Pith. sign in

REVIEW 4 major objections 6 minor 39 references

A Convolutional Layer Activation Dimensionality Reduction for Out-of-Distribution and Adversarial Attack Detection Methods

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A new dimensionality reduction compresses convolutional-layer activations to a user-chosen size while preserving or improving out-of-distribution and adversarial-attack detection.

desk verdict A credible kernel-based DR for activation analysis that needs numeric AUC tables and clearer split discipline before its headline claim is supported. read the letter →

arxiv 2608.10203 v1 pith:ZJYDR7H3 submitted 2026-08-10 cs.CV

Leandro de Souza Rosa , Lorenzo Capelli , Clara Nunes Barrancos , Mauro Mangia , Riccardo Rovatti This is my paper · ORCID
classification cs.CV
keywords out-of-distributiondetectionadversarialattackdimensionalityreductionconvolutionalneuralnetworksintermediateactivationssingularvaluedecompositionaveragepoolingcorevectors
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that convolutional-layer activations can be compressed far more aggressively than current practice without hurting, and sometimes helping, out-of-distribution (OoD) and adversarial-attack (AA) detection. It proposes a reduction it calls kernel: unroll the layer's kernels into a dense matrix, apply a trimmed singular value decomposition, project the unfolded input through the resulting matrix, and average-pool the projected activations. The resulting corevector has a user-chosen size $\kappa \le \min(c_o, c_i h_k w_k + 1)$, so the compression level is controllable and its least-compressed setting matches channel-wise average pooling. On CIFAR-100 and ImageNet1k, across four CNN architectures and two detectors (DMD and MACS), the paper reports that kernel matches or beats the strongest alternative reduction while using less memory and computation. A sympathetic reader would care because activation-based detection is then cheaper, more scalable, and tunable to the model at hand.

What carries the argument

The carrying object is the dense convolution-isomorphism matrix $\hat{\mathbf{B}}$, with one row per output channel and columns that are the flattened input kernels plus a bias column, so its size depends on the kernel parameters rather than growing quadratically with the input spatial size as the Toeplitz unrolling does. A trimmed SVD gives $\hat{\mathbf{B}} \approx \hat{\mathbf{P}} \hat{\mathbf{R}} \hat{\mathbf{S}}$; the rows of $\hat{\mathbf{S}}$ act as a new set of ordered kernels, and applying them to the unfolded input followed by average pooling yields the corevector of dimension $\kappa \le \min(c_o, c_i h_k w_k + 1)$. The SVD provides the ordering that makes truncation loss-minimizing, and average pooling provides the spatial collapse, so the representation stays as compact as channel-wise pooling while remaining adjustable.

What would settle it

Run the kernel reduction with $\kappa$ equal to the number of output channels and compare detection AUC with plain average pooling: if the rotated-then-pooled corevectors do not match or beat average pooling at that limit, the claimed information preservation fails. A sharper test replaces $\hat{\mathbf{S}}$ with a random projection of the same dimension; equal detection performance would show that the SVD ordering, not the compression alone, is doing the work.

Watch

Extended reading notes

Core claim

The central claim is that the information a detector needs from a convolutional layer survives a two-stage squeeze: rotate the layer's kernels by the SVD of the dense unrolled kernel matrix $\hat{\mathbf{B}} = [\hat{\mathbf{w}} \ \mathbf{b}]$, keep only the top $\kappa$ singular directions, and collapse each projected spatial map to its channel mean. The resulting corevector $\boldsymbol{\nu}_k \in \mathbb{R}^{\kappa}$ preserves the per-channel low-level-feature content that DMD and MACS rely on, and the SVD ordering makes the loss controllable: reducing $\kappa$ discards the least important directions first. The authors evaluate on CIFAR-100 and ImageNet1k with VGG, MobileNet, ResNet, and ConvNeXt, using OoD datasets and the BIM, PGD, FAB, Square, APGD, and APGD-with-TRADES attacks. They find that kernel consistently matches or outperforms the strongest alternative among average pooling and Toeplitz-SVD, while producing the smallest corevectors and the smallest SVD memory footprint.

Load-bearing premise

The load-bearing assumption is that the information DMD and MACS need for detection survives SVD truncation followed by average pooling; SVD guarantees faithful reconstruction of the kernel matrix, not preservation of detector-relevant signal.

Editorial extensions

If this is right

  • With the kernel reduction, both DMD and MACS match or beat the strongest alternative reduction on all tested OoD and AA benchmarks across all four architectures.
  • The smaller corevectors cut memory: for example, the stored SVD for ResNet drops from gigabytes with Toeplitz-SVD to 6.7 MB with the proposed method.
  • MACS, whose clustering degrades on high-dimensional corevectors, can use SVD-style control without suffering the large $\kappa$ values that Toeplitz-SVD requires.
  • DMD's back-propagation-based peephole computation becomes faster because the corevectors it differentiates through are smaller.
  • Both detectors become DR-agnostic, so practitioners can choose a reduction by footprint and robustness instead of being tied to a fixed pooling scheme.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A layer-wise rule that sets $\kappa$ from the SVD energy spectrum, such as retaining 95% of the singular-value mass, would probably recover the tuned $\kappa$ values without hyperparameter search, because the paper already shows the ordering carries the information.
  • The same unroll-project-pool recipe should transfer to other activation-based detectors and to non-convolutional layers expressible as affine maps, although the paper only tests convolutional layers.
  • When $\kappa$ equals the number of output channels, the kernel reduction differs from average pooling only by an orthogonal rotation of channels; comparing the two at that limit would isolate whether the SVD rotation itself, rather than the tunable dimension, drives the gains.
  • Because the method compresses activations to their channel count with minimal loss, it could serve as a general feature-map compression layer for memory-limited inference beyond OoD and AA detection.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a new dimensionality reduction method, called "kernel", for convolutional layer activations in out-of-distribution (OoD) and adversarial attack (AA) detection. The method reshapes the convolution weights into a dense matrix (the W1 isomorphism), applies a trimmed SVD, uses the right singular vectors to project the unfolded activations, and then average-pools the result to obtain a corevector of dimension kappa <= min(c_i h_k w_k + 1, c_o). The authors extend DMD and MACS to accept arbitrary dimensionality reductions, and evaluate kernel against average pooling and the Toeplitz-SVD reduction on CIFAR-100 and ImageNet1k with four CNN architectures. They report that kernel achieves comparable or better detection AUC while using smaller corevectors and lower memory/compute footprints.

Significance. If the empirical claims hold, the contribution is practical and well-motivated: it provides a controllable compression method that preserves the information needed by activation-based detectors, and the extension of DMD and MACS to generic DR is a useful contribution in itself. The use of a dense weight-matrix isomorphism to avoid the quadratic growth of the Toeplitz operator is elegant, and the reported memory savings are substantial. The paper includes a source-code reference, which supports reproducibility. However, the current evidence does not yet fully support the headline claim of consistent superiority: the paper lacks numeric AUC tables, confidence intervals, and multiple-seed statistics, and the model-selection and tuning procedures are not documented as being restricted to validation data.

major comments (4)
  1. [§5.2 and Figure 3] The central claim that kernel "consistently perform[s] better than, or comparable to, the strongest alternative" is not quantitatively supported by the manuscript. Figure 3 shows only scatter plots of Lambda_OoD and Lambda_AA, and the text does not provide per-dataset AUC values, confidence intervals, or multiple-seed statistics. Please add a table with the exact Lambda_OoD, Lambda_AA, and Lambda_all values for the best configuration of each method and model, together with standard deviations across at least three random seeds, and report statistical significance (e.g., paired tests) for the key kernel-vs-baseline comparisons.
  2. [§5.1.2 and §5.2] The model-layer selection for MobileNet ("empirically select 4 macro-blocks maximizing the detection methods' AUC", §5.1.2) and the hyperparameter tuning ("maximize Lambda_all", §5.2) do not state whether these procedures are performed on validation or test data. If the test set is used for either layer selection or tuning, the reported results are optimistic and not valid as held-out evaluations. Please specify the exact data split used for all selection and tuning steps, and confirm that the final AUC numbers are computed on test samples that were never used for any model or hyperparameter choice.
  3. [§4.1 and §4.2.2, Eq. (16)] The phrase "guaranteeing minimal information loss" overstates the Eckart-Young property. The trimmed SVD in Eq. (16) minimizes the Frobenius-norm reconstruction error of B_hat, but the pipeline then discards P_hat and R_hat and applies average pooling to the projected activations. The guarantee does not cover preservation of the class-conditional or OoD-discriminative structure on which DMD's Mahalanobis distance and MACS's GMM clustering operate. Please revise the wording to state exactly what the SVD truncation guarantees, and discuss why the discarded singular subspaces are expected not to harm detection performance.
  4. [Algorithm 1] The indexing formulas in Algorithm 1 are incorrect for non-square kernels. For a flat index channelo in {0,...,c_i h_k w_k - 1}, the correct decomposition is offset_w = channelo % w_k, offset_h = (channelo // w_k) % h_k, and channel_i = channelo // (w_k * h_k). The published line 3 uses (channelo // h_k) % h_k, which coincides with the correct mapping only when h_k = w_k. Since all layers in Table 1 have square kernels, this does not affect the reported experiments, but the method is claimed for general convolutional layers and the pseudocode must be fixed or qualified.
minor comments (6)
  1. [§5.1.1] DMD is evaluated only in its "aware" mode, which is stated in the text; the conclusions about DMD should nevertheless be explicitly framed as specific to this setting, since the aware mode uses OoD/AA samples from the same distribution as the test set for regressor training.
  2. [Figure 3] The scatter plots in Figure 3 are dense and hard to read; consider marking the best configuration of each method with distinct colors or labels, and add a separate numeric table for the best configurations to complement the plots.
  3. [§4.1] There is a typo in "hence eliminating the quadratic scaling with the layer's input dimension present intoeplitz": "intoeplitz" should be "in toeplitz".
  4. [§5.2] Please clarify why the search evaluates 50 combinations out of 10^L for avgpooling and 100^L for toeplitz and kernel; the relationship between the number of hyperparameters and the number of evaluated configurations is not immediately clear.
  5. [§3.4.1] The sentence "The toeplitz's shortcoming lies in high-dimensional, highly sparse matrices" is incomplete; specify that the sparse Toeplitz matrices lead to large memory usage and require large kappa values to retain information.
  6. [References] The reference to "han Liu and Arik (2020)" appears with the lowercase initials; please use the correct author name in the reference list and citation.

Circularity Check

1 steps flagged · score 6.0 of 10

Tuning and evaluation share the same test-based Λall, so the headline comparison is a fitted maximum rather than an independent prediction; the DR derivation itself is not circular.

  1. fitted input called prediction [Section 5.1.3 (Eq. 17), Section 5.2, Figure 3 caption, Table 3]
    "Ray Tune iteratively selects promising configurations to maximize Λall, evaluating a total of 50 combinations ... The “best” ones, according to the maximum Λall (highlighted with a diamond-shaped mark) are chosen for further evaluation. ... The performance of DMD and MACS is measured through the AUC (Λ) for differentiating between ID/nominal (from CIFAR-100’s or ImageNet1k’s test) and OoD/AA samples."

    Eq. (17) defines Λ as the geometric mean of per-dataset AUCs used to report results, with ID samples explicitly taken from the test split. Section 5.2 tunes every DR/detector hyperparameter (κ, ε, F) by maximizing this same Λall, and Figure 3/Table 3 then select the “best” configurations for “further evaluation” by the same maximum. The headline claim that kernel “consistently perform[s] better than, or comparable to, the strongest alternative” is therefore a re-reporting of the fitted selection objective rather than an independent prediction: the winning configuration is chosen because it maximizes the very AUC values that are later quoted as evidence. No held-out evaluation is described that would break the tie between selection and assessment.

full rationale

The DR derivation itself is not circular: Eqs. (14)-(16) build the projection from the layer’s own weight matrix B_hat, and the SVD optimality claim (Eckart-Young) is a standard external theorem; the basis is not derived from OoD/AA labels, and the benchmark datasets/attacks are external. The use of the authors’ own MACS as a baseline is self-citation, but it is not load-bearing in the derivation because MACS is also compared against DMD and its original toeplitz DR, and the comparison is empirical. The circularity is confined to the experimental protocol: the same test-based Λall used as the tuning objective is later reported as the evaluation result. Because the “best” configurations are chosen by maximizing Λall and the headline claim concerns Λall, the comparison is a report of fitted maxima rather than an independent prediction. This supports a partial-circularity score of 6 rather than 0-2.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central claim rests on hyperparameters kappa, epsilon, F, and delta, plus empirical assumptions that the dense-kernel SVD and average pooling preserve detector-relevant information. No new physical or mathematical entities are introduced. The method is built from cited math and prior detectors.

free parameters (6)
  • kappa for kernel DR = tuned per layer and dataset in range [50, min(co, ci*hk*wk+1)]
    Controls the corevector dimension after SVD projection and average pooling; tuned via Ray Tune and Optuna to maximize Lambda_all.
  • kappa for toeplitz DR = tuned per layer and dataset in range [50, 1024]
    Controls the corevector dimension for the Toeplitz-SVD baseline; tuned to maximize Lambda_all.
  • epsilon for DMD = tuned in range [0.001, 0.01]
    Perturbation magnitude used to generate class-conditional image variations in DMD; tuned per layer and dataset.
  • F for MACS GMM = tuned in range [50, 5*C]
    Number of Gaussian components in MACS's clustering step; tuned per layer and dataset.
  • delta for MACS score threshold = 0.9 for CIFAR-100, 0 for ImageNet1k
    Model confidence threshold used to select high-confidence training samples for proto-map construction; fixed by hand per dataset.
  • MobileNet macro-block selection = 4 macro-blocks
    The paper states the four macro-blocks were empirically selected to maximize the detection methods' AUC, which is an outcome-informed model selection choice.
assumptions (4)
  • standard math A convolutional layer can be represented as an affine map using the dense kernel unrolling B_hat (Eqs. 14-15).
    Taken from Praggastis et al. (2022); the paper cites it as a known convolution isomorphism. This is the foundation of the proposed method.
  • domain assumption Truncated SVD of B_hat provides an importance-ordered basis whose projection, after average pooling, retains the information needed for OoD and AA detection.
    The paper asserts this in Sections 4.1 and 4.2.2, but it is an empirical assumption because SVD optimality is for weight reconstruction, not downstream detection.
  • domain assumption Channel-wise averaging captures the presence or absence of low-level features in convolutional activations.
    Inherited from DMD (Lee et al. 2018) and used by the proposed method after SVD projection in Eq. (16).
  • domain assumption The selected last convolutional layers of each macro-block are representative of the model's decision process.
    Adopted from DMD guidelines; for MobileNet the layers were empirically selected to maximize AUC (Section 5.1.2), which is a weaker, outcome-informed assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Convolutional Layer Activation Dimensionality Reduction for Out-of-Distribution and Adversarial Attack Detection Methods." pith.science (2026). https://pith.science/paper/ZJYDR7H3

@misc{pith2026260810203,
  author       = {Pith},
  title        = {Pith review of: A Convolutional Layer Activation Dimensionality Reduction for Out-of-Distribution and Adversarial Attack Detection Methods},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZJYDR7H3}},
  note         = {Machine review of arXiv:2608.10203}
}
read the original abstract

Despite the success of convolutional neural networks in image classification tasks and their general application in multi-modal models, their susceptibility to out-of-distribution and adversarial attack samples raises concerns regarding trustworthiness and safety. Among the approaches to tackle such issues, detection methods that analyze the model's intermediate activations to estimate a confidence score are a promising family that evaluates the decision process, relying on a dimensionality reduction step to enable efficient downstream processing of the high-dimensional activations. However, when considering convolutional layers, the dimensionality reduction methods in the literature either lack a mechanism to control the compression/information-loss trade-off or yield large representations. In this paper, we carefully analyze two state-of-the-art detection methods and their dimensionality reductions for convolutional layers and develop a novel reduction method with a controllable high-compression level. We extend these two state-of-the-art detection methods, enabling the usage of any dimensionality reduction, and evaluate their performance on out-of-distribution and adversarial attack detection. Results show that the detection methods with the proposed dimensionality reduction consistently perform better than, or comparable to, the strongest alternative. Furthermore, the proposed method is shown to reduce computation and memory footprints, given that it has the highest compression among the compared methods.

Figures

Figures reproduced from arXiv: 2608.10203 by the authors.

Figure 1
Figure 1. General overview of IAs-based methods for OoD and AA detection. results are often leveraged by model-compression methods to create compact versions of models without sacrificing their performance, being successfully applied to models ranging from CNNs Meneghetti et al. (2023) to Large Language Models (LLMs) Sakr and Khailany (2024). 3. Reference Methods 3.1. Preliminaries We target CNN image classifiers (Φ), whose i… view at source ↗
Figure 2
Figure 2. Proposed method CL’s activation DR overview. 𝑖 represent the typical decision process for each class, which are summarized by a summation and normalization on the class direction to create the so-called “proto-maps” 𝑻 𝑖 ∈ ℝ𝐶×𝐿 according to Eq. 12. 𝑻 𝑖 = ∑ 𝑮∈𝑖 𝑮 ∀ 𝑖 ∈ {0,…, 𝐶 − 1} [𝑻 𝑖 ] 𝑐,𝑙 = [𝑻 𝑖 ] 𝑐,𝑙 𝐶 ∑ −1 𝑗=0 [𝑻 𝑖 ] 𝑗,𝑙 ∀ 𝑐 ∈ {0,…, 𝐶 − 1}, 𝑙 ∈ {0, …, 𝐿 − 1} (12) Finally, a cosine-similarity is used to compute… view at source ↗
Figure 3
Figure 3. ΛOoD and ΛAA for the configurations explored during tuning. The “best” ones, according to the maximum Λall (highlighted with a diamond-shaped mark) are chosen for further evaluation. Gray lines are the Λall product isometric curves. peepholes. In fact, toeplitz scales poorly to larger models, e.g., its SVD computation overflows the GPU19 memory in our tests20, making it detrimental to larger modern models [PITH_FUL… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 13 canonical work pages

  1. [5]

    Neural Comput

    Adaptive temperature scaling for Robust calibration of deep neural networks. Neural Comput. Appl. 36, 8073–8095. URL:https://doi.org/10.1007/s00521-024-09505-4, doi:10.1007/s00521-024-09505-4. Cancela-Outeda, C.,

    doi:10.1007/s00521-024-09505-4

  2. [10]

    Task-Agnostic Out-of-Distribution Detection Using Kernel Density Estimation, in: Un- certaintyforSafeUtilizationofMachineLearninginMedicalImaging,andPerinatalImaging,PlacentalandPretermImageAnalysis,Springer- Verlag, Berlin, Heidelberg. p. 91–101. URL:https://doi.org/10.1007/978-3-030-87735-4_9 , doi:10.1007/978-3-030-87735-4_

    work page doi:10.1007/978-3-030-87735-4_9

  3. [11]

    cc/paper_files/paper/2021/file/3941c4358616274ac2436eacf67fae05-Paper.pdf

    Exploring the limits of out-of-distribution detection, in: Proceedings of the 35th International ConferenceonNeuralInformationProcessingSystems,CurranAssociatesInc.,RedHook,NY,USA.URL: https://proceedings.neurips. cc/paper_files/paper/2021/file/3941c4358616274ac2436eacf67fae05-Paper.pdf. Gal, Y., Ghahramani, Z.,

    work page 2021

  4. [13]

    SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domain, in: 2021 International Joint Conference on Neural Networks (IJCNN), pp. 1–8. doi:10.1109/IJCNN52387.2021.9533442. de Souza Rosa, L., Et al.:Preprint submitted to Elsevier Page 14 of 16 Convolutional Layer Dimensionality Reduction for OoD and AA Detection Methods He, K., Zhang, X...

    arXiv 2021

  5. [15]

    (Eds.), Proceedings of the 33rd International ConferenceonNeuralInformationProcessingSystems,CurranAssociates,Inc

    Attribution-Based Confidence Metric For Deep Neural Networks, in: Wallach, H., Larochelle, H., Beygelzimer, A., d'Alché-Buc, F., Fox, E., Garnett, R. (Eds.), Proceedings of the 33rd International ConferenceonNeuralInformationProcessingSystems,CurranAssociates,Inc. URL: https://proceedings.neurips.cc/paper_files/ paper/2019/file/bc1ad6e8f86c42a371aff945535...

    work page 2019

  6. [16]

    Toronto, Ontario

    University of Toronto. Toronto, Ontario. URL: https://www.cs.utoronto.ca/~kriz/learning-features-2009-TR.pdf. Kurakin,A.,Goodfellow,I.J.,Bengio,S.,2018. Adversarialexamplesinthephysicalworld,in:Artificialintelligencesafetyandsecurity.Chapman and Hall/CRC, pp. 99–112. Lecun, Y., Bottou, L., Bengio, Y., Haffner, P.,

    work page 2009

  7. [18]

    (Eds.), Proceedings of Machine Learning and Systems, pp

    A System for Massively Parallel Hyperparameter Tuning, in: Dhillon, I., Papailiopoulos, D., Sze, V. (Eds.), Proceedings of Machine Learning and Systems, pp. 230–246. URL: https://proceedings.mlsys.org/paper_files/paper/2020/file/a06f20b349c6cf09a6b171c71b88bbfc-Paper.pdf. Liang, B., Li, H., Su, M., Li, X., Shi, W., Wang, X.,

    work page 2020

  8. [19]

    IEEE Transactions on Dependable and Secure Computing 18, 72–85

    Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction. IEEE Transactions on Dependable and Secure Computing 18, 72–85. doi:10.1109/TDSC.2018.2874243. Liaw, R., Liang, E., Nishihara, R., Moritz, P., Gonzalez, J.E., Stoica, I.,

    arXiv 2018

Show all 39 references
  1. [20]

    URL:https://arxiv.org/abs/1807.05118, arXiv:1807.05118

    Tune: A Research Platform for Distributed Model Selection and Training. URL:https://arxiv.org/abs/1807.05118, arXiv:1807.05118. Liu, J., Lin, Z., Padhy, S., Tran, D., Bedrax Weiss, T., Lakshminarayanan, B.,

    arXiv

  2. [21]

    (Eds.), Proceedings of the 34th International Conference on Neural Information Processing Systems, Curran Associates, Inc

    Simple and Principled Uncertainty Estimation with Deterministic Deep Learning via Distance Awareness, in: Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., Lin, H. (Eds.), Proceedings of the 34th International Conference on Neural Information Processing Systems, Curran Ass...

    2020 arXiv

  3. [23]

    URL: https://arxiv.org/abs/1706.06083, arXiv:1706.06083

    Towards deep learning models resistant to adversarial attacks. URL: https://arxiv.org/abs/1706.06083, arXiv:1706.06083. Marcel, S., Rodriguez, Y.,

    arXiv

  4. [26]

    Revisiting the calibration of modern neural networks, in: Proceedings of the 35th International Conference on Neural Information Processing Systems, Curran Asso- ciates Inc., Red Hook, NY, USA. pp. 15682–15694. URL: https://proceedings.neurips.cc/paper_files/paper/2021/file/ 8...

    2021

  5. [27]

    URL:https: //arxiv.org/abs/1803.04765, arXiv:1803.04765

    Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning. URL:https: //arxiv.org/abs/1803.04765, arXiv:1803.04765. Perez-Lebel, A., Morvan, M.L., Varoquaux, G.,

    arXiv

  6. [28]

    Computer Vision and Image Understanding 232, 103687

    A multi-view-CNN framework for deep representation learning in image classi- fication. Computer Vision and Image Understanding 232, 103687. URL:https://www.sciencedirect.com/science/article/pii/ S107731422300067X, doi:https://doi.org/10.1016/j.cviu.2023.103687. Praggastis, B.,...

  7. [29]

    URL:https://arxiv.org/abs/2208.06894, arXiv:2208.06894

    The SVD of Convolutional Weights: A CNN Interpretability Framework. URL:https://arxiv.org/abs/2208.06894, arXiv:2208.06894. Radford,A.,Kim,J.W.,Hallacy,C.,Ramesh,A.,Goh,G.,Agarwal,S.,Sastry,G.,Askell,A.,Mishkin,P.,Clark,J.,Krueger,G.,Sutskever,I.,2021. LearningTransferableVisu...

    2021 arXiv

  8. [30]

    URL:https://arxiv.org/abs/1906.00443, arXiv:1906.00443

    Dimensionality compression and expansion in Deep Neural Networks. URL:https://arxiv.org/abs/1906.00443, arXiv:1906.00443. Rossolini, G., Biondi, A., Buttazzo, G.,

    1906 arXiv

  9. [31]

    IEEE Transactions on Software Engineering 49, 802–815

    Increasing the Confidence of Deep Neural Networks by Coverage Analysis. IEEE Transactions on Software Engineering 49, 802–815. doi:10.1109/TSE.2022.3163682. de Souza Rosa, L., Et al.:Preprint submitted to Elsevier Page 15 of 16 Convolutional Layer Dimensionality Reduction for ...

    2022

  10. [33]

    (Eds.), Advances in Neural Information Processing Sys- tems, Curran Associates, Inc

    ESPACE: Dimensionality Reduction of Activations for Model Compression, in: Globerson, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J., Zhang, C. (Eds.), Advances in Neural Information Processing Sys- tems, Curran Associates, Inc.. pp. 17489–17517. URL: https://p...

    2024

  11. [34]

    URL:https://arxiv.org/abs/ 1409.1556, arXiv:1409.1556

    Very Deep Convolutional Networks for Large-Scale Image Recognition. URL:https://arxiv.org/abs/ 1409.1556, arXiv:1409.1556. Singh, A., Bay, A., Sengupta, B., Mirabile, A.,

    arXiv

  12. [35]

    IEEE Transactions on Image Processing 27, 6025–6038

    A Deep Multi-Modal CNN for Multi-Instance Multi-Label Image Classification. IEEE Transactions on Image Processing 27, 6025–6038. doi:10.1109/TIP.2018.2864920. VanHorn,G.,MacAodha,O.,Song,Y.,Cui,Y.,Sun,C.,Shepard,A.,Adam,H.,Perona,P.,Belongie,S.,2018. Theinaturalistspeciesclass...

    2018

  13. [36]

    Rethinking calibration of deep neural networks: do not be afraid of overconfidence, in: Proceedings of the 35th International Conference on Neural Information Processing Systems, Curran Associates Inc., Red Hook, NY, USA. pp. 11809–11820. URL: https://proceedings.neurips.cc/pa...

    2021

  14. [37]

    4911–4920

    Vim: Out-of-distribution with virtual-logit matching, in: 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4911–4920. doi:10.1109/CVPR52688.2022.00487. Xu, W., Evans, D., Qi, Y.,

    2022

  15. [38]

    URL:http://dx.doi.org/10.14722/ndss.2018.23198, doi:10.14722/ ndss.2018.23198

    Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks, in: Proceedings 2018 Network and Distributed System Security Symposium, Internet Society. URL:http://dx.doi.org/10.14722/ndss.2018.23198, doi:10.14722/ ndss.2018.23198. Yoon,T.,Kim,H.,2024.UncertaintyEs...

    2018

  16. [39]

    Convolutional Neural Networks with Compression Complexity Pooling for Out-of-Distribution Image Detection, in: Bessiere, C. (Ed.), Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence, IJCAI-20, International Joint ConferencesonArtificialIn...

    doi

  17. [40]

    URL:https://arxiv.org/abs/2306.09301, arXiv:2306.09301

    OpenOOD v1.5: Enhanced Benchmark for Out-of-Distribution Detection. URL:https://arxiv.org/abs/2306.09301, arXiv:2306.09301. Zhou,B.,Lapedriza,A.,Khosla,A.,Oliva,A.,Torralba,A.,2018. Places:A10MillionImageDatabaseforSceneRecognition. IEEETransactions on Pattern Analysis and Mac...

    2018 arXiv

  18. [1998]

    Proceedings of the IEEE 86, 2278–2324

    Gradient-based learning applied to document recognition. Proceedings of the IEEE 86, 2278–2324. doi:10.1109/5.726791. Lee,K.,Lee,K.,Lee,H.,Shin,J.,2018.Asimpleunifiedframeworkfordetectingout-of-distributionsamplesandadversarialattacks,in:Proceedings of the 32nd International C...

    2018 doi

  19. [2001]

    (Eds.), Database Theory — ICDT 2001, Springer Berlin Heidelberg, Berlin, Heidelberg

    On the Surprising Behavior of Distance Metrics in High Dimensional Space, in: Van den Bussche, J., Vianu, V. (Eds.), Database Theory — ICDT 2001, Springer Berlin Heidelberg, Berlin, Heidelberg. pp. 420–434. Akiba,T.,Sano,S.,Yanase,T.,Ohta,T.,Koyama,M.,2019. Optuna:ANext-genera...

    2001

  20. [2010]

    Torchvision the machine-vision package of torch, in: Proceedings of the 18th ACM International Conference on Multimedia, Association for Computing Machinery, New York, NY, USA. p. 1485–1488. doi:10.1145/1873951.1874254. Meneghetti, L., Demo, N., Rozza, G.,

  21. [2014]

    Describing Textures in the Wild, in: IEEE Conference in Computer Vision and Pattern Recognition, Greater Columbus Convention Center in Columbus, Ohio., United States. pp. 3606–3613. URL:https: //hal.science/hal-01109284, doi:10.1109/CVPR.2014.461. Croce, F., Andriushchenko, M....

    doi

  22. [2015]

    International Journal of Computer Vision (IJCV) 115, 211–252

    ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV) 115, 211–252. doi:10.1007/s11263-015-0816-y. Sakr, C., Khailany, B.,

    doi

  23. [2016]

    URL:https://openaccess.thecvf.com/content_cvpr_2016/html/He_Deep_Residual_ Learning_CVPR_2016_paper.html, arXiv:1512.03385

    Deep Residual Learning for Image Recognition, in: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). URL:https://openaccess.thecvf.com/content_cvpr_2016/html/He_Deep_Residual_ Learning_CVPR_2016_paper.html, arXiv:1512.03385. He,W.,Wei,J.,Chen...

    2017 arXiv

  24. [2018]

    URL:https://arxiv.org/abs/1811.03728, arXiv:1811.03728

    Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering. URL:https://arxiv.org/abs/1811.03728, arXiv:1811.03728. Cimpoi, M., Maji, S., Kokkinos, I., Mohamed, S., Vedaldi, A.,

    arXiv

  25. [2019]

    URL: https://proceedings.neurips.cc/paper_files/paper/2019/file/cfcce0621b49c983991ead4c3d4d3b6b-Paper.pdf

    Intrinsic dimension of data representations in deep neural networks, in: Proceedings of the 33rd International Conference on Neural Information Processing Systems, Curran Associates Inc., Red Hook, NY, USA. URL: https://proceedings.neurips.cc/paper_files/paper/2019/file/cfcce0...

    2019

  26. [2020]

    Square attack: A query-efficient black-box adversarial attack via random search, in: Computer Vision – ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIII, Springer-Verlag, Berlin, Heidelberg. p. 484–501. URL:https://doi.org/10.1007/97...

    2020 doi

  27. [2021]

    URL:https://arxiv.org/abs/2010.09670, arXiv:2010.09670

    Robustbench: a standardized adversarial robustness benchmark. URL:https://arxiv.org/abs/2010.09670, arXiv:2010.09670. Croce, F., Hein, M., 2020a. Minimally distorted adversarial examples with a fast adaptive boundary attack, in: III, H.D., Singh, A. (Eds.), Proceedings of the ...

    2010 arXiv

  28. [2022]

    Utilizing Network Features to Detect Erroneous Inputs, in: 2022 IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW), pp. 34–43. doi:10.1109/WACVW54805.2022.00009. Guo, C., Pleiss, G., Sun, Y., Weinberger, K.Q.,

    2022

  29. [2023]

    Applied Intelligence 53, 22818–22833

    A dimensionality reduction approach for convolutional neural networks. Applied Intelligence 53, 22818–22833. URL: https://doi.org/10.1007/s10489-023-04730-1, doi:10.1007/s10489-023-04730-1. Minderer, M., Djolonga, J., Romijnders, R., Hubis, F., Zhai, X., Houlsby, N., Tran, D.,...

    doi

  30. [2024]

    PyTorch 2: Faster Machine Learning Through Dynamic Python Bytecode Transformation and Graph Compilation, in: Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2, Association for Computing Machi...

  31. [2025]

    URL:https://arxiv.org/abs/2512.19472, arXiv:2512.19472

    Multi-Layer Confidence Scoring for Detection of Out-of-Distribution Samples, Adversarial Attacks, and In-Distribution Misclassifications. URL:https://arxiv.org/abs/2512.19472, arXiv:2512.19472. Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I....

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.