Pith. sign in

REVIEW 3 major objections 4 minor 41 references

Beyond Decision Boundaries: Relational Geometry Attacks on Contrastive Embedding Manifolds

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a bounded, generator-produced perturbation can invert the pairwise similarity structure of a contrastive embedding manifold, dropping MarkMatch verification accuracy from 95.4% to 38.6%.

desk verdict A plausible generator-based attack on contrastive verification whose headline results are undermined by training the attack on the victim's test set and by inconsistent probability reporting. read the letter →

arxiv 2608.10237 v1 pith:I5HGNSJP submitted 2026-08-10 cs.AI cs.CV

Fei Zhao , Peiyuan Zhang , Xi Li , Chengcui Zhang , Nitesh Saxena This is my paper · ORCID
classification cs.AIcs.CV
keywords contrastivelearningSiamesenetworksadversarialattackembeddingmanifoldpairwisesimilarityverificationsystemsrelationalgeometrygenerative
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that contrastive and Siamese verification systems, which make decisions from pairwise similarity in an embedding space rather than from class boundaries, can be attacked by systematically corrupting that relational geometry instead of by flipping individual predictions. The authors train a lightweight U-Net generator offline to learn geometry deformation priors from a frozen victim model; at attack time the generator adds a bounded perturbation to each input in a single forward pass. Across the MarkMatch ballot-mark verification system the attack lowers accuracy from 95.4% to 38.6%, and on all tested architectures it collapses the separation between positive and negative pairs, in some cases reversing it so that negative pairs become more similar than positive pairs. If this holds, real-time black-box attacks on similarity-based verification are feasible without per-query gradient computation, and robustness for such systems may need to focus on preserving relational geometry rather than decision boundaries.

What carries the argument

The load-bearing object is the geometry deformation generative network, a U-Net encoder-decoder with skip connections that maps each input image to a bounded perturbation field. Its training objective is built on the relational displacement $\Delta\ell = \ell_{\mathrm{adv}} - \ell_{\mathrm{clean}}$ between adversarial and clean temperature-scaled cosine logits, with a label-dependent sign $\alpha(y)$ that pushes positive-pair logits down and negative-pair logits up, plus a directional regularization term that penalizes batches where positive pairs fail to separate or negative pairs fail to collapse. Perturbations are clipped per pixel and $L^2$-projected so the deformation stays visually subtle. This machinery makes the attack a single feed-forward pass at deployment: all gradient computation happens once, offline, against the frozen victim.

What would settle it

Train the same geometry deformation generator on a dataset that is disjoint from and distributionally shifted relative to the victim's test set, for example signatures from a different population or writing instrument, then measure the accuracy drop and gap reduction on the original test set; if the drop collapses toward the surrogate-transfer baseline, the central claim of distribution-general relational corruption is refuted. A second check is to apply a certified input-space robustness method, such as randomized smoothing, and see whether the positive-negative inversion disappears at a small certified radius.

Watch

Extended reading notes

Core claim

The central discovery is that bounded image perturbations produced by a learned generator can invert the pairwise similarity structure that contrastive verification models rely on. The authors formulate the attack as manifold-level relational corruption: for positive pairs the objective is to separate embeddings, and for negative pairs to collapse them, encoded through a label-dependent direction term on the temperature-scaled cosine logit. On the MarkMatch victim model, the average positive-pair logit drops from 9.993 to -2.478 while the average negative-pair logit rises from 0.641 to 3.340, so the clean positive-negative gap of 9.352 becomes -5.818. The same pattern appears on SigNet, SigScatNet, and a CEDAR DenseNet model, with adversarial accuracy dropping from near-perfect to roughly 0.32-0.50. The paper argues this shows contrastive systems have a different adversarial vulnerability from classifiers: the vulnerable object is the relational organization of the embedding manifold, not any decision boundary.

Load-bearing premise

The attack generator is trained on an 8:2 split of the victim's test set, but the threat model claims it uses only an independent auxiliary dataset; if the learned perturbations depend on that distributional overlap, the reported accuracy collapse will not transfer to a realistic attacker.

Editorial extensions

If this is right

  • A trained generator becomes a real-time attack tool: after the offline stage, adversarial pairs are produced without iterative optimization, so low-latency verification endpoints are exposed.
  • Accuracy alone understates the effect; even where decisions partly survive, the positive-negative similarity order can be compressed or inverted, which would corrupt downstream ranking and retrieval built on the same embeddings.
  • Because the corruption is geometric rather than boundary-based, input-space defenses such as random transformations only soften it (adversarial accuracy rises from 0.363 to 0.480 but gap reduction remains 10.094) rather than eliminating it.
  • The consistency across DenseNet, SigNet, and SigScatNet victims suggests the vulnerability is anchored in the contrastive training paradigm rather than in one architecture.
  • A large $L^2$ budget is not required: a nearly unconstrained setting performs about the same as $\epsilon_2 = 2.5$, indicating the effect comes from targeted geometry deformation rather than perturbation magnitude.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the offline generator may transfer to victim models it was not trained on, since it learns deformation patterns from embedding geometry rather than from one classifier's boundaries; this is testable by training on one victim and attacking a held-out Siamese model.
  • Editorial inference: if the vulnerability is intrinsic to contrastive training, then defenses should be evaluated in embedding space, for example by relational adversarial training that penalizes positive-negative gap collapse, rather than only with input transformations.
  • Editorial inference: the threat model's claim of an independent auxiliary dataset is not actually exercised in the experiments, because the attack training set is carved from the victim's test set; a cleaner test would train the generator on a disjoint acquisition to clarify how much of the reported 95.4% to 38.6% drop depends on test-set distribution overlap.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a generator-based adversarial attack on contrastive/Siamese verification systems. Instead of crossing a decision boundary, an offline-trained U-Net generator produces bounded per-image perturbations that push positive pairs apart and pull negative pairs together in a frozen victim's temperature-scaled cosine-similarity embedding space. At deployment the generator emits perturbations in one forward pass, avoiding online gradient computation. Experiments on a MarkMatch ballot-mark verifier and on CEDAR signature verifiers report substantial accuracy degradation (e.g., 95.4% to 38.6% on MarkMatch), inversion of average positive/negative logits, and comparisons with Diff-PGD, ZO/NES, and surrogate-transfer baselines.

Significance. If the experimental evaluation is corrected, the paper would make a useful contribution: it identifies a distinct vulnerability class for similarity-based verification, and it shows that an amortized generator can, in principle, replace per-query iterative optimization. The problem formulation is clear, the attack objective is simple, and the cross-system experiments (SigNet, SigScatNet, CEDAR DenseNet) are a reasonable first step. The main strengths are the relational-geometry framing and the offline/online amortization idea. No code or machine-checked proofs are provided, and the current experimental protocol contains a serious threat-model violation and several internal inconsistencies, so the headline numbers cannot be taken at face value yet.

major comments (3)
  1. [Section 4.2 vs Section 3.3] The attack generator is trained on the victim's test set, contradicting the stated threat model. Section 3.3 says the attacker 'independently collects a small auxiliary dataset Dtrain_attack that follows a similar distribution to, but has no overlap with, the victim model's training data Dtrain_victim.' Section 4.2 instead sets Dtrain_attack to an 80% random split of Dtest_victim (1,578 of 1,972 pairs), and the sentence 'ensuring no overlap with the victim model's training and test data' is incorrect because Dtrain_attack is a subset of Dtest_victim. The remaining 20% is still drawn from the same victim test distribution, so the evaluation does not test generalization from an independently collected auxiliary set to a different query distribution. Because the central claim is that a fast, generator-based attack works under a realistic black-box threat model, the reported 0.954-to-0.386 accuracy drop and the logit inversion (9.993 to -2.478 vs 0.641 to 3.340) may substantially overstate the attack's effectiveness. The evaluation must be rerun with a genuinely disjoint auxiliary dataset, or the threat model must be explicitly revised to grant the attacker access to the victim's test distribution.
  2. [Section 3.6 vs Section 4.3] The headline relational-geometry metrics are the training objective in closed form, so their large values are partly a restatement of the loss rather than independent evidence of manifold corruption. With w_y = 1, L_attack = (1/N) [sum over positives of Delta-l + sum over negatives of (-Delta-l)] = -(Positive Logit Drop + Negative Logit Rise) = -GapReduction, up to class-balance and averaging constants. Thus the reported PosDrop = 12.471, NegRise = 2.698, and GapReduction = 15.170 largely mirror the fact that the generator minimized the objective in Section 3.6. The accuracy drop is an independent result, but the paper's stronger claim of 'complete inversion' of relational structure should be supported by metrics that are not directly optimized by the loss, such as rank-correlation of pairwise similarities, neighborhood-overlap statistics, or the fraction of pairs whose similarity ordering flips.
  3. [Table 1 and Table 7] There are internal inconsistencies in the reported probabilities and the decision rule. The text states that similarity logits are converted to probabilities with a sigmoid and compared with a threshold near 0.9962, but sigmoid(9.993) is about 0.99995, not 0.996; sigmoid(-2.478) is about 0.077, not 0.326; sigmoid(0.641) is about 0.655, not 0.559; and sigmoid(3.340) is about 0.966, not 0.589. With a threshold of 0.9962, a negative-pair logit of 3.340 would still be rejected, so the reported accuracy of 0.386 is not explainable from the Table 1 logits under the stated decision rule. In addition, the 'No Transform' row of Table 7 (Adv Acc 0.363, Pos Drop 13.529, Gap Red. 16.550) should match Table 1 (Adv Acc 0.386, Pos Drop 12.471, Gap Red. 15.170) but does not. Please clarify the exact decision rule, reconcile these tables, and report error bars over multiple train/test splits; currently every number in the paper is a point estimate from a single split.
minor comments (4)
  1. [Section 4.2] The same attack-split protocol is not described for SigNet, SigScatNet, and CEDAR DenseNet; please state how Dtrain_attack and Dtest_attack were constructed for each victim model and whether the same test-set-leakage issue applies to those experiments.
  2. [Section 3.6] The regularization term L_dir uses ReLU(Delta-l_+) and ReLU(-Delta-l_-), but the main loss already encourages positive pairs to separate and negative pairs to collapse; please clarify whether L_dir changes the optimum or mainly affects optimization dynamics.
  3. [Section 3.6, final paragraph] The text says perturbation magnitude is constrained by clipping and projection 'introduced in Section 3.5,' but these operations are defined in Section 3.4; the cross-reference should be corrected.
  4. [Front matter and Figure 2] The manuscript uses placeholder ACM formatting data (conference acronym, DOI placeholder, and 'Received 20 February 2007' boilerplate), and Figure 2's panels are not clearly labeled; these should be fixed in a polished version.

Circularity Check

2 steps flagged · score 4.0 of 10

Reported relational-corruption metrics are the training objective, and the attack generator is trained on 80% of the victim's test set despite the threat model claiming independent auxiliary data.

  1. fitted input called prediction [Section 3.6 (attack objective) vs Section 4.3 (relational-geometry metrics), Tables 1-2]
    "The main relational corruption objective is formulated as Lattack = 1/N Σ w_y α(y) Δℓ_i ... we also report three relational-geometry metrics. ... Positive Logit Drop: PosDrop = ℓ+_clean − ℓ+_adv ... Negative Logit Rise: NegRise = ℓ−_adv − ℓ−_clean ... GapReduction = (ℓ+_clean−ℓ−_clean) − (ℓ+_adv−ℓ−_adv)."

    For positive pairs, the L_attack term is α=1 times Δℓ = ℓ_adv − ℓ_clean, whose batch average is exactly −PosDrop; for negative pairs, α=−1 makes the term −Δℓ = ℓ_clean − ℓ_adv, exactly NegRise. With the stated weights w_+ = w_− = 1.0, minimizing L_attack maximizes PosDrop + NegRise = GapReduction. The headline 'relational corruption' numbers (12.471, 2.698, 15.170) are therefore the training objective evaluated on the attack test split, not an independent confirmation that the geometry has been corrupted beyond what the loss was designed to enforce. The only genuinely independent content is generalization to the held-out 20% of the same test set.

  2. other [Section 3.3 Threat Model vs Section 4.2 Attack Setup]
    "The attacker independently collects a small auxiliary dataset Dtrain_attack that follows a similar distribution to, but has no overlap with, the victim model's training data Dtrain_victim ... Following the threat model, we randomly split Dtest_victim into the auxiliary dataset Dtrain_attack for attack generator offline training and Dtest_attack for online attack evaluation at an 8:2 ratio."

    The implementation replaces the independently collected auxiliary set with an 80% random split of the victim's own test set, and the online evaluation uses the remaining 20% of that same test set. The generator is therefore trained on the target evaluation distribution, so the reported 0.954→0.386 accuracy drop and the logit inversion (9.993→-2.478 versus 0.641→3.340) measure within-test-set generalization rather than the claimed black-box scenario in which the attacker generalizes from a disjoint, independently collected query distribution. The central real-time black-box attack claim is thus supported by an evaluation that partially gives the attacker the target test data as training input.

full rationale

The main circularity is that the paper's headline relational-geometry metrics (Positive Logit Drop, Negative Logit Rise, Gap Reduction) are, by the paper's own equations, the same quantities minimized by L_attack. Reporting them as evidence of 'manifold-level relational corruption' is partly a restatement of the training objective. However, the generator is evaluated on a held-out 20% split, so generalization to unseen pairs within the same test distribution is an independent check, and the cross-system results (SigNet, SigScatNet, CEDAR DenseNet) extend beyond the single MarkMatch victim. The more serious problem is the threat-model mismatch: Section 4.2 trains the attack generator on 80% of Dtest_victim, while Section 3.3 promises an independently collected auxiliary dataset. This makes the online attack evaluation circular in a different sense: the attacker is effectively given 80% of the target test set for training, so the reported accuracy drop and logit inversion are not evidence for the claimed black-box, independently-collected-query setting. There is no load-bearing self-citation or imported uniqueness theorem; the self-citations are to the MarkMatch victim system and are not used to justify the attack derivation. Overall score 4: the central results retain some independent content, but two key 'predictions' reduce in part to the attack objective or to test-distribution leakage.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. It relies on standard differentiable similarity scoring, a U-Net generator, and several hand-chosen budgets and hyperparameters. The most consequential assumption is the use of the victim's test split as the attack training set, which is not the independent auxiliary dataset described in the threat model.

free parameters (4)
  • epsilon2 (L2 perturbation budget) = 2.5
    Hand-chosen hyperparameter; ablation shows similar attack strength without L2 constraint, so it is not the sole driver.
  • epsilon_pix (per-pixel clipping) = 16/255
    Hand-chosen to keep perturbations imperceptible; all main results use this budget.
  • verification threshold = ~0.9962
    Selected on validation ROC via Youden's J; the reported accuracy drops depend on this fixed threshold.
  • class weights w_y and lambda_dir = w_y = 1.0; lambda_dir not numerically reported
    Hyperparameters of the attack objective (Section 3.6); their values are not systematically swept.
assumptions (5)
  • domain assumption The frozen victim model is differentiable and white-box accessible during offline attack training, so gradients of cosine logits can be backpropagated into the generator.
    Section 3.3 states white-box access; Section 3.6 uses ℓ_adv in the loss. Without this assumption the generator cannot be trained as described.
  • ad hoc to paper Dtrain_attack and Dtest_attack are drawn from Dtest_victim, the victim's test split, which is treated as representative of the online attack distribution.
    Section 4.2 splits Dtest_victim 8:2 into attack training and evaluation. This differs from the threat model's claim of an independently collected auxiliary dataset and is a load-bearing methodological assumption.
  • domain assumption Bounded perturbations (epsilon2 = 2.5, pixel clip 16/255) preserve visual appearance and do not prevent valid image formation.
    Section 4.2 uses these bounds; Figure 2 supports the claim qualitatively, but there is no perceptual metric.
  • ad hoc to paper Relational geometry is adequately measured by average positive and negative logits and the gap between them (PosLogit, NegLogit, GapReduction).
    Section 4.3 defines these metrics as the operationalization of manifold-level corruption; no topological or distributional manifold measure is used.
  • standard math Cosine similarity after L2 normalization is used as the victim's decision score.
    Section 3.5 defines s(A,B) and ℓ(A,B); this is a standard metric learning setup.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond Decision Boundaries: Relational Geometry Attacks on Contrastive Embedding Manifolds." pith.science (2026). https://pith.science/paper/I5HGNSJP

@misc{pith2026260810237,
  author       = {Pith},
  title        = {Pith review of: Beyond Decision Boundaries: Relational Geometry Attacks on Contrastive Embedding Manifolds},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I5HGNSJP}},
  note         = {Machine review of arXiv:2608.10237}
}
read the original abstract

Contrastive learning and Siamese embedding models have become the foundation of modern verification systems, where decisions are governed not by discrete classification boundaries, but by relational geometry in embedding space. However, existing adversarial attacks remain fundamentally classification-centric, overlooking the vulnerability of relational geometry. In this paper, we introduce a geometry-aware adversarial attack framework that reformulates attacks on contrastive systems as manifold-level relational corruption. Instead of targeting individual predictions, the proposed framework systematically distorts similarity organization within the embedding manifold by pushing positive pairs apart while simultaneously pulling negative pairs closer, ultimately collapsing and inverting pairwise similarity structure. To enable scalable deployment, we shift iterative online optimization into an offline adversarial geometry deformation prior learning stage and train a lightweight feed-forward generator that learns generalized geometry deformation patterns from the victim model. Once trained, the generator produces adversarial perturbations through a single forward pass without requiring online gradient computation, enabling real-time online attacks against similarity-based verification systems. Experimental results across multiple verification architectures demonstrate substantial degradation of verification performance together with severe manifold-level relational corruption. On the Markmatch verification system, the proposed attack reduces accuracy from 95.4% to 38.6% while completely reversing the positive-negative similarity structure.

Figures

Figures reproduced from arXiv: 2608.10237 by the authors.

Figure 1
Figure 1. Conventional Attack (a): Traditional boundary [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Qualitative comparison of clean and adversarial [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 33 canonical work pages

  1. [1]

    Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In International conference on machine learning. PmLR, 1597–1607

    work page 2020

  2. [2]

    Sumit Chopra, Raia Hadsell, and Yann LeCun. 2005. Learning a similarity metric discriminatively, with application to face verification. In2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05). Vol. 1. IEEE, 539–546

    work page 2005

  3. [3]

    siamese

    Jane Bromley, Isabelle Guyon, Yann LeCun, Eduard Säckinger, and Roopak Shah. 1993. Signature verification using a" siamese" time delay neural network. Advances in neural information processing systems, 6

    work page 1993

  4. [4]

    Gregory Koch, Richard Zemel, Ruslan Salakhutdinov, et al. 2015. Siamese neural networks for one-shot image recognition. InICML deep learning workshop number 1. Vol. 2. Lille, 1–30

    work page 2015

  5. [5]

    Guoxin Wang, Shreejith Shanker, Avishek Nag, Yong Lian, and Deepu John

    work page

  6. [6]

    Talles B Viana, Victor LF Souza, Adriano LI Oliveira, Rafael MO Cruz, and Robert Sabourin. 2022. Contrastive learning of handwritten signature rep- resentations for writer-independent verification. In2022 International Joint Conference on Neural Networks (IJCNN). IEEE, 01–09

    work page 2022

  7. [7]

    Jindong Li, Dario Zanca, Vincent Christlein, Tim Hamann, Jens Barth, Pe- ter Kämpf, and Björn Eskofier. 2026. Enhancing imu-based online handwrit- ing recognition via contrastive learning with zero inference overhead.arXiv preprint arXiv:2602.07049

    work page Pith review arXiv 2026

  8. [8]

    Fei Zhao, Chengcui Zhang, Maya Shah, and Nitesh Saxena. 2024. Bubblesig: same-hand ballot stuffing detection. In2024 IEEE 7th International Conference on Multimedia Information Processing and Retrieval (MIPR). IEEE, 507–510

    work page 2024

Show all 41 references
  1. [9]

    Fei Zhao, Runlin Zhang, Chengcui Zhang, and Nitesh Saxena. 2025. Mark- match: same-hand stuffing detection. In2025 IEEE International Conference on Multimedia and Expo Workshops (ICMEW). IEEE, 1–2

    2025

  2. [10]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083

    2017 arXiv

  3. [11]

    Anmol Chokshi, Vansh Jain, Rajas Bhope, and Sudhir Dhage. 2023. Sigscatnet: a siamese + scattering based deep learning approach for signature forgery detection and similarity assessment.arXiv preprint arXiv:2311.05579

    2023 arXiv

  4. [12]

    Ignacio Toledo, Suman K

    Sounak Dey, Anjan Dutta, J. Ignacio Toledo, Suman K. Ghosh, Josep Llados, and Umapada Pal. 2017. Signet: convolutional siamese network for writer independent offline signature verification.arXiv preprint arXiv:1707.02131

    2017 arXiv

  5. [13]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572

    2014 arXiv

  6. [14]

    Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. 2023. Better diffusion models further improve adversarial training. In International conference on machine learning. PMLR, 36246–36263

    2023

  7. [15]

    Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. InInternational conference on machine learning. PMLR, 2206–2216

    2020

  8. [16]

    Walter J Scheirer, Anderson de Rezende Rocha, Archana Sapkota, and Terrance E Boult. 2012. Toward open set recognition.IEEE transactions on pattern analysis and machine intelligence, 35, 7, 1757–1772

    2012

  9. [17]

    Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray

  10. [18]

    Maham Jahangir, Muhammad Imran Malik, and Faisal Shafait. 2023. Adver- sarial attacks on convolutional siamese signature verification networks. In International Conference on Document Analysis and Recognition. Springer, 350– 365

    2023

  11. [19]

    Mo Zhou, Zhenxing Niu, Le Wang, Qilin Zhang, and Gang Hua. 2020. Adver- sarial ranking attack and defense. InEuropean Conference on Computer Vision. Springer, 781–799

    2020

  12. [20]

    Gabriel Zaid, Lilian Bossuet, François Dassance, Amaury Habrard, and Alexan- dre Venelli. 2021. Ranking loss: maximizing the success rate in deep learning side-channel analysis.IACR Transactions on Cryptographic Hardware and Em- bedded Systems, 25–55

    2021

  13. [21]

    Siyuan Li, Xing Xu, Zailei Zhou, Yang Yang, Guoqing Wang, and Heng Tao Shen. 2022. Arra: absolute-relative ranking attack against image retrieval. In Proceedings of the 30th ACM International Conference on Multimedia, 610–618

    2022

  14. [22]

    Xiruo Jiang, Yazhou Yao, Xili Dai, Fumin Shen, Liqiang Nie, and Heng-Tao Shen. 2024. Anti-collapse loss for deep metric learning.IEEE Transactions on Multimedia, 26, 11139–11150

    2024

  15. [23]

    Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. 2018. Generating adversarial examples with adversarial networks.arXiv preprint arXiv:1801.02610

    2018 arXiv

  16. [24]

    Zhiyu Zhu, Huaming Chen, Xinyi Wang, Jiayu Zhang, Zhibo Jin, Kim-Kwang Raymond Choo, Jun Shen, and Dong Yuan. 2024. Ge-advgan: improving the transferability of adversarial samples by gradient editing-based adversarial generative model. InProceedings of the 2024 SIAM internatio...

    2024

  17. [25]

    Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. 2018. Genera- tive adversarial perturbations. InProceedings of the IEEE conference on computer vision and pattern recognition, 4422–4431

    2018

  18. [26]

    Shumeet Baluja and Ian Fischer. 2017. Adversarial transformation networks: learning to generate adversarial examples.arXiv preprint arXiv:1703.09387

    2017 arXiv

  19. [27]

    Shagun Sharma and Kalpna Guleria. 2022. Deep learning models for image classification: comparison and applications. In2022 2nd International Conference on Advance Computing and Innovative Technologies in Engineering (ICACITE). IEEE, 1733–1738

    2022

  20. [28]

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. 2015. U-net: convolutional networks for biomedical image segmentation. InMedical Image Computing and Computer-Assisted Intervention. Springer, 234–241

    2015

  21. [29]

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger

  22. [30]

    Alec Radford et al. 2021. Learning transferable visual models from natural language supervision. InProceedings of the 38th International Conference on Machine Learning. PMLR, 8748–8763

    2021

  23. [31]

    Meenakshi K Kalera, Sargur Srihari, and Aihua Xu. 2004. Offline signature verification and identification using distance statistics.International Journal of Pattern Recognition and Artificial Intelligence, 18, 07, 1339–1360

    2004

  24. [32]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. 2014. Adam: a method for stochastic opti- mization.arXiv preprint arXiv:1412.6980

    2014 arXiv

  25. [33]

    William J. Youden. 1950. Index for rating diagnostic tests.Cancer, 3, 1, 32–35

    1950

  26. [34]

    Center of Excellence for Document Analysis and Recognition. n.d. CEDAR signature verification. https://cedar.buffalo.edu/signature/. (n.d.)

  27. [35]

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. 2023. Diffusion- based adversarial sample generation for improved stealthiness and controlla- bility.Advances in Neural Information Processing Systems, 36, 2894–2921

    2023

  28. [36]

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black- box adversarial attacks with limited queries and information. InInternational Conference on Machine Learning, 2137–2146

    2018

  29. [37]

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. 2017. ZOO: zeroth order optimization based black-box attacks to deep neural net- works without training substitute models. InProceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 15–26

    2017

  30. [38]

    Berkay Celik, and Ananthram Swami

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. InProceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, 506–519. Received 20 Febr...

    2017

  31. [2017]

    InProceedings of the IEEE conference on computer vision and pattern recognition, 4700–4708

    Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition, 4700–4708

  32. [2019]

    Metric learning for adversarial robustness.Advances in neural information processing systems, 32

  33. [2024]

    Ecg biometric authentication using self-supervised learning for iot edge sensors.IEEE Journal of Biomedical and Health Informatics, 28, 11, 6606–6618

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.