder, and uses them to supervise visual features through two complementary auxiliary losses during training. At inference, the adapter and prototype banks are discarded, leaving a standard backbone and classifier. Evaluated on GTSRB and LISA across four backbones and three physical attack types, LAMDA is the only method among ten evaluated that consistently improves robustness across all attack-backbone-dataset combinations, with gains of up to +12.5 pp under shadow attacks and +13.2 pp under natural-light attacks, while preserving or improving clean accuracy in nearly all cases.

Figures

Figures reproduced from arXiv: 2608.08815 by the authors.

Figure 1
Figure 1. Examples of physical perturbations. (a) Shadows [6]. (b) Natural Light [7]. (c) RP2 [8]. and templated (e.g., “a traffic sign: {description}”). Each prompt is encoded by the frozen text encoder, averaged, and normalized to form e desc c ∈ R D. Likewise, class names are inserted into templates (e.g., “a traffic sign: {name}”), encoded, averaged, and normalized to form e name c ∈ R D. Stacking across classes yields tw… view at source ↗
Figure 2
Figure 2. LAMDA (two-banks) training. Trainable nodes (backbone, linear head, adapter) are updated during training; Frozen nodes are fixed (the OpenCLIP text encoder and prototype banks). A single frozen OpenCLIP text encoder is shared by both parallel branches: descriptions are encoded once to build Edesc for adapter alignment via λ CE(Salign, y), where Salign = (ˆt E⊤ desc)/τ ; class names are encoded to Ename, whose ground… view at source ↗
Figure 3
Figure 3. ∆ accuracy (pp) relative to the CE-only (0, 0) baseline across eight (λ, µ) configurations for four backbones on GTSRB (a) and LISA (b). Across both datasets, (1, 1) provides the strongest overall performance across the evaluated splits and backbones, while larger loss weights generally reduce performance. 76 cm 203 cm 292 cm 458 cm Model Setting 76 cm 203 cm 292 cm 458 cm ResNet-18 Baseline ✓ SL35 (0.38) × SigAh (0… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Physical adversarial patch attack (RP2) on a [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 16 canonical work pages

  1. [1]

    The road ahead: A comprehensive review of recent advances in traffic sign and lane line recognition for autonomous systems,

    J. S. O. Medina, J. G. M. L ´azaro, A. Rass ˜olkin, and M. Ibrahim, “The road ahead: A comprehensive review of recent advances in traffic sign and lane line recognition for autonomous systems,”IEEE Open Journal of Vehicular Technology, 2025

    work page 2025

  2. [2]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

    2016

  3. [3]

    Swin transformer: Hierarchical vision transformer using shifted windows,

    Z. Liu, Y . Lin, Y . Cao, H. Hu, Y . Wei, Z. Zhang, S. Lin, and B. Guo, “Swin transformer: Hierarchical vision transformer using shifted windows,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 10 012–10 022

    2021

  4. [4]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gellyet al., “An image is worth 16x16 words: Transformers for image recognition at scale,”arXiv preprint arXiv:2010.11929, 2020

    arXiv 2010

  5. [5]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfel- low, and R. Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  6. [6]

    Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon,

    Y . Zhong, X. Liu, D. Zhai, J. Jiang, and X. Ji, “Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 15 345–15 354

    work page 2022

  7. [7]

    Natural light can also be dangerous: Traffic sign misinterpretation under adversarial natural light attacks,

    T.-F. Hsiao, B.-L. Huang, Z.-X. Ni, Y .-T. Lin, H.-H. Shuai, Y .-H. Li, and W.-H. Cheng, “Natural light can also be dangerous: Traffic sign misinterpretation under adversarial natural light attacks,” in2024 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2024, pp. 3903–3912

    work page 2024

  8. [8]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1625–1634

    work page 2018

Show all 31 references
  1. [9]

    On the natural ro- bustness of vision-language models against visual perception attacks in autonomous driving,

    P. MohajerAnsari, A. Salarpour, M. K ¨uhr, S. Huang, M. Hamad, S. Steinhorst, H. Olufowobi, and M. D. Pes ´e, “On the natural ro- bustness of vision-language models against visual perception attacks in autonomous driving,”arXiv preprint arXiv:2506.11472, 2025

    2025

  2. [10]

    Distillation as a defense to adversarial perturbations against deep neural networks,

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in2016 IEEE symposium on security and privacy (SP). IEEE, 2016, pp. 582–597

    2016

  3. [11]

    Counter- ing adversarial images using input transformations,

    C. Guo, M. Rana, M. Cisse, and L. Van Der Maaten, “Counter- ing adversarial images using input transformations,”arXiv preprint arXiv:1711.00117, 2017

    2017 arXiv

  4. [12]

    Provable defenses against adversarial ex- amples via the convex outer adversarial polytope,

    E. Wong and Z. Kolter, “Provable defenses against adversarial ex- amples via the convex outer adversarial polytope,” inInternational conference on machine learning. PMLR, 2018, pp. 5286–5295

    2018

  5. [13]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  6. [14]

    Robustness may be at odds with accuracy,

    D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry, “Robustness may be at odds with accuracy,”arXiv preprint arXiv:1805.12152, 2018

    2018 arXiv

  7. [15]

    Nvila: Efficient frontier visual language models,

    Z. Liu, L. Zhu, B. Shi, Z. Zhang, Y . Lou, S. Yang, H. Xi, S. Cao, Y . Gu, D. Liet al., “Nvila: Efficient frontier visual language models,” arXiv preprint arXiv:2412.04468, 2024

    2024 arXiv

  8. [16]

    Reproducible scaling laws for contrastive language-image learning,

    M. Cherti, R. Beaumont, R. Wightman, M. Wortsman, G. Ilharco, C. Gordon, C. Schuhmann, L. Schmidt, and J. Jitsev, “Reproducible scaling laws for contrastive language-image learning,” inProceedings of the IEEE/CVF conference on computer vision and pattern recogni- tion, 2023, p...

    2023

  9. [17]

    The German Traffic Sign Recognition Benchmark: A multi-class classification com- petition,

    J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “The German Traffic Sign Recognition Benchmark: A multi-class classification com- petition,” inIEEE International Joint Conference on Neural Networks, 2011, pp. 1453–1460

    2011

  10. [18]

    (2025) LISA traffic sign dataset

    Georgia Tech Digital Intelligence Systems Laboratory (DiSL). (2025) LISA traffic sign dataset. GTDLBench. Accessed: 2025-09-

    2025

  11. [19]

    Zero-shot distillation for image encoders: how to make effective use of synthetic data,

    N. Popp, J. H. Metzen, and M. Hein, “Zero-shot distillation for image encoders: how to make effective use of synthetic data,”arXiv preprint arXiv:2404.16637, 2024

    2024 arXiv

  12. [20]

    Promp- tkd: Unsupervised prompt distillation for vision-language models,

    Z. Li, X. Li, X. Fu, X. Zhang, W. Wang, S. Chen, and J. Yang, “Promp- tkd: Unsupervised prompt distillation for vision-language models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 26 617–26 626

    2024

  13. [21]

    Tinyclip: Clip distillation via affinity mimicking and weight inheritance,

    K. Wu, H. Peng, Z. Zhou, B. Xiao, M. Liu, L. Yuan, H. Xuan, M. Valenzuela, X. S. Chen, X. Wanget al., “Tinyclip: Clip distillation via affinity mimicking and weight inheritance,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 21 970–21 980

    2023

  14. [22]

    Clip-kd: An empirical study of clip model distillation,

    C. Yang, Z. An, L. Huang, J. Bi, X. Yu, H. Yang, B. Diao, and Y . Xu, “Clip-kd: An empirical study of clip model distillation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 15 952–15 962

    2024

  15. [23]

    Rethink- ing the inception architecture for computer vision,

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethink- ing the inception architecture for computer vision,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 2818–2826

    2016

  16. [24]

    Available: https://git-disl.github.io/GTDLBench/datasets/ lisa traffic sign dataset/

    [Online]. Available: https://git-disl.github.io/GTDLBench/datasets/ lisa traffic sign dataset/

  17. [25]

    Training with noise is equivalent to tikhonov regular- ization,

    C. M. Bishop, “Training with noise is equivalent to tikhonov regular- ization,”Neural computation, vol. 7, no. 1, pp. 108–116, 1995

    1995

  18. [26]

    Dropout: a simple way to prevent neural networks from overfitting,

    N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhut- dinov, “Dropout: a simple way to prevent neural networks from overfitting,”The journal of machine learning research, vol. 15, no. 1, pp. 1929–1958, 2014

    1929

  19. [27]

    Feature squeezing: Detecting adversarial examples in deep neural networks,

    W. Xu, D. Evans, and Y . Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,”arXiv preprint arXiv:1704.01155, 2017

    2017 arXiv

  20. [28]

    Contrast limited adaptive histogram equalization,

    K. Zuiderveld, “Contrast limited adaptive histogram equalization,” in Graphics gems IV, 1994, pp. 474–485

    1994

  21. [29]

    Mitigating adversar- ial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversar- ial effects through randomization,”arXiv preprint arXiv:1711.01991, 2017

    2017 arXiv

  22. [30]

    Certified adversarial robustness via randomized smoothing,

    J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” ininternational conference on machine learning. PMLR, 2019, pp. 1310–1320

    2019

  23. [31]

    Robustifying zero-shot vision language models by subspaces alignment,

    J. Dong, P. Koniusz, L. Feng, Y . Zhang, H. Zhu, W. Liu, X. Qu, and Y .-S. Ong, “Robustifying zero-shot vision language models by subspaces alignment,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 21 037–21 047

    2025

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.