Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

SAFER: Sharpness Aware layer-selective Finetuning for Enhanced Robustness in vision transformers

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Sharpness-aware fine-tuning of a few layers lifts ViT defense by 5–20%.

desk verdict The paper's own Table 1 contradicts its headline 'consistently enhances' claim, and that needs fixing before I'd trust the rest. read the letter →

arxiv 2501.01529 v1 pith:D33YRU2S submitted 2025-01-02 cs.CV

Bhavna Gopal , Huanrui Yang , Mark Horton , Yiran Chen This is my paper · ORCID
classification cs.CV
keywords adversarialrobustnessvisiontransformerssharpness-awareminimizationlayer-selectivefine-tuningoverfittingparameter-efficientPGDtrainingAutoAttack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that adversarial overfitting in vision transformers is concentrated in a small number of layers, and that sharpness-aware minimization (SAM) applied only to those layers—while freezing the rest—simultaneously improves clean accuracy and adversarial robustness. The proposed method, SAFER, measures each layer's tendency to overfit by a sharpness proxy computed from the norm of the adversarial-loss gradient with respect to that layer's weights, selects the top few layers, and fine-tunes them with the SAM objective, periodically re-selecting layers. Across ViT, DeiT, ConViT, and Swin on CIFAR-10, CIFAR-100, and Imagenette, SAFER reports typical gains of about 5% and peak gains near 20% over strong baselines, and it also improves results when combined with LoRA and DoRA. If correct, the paper shows that a global robustness problem can be solved locally: a small subset of layers carries most of the overfitting burden, and targeted smoothing of that subset suffices.

What carries the argument

The load-bearing object is the first-order Taylor sharpness metric of Eq. (6): for each layer $i$, $\gamma_i \approx \sum_{x\in B} \max_{\|\epsilon\|_2\le\rho} \epsilon^T \partial \mathcal{L}_{\mathrm{adv}}(w_i,x)/\partial w_i \propto \sum_{x\in B} \|\partial \mathcal{L}_{\mathrm{adv}}(w_i,x)/\partial w_i\|_2$. This single-backward-pass proxy estimates how much the adversarial loss changes when that layer's weights are perturbed, ranking layers by susceptibility to overfitting. SAFER then fine-tunes the top-$K$ layers with the SAM objective, perturbing only those weights in the direction of the adversarial-loss gradient, while freezing the remaining layers; the selection is refreshed every ten epochs to track the layers that currently overfit.

What would settle it

Compute the full SAM sharpness (Eq. 4, with the maximization over $\epsilon$ solved iteratively rather than linearized) for every layer of a pretrained DeiT-Ti, then fine-tune each single layer with SAM in turn and record the resulting clean and PGD-20 accuracy; if the layers with the highest full sharpness are not the ones whose individual fine-tuning yields the largest improvements, or if the linear proxy of Eq. (6) disagrees with the full sharpness ranking, the selection mechanism is not the cause of SAFER's gains.

Watch

Extended reading notes

Core claim

The central claim is that the per-layer sharpness of the adversarial loss, approximated by $\gamma_i \propto \sum_{x\in B} \|\partial \mathcal{L}_{\mathrm{adv}}(w_i, x)/\partial w_i\|_2$, reliably identifies which transformer layers overfit during adversarial training, and that applying SAM only to those layers (about 5% of the model's layers) while freezing the others yields models that are both more accurate on clean data and more resistant to white-box and black-box attacks. The authors state that this layer-selective application resolves the convergence problems that arise when SAM is applied to the entire transformer, and that it outperforms layer-selective methods designed for CNNs, such as CLAT and RiFT, which degrade ViT robustness.

Load-bearing premise

The method's success rests on the empirical claim that the first-order Taylor sharpness of Eq. (6), a gradient-norm proxy computed on the adversarial loss, ranks layers in the same order as their actual contribution to whole-model overfitting; if that proxy misranks layers, SAFER degenerates into fine-tuning random layers.

Editorial extensions

If this is right

  • SAFER removes the need for early stopping: models keep improving in clean and adversarial accuracy through extended adversarial training, whereas PGD-AT and PGD-AT with SAM decline.
  • Robustness transfers to unseen attacks: SAFER improves accuracy under AutoAttack, FAB, StAdv, and Pixel attacks, even though only PGD attacks are seen during training.
  • The method composes with parameter-efficient fine-tuning: adding SAFER to LoRA and DoRA improves both clean and PGD-20 accuracy over the corresponding PGD-AT baselines.
  • Sharpness rankings are stable across datasets and batch samples, indicating that certain layers have architecture-inherent tendencies to overfit, and dynamic re-selection is needed because the set of overfitting layers changes during fine-tuning.
  • The overhead is small: layer sharpness can be estimated from 0.001% of the training data with about 0.2% extra time, and a SAFER fine-tuning epoch adds roughly 3% over SGD.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the sharpness proxy genuinely localizes overfitting, the same principle might apply beyond adversarial training—for example, to standard fine-tuning of large models where a few layers dominate catastrophic forgetting or distribution shift.
  • The stability of sharp layers across datasets raises the question of whether specific transformer modules (attention vs. MLP, early vs. late blocks) are structurally prone to non-robust features; identifying that mechanism could inspire architectural changes rather than post-hoc fine-tuning.
  • A natural next test is scaling: if SAFER's benefit grows with model size and parameter count, it could become a cheap default for robustly adapting large pretrained transformers, where full-model SAM is prohibitively expensive.
  • Because SAFER uses only gradient norms, it may extend to architectures where feature-based criticality indices (like CLAT's) are incomparable across layers, such as mixed CNN-transformer or multimodal backbones.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes SAFER, a layer-selective fine-tuning method for vision transformers that estimates a per-layer sharpness of the adversarial loss using a gradient-norm proxy (Eq. (6)), selects the top-K sharpest layers, and applies sharpness-aware minimization only to those layers while freezing the rest. Experiments across CIFAR-10, CIFAR-100, and Imagenette on ViT, DeiT, ConViT, and Swin variants compare SAFER against PGD-AT with SGD/SAM optimizers, ARD+PRM, and the method of Tian et al., and also include black-box evaluations and PEFT variants with LoRA/DoRA. The central claim is that SAFER consistently improves both clean and adversarial accuracy over baselines, with typical gains around 5% and peaks up to 20%.

Significance. If the reported results are reliable, SAFER is a practically useful and computationally cheap method: it shows that adversarial overfitting in ViTs may be concentrated in a small number of layers and that targeted SAM fine-tuning can mitigate it. The paper's strengths are its breadth of architectures and datasets, the direct comparison against layer-selective baselines (RiFT, CLAT), the ablation of dynamic versus fixed layer selection, the random-layer control in Table 6, and the overhead analysis in Section 4.4. However, the headline consistency claim is contradicted by one of the paper's own table rows, and the theoretical motivation for the sharpness proxy is heuristic; these issues need to be addressed before the paper can be accepted.

major comments (4)
  1. [Sec. 4.2.1, Table 1] The Abstract claims SAFER 'consistently enhances both clean and adversarial accuracy over baseline approaches.' Table 1 contains a direct counterexample: for DeiT-Ti on Imagenette, 'Tian et al.' obtains PGD-20=57.24 and AA=54.89, while '[30]+SAFER' obtains PGD-20=50.80 and AA=56.38. PGD-20 drops by 6.44 points, even though clean accuracy improves by 0.91 points. The text in Sec. 4.2.1 presents this row as evidence of SAFER 'over SOTA techniques' without discussing the regression. If the consistency claim is intended only for the PGD-AT baselines, that scope must be stated explicitly; as written, the claim is falsified by the paper's own table.
  2. [Sec. 3.1, Eq. (6)] The derivation from Eq. (4) to Eq. (6) reduces the sharpness measure to a gradient norm: for each x, max_{||epsilon||<=rho} epsilon^T grad = rho * ||grad||, so the maximum over the ball contains no second-order curvature information. More importantly, Eq. (1) is a bound on the clean training loss LS, whereas Eq. (4) uses the adversarial loss Ladv; the transfer of the SAM generalization bound to per-layer adversarial sharpness is not justified. Because SAFER's layer selection depends entirely on this proxy, the paper should either validate the proxy directly (e.g., by showing that the Eq. (6) ranking correlates with per-layer fine-tuning gains) or explicitly present the proxy as a heuristic, rather than as a consequence of the SAM theory.
  3. [Sec. 4.1, Sec. 4.3] Several free hyperparameters—K (about 5% of layers), the 10-epoch sharpness re-measurement interval, and the number of initial adversarial pretraining epochs—are selected via hyperparameter optimization on the same CIFAR-10 and Imagenette benchmarks that appear in the main tables. No held-out validation split is described, and the ablations in Sec. 4.3.2 and Appendices B and C are also run on these datasets. Consequently, the reported gains could be partly due to tuning these hyperparameters to the test distributions. A cross-dataset sensitivity check or an explicit statement of this risk is needed to support the paper's generalization claims.
  4. [Sec. 4.1] The manuscript reports 'the lowest observed accuracies' from at least 10 runs, but no standard deviations or confidence intervals are given anywhere. Several reported improvements are small (e.g., Swin-Ti on Imagenette: PGD-20 from 74.40 to 75.45 and AA from 71.20 to 72.69 in Table 1), and without variance estimates it is impossible to judge whether these differences are meaningful. Reporting means and standard deviations for the main comparisons in Table 1 would materially strengthen the claims.
minor comments (4)
  1. [Sec. 3.2, Eq. (7)] In Eq. (7), the SAM perturbation epsilon is defined in terms of the gradient of Ladv with respect to w_i, but the notation leaves implicit that epsilon depends on the current w_i and on the adversarial example; a more explicit definition would improve reproducibility.
  2. [Table 1 and throughout] Several table headers and cells contain typographical artifacts such as 'C IFAR -10', 'ARD + PRM', and 'TIAN ET AL .'. These should be cleaned before publication.
  3. [Appendix D.2, Table 11] The table reports SAFER improvements as '+3.36' and '+2.61' for FAB and StAdv, but the absolute baseline values are not shown for FAB, StAdv, and PIXEL. Please provide the absolute numbers for both baseline and SAFER models.
  4. [Sec. 4.3.1, Figure 2] The statement that 'incorporating SAFER at any stage of training results in higher clean accuracy and robustness at convergence' is supported only for the 70-epoch budget in Figure 2. The extended 150-epoch curves in Appendix E compare SAFER starting at epoch 50 with SAFER from scratch, not with SAFER starting at other stages, so the phrase 'any stage' is too broad and should be qualified.

Circularity Check

0 steps flagged · score 0.0 of 10

No derivation step reduces to its inputs; the central claim is empirical and the self-citation is not load-bearing.

full rationale

SAFER is an empirical method: layers are ranked by a first-order Taylor proxy for adversarial-loss sharpness (Eq. 6), and then SAM is applied to the selected top-K layers (Eq. 7). The sharpness proxy is not fitted to the reported accuracies; the number of layers and the re-selection interval are hyperparameters ablated on the same benchmarks, which is a hyperparameter-selection concern rather than a definitional reduction. The CLAT citation [13] is from the same authors, but it is used only as motivation, and the paper then empirically shows that CLAT's selection fails on ViTs (Table 2), so the central claim does not rest on that self-citation. No equation in the derivation is equivalent to an output by construction: Eq. (6) is a Taylor approximation of Eq. (4), and Eq. (7) is SAM applied to a layer subset; neither contains the reported accuracy numbers as inputs. The headline claim of consistent enhancement is strained by the paper's own Table 1, where [30]+SAFER on DeiT-Ti/Imagenette drops PGD-20 from 57.24 to 50.80, but that is an internal-consistency or evaluation issue, not circularity. The Conclusion also explicitly leaves open why certain layers overfit, confirming that the work is not presenting a self-contained derivation from first principles. I find no significant circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central results depend on a handful of tuned hyperparameters (K, pretraining split, re-selection interval, SAM radius) and on three unproved domain assumptions: that the SAM bound carries over to adversarial loss, that the Taylor gradient norm is a faithful sharpness proxy, and that high-sharpness layers are the ones that transfer when fine-tuned. No invented physical entities are introduced.

free parameters (4)
  • number of selected layers K = Top-2 layers for DeiT-Ti and ViT-S (about 5% of 36 layer options); Table 7 lists 5 critical layers, creating ambiguity
    K is chosen by hyperparameter optimization on the same CIFAR-10 and Imagenette benchmarks, and the headline results depend on this choice (Appendix C).
  • initial adversarial pretraining epochs before SAFER = 50 epochs in the 70-epoch budget shown in Figure 2; stated as 'some epochs' in Sec 3.2
    The pretraining/finetuning split is a tuned hyperparameter, and Figure 2 shows sensitivity to it.
  • sharpness re-measurement interval = 10 epochs
    The interval for dynamic layer selection is a SAFER hyperparameter (Sec 3.2); Appendix B shows fixed selection performs worse, so this choice affects results.
  • SAM perturbation radius rho = not reported
    The SAM update in Eq (7) requires a rho; the paper describes following the decay schedule from Foret et al. but never states the radius, making the results under-specified.
assumptions (4)
  • domain assumption The SAM generalization bound in Eq (1), proven for clean loss LS, also applies when the loss is the adversarial training loss Ladv from Eq (3).
    The derivation of layer sharpness in Sec 3.1 switches from L to Ladv without re-proving the bound; the minimax nature of Ladv changes the optimization landscape.
  • domain assumption The loss is approximately linear in each layer's weights over the perturbation ball, validating Eq (6) as a proxy for Eq (4).
    The first-order Taylor expansion is standard math, but its validity for deep transformer weights over a nonzero rho ball is not established.
  • domain assumption Layers with the highest gradient-norm sharpness are the layers most prone to overfitting, and fine-tuning them transfers to whole-model generalization.
    This is the core empirical hypothesis of the paper, asserted without proof and supported only by the experiments that define the claim.
  • domain assumption Freezing all non-selected layers during SAFER fine-tuning does not prevent the selected layers from improving the full model's adversarial robustness.
    The method relies on freezing the rest of the model; the paper does not show that non-selected layers cannot contribute to robustness.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SAFER: Sharpness Aware layer-selective Finetuning for Enhanced Robustness in vision transformers." pith.science (2026). https://pith.science/paper/D33YRU2S

@misc{pith2026250101529,
  author       = {Pith},
  title        = {Pith review of: SAFER: Sharpness Aware layer-selective Finetuning for Enhanced Robustness in vision transformers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D33YRU2S}},
  note         = {Machine review of arXiv:2501.01529}
}
read the original abstract

Vision transformers (ViTs) have become essential backbones in advanced computer vision applications and multi-modal foundation models. Despite their strengths, ViTs remain vulnerable to adversarial perturbations, comparable to or even exceeding the vulnerability of convolutional neural networks (CNNs). Furthermore, the large parameter count and complex architecture of ViTs make them particularly prone to adversarial overfitting, often compromising both clean and adversarial accuracy. This paper mitigates adversarial overfitting in ViTs through a novel, layer-selective fine-tuning approach: SAFER. Instead of optimizing the entire model, we identify and selectively fine-tune a small subset of layers most susceptible to overfitting, applying sharpness-aware minimization to these layers while freezing the rest of the model. Our method consistently enhances both clean and adversarial accuracy over baseline approaches. Typical improvements are around 5%, with some cases achieving gains as high as 20% across various ViT architectures and datasets.

Figures

Figures reproduced from arXiv: 2501.01529 by the authors.

Figure 1
Figure 1. Sharpness value (Equ. (6)) measured over layers of an adversarially-trained DeiT-Tiny model (bottom), where the layers with top-2 values are selected for SAFER finetuning. The layers’ adversarial loss landscape before adversarial finetuning (left) and after SAFER finetuning (right) are visualized on the top. 2. Related Work 2.1. Adversarial training and overfitting The concept of Adversarial Training (AT) emerged in… view at source ↗
Figure 2
Figure 2. SAFER performance at different starting points on CIFAR-10 with DeiT-Ti: clean (left) vs. adversarial (right) accuracies. [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Performance comparison of DeiT-Ti and ViT-S as a function of number of sharp layers selected for SAFER finetuning. The [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: SAFER vs. PGD-AT (SAM) performance on CIFAR-10 with DeiT-Ti: clean (left) vs. adversarial (right) accuracies. [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Are Fast Methods Stable in Adversarially Robust Transfer Learning?

    cs.LG 2025-06 conditional novelty 6.0 of 10

    FGSM adversarial fine-tuning avoids catastrophic overfitting at standard eps=4 and 8 and matches PGD robustness within 1.4% at a quarter of the training time.

Reference graph

Works this paper leans on

40 extracted references · 28 canonical work pages · cited by 1 Pith paper

  1. [30]

    Deeper insights into the robustness of vits towards common corruptions

    Rui Tian, Zuxuan Wu, Qi Dai, Han Hu, and Yu-Gang Jiang. Deeper insights into the robustness of vits towards common corruptions. arXiv preprint arXiv:2204.12143, 2022. 5, 6

    arXiv 2022

  2. [1]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples, 2018

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples, 2018. 1, 2

    work page 2018

  3. [2]

    Are transformers more robust than cnns?, 2021

    Yutong Bai, Jieru Mei, Alan Yuille, and Cihang Xie. Are transformers more robust than cnns?, 2021. 1

    work page 2021

  4. [3]

    End-to- end object detection with transformers

    Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to- end object detection with transformers. In European confer- ence on computer vision, pages 213–229. Springer, 2020. 1

    2020

  5. [4]

    Towards evaluating the robustness of neural networks, 2017

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, 2017. 2

    work page 2017

  6. [5]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705 ,

    arXiv 1902

  7. [6]

    Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C. Duchi. Unlabeled data improves adver- sarial robustness, 2022. 2

    work page 2022

  8. [7]

    Minimally distorted adversarial examples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In International Conference on Machine Learning , pages 2196–2205. PMLR, 2020. 12

    work page 2020

Show all 40 references
  1. [8]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks, 2020

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks, 2020. 1, 2, 4

    2020

  2. [9]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. 1, 4, 6

    2010 arXiv

  3. [10]

    Convit: Improv- ing vision transformers with soft convolutional inductive bi- ases

    St ´ephane d’Ascoli, Hugo Touvron, Matthew L Leavitt, Ari S Morcos, Giulio Biroli, and Levent Sagun. Convit: Improv- ing vision transformers with soft convolutional inductive bi- ases. In International conference on machine learning, pages 2286–2296. PMLR, 2021. 4, 6

    2021

  4. [11]

    Sharpness-aware minimization for efficiently improving generalization, 2021

    Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization, 2021. 1, 2, 3, 4, 5

    2021

  5. [12]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2015. 1, 2

    2015

  6. [13]

    Criticality leveraged adversarial train- ing (clat) for boosted performance via parameter efficiency,

    Bhavna Gopal, Huanrui Yang, Jingyang Zhang, Mark Hor- ton, and Yiran Chen. Criticality leveraged adversarial train- ing (clat) for boosted performance via parameter efficiency,

  7. [14]

    Parameter-efficient fine-tuning for large models: A comprehensive survey, 2024

    Zeyu Han, Chao Gao, Jinyang Liu, Jeff Zhang, and Sai Qian Zhang. Parameter-efficient fine-tuning for large models: A comprehensive survey, 2024. 2

    2024

  8. [15]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 6

    2016

  9. [16]

    Imagewang

    Jeremy Howard. Imagewang. 4

  10. [17]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021. 2, 5

    2021

  11. [18]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. 2009. 4

    2009

  12. [19]

    Bevformer: Learning bird’s-eye-view representation from multi-camera images via spatiotemporal transformers

    Zhiqi Li, Wenhai Wang, Hongyang Li, Enze Xie, Chong- hao Sima, Tong Lu, Yu Qiao, and Jifeng Dai. Bevformer: Learning bird’s-eye-view representation from multi-camera images via spatiotemporal transformers. In European con- ference on computer vision, pages 1–18. Springer, 2022. 1

    2022

  13. [20]

    Dora: Weight-decomposed low-rank adaptation

    Shih-Yang Liu, Chien-Yi Wang, Hongxu Yin, Pavlo Molchanov, Yu-Chiang Frank Wang, Kwang-Ting Cheng, and Min-Hung Chen. Dora: Weight-decomposed low-rank adaptation. arXiv preprint arXiv:2402.09353, 2024. 2, 5

    2024 arXiv

  14. [21]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021. 1, 4, 6

    2021

  15. [22]

    Towards deep learning models resistant to adversarial attacks, 2019

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019. 1, 2, 4

    2019

  16. [23]

    When adversarial training meets vision trans- formers: Recipes from training to architecture, 2022

    Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision trans- formers: Recipes from training to architecture, 2022. 1, 5

    2022

  17. [24]

    When adversarial training meets vision trans- formers: Recipes from training to architecture

    Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision trans- formers: Recipes from training to architecture. Advances in Neural Information Processing Systems, 35:18599–18611,

  18. [25]

    Scalable diffusion models with transformers

    William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision, pages 4195–4205,

  19. [26]

    Zico Kolter

    Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning, 2020. 5, 12

    2020

  20. [27]

    Davis, Gavin Taylor, and Tom Goldstein

    Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free!, 2019. 2

    2019

  21. [28]

    One pixel attack for fooling deep neural networks

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828–841,

  22. [29]

    In- triguing properties of neural networks, 2014

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. In- triguing properties of neural networks, 2014. 1

    2014

  23. [31]

    Training data-efficient image transformers & distillation through at- tention

    Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herv ´e J´egou. Training data-efficient image transformers & distillation through at- tention. In International conference on machine learning , pages 10347–10357. PMLR, 2021. 1, 4, 6

    2021

  24. [32]

    Gomez, Lukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszko- reit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need, 2023. 2

    2023

  25. [33]

    Spatially transformed adversarial ex- amples

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial ex- amples. arXiv preprint arXiv:1801.02612, 2018. 12

    2018 arXiv

  26. [34]

    Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan Yuille, and Quoc V . Le. Adversarial examples improve im- age recognition, 2020. 2

    2020

  27. [35]

    Dverge: diversifying vulnerabilities for enhanced robust generation of ensembles

    Huanrui Yang, Jingyang Zhang, Hongliang Dong, Nathan Inkawhich, Andrew Gardner, Andrew Touchet, Wesley Wilkes, Heath Berry, and Hai Li. Dverge: diversifying vulnerabilities for enhanced robust generation of ensembles. Advances in Neural Information Processing Systems , 33: 550...

    2020

  28. [36]

    Wide residual net- works, 2017

    Sergey Zagoruyko and Nikos Komodakis. Wide residual net- works, 2017. 6

    2017

  29. [37]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy, 2019. 2

    2019

  30. [38]

    Autolora: Automatically tuning matrix ranks in low-rank adaptation based on meta learning, 2024

    Ruiyi Zhang, Rushi Qiang, Sai Ashish Somayajula, and Pengtao Xie. Autolora: Automatically tuning matrix ranks in low-rank adaptation based on meta learning, 2024. 1, 3

    2024

  31. [39]

    On the duality be- tween sharpness-aware minimization and adversarial train- ing

    Yihao Zhang, Hangzhou He, Jingyu Zhu, Huanran Chen, Yifei Wang, and Zeming Wei. On the duality be- tween sharpness-aware minimization and adversarial train- ing. arXiv preprint arXiv:2402.15152, 2024. 1, 3

    2024 arXiv

  32. [40]

    Improving generalization of adversarial training via robust critical fine-tuning, 2023

    Kaijie Zhu, Jindong Wang, Xixu Hu, Xing Xie, and Ge Yang. Improving generalization of adversarial training via robust critical fine-tuning, 2023. 1, 3, 5 SAFER: Sharpness Aware layer-selective Finetuning for Enhanced Robustness in vision transformers Supplementary Material A. ...

    2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.