Pith. sign in

REVIEW 4 major objections 6 minor 31 references

Improving the Robustness/Accuracy Tradeoff Against Adversarial Attacks Using Information Bottleneck Distillation Through Dual Teachers

T0 review · 4 major / 6 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Dual-teacher distillation lifts clean accuracy while preserving adversarial robustness.

desk verdict Modest dual-teacher twist on IBD with a plausible claim, but the evidence as reported is too fragile to trust: no seeds, post-hoc setup selection, and an inconsistent table. read the letter →

arxiv 2607.27737 v1 pith:AQJJEQAB submitted 2026-07-30 cs.LG

Vincent Ryusuke Takahashi , Yoshinari Takeishi , Jun'ichi Takeuchi , Kave Salamatian This is my paper · ORCID
classification cs.LG
keywords InformationBottleneckDistillationadversarialrobustnessknowledgedual-teacheraccuracy-robustnesstradeoffharmonicmeanattentionmatrixCIFAR-10
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the familiar accuracy/robustness tradeoff in adversarially robust distillation can be eased by giving the student a second teacher trained only on clean inputs. It extends Information Bottleneck Distillation (IBD) with two architectures, Double Distillation and Joint Distillation, that align the student's intermediate features with a robust teacher on adversarial inputs and, in the joint variant, with a clean teacher on natural inputs. On CIFAR-10 and CIFAR-100, the new methods hold adversarial accuracy roughly constant while raising clean accuracy, so the harmonic mean of clean and robust accuracy — the paper's headline tradeoff metric — is consistently a few tenths of a point above IBD's. The improvement grows with student model size, and the paper shows the attention-based feature transfer matters even when its learned weights collapse to a uniform pattern. If the results hold, the recipe is simple: a clean teacher plus separate attention matrices for each teacher buys back part of the clean accuracy that adversarial training gives up, at about 1.5 times the training cost.

What carries the argument

The machinery is the 'clean teacher,' a network trained only on natural images, added alongside the adversarial 'robust teacher' of the original IBD loss. In Joint Distillation, two separate learned cross-layer attention matrices weight the feature-consistency (compression) terms: one matrix aligns the student's features with the clean teacher's on clean inputs, the other with the robust teacher's on adversarial inputs. The same objective mixes clean-teacher soft labels on natural samples with robust-teacher soft labels on perturbed samples. The paper demonstrates the module's function by removing it: in the 'global regularization' setting, where the attention weights converge to a uniform r

What would settle it

Re-run the comparison with the original IBD authors' released code (or a documented re-implementation), identical student architecture, training budget, attack protocol, and the same reported hyperparameters; if IBD reproduces at 84% clean / 52% AutoAttack on CIFAR-10, or if any of the external baseline numbers in Table 6 change by as little as 0.3 points, the claimed harmonic-mean advantage of the dual-teacher methods disappears.

Watch

Extended reading notes

Core claim

In the authors' terms, their methods 'improve classification accuracy on clean samples compared to the original IBD, while maintaining similar accuracy on adversarial samples,' and under each method's optimal configuration they 'consistently achieve a higher harmonic mean than the baseline IBD.' The strongest evidence is Table 6: on CIFAR-10, Joint Distillation reaches 84.02% clean accuracy and 51.89% AutoAttack accuracy (harmonic mean 64.16), against 83.62%, 51.78%, and 63.96 for IBD; on CIFAR-100 the corresponding numbers are 59.45%, 28.79% (38.79) versus 58.28%, 29.04% (38.76). The gain is real but measured in tenths of a percentage point. The paper's own negative result is that an adapti

Load-bearing premise

The conclusions rest on the trustworthiness of the reproduced IBD baseline and the comparability of all the comparison numbers, because the claimed advantages are differences of a few tenths of a percentage point; the paper does not state whether the IBD baseline and the state-of-the-art results in Table 6 were obtained under identical, reproducible conditions.

Editorial extensions

If this is right

  • On both CIFAR-10 and CIFAR-100, Joint Distillation attains the highest harmonic mean under AutoAttack among all compared methods (64.16 vs 63.96 for IBD on CIFAR-10; 38.79 vs 38.76 on CIFAR-100).
  • The clean accuracy gain over IBD appears at every value of the trade-off parameter α tested (0.85–0.95), up to 84.34% for JD vs 83.65% for IBD.
  • For students at least one-quarter the size of the teacher, the dual-teacher methods match or exceed IBD's robust accuracy; only at the smallest size (1M parameters) does IBD keep a clear edge.
  • Replacing the fixed tradeoff weight with the adaptive balancing scheme from a recent dual-teacher approach (B-DD/B-JD) raised clean accuracy (up to 86.77%) but hurt AutoAttack robustness, so the authors kept the fixed α.
  • The proposed methods cost about 1.5× the training time and about 1.7× the parameters of IBD, so the tradeoff gain is bought with extra compute.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported gains are on the order of 0.2–0.4 points in harmonic mean; if these are replicated by other groups, the method is an incremental improvement, not a step change.
  • Because the attention module is beneficial even when its weights become uniform, the early training signal of attention may be doing the work; a testable extension would be to freeze or schedule the attention matrix after a few epochs to save compute.
  • The capacity-dependent gains suggest a hypothesis: below some student capacity, a second teacher's features overload the student; a curriculum that starts with the robust teacher and introduces the clean teacher later might transfer better to small students.
  • The negative result on adaptive balancing hints that the balancing rule sharpens clean-teacher influence too aggressively; a softer temperature schedule that only lowers the robust teacher's temperature, or a per-layer weighting, might preserve AutoAttack accuracy while recovering clean accuracy.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes two dual-teacher distillation methods, Double Distillation (DD) and Joint Distillation (JD), that extend the Information Bottleneck Distillation (IBD) framework by adding a clean-teacher stream to the existing robust-teacher stream. DD uses clean-teacher soft labels for clean inputs and robust-teacher soft labels and attention-weighted features for adversarial inputs (Eq. 4); JD additionally distills clean-teacher features on clean inputs via a separate learned attention matrix (Eq. 5). The methods are evaluated on CIFAR-10 and CIFAR-100 with a Pre-Activation ResNet-18 student and WRN teachers, under two regularization/attack-budget configurations. The paper reports improved clean accuracy over IBD at similar robust accuracy, and states that in each method's optimal configuration the proposed methods achieve higher harmonic means than IBD. It also compares against state-of-the-art adversarial training and distillation methods, reports the effect of student size, and analyzes attention-weight behavior under the two training setups.

Significance. If the reported improvements are real, the paper makes a useful empirical contribution: a simple and well-motivated extension of IBD that shifts the clean/robust tradeoff in a favorable direction, particularly for larger student models, and that is competitive with recent dual-teacher frameworks such as B-MTARD. The analysis of attention weight convergence under different regularization regimes is also informative. The claims are, however, entirely empirical and rest on very small differences in harmonic mean (often a few tenths of a percentage point), so the strength of the contribution currently depends on statistical reliability and experimental comparability that the manuscript does not demonstrate. The authors provide anonymous code, which is a positive step, but no proofs or reproducible experimental protocol details are included for the comparison baselines.

major comments (4)
  1. [Table 4, Section 4.3] The 'optimal configuration' comparison is not internally reproducible. For the selective DD row, Table 3 reports clean=84.37 and AA=51.40; Eq. (6) gives harmonic mean 2*84.37*51.40/(84.37+51.40)=63.88, not the printed 64.09. Similarly, the clean value 84.06 in Table 4 does not match Table 3's 84.37, and the PGD harmonic mean is also inconsistent (66.08 vs. the implied 66.04). Since the conclusion 'each method evaluated in its respective optimal configuration' relies directly on Table 4, this arithmetic inconsistency undermines the central empirical claim until corrected.
  2. [Tables 1-8, Section 4] No multiple seeds, standard deviations, or significance tests are reported. The headline advantages over IBD are small (e.g., AA harmonic mean 64.16 vs. 63.96 on CIFAR-10; 38.79 vs. 38.76 on CIFAR-100), and adversarial training runs generally vary by more than these differences across seeds. Without at least three seeds with error bars, or a paired significance test, the claimed improvement could be seed noise. This is load-bearing because the paper's central claim is a modest but consistent harmonic-mean gain.
  3. [Section 4.1, Table 6] The provenance and comparability of the baseline and comparison numbers are not specified. The IBD baseline is described only as 'a reproduction' with no indication of whether the authors' code or a reimplementation was used. The AT, TRADES, ARD, RSLAD, HBaR, InfoAT, and B-MTARD results in Table 6 are not accompanied by the evaluation protocol (same attack implementations, same student architecture, same training budget, same hyperparameters). If these numbers are copied from prior papers rather than run under identical conditions, the 'competitive with state-of-the-art' claim is not supported. The authors should state this explicitly or rerun the comparisons.
  4. [Section 4.3, Table 4] The selection of each method's 'optimal configuration' is performed post hoc on the evaluation tables (global for DD/JD, selective for IBD). No held-out validation set or model selection procedure is described. Because the harmonic mean differences are within run-to-run variability, selecting the best configuration based on the reported test numbers risks overfitting the conclusion to this particular run. A pre-specified protocol or a validation-based selection would make the 'optimal configuration' claim trustworthy.
minor comments (6)
  1. [Section 4.3] The selective setup changes both the L2 regularization and the number of PGD training steps (10 to 20) relative to the global setup, so the 'regularization setup' comparison is confounded with attack budget. This should be acknowledged in the interpretation.
  2. [Table 2] The column header 'Normal Values' is unclear; presumably it refers to the raw accuracy values rather than harmonic means. Please reword.
  3. [Tables 4 and 5] There are typographical inconsistencies: 'Joint Distillations' should be 'Joint Distillation', and the 'best results' formatting is inconsistent across tables (e.g., Table 5 does not bold the best row).
  4. [References] Reference [17] cites 'ResNet-18' as a dataset with a TIB service URL; this should be a proper citation to He et al. (2016) for Pre-Activation ResNet, and the dataset URL is inappropriate.
  5. [Figure 5] Figure 5 is referenced in the text but does not appear in the manuscript; the caption mentions a non-uniform y-axis scale, which should be made explicit in the figure if included.
  6. [Eq. (4), Eq. (5)] The notation y_clean and y_rob denotes teacher soft labels, but L_CE usually denotes cross-entropy with hard labels. Please clarify the temperature and soft-target treatment, or rename the loss term.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Eq. (4)–(5) are empirical proposal losses evaluated against external baselines, not derivations that reduce to their inputs.

full rationale

There is no derivation chain that could collapse into its own inputs. L_double (Eq. 4) and L_joint (Eq. 5) are proposed extensions of the externally published IBD loss (Eq. 3); their reported accuracies are measured outcomes, not values substituted back into the same equations. The attention weights are learned, and the paper does not define any teacher or student output in terms of the final harmonic mean. No load-bearing self-citation is present: the IBD baseline [8], the harmonic-mean criterion [27], and all Table 6 comparators (AT, TRADES, ARD, RSLAD, HBaR, InfoAT, B-MTARD) are external works with no author overlap with this paper; there is no self-citation chain or imported uniqueness theorem. The post-hoc choice of 'global' vs 'selective' regularization and of α is a model-selection/evaluation protocol; it can inflate a claimed advantage but is not a circular reduction because the accuracies are not forced by the selection rule. I flag two support/reliability gaps that are not circularity: (i) Table 4's selective DD row is internally inconsistent (Clean=84.06, AA=51.40 has harmonic mean 63.88, not the printed 64.09; Clean also differs from Table 3's 84.37), so the 'optimal configuration' comparison is not fully reproducible; (ii) no seeds/error bars are given, and the headline differences are a few tenths of a harmonic-mean point. These are correctness concerns, not circularity. Under the requested taxonomy the honest finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

All free parameters are hyperparameters. The central results depend on alpha=0.9, beta=0.8, the L2 regularization setup, and the number of PGD training steps; each method is then evaluated in its best-performing setup. The paper borrows the IBD approximation of the Information Bottleneck objective and the harmonic-mean evaluation criterion from prior work without independent justification, and assumes the reproduced IBD baseline and external SOTA numbers are comparable.

free parameters (4)
  • alpha = 0.9 (swept 0.85-0.95 in Appendix A.1)
    Trade-off between clean and adversarial cross-entropy in Eqs (4)-(5); chosen to match IBD [8], no validation protocol reported.
  • beta = 0.8
    Weight of feature-distillation/attention loss, taken from IBD [8].
  • regularization setup = global (L2=5e-4 on all params, PGD10) or selective (no bias L2, PGD20)
    The better setup is reported for each method post hoc (Table 4); affects conclusion.
  • PGD training steps = 10 or 20
    Changed together with L2 setup, confounding the selective/global comparison.
assumptions (5)
  • domain assumption The feature-matching term in Eq (3) is a valid approximation of the Information Bottleneck objective.
    Adopted from [8] without independent derivation; this is the foundation of the loss being extended.
  • domain assumption Adversarially trained WideResNet teachers (TRADES/AWP) are appropriate teachers whose robustness transfers to students.
    Relies on prior findings [22,23]; not proven here.
  • domain assumption Harmonic mean H in Eq (6) is the right scalar summary of the accuracy/robustness tradeoff.
    Follows [27]; ranking of methods changes if arithmetic mean or clean accuracy alone is used, as the B-MTARD example shows.
  • domain assumption CIFAR-10/100 robust accuracy under FGSM/PGD/CW/AutoAttack is a sufficient proxy for real-world adversarial robustness.
    Standard practice, but an assumption about external validity.
  • domain assumption The reproduced IBD baseline and Table 6 comparison numbers are faithful and comparable.
    Paper does not document whether baselines were rerun under identical settings; supports all claimed gains.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving the Robustness/Accuracy Tradeoff Against Adversarial Attacks Using Information Bottleneck Distillation Through Dual Teachers." pith.science (2026). https://pith.science/paper/AQJJEQAB

@misc{pith2026260727737,
  author       = {Pith},
  title        = {Pith review of: Improving the Robustness/Accuracy Tradeoff Against Adversarial Attacks Using Information Bottleneck Distillation Through Dual Teachers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AQJJEQAB}},
  note         = {Machine review of arXiv:2607.27737}
}
read the original abstract

Deep neural networks (DNNs) have achieved remarkable success in classical machine learning problems. However, they are known to be vulnerable to adversarial attacks. Countermeasures proposed in the literature, notably Information Bottleneck Distillation (IBD) introduced by Kuang et al., degrade the classification accuracy on clean inputs while improving the robustness to adversarial inputs. In this work, we extend the IBD framework by introducing an extra teacher model (clean teacher) trained with only clean inputs, into the distillation process from a robust teacher model trained by adversarial training. The features of both clean and robust teachers are transferred to the student through a cross-layer attention matrix. Experimental results on the CIFAR-10 and CIFAR-100 datasets show that the proposed method improves classification accuracy on clean samples compared to the original IBD, while maintaining similar accuracy on adversarial samples. Furthermore, our methods are competitive with state-of-the-art approaches, including the recent dual-teacher distillation framework B-MTARD, particularly in terms of the harmonic mean between clean and robust accuracy. We also analyze the impact of different training settings that have different influences on the attention module.

Figures

Figures reproduced from arXiv: 2607.27737 by the authors.

Figure 1
Figure 1. Diagram of the Double Distillation method. Clean samples are passed through the clean [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Diagram of the Joint Distillation Method. Clean samples are passed through the clean [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Attention weights in the Information Bottleneck Distillation [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Attention weights in the Joint Distillation [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: accuracy of the IBD and JD depending on the size of the student model (the y-axis scale is [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 4 linked inside Pith

  1. [1]

    Explaining and Harnessing Adversarial Examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” inProc. Int. Conf. Learn. Represent. (ICLR), 2015

    2015

  2. [2]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inProc. Int. Conf. Learn. Represent. (ICLR), 2018

    2018

  3. [3]

    Distilling the Knowledge in a Neural Network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the Knowledge in a Neural Network,” arXiv preprint arXiv:1503.02531, 2015

    arXiv 2015

  4. [4]

    Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks,

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks,” inProc. IEEE Symp. Security Privacy (SP), 2016

    2016

  5. [5]

    The Information Bottleneck Method,

    N. Tishby, F. C. Pereira, and W. Bialek, “The Information Bottleneck Method,” arXiv preprint arXiv:physics/0004057, 2000

    arXiv 2000

  6. [6]

    Deep Learning and the Information Bottleneck Principle,

    N. Tishby, and N. Zaslavsky, “Deep Learning and the Information Bottleneck Principle,” inProc. IEEE Inf. Theory Workshop (ITW), 2015, pp. 1–5

    2015

  7. [7]

    On the Information Bottleneck Theory of Deep Learning,

    A. M. Saxe, Y . Bansal, J. Dapello, M. Advani, A. Kolchinsky, B. D. Tracey, and D. D. Cox, “On the Information Bottleneck Theory of Deep Learning,” inProc. Int. Conf. Learn. Represent. (ICLR), 2018

    2018

  8. [8]

    Improving Adversarial Robustness via Information Bottleneck Distillation,

    H. Kuang, H. Liu, Y . Wu, S. Satoh, and R. Ji, “Improving Adversarial Robustness via Information Bottleneck Distillation,” inAdv. Neural Inf. Process. Syst. (NeurIPS), 2023

    2023

Show all 31 references
  1. [9]

    Self-Supervised Adversarial Training via Diverse Augmented Queries and Self-Supervised Double Perturbation,

    R. Zhang, S. Tang, and J. Cao, “Self-Supervised Adversarial Training via Diverse Augmented Queries and Self-Supervised Double Perturbation,” inAdv. Neural Inf. Process. Syst. (NeurIPS), 2024

    2024

  2. [10]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” inProc. Int. Conf. Learn. Represent. (ICLR), 2014

    2014

  3. [11]

    Defensive Distillation is Not Robust to Adversarial Examples,

    N. Carlini and D. Wagner, “Defensive Distillation is Not Robust to Adversarial Examples,” in arXiv:1607.04311, 2016

    2016 arXiv

  4. [12]

    Adversarial training for free!

    A. Shafahi, M. Najibi, A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!” inAdv. Neural Inf. Process. Syst. (NeurIPS), 2019

    2019

  5. [13]

    FitNets: Hints for thin deep nets,

    A. Romero, N. Ballas, S. Ebrahimi Kahou, A. Chassang, C. Gatta, and Y . Bengio, “FitNets: Hints for thin deep nets,” inProc. Int. Conf. Learn. Represent. (ICLR), 2015

    2015

  6. [14]

    Deep variational information bottleneck,

    A. A. Alemi, I. Fischer, J. V . Dillon, and K. Murphy, “Deep variational information bottleneck,” arXiv preprint arXiv:1612.00410, 2016

    2016 arXiv

  7. [15]

    The conditional entropy bottleneck,

    I. Fischer, “The conditional entropy bottleneck,”Entropy, vol. 22, no. 9, p. 999, 2020

    2020

  8. [16]

    The CIFAR-10 dataset,

    A. Krizhevsky, V . Nair, and G. Hinton, “The CIFAR-10 dataset,” Canadian Institute for Advanced Research,

  9. [17]

    ResNet-18,

    M. Yang, D. Xu, H. Chen, Z. Wen, and M. Chen, “ResNet-18,” dataset, 2024. [Online]. Available: https://service.tib.eu/ldmservice/dataset/resnet-18

    2024

  10. [18]

    Wide residual networks,

    S. Zagoruyko and N. Komodakis, “Wide residual networks,” inProc. British Mach. Vision Conf. (BMVC), 2016

    2016

  11. [19]

    Theoretically principled trade-off between robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao, E. P. Xing, L. El Ghaoui, and M. I. Jordan, “Theoretically principled trade-off between robustness and accuracy,” inProc. Int. Conf. Mach. Learn. (ICML), 2019

    2019

  12. [20]

    Towards Evaluating the Robustness of Neural Networks,

    N. Carlini and D. Wagner, “Towards Evaluating the Robustness of Neural Networks,” inProc. IEEE Symp. Security Privacy (SP), 2017

    2017

  13. [21]

    Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks,

    F. Croce and M. Hein, “Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks,” inProc. Int. Conf. Mach. Learn. (ICML), 2020

    2020

  14. [22]

    Adversarially robust distillation,

    M. Goldblum, L. Fowl, S. Feizi, and T. Goldstein, “Adversarially robust distillation,” inProc. AAAI Conf. Artif. Intell., vol. 34, pp. 3996–4003, 2020

    2020

  15. [23]

    Revisiting adversarial robustness distillation: Robust soft labels make student better,

    B. Zi, S. Zhao, X. Ma, and Y .-G. Jiang, “Revisiting adversarial robustness distillation: Robust soft labels make student better,” inProc. IEEE/CVF Int. Conf. Comput. Vis. (ICCV), pp. 16443–16452, 2021

    2021

  16. [24]

    InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle,

    M. Xu, T. Zhang, Z. Li, and D. Zhang, “InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle,”IEEE Trans. Neural Netw. Learn. Syst., 2022

    2022

  17. [25]

    Adversarial Weight Perturbation Helps Robust Generalization,

    D. Wu, S. Xia, and Y . Wang, “Adversarial Weight Perturbation Helps Robust Generalization,” inAdv. Neural Inf. Process. Syst. (NeurIPS), 2020

    2020

  18. [26]

    Revisiting Hilbert–Schmidt Information Bottleneck for Adversarial Robustness,

    Z. Wang, T. Jian, A. Masoomi, S. Ioannidis, and J. Dy, “Revisiting Hilbert–Schmidt Information Bottleneck for Adversarial Robustness,” inAdv. Neural Inf. Process. Syst. (NeurIPS), vol. 34, 2021

    2021

  19. [27]

    Conserve-Update-Revise to Cure Generalization and Robustness Trade- off in Adversarial Training,

    S. Gowda, B. Zonooz, E. Arani, “Conserve-Update-Revise to Cure Generalization and Robustness Trade- off in Adversarial Training,” inProc. Int. Conf. Learn. Represent. (ICLR), 2024. 11

    2024

  20. [28]

    Mitigating Accuracy-Robustness Trade-off via Balanced Multi-Teacher Adversarial Distillation,

    S. Zhao, X. Wang, and X. Wei, “Mitigating Accuracy-Robustness Trade-off via Balanced Multi-Teacher Adversarial Distillation,” inIEEE Trans. Pattern Anal. Mach. Intell., 2024

    2024

  21. [29]

    Adversarial machine learning: a review of methods, tools, and critical industry sectors,

    S. Pelekis, T. Koutroubas, A. Blika, A. Berdelis, E. Karakolis, C. Ntanos, E. Spiliotis, and D. Askounis, “Adversarial machine learning: a review of methods, tools, and critical industry sectors,” inArtif. Intell. Rev., 2025

    2025

  22. [30]

    A meta-survey of adversarial attacks against artificial intelligence algorithms, including diffusion models,

    M. Pawlicki, A. Pawlicka, R. Kozik, and M. Chora´s, “A meta-survey of adversarial attacks against artificial intelligence algorithms, including diffusion models,” inNeurocomputing, 2025. A Technical appendices and supplementary material A.1 Impact ofα In all three methods, α r...

    2025

  23. [2009]

    Available: http://www.cs.toronto.edu/ kriz/cifar.html

    [Online]. Available: http://www.cs.toronto.edu/ kriz/cifar.html

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.