Calibrating Uncertainty for Zero-Shot Adversarial CLIP

Dongping Zhang; Qibin Zhao; Wenjing Lu; Yang Yang; Yuning Qiu; Zerui Tao

REVIEW 4 major objections 4 minor 1 cited by

UCAT restores calibrated uncertainty in adversarial CLIP by aligning Dirichlet distributions of clean and attacked inputs

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 16:30 UTC pith:C5IFZC3J

load-bearing objection Plausible new robustness loss for adversarial CLIP; the calibration claims rest on an unproven ordering assumption that likely fails. the 4 major comments →

arxiv 2512.12997 v3 pith:C5IFZC3J submitted 2025-12-15 cs.CV cs.AIcs.LG

Calibrating Uncertainty for Zero-Shot Adversarial CLIP

Wenjing Lu , Zerui Tao , Yuning Qiu , Dongping Zhang , Yang Yang , Qibin Zhao This is my paper

classification cs.CV cs.AIcs.LG

keywords CLIPzero-shot adversarial robustnessuncertainty calibrationDirichlet distributionevidential deep learningaleatoric uncertaintyepistemic uncertaintyadversarial fine-tuning

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Adversarial perturbations do more than lower CLIP's accuracy: they often make the model more confident, producing low predictive uncertainty on inputs that are actually hard. The paper argues that existing zero-shot adversarial fine-tuning methods overlook this miscalibration because they align only the winning logit (or single text anchor) and ignore the geometry of nearby classes. It proposes UCAT, which re-reads CLIP's logits as the concentration parameters of a Dirichlet distribution and then regularizes the entire clean and adversarial Dirichlet distributions against each other with a KL term. On 16 single-label datasets and MS-COCO, the paper reports that this restores a sensible ordering of uncertainty (clean original < fine-tuned clean < fine-tuned adversarial), improves adversarial robustness relative to prior single-anchor methods, and preserves clean accuracy. The paper itself scopes these claims to image-encoder attacks, to fine-tuned (not test-time) settings, and to CLIP-family backbones.

Core claim

The central discovery is a structural correspondence: CLIP's softmax over image–text logits is exactly the mean of a Dirichlet distribution whose concentration parameters are α_k = exp((τℓ_k+1)/τ′). Choosing τ′=τ recovers CLIP's predictive distribution verbatim, so CLIP's pretrained logits can be treated as evidence without changing the model's predictions. This gives closed-form aleatoric and epistemic uncertainty estimates from one forward pass. The paper's method, UCAT, fine-tunes the image encoder with L = L_ce + λ KL(Dir(α_adv) ∥ Dir(α)), aligning the attacked sample's evidence distribution back to the clean one instead of pulling a single logit to the ground-truth anchor. The paper cla

What carries the argument

The Dirichlet reparameterization α_k(x) = exp((τℓ_k(x)+1)/τ′) of CLIP logits into concentration parameters; the paper proves this is a valid evidence mapping (α_k≥1, monotone) and that it equals CLIP's softmax exactly when τ′=τ, with s=τ/τ′ acting as a temperature that sharpens or flattens predictions without changing the argmax. The training mechanism is the KL divergence KL(Dir(α_adv)∥Dir(α)) between the attacked and clean Dirichlet distributions, combined with the text-guided cross-entropy term; this is what carries the uncertainty calibration by matching both AU (class-ambiguity shape) and EU (total evidence α0) simultaneously.

Load-bearing premise

The method's calibration results depend on the assumption in Appendix E.1 that switching from the exponential evidence map to softplus and using τ=0.01 for aleatoric versus τ=0.07 for epistemic uncertainty changes only the magnitude of uncertainty values and never their ordering; if that ordering shifts, the reported AUROC improvements would not measure what they claim.

What would settle it

Across the 16 evaluation datasets, compute the per-sample ranking of AU/EU twice: once with α=exp((τℓ+1)/τ′) and once with the softplus-based α and the different τ values used in reporting; if the Kendall rank correlation drops well below 1 on any dataset, the ordering-preservation premise fails and the calibration numbers need to be recomputed under one consistent mapping.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

Attacked inputs can be recognized by their uncertainty signature: after UCAT fine-tuning, adversarial images no longer look spuriously confident, so uncertainty itself becomes a usable reliability signal under perturbation.
Because KL(Dir(α_adv)∥Dir(α)) aligns the whole evidence vector, the method preserves relative inter-class geometry, which the paper argues is the reason clean accuracy and zero-shot transfer are retained while robustness improves.
Closed-form AU and EU estimates mean reliability can be monitored per sample with no sampling or extra model, a property inherited directly from the Dirichlet reparameterization.
The same reparameterization works across the CLIP-family backbones the paper tests, suggesting the correction is not tied to one architecture.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

A natural next test the authors do not run: use EU = C/(α0+C) as a per-sample adversarial detector. Since UCAT raises EU specifically on attacked inputs, thresholding EU could flag perturbations in-the-wild without a separate detector.
The same Dirichlet evidence view could be applied to text-encoder attacks or to prompt-ensemble diversity; the paper confines itself to image perturbations, but the concentration-parameter identity is agnostic to which encoder produced the logits.
If the ordering-preservation assumption in Appendix E.1 (softplus and different τ's leave ranking unchanged) is violated, AUROC comparisons would need recalculation with a single consistent mapping; a direct rank-correlation check is the cheap way to settle it.
The temperature ratio s=τ/τ′ (<1) gives a free calibration dial on clean inputs too; one could tune s on a validation set to lower ECE without retraining.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Plausible new robustness loss for adversarial CLIP; the calibration claims rest on an unproven ordering assumption that likely fails.

read the letter

UCAT is a new objective for adversarial fine-tuning of CLIP that aligns Dirichlet distributions derived from clean and adversarial logits. The robustness gains look real; the calibration claims are undermined by an unproven implementation choice.

The genuinely new bit is the loss L = L_ce + λ KL(Dir(α_adv) ∥ Dir(α)). The Dirichlet reformulation itself is not new—as the paper's own Corollary 4.3.1 states, it is just softmax with temperature s=τ/τ'. Calling it a 'theoretical account' of CLIP uncertainty overstates the case; the equivalence is a tautology for any logits. What is useful is the empirical finding that aligning the full concentration vectors outperforms aligning softmax probabilities (Table 3).

The main robustness results across 16 datasets seem solid enough. The method matches or beats TeCoA, FARE, PMG-AFT, and TGA-ZSR in several settings, with modest gains in the main PGD/AutoAttack averages. The MS-COCO results also look reasonable.

The load-bearing problem is the uncertainty evaluation. Appendix E.1 switches to softplus and, crucially, uses τ=0.01 for AU and τ=0.07 for EU, asserting this affects only magnitudes, not rankings. That assertion is unproven and likely wrong. AU is a nonlinear function of the whole α vector, and changing τ rescales α unevenly across samples, so sample-wise AU and EU orderings can invert. The AU-AUROC and EU-AUROC numbers in Fig. 3b depend entirely on those rankings. Without a proof or an empirical check that rankings are preserved, the calibration improvements are not established. This is not a minor footnote; it is the paper's second headline claim.

There are also the usual concerns: τ' and λ are chosen on the same 16-dataset benchmark used for reporting, and there are no error bars. These inflate confidence in the numbers but are common in this subfield.

Bottom line: the robustness method is worth trying and the paper deserves a serious referee, but the calibration section has to be repaired—either prove order preservation, compute AU/EU with the actual τ, or use metrics that are invariant to monotone transforms. I'd like to see this as a workshop or conference paper after those fixes.

Referee Report

4 major / 4 minor

Summary. The paper proposes UCAT, an adversarial fine-tuning objective for zero-shot CLIP. It reparameterizes CLIP logits as Dirichlet concentration parameters α_k = exp((τℓ_k+1)/τ′), defines closed-form aleatoric and epistemic uncertainties from the induced Dirichlet distribution, and regularizes training by aligning the adversarial Dirichlet with the clean one via KL divergence in addition to a text-guided cross-entropy term. The method is evaluated on 16 single-label datasets and MS-COCO, under PGD, CW, AutoAttack, CAA, and A3 attacks, comparing against TeCoA, FARE, PMG-AFT, and TGA-ZSR. The paper reports improved average adversarial robustness, competitive clean accuracy, and improved calibration measured by ECE and AU/EU AUROC.

Significance. If the results hold, the paper makes a useful empirical contribution: it highlights the over-confidence of CLIP under adversarial perturbations and shows that a simple Dirichlet-level distributional regularizer can improve robustness and calibration across many zero-shot benchmarks. The experimental coverage is broad (16 datasets, multiple attack protocols, stronger training regimes, several backbones, multi-label evaluation), and the ablation study isolates the benefit of aligning Dirichlet parameters over softmax probabilities. However, the calibration claims currently rest on an unproven and questionable ordering-preservation assertion in Appendix E.1, and the main hyperparameters are selected on the same 16-dataset benchmark used for evaluation. These issues prevent the paper from being accepted in its current form.

major comments (4)

[Appendix E.1 / Fig. 3b] The assertion that 'both the softplus mapping and the rescaling by τ affect only the magnitude of uncertainty values, not their ordering' is load-bearing for the AU/EU AUROC results in Fig. 3b, but it is not proven and is not implied by monotonicity of the activation. AU in Eq. (6) is a nonlinear function of the whole α vector; EU in Eq. (7) is monotone in α0, but α0 changes nonlinearly under the τ-switch and softplus in sample-dependent ways. Moreover, with the theoretical mapping at τ′=0.07, α0 is astronomically large (≈ exp(28)), so EU ≈ 0 for all samples; the τ=0.07 switch is what creates any EU variance, making the reported EU-AUROC an artifact of the chosen evaluation temperature. Since AUROC is rank-based, even pairwise ranking inversions change the metric. Please provide a formal proof or an empirical verification of rank preservation on the actual feature distributions, or remov
[Sec. 6.3 / Appendix F.3 / Table 7 / Fig. 3a] The calibration coefficient τ′ and the regularization weight λ are selected on the same 16 datasets used to report the headline results. Table 7 sweeps τ′ over {0.01,…,0.10} and chooses 0.07 by the average harmonic mean on the 16 test datasets; Fig. 3a selects λ·β by the same average. This is selection on the test benchmark, so the reported averages are optimistic and the margin over baselines is not a fair estimate of generalization. Use a validation protocol that does not touch the evaluation datasets (e.g., select on TinyImageNet validation or a held-out subset of the 16 datasets), or report results for all swept values with clear disclosure that the reported numbers are the best on the test set.
[All experiments (Tables 2, 5, 6, 8)] All results appear to be single runs with no error bars or significance testing, while several headline differences are very small (e.g., Table 2 AutoAttack average: 30.58 vs. 30.52 for TGA-ZSR; Table 5 AutoAttack average: 20.67 vs. 19.98; Table 1 mAP: 37.60 vs. 38.23 for TGA-ZSR). Without variance estimates over multiple seeds or bootstrap confidence intervals, the reader cannot assess whether the claimed improvements are meaningful. Please add at least 3 seeds and report mean±std for the main tables and figures, or justify why single-run comparisons are sufficient in this setting.
[Section 4 / Abstract] The paper describes the Dirichlet reformulation as 'a theoretically justified and closed-form approach,' but Lemma 4.3 is essentially a softmax identity: defining α=exp(h(ℓ)) gives p_Dir=softmax(sℓ) by construction. This does not establish that CLIP's contrastive objective induces a Dirichlet distribution over class probabilities, nor that CLIP logits are 'evidence' in the EDL sense. The reformulation is a modeling choice whose utility is empirical; the theoretical framing overstates the result. I recommend tempering the claims and clearly distinguishing the reparameterization identity from an actual probabilistic interpretation of CLIP's training objective.

minor comments (4)

[Section 4] Typo: 'naturally admits provides closed-form uncertainty decomposition' should be 'naturally provides a closed-form uncertainty decomposition'.
[Appendix D.2.1] Typos: 'accuray invariance' should be 'accuracy invariance'; 'calibaration control' should be 'calibration control'.
[Notation] The symbol τ is overloaded: it denotes the CLIP temperature in Eq. (8) and also the ad hoc evaluation temperature in Appendix E.1. Please clarify the notation, especially whether τ in the uncertainty computation is the model's learned temperature or a free evaluation parameter.
[Reproducibility] The reproducibility statement says only that implementation details are in the appendix; no code is provided. Given the number of implementation choices (τ′, λ, softplus, temperature switch), releasing code would greatly improve reproducibility.

Circularity Check

2 steps flagged

Test-set selection of the calibration coefficient τ′ and a textbook softmax–Dirichlet identity presented as a theoretical derivation make part of the reported robustness/calibration numbers forced; the core UCAT objective still has independent empirical content.

specific steps

fitted input called prediction [Appendix F.3 / Table 7; Section 6 'Implementational Details']
"Appendix F.3: 'As shown in Table 7, We perform a controlled ablation by varying the Dirichlet calibration coefficient τ′ and reporting clean accuracy, AutoAttack robustness, and their harmonic mean H across 16 datasets. This study isolates the influence of the evidence-scaling term in our formulation and identifies τ′=0.07 as the best operating point.' Main text (Sec. 6): 'We set λ=10^5/β with β=2/e^{τ′}, and fix τ′=0.07 following standard contrastive learning practices.'"

τ′ enters the definition α_k=exp((τℓ_k+1)/τ′) and also sets the loss weight λ=10^5/β. Table 7 selects τ′=0.07 by maximizing clean/robust harmonic mean on the same 16 benchmarks that are later reported as the method's performance. The headline numbers at τ′=0.07 are therefore the argmax of the evaluation metric over the calibration grid, not an independent prediction. The text presents the choice as a fixed 'standard practice' after the fact, obscuring that it is a test-set fit.
renaming known result [Section 4, Definition 4.1, Lemma 4.3]
"Section 4: 'Comparing CLIP’s zero-shot probability in Equation 2 with the Dirichlet expectation in Equation 5 reveals a structural correspondence: both are softmax operations over a set of logits. This motivates a non-trivial identification that reinterprets CLIP logits as evidence governing a Dirichlet distribution (Definition 4.1).' Lemma 4.3: 'If s=1... p^Dir_k(x) = exp(h(ℓ_k))/Σ_j exp(h(ℓ_j)) = softmax(ℓ(x))_k = p^CLIP_k(x).'"

The 'theoretically justified' reformulation is the known softmax–Dirichlet identity: with α_k=exp(sℓ_k+const), the Dirichlet mean E[π_k]=α_k/α_0 equals softmax(sℓ_k). The additive constant cancels, so Lemma 4.3 is true by construction. The paper presents this algebraic identity as a 'non-trivial identification' and a proof that CLIP implicitly optimizes a Dirichlet model, then derives AU/EU from the same α. This is a renaming of the standard EDL parameterization (Sensoy et al. 2018; Malinin & Gales 2018, cited by the paper) rather than a derivation of new uncertainty content.

full rationale

UCAT's training objective (L = L_ce + λ KL(Dir(α_adv)∥Dir(α))) and its evaluation on unseen datasets are not circular in themselves; the robustness improvements are empirical, and the KL objective does not directly optimize AUROC or ECE. No self-citations are load-bearing. However, two steps weaken the derivation chain. First, the calibration coefficient τ′—which defines α and the loss weight λ—is selected in Table 7 by maximizing performance on the same 16 benchmarks that are later reported as the method's results; the headline numbers are therefore a test-set argmax, not independent predictions. Second, the 'theoretically justified' Dirichlet reformulation is the textbook softmax–Dirichlet expectation identity (α_k=exp(sℓ_k+const) ⇒ E[π]=softmax(sℓ)); presenting it as a 'non-trivial identification' with a 'proof' of CLIP's Dirichlet structure, and then deriving AU/EU from the same α, is a renaming of known EDL results. Appendix E.1's assertion that softplus and τ-switching preserve AU/EU ordering is an unproven and likely false claim; this is a correctness risk for the AUROC-based calibration evidence rather than a circularity, so it does not by itself raise the circularity score beyond the above issues.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The paper's genuine contribution is the UCAT loss, but it depends on the EDL interpretation of logits as evidence, unproven order-preservation of post-hoc implementation choices, and two hyperparameters tuned on the evaluation benchmark.

free parameters (4)

τ' (Dirichlet calibration coefficient) = 0.07
Set to 0.07 following contrastive learning practice; Table 7 shows this value maximizes the average harmonic mean over the 16 evaluation datasets, i.e., tuned on the test suite.
λ (uncertainty regularization strength) = 10^5/β, β=2/e^τ'
Chosen from {10^4, 5×10^4, 10^5, 5×10^5, 10^6}·β by peaking average harmonic mean over the same 16 datasets (Fig 3a).
Evaluation temperature for AU vs EU = τ=0.01 for AU; τ=0.07 for EU
Adopted in Appendix E.1 to keep values numerically stable; a post-hoc choice not derived from the formulation.
Activation function for uncertainty computation = softplus(h(ℓ))
Substituted for exp(h(ℓ)) in practical uncertainty computation; not part of the theory in Section 4.

axioms (5)

standard math Softmax can be written as the expectation of a Dirichlet distribution with α_k = exp(z_k)
Basis of Definition 4.1 / Lemma 4.3; a known equivalence, not new to this paper.
domain assumption α_k ≥ 1 and α0 encodes 'evidence', with AU/EU closed forms (Eqs 6-7) carrying semantic meaning
Imported from evidential deep learning; the paper does not independently validate this interpretation for CLIP.
domain assumption Predictive uncertainty should increase with input difficulty or distributional shift
Normative expectation used to interpret 'miscalibration' in Fig 1b; not derived.
domain assumption The magnitude (α0) of CLIP logits carries semantically meaningful absolute evidence beyond the softmax probabilities
Central to why Dirichlet-KL outperforms softmax-KL in the ablation; assumed from EDL, not proven for CLIP.
ad hoc to paper softplus substitution and τ rescaling preserve sample-wise ordering of AU and EU
Asserted in Appendix E.1 without proof; load-bearing for the uncertainty evaluation.

pith-pipeline@v1.3.0-alltime-deepseek · 27466 in / 13109 out tokens · 110221 ms · 2026-08-03T16:30:19.322914+00:00 · methodology

0 comments

read the original abstract

CLIP delivers strong zero-shot classification but remains highly vulnerable to adversarial attacks. Prior adversarial fine-tuning work primarily matches predicted logits between clean and adversarial examples, which overlooks uncertainty calibration and may degrade the zero-shot generalization. A common expectation in reliable uncertainty estimation is that predictive uncertainty should increase as inputs become more difficult or shift away from the training distribution. However, we frequently observe the opposite in the adversarial setting: perturbations not only degrade accuracy but also suppress uncertainty, leading to severe miscalibration and over-confidence. This reveals a critical reliability gap beyond robustness. To bridge this gap, we propose an adversarial fine-tuning objective for CLIP considering both accuracy and uncertainty. By reparameterizing CLIP outputs as the concentration parameters of a Dirichlet distribution, we propose a unified representation that captures relative semantic structure and confidence magnitude. This enables holistic distribution alignment under perturbations, moving beyond single-logit anchoring and restoring calibrated uncertainty. Experiments across multiple zero-shot benchmarks demonstrate that our method significantly improves uncertainty calibration and achieves competitive adversarial robustness while preserving clean accuracy.

Figures

Figures reproduced from arXiv: 2512.12997 by Dongping Zhang, Qibin Zhao, Wenjing Lu, Yang Yang, Yuning Qiu, Zerui Tao.

**Figure 1.** Figure 1: (a) Conceptual illustration of hypersphere geometry. Traditional anchor-based zeroshot adversarial robustness (ZSAR) methods align features only to the ground-truth class, while our method preserves inter-class geometry via distributional calibration. (b) Predictive uncertainty on 16 datasets. CLIP shows reduced entropy on adversarial inputs, whereas our method UCAT restores calibrated uncertainty. Arrows… view at source ↗

**Figure 2.** Figure 2: Overview of our uncertainty calibration adversarial fine-tuning framework. Clean and adversarial images are encoded by CLIP’s image encoder, while text prompts are processed by the frozen text encoder. Our training objective combines the text-guided contrastive loss with an uncertainty calibration regularization term that aligns adversarial Dirichlets with the original clean distributions, thereby preservi… view at source ↗

**Figure 3.** Figure 3: (a) Sensitivity analysis of the regularization strength λ. We evaluate λ · β ∈ {104 , 5 × 104 , 105 , 5 × 105 , 106}, β = 2/eτ ′ on all 16 datasets, reporting averages of clean accuracy, PGD-100 (Madry et al., 2017) robustness, and their harmonic mean. (b) Comprehensive evaluation averaged over 16 datasets under strong adversarial training (PGD-10, ϵ = 2/255) and AutoAttack (Croce & Hein, 2020) testing. X… view at source ↗

**Figure 4.** Figure 4: Effect of strong white-box attacks (ϵ = 1/255, 100 steps) on accuracy and predictive uncertainty across 16 datasets. Each panel shows the change under a single attack type (left: PGD, center: CW, right: AutoAttack); for each dataset the filled light bars plot ∆PU = PUattacked−PUclean (left axis) and the hatched bars plot ∆Acc = Accattacked − Accclean in percentage points (right axis). Negative values there… view at source ↗

**Figure 5.** Figure 5: Comparison of aleatoric uncertainty on clean and adversarial samples across 16 datasets between CLIP and our method, adversarially trained on tinyImageNet under 10-step PGD with ϵ = 2/255 [PITH_FULL_IMAGE:figures/full_fig_p019_5.png] view at source ↗

**Figure 6.** Figure 6: Comparison of epistemic uncertainty on clean and adversarial samples across 16 datasets between original CLIP and our method, adversarially trained on tinyImageNet under 10-step PGD with ϵ = 2/255. 19 [PITH_FULL_IMAGE:figures/full_fig_p019_6.png] view at source ↗

discussion (0)

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

Two Sides of the Same Coin: Co-Evolving Search for Cross-Task Attacks on Vision-Language Models
cs.CV 2026-08 conditional novelty 6.0

CoEvoAttack uses evolutionary search on both text and image sides to generate object-region adversarial examples that transfer across captioning, detection, region categorization, and localization in unified VLMs.

Reference graph

Works this paper leans on

4 extracted references · cited by 1 Pith paper

[1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...
[2]

@esa (Ref

\@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should not add it explicitly Type <Return> for now, but then later remove the command n...
[3]

\@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@first@sw \@firstoftwo \@ifundefined NAT@b*@#2 \@firstoftwo @num @NAT@ctr \@secondoft...
[4]

@open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibsetup #1 @NAT@ctr @ @openbib .11em \@plus.33em \@minus.07em 4000 4000 `\.\@m @bibit...

[1] [1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

[2] [2]

@esa (Ref

\@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should not add it explicitly Type <Return> for now, but then later remove the command n...

[3] [3]

\@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@first@sw \@firstoftwo \@ifundefined NAT@b*@#2 \@firstoftwo @num @NAT@ctr \@secondoft...

[4] [4]

@open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibsetup #1 @NAT@ctr @ @openbib .11em \@plus.33em \@minus.07em 4000 4000 `\.\@m @bibit...