Pith. sign in

REVIEW 2 major objections 1 minor 299 references

USAD: Uncertainty-aware Statistical Adversarial Detection

T0 review · 2 major / 1 minor · reviewed 2026-06-29 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read USAD detects adversarial examples more reliably by measuring their excess feature variance and instability under perturbations.

desk verdict USAD defines two new discrepancy stats (VD and PCD) to target uncertainty patterns missed by MMD in SAD, but the abstract gives no experimental backing for the performance claims. read the letter →

arxiv 2606.27832 v1 pith:GCFM2QDW submitted 2026-06-26 cs.LG

Zhijian Zhou , Xunye Tian , Jiacheng Zhang , Zesheng Ye , Yiyi Guo , Donghao Zhang , Liuhua Peng , Feng Liu This is my paper
classification cs.LG
keywords adversarialdetectionstatisticaluncertaintyvariancediscrepancycovariancetwo-sampletestmachinelearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that standard MMD-based two-sample tests miss the characteristic uncertainty signatures of adversarial examples, specifically their wider feature spread and greater sensitivity to small input changes. It introduces two new statistics, Variance Discrepancy and Perturbation-based Covariance Discrepancy, to quantify these global and local uncertainty differences between a query batch and a clean reference set. Aggregating the two statistics produces a test that flags distributional drift while preserving false-alarm control. A reader would care because the approach targets behaviors that are distinctive to adversarial inputs rather than relying on generic distributional distance alone.

What carries the argument

Variance Discrepancy (VD) and Perturbation-based Covariance Discrepancy (PCD) aggregated as uncertainty-aware test statistics inside the two-sample testing procedure for SAD.

What would settle it

A controlled experiment in which adversarial examples generated against the same model show equal or smaller variance and equal or smaller covariance change under Gaussian perturbation than clean examples, resulting in no detection gain for USAD over MMD.

Watch

Extended reading notes

Core claim

USAD augments the statistical adversarial detection framework with Variance Discrepancy, which measures the difference in feature variance between queries and clean examples, and Perturbation-based Covariance Discrepancy, which measures the change in feature covariance after adding Gaussian noise; their combination yields a stronger two-sample test statistic than MMD for identifying batches that contain adversarial examples.

Load-bearing premise

Adversarial examples reliably produce larger feature spread and greater covariance instability under perturbations than clean examples, and these differences are not already captured by MMD.

Editorial extensions

If this is right

  • VD isolates global uncertainty by comparing raw feature variances across the two sets.
  • PCD isolates local uncertainty by comparing covariance matrices computed on original and perturbed inputs.
  • The combined statistic improves detection accuracy over MMD baselines on multiple attack types while retaining type-I error control.
  • The method demonstrates that SAD performance rises when the test statistic is chosen to match known properties of the shift being detected.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same uncertainty statistics might be applied to detect other non-adversarial distribution shifts that also increase feature spread or instability.
  • Alternative perturbation distributions or higher-order moments could be substituted for the Gaussian noise used in PCD.
  • The two-sample testing view suggests that any domain-specific signature of a shift can be turned into a custom discrepancy measure.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 1 minor

Summary. The manuscript proposes Uncertainty-aware Statistical Adversarial Detection (USAD) as an extension of statistical adversarial detection (SAD). It introduces two new discrepancy statistics—Variance Discrepancy (VD) to capture global feature-spread differences and Perturbation-based Covariance Discrepancy (PCD) to capture local covariance instability under Gaussian perturbations—then aggregates them to detect distributional drift between clean examples and a query batch that may contain adversarial examples. The central claim is that this aggregation yields superior detection performance over MMD-based baselines on various attacks while preserving false-alarm control.

Significance. If the empirical results hold and the new statistics integrate cleanly into the two-sample test without new failure modes, the work could strengthen SAD by explicitly targeting AE-specific uncertainty behaviors that standard MMD may miss. The public code link supports reproducibility. However, the provided abstract contains no quantitative results, datasets, error bars, or ablation studies, so the practical significance cannot be assessed from the given text.

major comments (2)
  1. [Abstract] Abstract: the central empirical claim that 'USAD achieves superior detection performances over baseline methods' is stated without any experimental details, error bars, dataset descriptions, ablation results, or statistical significance tests. This is load-bearing for the paper's main contribution.
  2. [Abstract] Abstract: the claim that VD and PCD capture uncertainty patterns 'crucial for detection' and not already addressed by MMD rests on an unverified assumption; no derivation, proof, or preliminary comparison is supplied to show that the new statistics are independent of or additive to MMD.
minor comments (1)
  1. [Abstract] The code repository link uses an anonymous domain; a permanent, non-anonymous link should be provided for review.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their review and constructive comments on the abstract. We address each major comment point by point below, indicating planned revisions where appropriate.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the central empirical claim that 'USAD achieves superior detection performances over baseline methods' is stated without any experimental details, error bars, dataset descriptions, ablation results, or statistical significance tests. This is load-bearing for the paper's main contribution.

    Authors: We agree that the abstract presents the empirical claim at a summary level without quantitative details. This follows standard abstract conventions given length limits, while the full manuscript reports all requested elements (error bars, datasets, ablations, and significance tests) in the Experiments section. To address the concern directly, we will revise the abstract to incorporate a concise statement of key results and datasets used. revision: yes

  2. Referee: [Abstract] Abstract: the claim that VD and PCD capture uncertainty patterns 'crucial for detection' and not already addressed by MMD rests on an unverified assumption; no derivation, proof, or preliminary comparison is supplied to show that the new statistics are independent of or additive to MMD.

    Authors: The abstract summarizes the motivation that MMD's properties limit capture of AE-specific global spread and local perturbation instability; the full manuscript provides the supporting conceptual analysis in Section 3 and demonstrates additivity via ablations in Section 5. No formal independence proof is given, as the contribution is empirical and statistical rather than theoretical. We will add a short clarifying sentence referencing the empirical additivity in the revised abstract. revision: partial

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity identified

full rationale

The provided text consists only of the abstract, which introduces two new statistics (VD and PCD) as explicit measures of global and local uncertainty patterns without any equations, derivations, parameter fitting, or self-citations. No step reduces a claimed result to its inputs by construction, renames a known result, or relies on load-bearing self-citation. The central claim is an empirical performance comparison, which remains independent of the inputs in the given material. This matches the reader's assessment of score 2.0 with no equations shown that could create circularity.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

Only the abstract is available, so the ledger is necessarily incomplete. No free parameters, axioms, or invented entities are explicitly stated beyond standard two-sample testing assumptions.

assumptions (1)
  • domain assumption Two-sample test framework with controlled false-alarm rate applies to mixed clean/adversarial query batches
    Stated in the opening of the abstract as the foundation of SAD.

how reviews work

0 comments
Cite this review

Pith. "Pith review of USAD: Uncertainty-aware Statistical Adversarial Detection." pith.science (2026). https://pith.science/paper/GCFM2QDW

@misc{pith2026260627832,
  author       = {Pith},
  title        = {Pith review of: USAD: Uncertainty-aware Statistical Adversarial Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GCFM2QDW}},
  note         = {Machine review of arXiv:2606.27832}
}
read the original abstract

Statistical adversarial detection (SAD) treats detection as a two-sample test. Given a reference set of clean examples (CEs) and a batch of queries, potentially containing an unknown mixture of CEs and adversarial examples (AEs), SAD decides whether the query distribution drifts away from the CE distribution while controlling the false-alarm rate. Existing SAD-based methods mainly use maximum mean discrepancy (MMD) to measure the distributional discrepancy. However, MMD's distributional properties limit its ability to capture characteristic uncertainty patterns of AEs that are crucial for detection: AEs typically exhibit abnormal feature spread (i.e., global uncertainty) and instability under perturbations (i.e., local uncertainty). To close the gap, we propose Uncertainty-aware Statistical Adversarial Detection (USAD), which explicitly captures these uncertainty patterns with two new statistics: (1) Variance Discrepancy (VD), which measures the difference in feature spread between AEs and CEs to capture global uncertainty differences. (2) Perturbation-based Covariance Discrepancy (PCD), which compares feature covariance under Gaussian perturbations to capture local uncertainty differences. By aggregating VD and PCD, USAD achieves superior detection performances over baseline methods against various adversarial attacks, highlighting the importance of considering characteristic behaviors of AEs for effective SAD. Our code is available at: https://anonymous.4open.science/r/USAD.

Figures

Figures reproduced from arXiv: 2606.27832 by the authors.

Figure 1
Figure 1. Statistical characteristics of MMD-based SAD using semantic features (Gao et al., 2021). (a): Kernel density estimates of MMD values for three AE batch sizes (n = {20, 50, 100}). The vertical dashed line denotes the test threshold. The shaded regions to the right of the threshold indicate detection power, quantified by the area percentages shown in the legend (91.43% for n = 100, 78.21% for n = 50, and 59.30% for n … view at source ↗
Figure 2
Figure 2. Uncertainty-aware Statistical Adversarial Detection (USAD). The semantic features of CEs X ∼ P and queries Y ∼ Q (suspected AEs) are extracted by using the penultimate layer of classifier f. From these features, USAD estimates (i) variance discrepancy (VD) measuring shifts in feature-spread between X and Y and (ii) perturbation-based covariance discrepancy (PCD) comparing their covariance mean-embeddings under Gauss… view at source ↗
Figure 3
Figure 3. Results (a−h) are test power (detection rate) under different adversarial attacks with different ϵ, the given adversarial samples all share the same sample size |Y | = 50. The results are averaged over 1, 000 repetitions and the ideal test power is 1. The target model is ResNet-50 trained on ImageNet dataset in (a−d), and ResNet-18 trained on CIFAR-10 dataset in (e−h). 48 56 64 72 80 88 96 104 The L2 norm /255 of AA… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Results (a−d) are test power (detection rate) under different adversarial attacks with different ϵ under L2 norm, given adversarial samples all share the same sample size |Y | = 50. The results are averaged over 1, 000 repetitions and the ideal test power is 1 (the sam…
Figure 5
Figure 5. Figure 5: Results (a−b) are type I error (false alarm rate) control check where given examples are actually drawn from clean examples under different clean example sizes. The results are averaged over 1, 000 repetitions and the ideal type I error is around the significance level…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

299 extracted references · 2 canonical work pages

  1. [1]

    Square attack: A query-efficient black-box adversarial attack via random search

    Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. Square attack: A query-efficient black-box adversarial attack via random search. In ECCV, 2020

    2020

  2. [2]

    MMD-Fuse : Learning and combining kernels for two-sample testing without data splitting

    Biggs, F., Schrab, A., and Gretton, A. MMD-Fuse : Learning and combining kernels for two-sample testing without data splitting. In NeurIPS, 2023

    2023

  3. [3]

    Evading adversarial example detection defenses with orthogonal projected gradient descent

    Bryniarski, O., Hingun, N., Pachuca, P., Wang, V., and Carlini, N. Evading adversarial example detection defenses with orthogonal projected gradient descent. In ICLR, 2022

    2022

  4. [4]

    A., Liu, M., and Li, B

    Cao, Y., Wang, N., Xiao, C., Yang, D., Fang, J., Yang, R., Chen, Q. A., Liu, M., and Li, B. Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks. In IEEE Symposium on Security and Privacy , pp.\ 176--194, 2021

    2021

  5. [5]

    and Wagner, D

    Carlini, N. and Wagner, D. Adversarial examples are not easily detected: Bypassing ten detection methods. In AISec, 2017 a

    2017

  6. [6]

    and Wagner, D

    Carlini, N. and Wagner, D. A. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy , pp.\ 39--57. IEEE, 2017 b

    2017

  7. [7]

    and Bhattacharya, B

    Chatterjee, A. and Bhattacharya, B. B. Boosting the power of kernel two-sample tests. Biometrika, 112 0 (1): 0 asae048, 2025

    2025

  8. [8]

    and Cloninger, A

    Cheng, X.-Y. and Cloninger, A. Classification logit two-sample testing by neural networks. arXiv, 2019

    2019

Show all 299 references
  1. [9]

    Certified adversarial robustness via randomized smoothing

    Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial robustness via randomized smoothing. In ICML, 2019

    2019

  2. [10]

    and Hein, M

    Croce, F. and Hein, M. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML, 2020 a

    2020

  3. [11]

    and Hein, M

    Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020 b

    2020

  4. [12]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In CVPR, 2009

    2009

  5. [13]

    LiBRe : A practical B ayesian approach to adversarial detection

    Deng, Z., Yang, X., Xu, S., Su, H., and Zhu, J. LiBRe : A practical B ayesian approach to adversarial detection. In CVPR, 2021

    2021

  6. [14]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021

    2021

  7. [15]

    Robustness of classifiers: from adversarial to random noise

    Fawzi, A., Moosavi-Dezfooli, S.-M., and Frossard, P. Robustness of classifiers: from adversarial to random noise. In NeurIPS, 2016

    2016

  8. [16]

    R., Shintre, S., and Gardner, A

    Feinman, R., Curtin, R. R., Shintre, S., and Gardner, A. B. Detecting adversarial samples from artifacts. arXiv, 2017

    2017

  9. [17]

    Maximum mean discrepancy test is aware of adversarial attacks

    Gao, R., Liu, F., Zhang, J., Han, B., Liu, T., Niu, G., and Sugiyama, M. Maximum mean discrepancy test is aware of adversarial attacks. In ICML, 2021

    2021

  10. [18]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In ICLR, 2015

    2015

  11. [19]

    M., Rasch, M

    Gretton, A., Borgwardt, K. M., Rasch, M. J., Sch \"o lkopf, B., and Smola, A. A kernel two-sample test. Journal of Machine Learning Research, 13 0 (1): 0 723--773, 2012

    2012

  12. [20]

    On the (statistical) detection of adversarial examples

    Grosse, K., Manoharan, P., Papernot, N., Backes, M., and McDaniel, P. On the (statistical) detection of adversarial examples. arXiv, 2017

    2017

  13. [21]

    Trustworthy Machine Learning: From Data to Models

    Han, B., Yao, J., Liu, T., Li, B., Koyejo, S., and Liu, F. Trustworthy Machine Learning: From Data to Models. Now Foundations and Trends, 2025

    2025

  14. [22]

    Kernel change-point analysis

    Harchaoui, Z., Moulines, E., and Bach, F. Kernel change-point analysis. In NeurIPS, 2008

    2008

  15. [23]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In CVPR, 2016

    2016

  16. [24]

    and Goeman, J

    Hemerik, J. and Goeman, J. Exact testing with random permutations. Test, 27 0 (4): 0 811--825, 2018

    2018

  17. [25]

    Probability inequalities for sums of bounded random variables

    Hoeffding, W. Probability inequalities for sums of bounded random variables. In The Collected Works of Wassily Hoeffding, pp.\ 409--426, New York, NY, 1994. Springer

    1994

  18. [26]

    Model-agnostic adversarial detection by random perturbations

    Huang, B., Wang, Y., and Wang, W. Model-agnostic adversarial detection by random perturbations. In IJCAI, 2019

    2019

  19. [27]

    H., and Courville, A

    Huang, C., Lim, J. H., and Courville, A. C. A variational perspective on diffusion-based generative models and score matching. In NeurIPS, 2021

    2021

  20. [28]

    Adversarial examples are not bugs, they are features

    Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. Adversarial examples are not bugs, they are features. In NeurIPS, 2019

    2019

  21. [29]

    Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations

    Jing, P., Tang, Q., Du, Y., Xue, L., Luo, X., Wang, T., Nie, S., and Wu, S. Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations. In USENIX Security Symposium , pp.\ 3237--3254, 2021

    2021

  22. [30]

    Diffattack: Evasion attacks against diffusion-based adversarial purification

    Kang, M., Song, D., and Li, B. Diffattack: Evasion attacks against diffusion-based adversarial purification. In NeurIPS, 2023

    2023

  23. [31]

    B., Aydore, S., Rauschmayr, N., and Kenthapadi, K

    Kaya, Y., Zafar, M. B., Aydore, S., Rauschmayr, N., and Kenthapadi, K. Generating distributional adversarial examples to evade statistical detectors. In ICML, 2022

    2022

  24. [32]

    Minimax optimality of permutation tests

    Kim, I., Balakrishnan, S., and Wasserman, L. Minimax optimality of permutation tests. Annals of Statistics, 50 0 (1): 0 225--251, 2022

    2022

  25. [33]

    CIFAR-10 (canadian institute for advanced research)

    Krizhevsky, A., Nair, V., and Hinton, G. CIFAR-10 (canadian institute for advanced research). 2009. URL http://www.cs.toronto.edu/ kriz/cifar.html

    2009

  26. [34]

    J., and Bengio, S

    Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial examples in the physical world. In ICLR, Workshop Track Proceedings, 2017

    2017

  27. [35]

    Certified adversarial robustness with additive noise

    Li, B., Chen, C., Wang, W., and Carin, L. Certified adversarial robustness with additive noise. In NeurIPS, 2019

    2019

  28. [36]

    Liu, F., Xu, W., Lu, J., Zhang, G., Gretton, A., and Sutherland, D. J. Learning deep kernels for non-parametric two-sample tests. In ICML, 2020

    2020

  29. [37]

    M., Wijewickrema, S

    Ma, X., Li, B., Wang, Y., Erfani, S. M., Wijewickrema, S. N. R., Schoenebeck, G., Song, D., Houle, M. E., and Bailey, J. Characterizing adversarial subspaces using local intrinsic dimensionality. In ICLR, 2018

    2018

  30. [38]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018

    2018

  31. [39]

    DeepFool : A simple and accurate method to fool deep neural networks

    Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P. DeepFool : A simple and accurate method to fool deep neural networks. In CVPR, 2016

    2016

  32. [40]

    Robustness of classifiers to universal perturbations: A geometric perspective

    Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., Frossard, P., and Soatto, S. Robustness of classifiers to universal perturbations: A geometric perspective. In ICLR, 2018

    2018

  33. [41]

    Kernel mean embedding of distributions: A review and beyond

    Muandet, K., Fukumizu, K., Sriperumbudur, B., and Sch \"o lkopf, B. Kernel mean embedding of distributions: A review and beyond. Foundations and Trends in Machine Learning , 10 0 (1-2): 0 1--141, 2017

    2017

  34. [42]

    and Pillai, S

    Papoulis, A. and Pillai, S. U. Probability, Random Variables and Stochastic Processes. McGraw Hill, 2001

    2001

  35. [43]

    The odds are odd: A statistical test for detecting adversarial examples

    Roth, K., Kilcher, Y., and Hofmann, T. The odds are odd: A statistical test for detecting adversarial examples. In ICML, 2019

    2019

  36. [44]

    Efficient aggregated kernel tests using incomplete U -statistics

    Schrab, A., Kim, I., Guedj, B., and Gretton, A. Efficient aggregated kernel tests using incomplete U -statistics. In NeurIPS, 2022

    2022

  37. [45]

    MMD aggregated two-sample test

    Schrab, A., Kim, I., Albert, M., Laurent, B., Guedj, B., and Gretton, A. MMD aggregated two-sample test. Journal of Machine Learning Research, 24: 0 194:1--194:81, 2023

    2023

  38. [46]

    and Ermon, S

    Song, Y. and Ermon, S. Generative modeling by estimating gradients of the data distribution. In NeurIPS, 2019

    2019

  39. [47]

    P., Kumar, A., Ermon, S., and Poole, B

    Song, Y., Sohl - Dickstein, J., Kingma, D. P., Kumar, A., Ermon, S., and Poole, B. Score-based generative modeling through stochastic differential equations. In ICLR, 2021

    2021

  40. [48]

    Sample-specific noise injection for diffusion-based adversarial purification

    Sun, Y., Zhang, J., Ye, Z., Xiao, C., and Liu, F. Sample-specific noise injection for diffusion-based adversarial purification. In ICML, 2025

    2025

  41. [49]

    J., and Fergus, R

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I. J., and Fergus, R. Intriguing properties of neural networks. In ICLR, 2014

    2014

  42. [50]

    Detecting adversarial examples is (nearly) as hard as classifying them

    Tram \` e r, F. Detecting adversarial examples is (nearly) as hard as classifying them. In ICML, 2022

    2022

  43. [51]

    Sparse adversarial perturbations for videos

    Wei, X., Zhu, J., Yuan, S., and Su, H. Sparse adversarial perturbations for videos. In AAAI, 2019

    2019

  44. [52]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability

    Xue, H., Araujo, A., Hu, B., and Chen, Y. Diffusion-based adversarial sample generation for improved stealthiness and controllability. In NeurIPS, 2023

    2023

  45. [53]

    On the certified robustness for ensemble models and beyond

    Yang, Z., Li, L., Xu, X., Kailkhura, B., Xie, T., and Li, B. On the certified robustness for ensemble models and beyond. In ICLR, 2022

    2022

  46. [54]

    P., Ghaoui, L

    Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., and Jordan, M. I. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019

    2019

  47. [55]

    Improving accuracy-robustness trade-off via pixel reweighted adversarial training

    Zhang, J., Liu, F., Zhou, D., Zhang, J., and Liu, T. Improving accuracy-robustness trade-off via pixel reweighted adversarial training. In ICML, 2024

    2024

  48. [56]

    Zhang, J., Rubinstein, B. I. P., Zhang, J., and Liu, F. One stone, two birds: Enhancing adversarial defense through the lens of distributional discrepancy. In ICML, 2025

    2025

  49. [57]

    Detecting adversarial data by probing multiple perturbations using expected perturbation score

    Zhang, S., Liu, F., Yang, J., Yang, Y., Li, C., Han, B., and Tan, M. Detecting adversarial data by probing multiple perturbations using expected perturbation score. In ICML, 2023

    2023

  50. [58]

    and Liu, C

    Zhong, X. and Liu, C. Sparse-pgd: A unified framework for sparse adversarial perturbations generation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  51. [59]

    On the exploration of local significant differences for two-sample test

    Zhou, Z., Ni, J., Yao, J.-H., and Gao, W. On the exploration of local significant differences for two-sample test. In NeurIPS, 2023

    2023

  52. [60]

    J., and Liu, F

    Zhou, Z., Tian, X., Peng, L., Lei, C., Schrab, A., Sutherland, D. J., and Liu, F. DUAL : Learning diverse kernels for aggregated two-sample and independence testing. In NeurIPS, 2025

    2025

  53. [61]

    ICML , year=

    The odds are odd: A statistical test for detecting adversarial examples , author=. ICML , year=

  54. [62]

    , author=

    Model-Agnostic Adversarial Detection by Random Perturbations. , author=. IJCAI , year=

  55. [63]

    NeurIPS , year=

    Robustness of classifiers: from adversarial to random noise , author=. NeurIPS , year=

  56. [64]

    ICML , year=

    Generating Distributional Adversarial Examples to Evade Statistical Detectors , author=. ICML , year=

  57. [65]

    Adversarial Examples Are Not Bugs, They Are Features , author =

  58. [66]

    Robustness of Classifiers to Universal Perturbations:

    Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Fawzi, Omar and Frossard, Pascal and Soatto, Stefano , year = 2018, booktitle =. Robustness of Classifiers to Universal Perturbations:

    2018

  59. [67]

    Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal , year = 2016, booktitle =

    2016

  60. [68]

    Certified Adversarial Robustness via Randomized Smoothing , author =

  61. [69]

    Certified Adversarial Robustness with Additive Noise , author =

  62. [70]

    On the Certified Robustness for Ensemble Models and Beyond , author =

  63. [71]

    Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods , author =

  64. [72]

    Deng, Zhijie and Yang, Xiao and Xu, Shizhen and Su, Hang and Zhu, Jun , year = 2021, booktitle =. LiBRe:

    2021

  65. [73]

    A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks , author =

  66. [74]

    Detecting adversarial samples from artifacts , author =

  67. [75]

    Two-sample Testing Using Deep Learning , author =

  68. [76]

    Kernel Change-point Analysis , author =

  69. [77]

    Testing for Homogeneity with Kernel Fisher Discriminant Analysis , author =

  70. [78]

    Annals of Statistics , volume = 52, number = 3, pages =

    Spectral regularized kernel two-sample tests , author =. Annals of Statistics , volume = 52, number = 3, pages =

  71. [79]

    Is Out-of-Distribution Detection Learnable? , author =

  72. [80]

    Dataset shift in machine learning , author =

  73. [81]

    Neural computation , volume = 10, number = 7, pages =

    Approximate statistical tests for comparing supervised classification learning algorithms , author =. Neural computation , volume = 10, number = 7, pages =

  74. [82]

    Biostatistics & Epidemiology , volume = 1, number = 1, pages =

    A tutorial on kernel density estimation and recent advances , author =. Biostatistics & Epidemiology , volume = 1, number = 1, pages =

  75. [83]

    Higher-order total variation approaches and generalisations , author =

  76. [84]

    Total Variation in Imaging , author =

  77. [85]

    U-statistics: Theory and Practice , author =

  78. [86]

    Theory of U-statistics , author =

  79. [87]

    The Annals of Mathematical Statistics , volume = 14, number = 3, pages =

    On stochastic limit and order relationships , author =. The Annals of Mathematical Statistics , volume = 14, number = 3, pages =

  80. [88]

    Journal of statistical planning and inference , volume = 38, number = 1, pages =

    Weighted bootstrapping of U-statistics , author =. Journal of statistical planning and inference , volume = 38, number = 1, pages =

  81. [89]

    Towards Deep Learning Models Resistant to Adversarial Attacks , author =

  82. [90]

    Transactions of the American Mathematical Society , volume = 72, number = 1, pages =

    On the application of the Borel-Cantelli lemma , author =. Transactions of the American Mathematical Society , volume = 72, number = 1, pages =

  83. [91]

    Journal of Machine Learning Research , volume = 24, pages =

    Schrab, Antonin and Kim, Ilmun and Albert, M. Journal of Machine Learning Research , volume = 24, pages =

  84. [92]

    Huang and Y

    B. Huang and Y. Liu and L. Peng , year = 2023, journal =. Weighted bootstrap for two-sample

    2023

  85. [93]

    Probability Theory and Related Fields , volume = 93, number = 4, pages =

    Bootstrap, wild bootstrap, and asymptotic normality , author =. Probability Theory and Related Fields , volume = 93, number = 4, pages =

  86. [94]

    Data Augmentation Can Improve Robustness , author =

  87. [95]

    Journal of physics: Conference series , volume = 1168, pages =

    An overview of overfitting and its solutions , author =. Journal of physics: Conference series , volume = 1168, pages =

  88. [96]

    Journal of big data , volume = 6, number = 1, pages =

    A survey on image data augmentation for deep learning , author =. Journal of big data , volume = 6, number = 1, pages =

  89. [97]

    On the empirical estimation of integral probability metrics , author =

  90. [98]

    Advances in applied probability , volume = 29, number = 2, pages =

    Integral probability metrics and their generating classes of functions , author =. Advances in applied probability , volume = 29, number = 2, pages =

  91. [99]

    B. K. Sriperumbudur and K. Fukumizu and A. Gretton and G. R. G. Lanckriet and B. Sch. Kernel Choice and Classifiability for

  92. [100]

    Informative Features for Model Comparison , author =

  93. [101]

    A Kernel Stein Test of Goodness of Fit for Sequential Models , author =

  94. [102]

    Kernel Stein Tests for Multiple Model Comparison , author =

  95. [103]

    Journal of the Royal Statistical Society Series B: Statistical Methodology , volume = 85, number = 3, pages =

    A kernel Stein test for comparing latent variable models , author =. Journal of the Royal Statistical Society Series B: Statistical Methodology , volume = 85, number = 3, pages =

  96. [104]

    B. K. Sriperumbudur and K. Fukumizu and G. Lanckriet , year = 2011, journal =. Universality, Characteristic Kernels and

    2011

  97. [105]

    Journal of Computational and Graphical Statistics , volume = 10, number = 1, pages =

    The art of data augmentation , author =. Journal of Computational and Graphical Statistics , volume = 10, number = 1, pages =

  98. [106]

    Kernel-Based Tests for Likelihood-Free Hypothesis Testing , author =

  99. [107]

    A Test of Relative Similarity For Model Selection in Generative Models , author =

  100. [108]

    Chicco and M

    D. Chicco and M. J. Warrens and G. Jurman , year = 2021, journal =. The coefficient of determination R-squared is more informative than

    2021

  101. [109]

    Neurocomputing , volume = 456, pages =

    Domain generalization via optimal transport with metric similarity learning , author =. Neurocomputing , volume = 456, pages =

  102. [110]

    World Literature Today , volume = 24, number = 1, pages =

    Pascal VOC 2008 challenge , author =. World Literature Today , volume = 24, number = 1, pages =

    2008

  103. [111]

    Learning and Transferring Mid-level Image Representations Using Convolutional Neural Networks , author =

  104. [112]

    Machine Learning , volume = 79, number =

    A theory of learning from different domains , author =. Machine Learning , volume = 79, number =

  105. [113]

    Deng and W

    J. Deng and W. Dong and R. Socher and Li. ImageNet:

  106. [114]

    Pattern Recognition and Machine Learning , author =

  107. [115]

    Distance metric learning: A comprehensive survey , author =

  108. [116]

    Density Estimation for Statistics and Data Analysis , author =

  109. [117]

    ITM web of conferences , volume = 23, pages =

    Kernel density estimation and its application , author =. ITM web of conferences , volume = 23, pages =

  110. [118]

    Advances in Neural Information Processing Systems 29 , publisher =

    Unsupervised Domain Adaptation with Residual Transfer Networks , author =. Advances in Neural Information Processing Systems 29 , publisher =

  111. [119]

    NeurIPS , publisher =

    Transfer Learning via Minimizing the Performance Gap Between Domains , author =. NeurIPS , publisher =

  112. [120]

    ICML , address =

    Label-Noise Robust Domain Adaptation , author =. ICML , address =

  113. [121]

    Maximum Mean Discrepancy Test is Aware of Adversarial Attacks , author =

  114. [122]

    Meta-learning with adaptive learning rates for few-shot fault diagnosis , author =

  115. [123]

    The Collected Works of Wassily Hoeffding , publisher =

    Probability inequalities for sums of bounded random variables , author=. The Collected Works of Wassily Hoeffding , publisher =

  116. [124]

    D. J. Sutherland , year = 2019, journal =. Unbiased estimators for the variance of

    2019

  117. [125]

    The Collected Works of Wassily Hoeffding , publisher =

    The large-sample power of tests based on permutations of observations , author =. The Collected Works of Wassily Hoeffding , publisher =

  118. [126]

    Test , volume = 27, number = 4, pages =

    Exact testing with random permutations , author =. Test , volume = 27, number = 4, pages =

  119. [127]

    Biometrika , volume = 89, number = 2, pages =

    Permutation tests for equality of distributions in high-dimensional settings , author =. Biometrika , volume = 89, number = 2, pages =

  120. [128]

    Succinct Quantum Testers for Closeness and k-Wise Uniformity of Probability Distributions , author =

  121. [129]

    Active Tolerant Testing , author =

  122. [130]

    The Price of Tolerance in Distribution Testing , author =

  123. [131]

    Proceedings of the 25th International Conference on Artificial Intelligence and Statistics , address =

    Compress Then Test: Powerful Kernel Testing in Near-linear Time , author =. Proceedings of the 25th International Conference on Artificial Intelligence and Statistics , address =

  124. [132]

    Higher Order Kernel Mean Embeddings to Capture Filtrations of Stochastic Processes , author =

  125. [133]

    Felix Biggs and Antonin Schrab and Arthur Gretton , year = 2023, booktitle =

    2023

  126. [134]

    On the Exploration of Local Significant Differences for Two-Sample Test , author =

  127. [135]

    Reproducing kernel Hilbert spaces in probability and statistics , author =

  128. [136]

    Proceedings of the 33nd International Conference on Machine Learning , address =

    A Kernelized Stein Discrepancy for Goodness-of-fit Tests , author =. Proceedings of the 33nd International Conference on Machine Learning , address =

  129. [137]

    Proceedings of the 33nd International Conference on Machine Learning , address =

    A Kernel Test of Goodness of Fit , author =. Proceedings of the 33nd International Conference on Machine Learning , address =

  130. [138]

    NeurIPS , publisher =

    A Kernel Statistical Test of Independence , author =. NeurIPS , publisher =

  131. [139]

    NeurIPS , publisher =

    A Fast, Consistent Kernel Two-Sample Test , author =. NeurIPS , publisher =

  132. [140]

    Advances in Neural Information Processing Systems 13 , publisher =

    The Kernel Trick for Distances , author =. Advances in Neural Information Processing Systems 13 , publisher =

  133. [141]

    Proceedings of the 57th Annual Symposium on Foundations of Computer Science , address =

    A New Approach for Testing Properties of Discrete Distributions , author =. Proceedings of the 57th Annual Symposium on Foundations of Computer Science , address =

  134. [142]

    Proceedings of the 56th Annual Symposium on Foundations of Computer Science , address =

    Optimal Algorithms and Lower Bounds for Testing Closeness of Structured Distributions , author =. Proceedings of the 56th Annual Symposium on Foundations of Computer Science , address =

  135. [143]

    Advances in Neural Information Processing Systems 28 , publisher =

    Optimal Testing for Properties of Distributions , author =. Advances in Neural Information Processing Systems 28 , publisher =

  136. [144]

    Testing Closeness of Discrete Distributions , author =. J

  137. [145]

    Advances in Neural Information Processing Systems 28 , publisher =

    Testing Closeness With Unequal Sized Samples , author =. Advances in Neural Information Processing Systems 28 , publisher =

  138. [146]

    Proceedings of the 25th Annual

    Optimal Algorithms for Testing Closeness of Discrete Distributions , author =. Proceedings of the 25th Annual

  139. [147]

    C. L. Canonne , year = 2020, journal =. A Survey on Distribution Testing: Your Data is Big

    2020

  140. [148]

    Diakonikolas and D

    I. Diakonikolas and D. M. Kane and S. Liu , year = 2024, booktitle =. Testing Closeness of Multivariate Distributions via

    2024

  141. [149]

    NeurIPS , publisher =

    Sequential Algorithms for Testing Closeness of Distributions , author =. NeurIPS , publisher =

  142. [150]

    Theory of Computing , volume = 9, pages =

    Testing Properties of Collections of Distributions , author =. Theory of Computing , volume = 9, pages =

  143. [151]

    Econometric Reviews , volume = 15, number = 3, pages =

    Nonparametric testing of closeness between two unknown distribution functions , author =. Econometric Reviews , volume = 15, number = 3, pages =

  144. [152]

    Proceedings of the 25th Annual Conference on Learning Theory , pages =

    Competitive Classification and Closeness Testing , author =. Proceedings of the 25th Annual Conference on Learning Theory , pages =

  145. [153]

    Proceedings of the 40th Annual

    Testing symmetric properties of distributions , author =. Proceedings of the 40th Annual

  146. [154]

    Proceedings of the 48th International Colloquium on Automata, Languages, and Programming , pages =

    Property Testing of Regular Languages with Applications to Streaming Property Testing of Visibly Pushdown Languages , author =. Proceedings of the 48th International Colloquium on Automata, Languages, and Programming , pages =

  147. [155]

    Proceedings of the 41st Annual Symposium on Foundations of Computer Science , pages =

    Testing that distributions are close , author =. Proceedings of the 41st Annual Symposium on Foundations of Computer Science , pages =

  148. [156]

    ICML , pages =

    A Model-free Closeness-of-influence Test for Features in Supervised Learning , author =. ICML , pages =

  149. [157]

    Annals of Statistics , volume = 50, number = 1, pages =

    Minimax optimality of permutation tests , author =. Annals of Statistics , volume = 50, number = 1, pages =

  150. [158]

    Pattern Recognition , volume = 41, number = 12, pages =

    Learning a Mahalanobis distance metric for data clustering and classification , author =. Pattern Recognition , volume = 41, number = 12, pages =

  151. [159]

    Advances in Neural Information Processing Systems 15 , publisher =

    Distance Metric Learning with Application to Clustering with Side-Information , author =. Advances in Neural Information Processing Systems 15 , publisher =

  152. [160]

    Geographical analysis , volume = 20, number = 1, pages =

    Lagrange multiplier test diagnostics for spatial dependence and spatial heterogeneity , author =. Geographical analysis , volume = 20, number = 1, pages =

  153. [161]

    The American Statistician , volume = 20, number = 2, pages =

    Sequential trials, sequential analysis and the likelihood principle , author =. The American Statistician , volume = 20, number = 2, pages =

  154. [162]

    PloS One , volume = 9, number = 10, pages =

    Applications of the Wei-Lachin multivariate one-sided test for multiple outcomes on possibly different scales , author =. PloS One , volume = 9, number = 10, pages =

  155. [163]

    Philosophical Transactions of the Royal Society of London: Series A , volume = 231, pages =

    On the problem of the most efficient tests of statistical hypotheses , author =. Philosophical Transactions of the Royal Society of London: Series A , volume = 231, pages =

  156. [164]

    Biometrika , volume = 93, number = 3, pages =

    False discovery control with p-value weighting , author =. Biometrika , volume = 93, number = 3, pages =

  157. [165]

    All of Statistics: A Concise Course in Statistical Inference , author =

  158. [166]

    Fundamentals of Applied Probability and Random Processes , author =

  159. [167]

    Annals of Statistics , volume = 26, number = 6, pages =

    Directional tests for one-sided alternatives in multivariate models , author =. Annals of Statistics , volume = 26, number = 6, pages =

  160. [168]

    Statistical Papers , volume = 62, number = 3, pages =

    Refined critical boundary with enhanced statistical power for non-directional two-sided tests in group sequential designs with multiple endpoints , author =. Statistical Papers , volume = 62, number = 3, pages =

  161. [169]

    Proceedings of the 1st Conference on Causal Learning and Reasoning , address =

    Interactive rank testing by betting , author =. Proceedings of the 1st Conference on Causal Learning and Reasoning , address =

  162. [170]

    Proceedings of the 38th Conference on Uncertainty in Artificial Intelligence , address =

    A label efficient two-sample test , author =. Proceedings of the 38th Conference on Uncertainty in Artificial Intelligence , address =

  163. [171]

    ICLR , address =

    Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks , author =. ICLR , address =

  164. [172]

    Proceedings of the

    Beyond two-sample-tests: Localizing data discrepancies in high-dimensional spaces , author =. Proceedings of the

  165. [173]

    NeurIPS , publisher =

    PyTorch: An Imperative Style, High-Performance Deep Learning Library , author =. NeurIPS , publisher =

  166. [174]

    NeurIPS , publisher =

    Density-difference estimation , author =. NeurIPS , publisher =

  167. [175]

    Multivariate analysis , author =

  168. [176]

    Multiple Comparison Procedures , author =

  169. [177]

    Probability, Random Variables and Stochastic Processes , author =

  170. [178]

    Statistics in Medicine , volume = 33, number = 11, pages =

    Multiple hypothesis testing in genomics , author =. Statistics in Medicine , volume = 33, number = 11, pages =

  171. [179]

    Proceedings of the 35th International Conference on Machine Learning , address =

    QuantTree: Histograms for Change Detection in Multivariate Data Streams , author =. Proceedings of the 35th International Conference on Machine Learning , address =

  172. [180]

    Statistics in Medicine , volume = 28, number = 4, pages =

    A graphical approach to sequentially rejective multiple test procedures , author =. Statistics in Medicine , volume = 28, number = 4, pages =

  173. [181]

    ICML , address =

    Familywise Error Rate Control by Interactive Unmasking , author =. ICML , address =

  174. [182]

    Biometrika , volume = 75, number = 4, pages =

    A sharper Bonferroni procedure for multiple tests of significance , author =. Biometrika , volume = 75, number = 4, pages =

  175. [183]

    , author =

    Powers of some one-sided multivariate tests with unknown population covariance matrix. , author =. Songklanakarin Journal of Science & Technology , volume = 31, number = 3, pages =

  176. [184]

    Statistical Analysis and Data Mining: The ASA Data Science Journal , volume = 13, number = 1, pages =

    Two-sample test based on classification probability , author =. Statistical Analysis and Data Mining: The ASA Data Science Journal , volume = 13, number = 1, pages =

  177. [185]

    Proceedings of the 18th International Conference on Information Processing in Medical Imaging , address =

    Permutation tests for classification: towards statistical significance in image-based studies , author =. Proceedings of the 18th International Conference on Information Processing in Medical Imaging , address =

  178. [186]

    Advances in Neural Information Processing Systems 27 , publisher =

    Optimal rates for k-NN density and mode estimation , author =. Advances in Neural Information Processing Systems 27 , publisher =

  179. [187]

    Journal of Multivariate Analysis , volume = 9, number = 1, pages =

    Multivariate k-nearest neighbor density estimates , author =. Journal of Multivariate Analysis , volume = 9, number = 1, pages =

  180. [188]

    Journal of Biopharmaceutical Statistics , volume = 28, number = 1, pages =

    Advances in p-value based multiple test procedures , author =. Journal of Biopharmaceutical Statistics , volume = 28, number = 1, pages =

  181. [189]

    Scandinavian Journal of Statistics , volume = 6, number = 2, pages =

    A simple sequentially rejective multiple test procedure , author =. Scandinavian Journal of Statistics , volume = 6, number = 2, pages =

  182. [190]

    NeurIPS , publisher =

    Failing loudly: An empirical study of methods for detecting dataset shift , author =. NeurIPS , publisher =

  183. [191]

    Matrix analysis , author =

  184. [192]

    ICML , address =

    On a projective ensemble approach to two sample test for equality of distributions , author =. ICML , address =

  185. [193]

    Annals of Statistics , volume = 48, number = 6, pages =

    Robust multivariate nonparametric tests via projection averaging , author =. Annals of Statistics , volume = 48, number = 6, pages =

  186. [194]

    Advances in Neural Information Processing Systems 24 , publisher =

    A More Powerful Two-Sample Test in High Dimensions using Random Projection , author =. Advances in Neural Information Processing Systems 24 , publisher =

  187. [195]

    Journal of Applied Statistics , volume = 27, number = 5, pages =

    A class of robust stepwise alternatives to Hotelling's T 2 tests , author =. Journal of Applied Statistics , volume = 27, number = 5, pages =

  188. [196]

    Journal of the Royal Statistical Society: Series B , volume = 80, number = 4, pages =

    AdaPT: An interactive procedure for multiple testing with side information , author =. Journal of the Royal Statistical Society: Series B , volume = 80, number = 4, pages =

  189. [197]

    Journal of the Royal Statistical Society: Series C , volume = 29, number = 2, pages =

    An exploratory technique for investigating large quantities of categorical data , author =. Journal of the Royal Statistical Society: Series C , volume = 29, number = 2, pages =

  190. [198]

    Machine Learning , volume = 1, number = 1, pages =

    Induction of Decision Trees , author =. Machine Learning , volume = 1, number = 1, pages =

  191. [199]

    Zaremba and A

    W. Zaremba and A. Gretton and M. B. Blaschko , year = 2013, booktitle =. B-test:

    2013

  192. [200]

    NeurIPS , publisher =

    Meta Two-Sample Testing: Learning Kernels for Testing with Limited Data , author =. NeurIPS , publisher =

  193. [201]

    NeurIPS , publisher =

    A permutation-free kernel two-sample test , author =. NeurIPS , publisher =

  194. [202]

    Efficient Aggregated Kernel Tests using Incomplete

    Schrab, Antonin and Kim, Ilmun and Guedj, Benjamin and Gretton, Arthur , year = 2022, booktitle =. Efficient Aggregated Kernel Tests using Incomplete

    2022

  195. [203]

    J.-M. K. NeurIPS , publisher =

  196. [204]

    Classification logit two-sample testing by neural networks for differentiating near manifold densities , author =

  197. [205]

    Proceedings of the 30th International Joint Conference on Neural Networks , address =

    Uniform histograms for change detection in multivariate data , author =. Proceedings of the 30th International Joint Conference on Neural Networks , address =

  198. [206]

    Annals of Applied Statistics , volume = 17, number = 1, pages =

    TEAM: A multiple testing algorithm on the aggregation tree for flow cytometry analysis , author =. Annals of Applied Statistics , volume = 17, number = 1, pages =

  199. [207]

    Biostatistics , volume = 22, number = 3, pages =

    A local group differences test for subject-level multivariate density neuroimaging outcomes , author =. Biostatistics , volume = 22, number = 3, pages =

  200. [208]

    Journal of the International Society for Analytical Cytology , volume = 45, number = 1, pages =

    Frequency difference gating: A multivariate method for identifying subsets that differ between samples , author =. Journal of the International Society for Analytical Cytology , volume = 45, number = 1, pages =

  201. [209]

    Journal of the Royal Statistical Society: Series B , volume = 79, number = 2, pages =

    Probabilistic multi-resolution scanning for two-sample differences , author =. Journal of the Royal Statistical Society: Series B , volume = 79, number = 2, pages =

  202. [210]

    International Journal of Man-machine Studies , volume = 27, number = 3, pages =

    Simplifying decision trees , author =. International Journal of Man-machine Studies , volume = 27, number = 3, pages =

  203. [211]

    Proceedings of the IEEE International Conference on Systems, Man and Cybernetics , address =

    An iterative growing and pruning algorithm for classification tree design , author =. Proceedings of the IEEE International Conference on Systems, Man and Cybernetics , address =

  204. [212]

    IEEE Transactions on Computers , volume = 26, number = 4, pages =

    A recursive partitioning decision rule for nonparametric classification , author =. IEEE Transactions on Computers , volume = 26, number = 4, pages =

  205. [213]

    Computational Statistics & Data Analysis , volume = 170, pages =

    On the use of random forest for two-sample testing , author =. Computational Statistics & Data Analysis , volume = 170, pages =

  206. [214]

    Journal of Mathematical Methods in Biosciences , volume = 51, number = 3, pages =

    Highest density difference region estimation with application to flow cytometric data , author =. Journal of Mathematical Methods in Biosciences , volume = 51, number = 3, pages =

  207. [215]

    IEEE Transactions on Systems, Man, and Cybernetics, Part C , volume = 35, number = 4, pages =

    Top-down induction of decision trees classifiers-a survey , author =. IEEE Transactions on Systems, Man, and Cybernetics, Part C , volume = 35, number = 4, pages =

  208. [216]

    Annual Review of Statistics and Its Application , volume = 10, pages =

    Three-Decision Methods: A Sensible Formulation of Significance Tests—and Much Else , author =. Annual Review of Statistics and Its Application , volume = 10, pages =

  209. [217]

    , author =

    Directional statistical decisions. , author =. Psychological Review , volume = 67, number = 3, pages =

  210. [218]

    Proceedings of the 34th International Conference on Machine Learning , address =

    An adaptive test of independence with analytic kernel embeddings , author =. Proceedings of the 34th International Conference on Machine Learning , address =

  211. [219]

    Journal of Machine Learning Research , volume = 12, pages =

    Multiple kernel learning algorithms , author =. Journal of Machine Learning Research , volume = 12, pages =

  212. [220]

    Optimal kernel choice for large-scale two-sample tests , author =

  213. [221]

    Advances in Neural Information Processing Systems 18 , publisher =

    A General and Efficient Multiple Kernel Learning Algorithm , author =. Advances in Neural Information Processing Systems 18 , publisher =

  214. [222]

    NeurIPS , publisher =

    Parametric local metric learning for nearest neighbor classification , author =. NeurIPS , publisher =

  215. [223]

    Chemometrics and Intelligent Laboratory Systems , volume = 50, number = 1, pages =

    The mahalanobis distance , author =. Chemometrics and Intelligent Laboratory Systems , volume = 50, number = 1, pages =

  216. [224]

    , author =

    Distance metric learning for large margin nearest neighbor classification. , author =. Journal of Machine Learning Research , volume = 10, number = 9, pages =

  217. [225]

    Convex Optimization , author =

  218. [226]

    Proceedings of the 11th International Workshop on Applied Parallel Computing , address =

    Blocked Schur algorithms for computing the matrix square root , author =. Proceedings of the 11th International Workshop on Applied Parallel Computing , address =

  219. [227]

    Journal of Machine Learning Research , volume = 11, number = 50, pages =

    Hilbert space embeddings and metrics on probability measures , author =. Journal of Machine Learning Research , volume = 11, number = 50, pages =

  220. [228]

    American Statistician , volume = 76, number = 1, pages =

    Calculating sample size for Follmann’s simple multivariate test for one-sided alternatives , author =. American Statistician , volume = 76, number = 1, pages =

  221. [229]

    NeurIPS , publisher =

    Comparing distributions: _1 geometry improves kernel two-sample testing , author =. NeurIPS , publisher =

  222. [230]

    Monthly Notices of the Royal Astronomical Society , volume = 471, number = 3, pages =

    Local two-sample testing: A new tool for analysing high-dimensional astronomical data , author =. Monthly Notices of the Royal Astronomical Society , volume = 471, number = 3, pages =

  223. [231]

    Nature Methods , volume = 14, number = 7, pages =

    Testing for differential abundance in mass cytometry data , author =. Nature Methods , volume = 14, number = 7, pages =

  224. [232]

    Ma and W.-H

    L. Ma and W.-H. Wong , year = 2011, journal =. Coupling optional P

    2011

  225. [233]

    Annals of Statistics , volume = 38, number = 2, pages =

    A two-sample test for high-dimensional data with applications to gene-set testing , author =. Annals of Statistics , volume = 38, number = 2, pages =

  226. [234]

    National Academy of Sciences , volume = 104, number = 27, pages =

    Let-7 expression defines two differentiation stages of cancer , author =. National Academy of Sciences , volume = 104, number = 27, pages =

  227. [235]

    IEEE Transactions on Cybernetics , volume = 51, number = 6, pages =

    Concept drift detection via equal intensity k-means space partitioning , author =. IEEE Transactions on Cybernetics , volume = 51, number = 6, pages =

  228. [236]

    Li and W.-C Chang and Y

    C.-L. Li and W.-C Chang and Y. Cheng and Y.-M. Yang and B. P. Advances in Neural Information Processing Systems 30 , publisher =

  229. [237]

    Foundations and Trends

    Kernel mean embedding of distributions: A review and beyond , author =. Foundations and Trends

  230. [238]

    Theory and Application of the Linear Model , author =

  231. [239]

    Electronic Journal of Statistics , volume = 13, number = 2, pages =

    Global and local two-sample tests via regression , author =. Electronic Journal of Statistics , volume = 13, number = 2, pages =

  232. [240]

    Journal of Nonparametric Statistics , volume = 25, number = 3, pages =

    Local significant differences from nonparametric two-sample tests , author =. Journal of Nonparametric Statistics , volume = 25, number = 3, pages =

  233. [241]

    Revisiting classifier two-sample tests , author=

  234. [242]

    D. P. Kingma and J. Ba , year = 2015, booktitle =. Adam:

    2015

  235. [243]

    Efficiency lower bounds for distribution-free Hotelling-type two-sample tests based on optimal transport , author =

  236. [244]

    Journal of the American Statistical Association , volume = 74, number = 365, pages =

    A Monte Carlo investigation of the robustness of Hotelling's one-and two-sample T 2 tests , author =. Journal of the American Statistical Association , volume = 74, number = 365, pages =

  237. [245]

    Journal of Machine Learning Research , volume = 23, number = 73, pages =

    A kernel two-sample test for functional data , author =. Journal of Machine Learning Research , volume = 23, number = 73, pages =

  238. [246]

    Applied Multivariate Statistical Analysis , author =

  239. [247]

    Annals of Mathematical Statistics , volume = 2, number = 3, pages =

    The generalization of Student's ratio , author =. Annals of Mathematical Statistics , volume = 2, number = 3, pages =

  240. [248]

    Classification logit two-sample testing by neural networks , author =

  241. [249]

    Journal of Machine Learning Research , volume = 13, number = 1, pages =

    A kernel two-sample test , author =. Journal of Machine Learning Research , volume = 13, number = 1, pages =

  242. [250]

    Journal of the American Statistical Association , volume = 91, number = 434, pages =

    A simple multivariate test for one-sided alternatives , author =. Journal of the American Statistical Association , volume = 91, number = 434, pages =

  243. [251]

    Annals of Statistics , volume = 49, number = 1, pages =

    Classification Accuracy as A Proxy for Two-Sample Testing , author =. Annals of Statistics , volume = 49, number = 1, pages =

  244. [252]

    Proceedings of the 39th International Conference on Machine Learning , address =

    Sequential Covariate Shift Detection Using Classifier Two-Sample Tests , author =. Proceedings of the 39th International Conference on Machine Learning , address =

  245. [253]

    , author =

    Generative Models and Model Criticism via Optimized Maximum Mean Discrepancy. , author =. ICLR , address =

  246. [254]

    Advances in Neural Information Processing Systems 28 , publisher =

    Fast two-sample testing with analytic representations of probability measures , author =. Advances in Neural Information Processing Systems 28 , publisher =

  247. [255]

    Journal of the Royal Statistical Society: Series B , volume = 76, number = 2, pages =

    Two-sample test of high dimensional means under dependence , author =. Journal of the Royal Statistical Society: Series B , volume = 76, number = 2, pages =

  248. [256]

    Advances in Neural Information Processing Systems 33 , publisher =

    Learning kernel tests without data splitting , author =. Advances in Neural Information Processing Systems 33 , publisher =

  249. [257]

    Advances in Neural Information Processing Systems 29 , publisher =

    Interpretable distribution features with maximum testing power , author =. Advances in Neural Information Processing Systems 29 , publisher =

  250. [258]

    Learning Deep Kernels for Non-Parametric Two-Sample Tests , author =

  251. [259]

    Approximation Theorems of Mathematical Statistics , author =

  252. [260]

    Counterexamples in Topology , author =

  253. [261]

    Advances in Neural Information Processing Systems 19 , publisher =

    A Kernel Method for the Two-Sample-Problem , author =. Advances in Neural Information Processing Systems 19 , publisher =

  254. [262]

    Intriguing properties of neural networks , author =

  255. [263]

    Explaining and Harnessing Adversarial Examples , author =

  256. [264]

    Adversarial examples in the physical world , author =

  257. [265]

    Towards Evaluating the Robustness of Neural Networks , author =

  258. [266]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks , author =

  259. [267]

    Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack , author =

  260. [268]

    Square Attack:

    Maksym Andriushchenko and Francesco Croce and Nicolas Flammarion and Matthias Hein , year = 2020, booktitle =. Square Attack:

    2020

  261. [269]

    Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality , author =

  262. [270]

    Zhijie Deng and Xiao Yang and Shizhen Xu and Hang Su and Jun Zhu , year = 2021, booktitle =

    2021

  263. [271]

    Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Score , author =

  264. [272]

    Generative Modeling by Estimating Gradients of the Data Distribution , author =

  265. [273]

    Score-Based Generative Modeling through Stochastic Differential Equations , author =

  266. [274]

    A Variational Perspective on Diffusion-Based Generative Models and Score Matching , author =

  267. [275]

    Detecting Adversarial Data Using Perturbation Forgery , author =

  268. [276]

    One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy , author =

  269. [277]

    Trustworthy Machine Learning: From Data to Models , author =

  270. [278]

    Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks , author =

  271. [279]

    Too Good to Be Safe: Tricking Lane Detection in Autonomous Driving with Crafted Perturbations , author =

  272. [280]

    Theoretically Principled Trade-off between Robustness and Accuracy , author =

  273. [281]

    Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training , author =

  274. [282]

    Diffusion Models for Adversarial Purification , author =

  275. [283]

    Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification , author =

  276. [284]

    Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them , author =

  277. [285]

    Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent , author =

  278. [286]

    Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllability , author =

  279. [287]

    DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification , author =

  280. [288]

    Testing Statistical Hypotheses , author =

  281. [289]

    Zhou, Zhijian and Tian, Xunye and Peng, Liuhua and Lei, Chao and Schrab, Antonin and Sutherland, Danica J and Liu, Feng , year = 2025, booktitle =

    2025

  282. [290]

    arXiv , year=

    On the (statistical) detection of adversarial examples , author=. arXiv , year=

  283. [291]

    Biometrika , volume=

    Boosting the power of kernel two-sample tests , author=. Biometrika , volume=

  284. [292]

    2009 , url=

    , author=. 2009 , url=

    2009

  285. [293]

    CVPR , year=

    Imagenet: A large-scale hierarchical image database , author=. CVPR , year=

  286. [294]

    CVPR , year =

    Kaiming He and Xiangyu Zhang and Shaoqing Ren and Jian Sun , title =. CVPR , year =

  287. [295]

    ICLR , year =

    Alexey Dosovitskiy and Lucas Beyer and Alexander Kolesnikov and Dirk Weissenborn and Xiaohua Zhai and Thomas Unterthiner and Mostafa Dehghani and Matthias Minderer and Georg Heigold and Sylvain Gelly and Jakob Uszkoreit and Neil Houlsby , title =. ICLR , year =

  288. [296]

    arXiv preprint arXiv:2206.08738 , year=

    Detecting Adversarial Examples in Batches--a geometrical approach , author=. arXiv preprint arXiv:2206.08738 , year=

  289. [297]

    arXiv preprint arXiv:2104.10076 , year=

    Mixdefense: A defense-in-depth framework for adversarial example detection based on statistical and semantic analysis , author=. arXiv preprint arXiv:2104.10076 , year=

  290. [298]

    AAAI , year=

    Sparse adversarial perturbations for videos , author=. AAAI , year=

  291. [299]

    IEEE Transactions on Pattern Analysis and Machine Intelligence , year=

    Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generation , author=. IEEE Transactions on Pattern Analysis and Machine Intelligence , year=

Pith tools

Reviewed June 29, 2026 · model on record in the stance chip above.