Pith. sign in

REVIEW 3 major objections 5 minor 51 references

Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Floating-point rounding inflates CE gradient error in PGD attacks; a per-phase scaling factor t* defined in this paper is claimed to minimize it, bringing T-MIFPE close to AutoAttack's robustness numbers in 100 iterations.

desk verdict A plausible but under-derived extension of MIFPE; the theory does not deliver a computable t* as written, and the empirical gain over MIFPE is tiny. read the letter →

arxiv 2507.22428 v1 pith:GZ5SXC6J submitted 2025-07-30 cs.LG cs.AIcs.CV

Yunrui Yu , Hang Su , Cheng-zhong Xu , Zhizhong Su , Jun Zhu This is my paper
classification cs.LGcs.AIcs.CV MSC 68T0765G50
keywords floating-pointerrorrelativecross-entropylossadversarialattacksPGDT-MIFPErobustnessevaluationgradientcomputation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the long-observed overestimation of model robustness by PGD with cross-entropy loss has a numerical cause: floating-point rounding and underflow inflate relative errors in the CE gradient, especially when the top two logits nearly coincide. It derives, for each of four attack phases (untargeted/targeted × successful/unsuccessful), the scaling factor t* that maximizes the magnitude of the dominant gradient coefficient, thereby minimizing the worst-case relative error of that term. The resulting loss, T-MIFPE, scales logits by t*/(z_pi1 - z_pi2)_detached before computing CE. If correct, a 100-iteration PGD with T-MIFPE approaches the robust accuracy that AutoAttack reaches with thousands of iterations, giving cheaper and more trustworthy robustness evaluation. The paper's Table 1 supports this: T-MIFPE lands within about 0.1 points of AutoAttack on several CIFAR-10 models.

What carries the argument

The object that carries the argument is the coefficient g(t) — for unsuccessful untargeted attacks c(1 − p^c_{π1}), for successful untargeted attacks c p^c_{π1}, for targeted unsuccessful attacks c(p^c_{π1} − p^c_{πj}), and for successful targeted attacks c(1 − p^c_{π1}) — paired with the worst-case relative-error bound δ^sup(t) = ε_max / |g(t)∇(z_{π1}−z_{π2})|. The paper bounds the true truncation error by ε_max ($2^{{−10}}$, $2^{{−23}}$, $2^{{−52}}$ for 16/32/64-bit floats), treats the margin gradient as constant in t, and chooses t to maximize g(t), i.e., to minimize the bound. The underflow threshold λ enters as a ceiling on t, keeping the softmax probabilities non-zero in successful phases.

What would settle it

Take a fixed CIFAR-10 robust model, compute full gradients with CE at t values 0.25 t*, t*, and 4 t* on the same inputs, and measure the relative L2 error against a float64 reference; if the full-gradient error is not minimal at t*, or if PGD-100 robust accuracy at t = 0.25 t* equals that at t*, then the claim that t* minimizes relative error is not empirically supported.

Watch

Extended reading notes

Core claim

The paper's central claim is that the overestimation of robustness by PGD with cross-entropy loss is a floating-point phenomenon with a calculable optimum. For each of the four attack phases, the CE gradient decomposes into margin-gradient terms whose coefficients are products of a scale factor c = t/Δ and softmax probabilities; the worst-case relative error of the leading term is ε_max divided by the magnitude of that coefficient. Maximizing the coefficient over t gives t* = Δ B(B−1)/(−S) for unsuccessful phases and λ-bounded formulas for successful and targeted phases, and T-MIFPE is exactly CE(t* z/Δ_value, y), recomputed at every iteration because logits drift. The paper argues this theoretically optimal scaling makes gradient directions more accurate, so a 100-iteration PGD with T-MIFPE approaches the robust-accuracy numbers that AutoAttack produces with at least 4900 iterations.

Load-bearing premise

The whole derivation rests on the assumption that minimizing the relative error of a single coefficient on the top-margin gradient term also minimizes the total gradient error, since the remaining gradient terms are never bounded; if another term dominates the gradient, t* need not reduce the overall relative error.

Editorial extensions

If this is right

  • T-MIFPE with 100 PGD iterations gives robust-accuracy estimates that sit within about 0.01–0.10 points of AutoAttack's 4900-iteration numbers on several CIFAR-10 and CIFAR-100 models, which would make single-loss robustness evaluation dramatically cheaper.
  • Because t* is recomputed each iteration, T-MIFPE adapts to the logit distribution as the attack progresses, avoiding the fixed T=1 that MIFPE uses.
  • The phase-dependent formulas imply that no single constant scaling can be optimal for both successful and unsuccessful attack phases; any fixed-temperature CE variant will be suboptimal in at least one phase.
  • In the paper's tables, T-MIFPE consistently beats CE, C&W, and DLR on ℓ∞ CIFAR-10/CIFAR-100, and on ℓ2 CIFAR-10 it matches AA where DLR overestimates robustness by up to 8 points.
  • The theoretical framework gives a per-iteration, logit-dependent rule that should transfer to any gradient-based attack that backpropagates through a log-softmax.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the dominant-term assumption carries over to other exponential losses, the same t* recipe could be applied to temperature-scaled CE, focal loss, or distillation losses, potentially improving their attack strength as well (an extension the paper does not test).
  • The paper does not report how robust accuracy varies with t around t*; plotting attack success against t on a grid would show whether t* is a sharp optimum or a broad plateau, and would tell practitioners how precisely t* must be computed.
  • Since the underflow threshold λ differs across 16-, 32-, and 64-bit arithmetic, the optimal scaling depends on the precision used for forward and backward passes; this suggests robustness numbers should be reported together with the numeric precision of the attack.
  • The gains over MIFPE are small (usually 0.01–0.10 points), so in practice the main contribution may be the principled explanation and the per-iteration adaptation rather than a large improvement in attack success.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript studies floating-point-induced relative errors in CE-loss gradients for gradient-based adversarial attacks, proposing a four-scenario taxonomy (unsuccessful/successful untargeted and targeted attacks). It introduces T-MIFPE, a loss that scales logits by t*/Delta, where t* is intended to minimize the relative error of the dominant gradient coefficient. Experiments with PGD-100 on MNIST, CIFAR-10, CIFAR-100, and ImageNet compare T-MIFPE with CE, C&W, DLR, MIFPE, GAMA-PGD, and AutoAttack, reporting small robustness-accuracy improvements over MIFPE.

Significance. If the derivation of t* were correct, T-MIFPE would be a principled replacement for the heuristic T=1 of MIFPE, and the systematic four-scenario analysis of gradient coefficients would be a useful contribution to understanding numerical instability in adversarial attacks. The paper explicitly decomposes the CE gradient into ordered-logit components and correctly identifies underflow as a key failure mode. However, the central optimization is not actually solved as written, and the experimental advantage over MIFPE is marginal, so the significance of the contribution is not yet established.

major comments (3)
  1. [Section 3.1.1, Eq. (14) and Section 6.3, Eq. (40)] The claim that h(t) in Eq. (13) is linear is false. B and S both depend on t through c = t/Delta, so h'(t) = (2B S + t S')/Delta, which is not a constant slope. Consequently Eq. (14), t* = Delta B(B-1)/(-S), is a fixed-point equation t = F(t) rather than a closed-form expression for t*. The paper provides no existence or uniqueness proof and no algorithm for computing t*. The same defect appears verbatim in Eq. (40) for the successful targeted phase. Because every PGD iteration of T-MIFPE uses t*, the proposed loss function is underspecified as defined.
  2. [Section 6.1, Eq. (24)] The underflow threshold in Eq. (24) is derived from the wrong exponent. In this phase the softmax is re-centered at z_pi2, so the probability that can underflow is p_c_pi_j = exp(c(z_pi_j - z_pi2))/B, with exponent c(z_pi_j - z_pi2) = t(Delta - (z_pi1 - z_pi_j))/Delta. The paper instead sets t* from exp(c(z_pi_j - z_pi1)), giving t* = lambda Delta/(z_pi1 - z_pi_j). For j > 2 this yields a bound that is stricter than the true underflow threshold by an amount depending on z_pi2 - z_pi_j, so t* is not the maximum value allowed by the underflow constraint and the claimed optimality for this phase is unsupported; for j = 2 the bound is vacuous because z_pi_j - z_pi2 = 0.
  3. [Section 3.1.1, Eqs. (8)-(10), and Appendix 6.1] The analysis minimizes the relative error of only the leading coefficient c(1 - p_c_pi1) (or c p_c_pi1 in the successful phase) multiplying grad_x(z_pi2 - z_pi1). The remaining terms in the gradient expansion, such as c(1 - p_c_pi1 - p_c_pi2) grad_x(z_pi3 - z_pi2), are never bounded. Without a proof that the leading term dominates the total relative gradient error, minimizing one coefficient need not reduce the relative error of the full CE gradient. This assumption is load-bearing because t* is chosen entirely from this single-coefficient objective.
minor comments (5)
  1. [Section 6.3, Eq. (35)] The first term in Eq. (35) is missing a factor of c: it should be c(1 - p_c_pi1) grad_x(z_pi1 - z_pi2), not (1 - c p_c_pi1) grad_x(z_pi1 - z_pi2). The subsequent definition of g(t)t_s uses the correct coefficient, but the displayed derivation is inconsistent.
  2. [Section 3.1.1, Eq. (6)] The notation is inconsistent: Eq. (6) writes grad_z CE(cz,y) but then uses grad_x for the logit differences. Please clarify that gradients are with respect to the input x through the chain rule, and use a single consistent notation.
  3. [Figure 1] Figure 1 plots t* for each scenario, but the text does not state how t* was computed numerically. If root-finding was used for Eqs. (14) and (40), the algorithm, initialization, and convergence criterion should be described; otherwise the figure is not reproducible.
  4. [Section 4, Table 1] The claim that T-MIFPE provides 'substantial and consistent improvements' over CE is not supported by Table 1: for example, on MNIST 'Uncovering limits' T-MIFPE gives 96.51% versus CE's 96.55%, and on 'MMA training' T-MIFPE gives 94.80% versus CE's 95.09%. The differences between T-MIFPE and MIFPE are also at most 0.10 points and often 0.00-0.01 points, so the empirical evidence is weak.
  5. [Sections 4 and 8] The step-size schedule is described as 'cosine decaying' in Section 4 but as 'linearly decaying' in Section 8; please reconcile these descriptions.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular reduction: t* is derived from the paper's own error model and checked against external RobustBench; the fixed-point and dominance issues are correctness concerns, not circularity.

full rationale

The central derivation of t* is self-contained: Eq. (14) and (40) are obtained from the paper's own first-order condition on g(t), not from a fit to experimental outcomes, and Table 1's AutoAttack comparison is an external benchmark with over 4900 iterations that is not used to set t*. Although the loss family L_CE(t z/Delta_value, y) is inherited from the authors' prior MIFPE paper (Ref. [29]), the optimal scaling factor t* is newly derived rather than quoted from that paper, so the self-citation is not load-bearing. The paper's main defects are non-circular: Eq. (14) and (40) are actually fixed-point equations because B and S depend on t through c=t/Delta, so t* is not a closed-form solution as written; the relative-error analysis assumes the leading gradient term dominates without bounding the omitted terms; and the underflow threshold in Eq. (24) and (32) is derived for a softmax re-centered at z_pi1 while the accompanying softmax in Sec. 6.1 is re-centered at z_pi2. Section 7 also concedes that targeted attacks were not experimentally tested. None of these issues makes a prediction equal to its input by construction, so there is no significant circularity.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central derivation is nearly self-contained but rests on an unproved dominance assumption, an unproved uniqueness of t*, a hand-set lower bound t*>=1, and standard floating-point error bounds. No invented physical entities are introduced. The main free parameters are the lower bound 1 and the unspecified root-finding tolerance for the implicit Eq (14).

free parameters (2)
  • t* lower bound = 1
    Appendix 6.1 and 6.2 set t* = max(1, ...); the floor of 1 is chosen by hand to avoid small-t relative errors, not derived from the error analysis.
  • root-finding tolerance for implicit t* = unspecified
    Eq (14) is implicit in t because B and S depend on t, but the paper does not state an iterative solver or tolerance, effectively leaving a hidden implementation parameter.
assumptions (5)
  • standard math Floating-point rounding and underflow errors are bounded by machine epsilon and underflow thresholds lambda for 16, 32, and 64 bit formats.
    Used throughout Section 3 and Appendix 6; lambda values 16.6355, 103.2789, 744.4401 are standard IEEE-754 constants.
  • domain assumption The relative error of the full CE gradient is controlled by the coefficient of the top-margin gradient term, such as c(1-p_pi1) for unsuccessful untargeted attacks.
    Introduced in Section 3.1.1, Eqs (8)-(10); the omitted gradient terms are never bounded, so this dominance assumption is load-bearing.
  • domain assumption The gradient term is constant with respect to the scaling factor t/Delta.
    Stated after Eq (10) in Section 3.1.1; true for model-dependent logit gradients but used to turn the maximization into a one-dimensional problem.
  • ad hoc to paper A unique maximizer t* exists for g(t) in the unsuccessful phases.
    The paper asserts h(t) in Eq (13) is linear and monotonically decreasing, which is false because B and S depend on t; no existence or uniqueness proof is given.
  • ad hoc to paper For successful untargeted and unsuccessful targeted attacks, the optimal t* is the largest value before p_pi_j underflows, capped below at 1.
    Appendix 6.1 and 6.2, Eqs (24) and (32); the threshold formula uses z_pi1-z_pi_j, but the exponent in p_pi_j for the successful untargeted phase depends on z_pi2, so the justification is mismatched.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss." pith.science (2026). https://pith.science/paper/GZ5SXC6J

@misc{pith2026250722428,
  author       = {Pith},
  title        = {Pith review of: Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GZ5SXC6J}},
  note         = {Machine review of arXiv:2507.22428}
}
abstract

Gradient-based adversarial attacks using the Cross-Entropy (CE) loss often suffer from overestimation due to relative errors in gradient computation induced by floating-point arithmetic. This paper provides a rigorous theoretical analysis of these errors, conducting the first comprehensive study of floating-point computation errors in gradient-based attacks across four distinct scenarios: (i) unsuccessful untargeted attacks, (ii) successful untargeted attacks, (iii) unsuccessful targeted attacks, and (iv) successful targeted attacks. We establish theoretical foundations characterizing the behavior of relative numerical errors under different attack conditions, revealing previously unknown patterns in gradient computation instability, and identify floating-point underflow and rounding as key contributors. Building on this insight, we propose the Theoretical MIFPE (T-MIFPE) loss function, which incorporates an optimal scaling factor $T = t^*$ to minimize the impact of floating-point errors, thereby enhancing the accuracy of gradient computation in adversarial attacks. Extensive experiments on the MNIST, CIFAR-10, and CIFAR-100 datasets demonstrate that T-MIFPE outperforms existing loss functions, including CE, C\&W, DLR, and MIFPE, in terms of attack potency and robustness evaluation accuracy.

Figures

Figures reproduced from arXiv: 2507.22428 by the authors.

Figure 1
Figure 1. Analysis of the relative error in gradients computed using cross-entropy loss for [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 36 canonical work pages

  1. [1]

    Improving aircraft performance using machine learning: A review

    Soledad Le Clainche, Esteban Ferrer, Sam Gibson, Elisabeth Cross, Alessandro Parente, and Ricardo Vinuesa. Improving aircraft performance using machine learning: A review. Aerospace Science and Technology, 138:108354, 2023

    work page 2023

  2. [2]

    Deep convolutional neural network based medical image classification for disease diagnosis

    Samir S Yadav and Shivajirao M Jadhav. Deep convolutional neural network based medical image classification for disease diagnosis. Journal of Big data, 6(1):1–18, 2019

    work page 2019

  3. [3]

    Deep multi-modal object detection and semantic segmentation for autonomous driving: Datasets, methods, and challenges

    Di Feng, Christian Haase-Schütz, Lars Rosenbaum, Heinz Hertlein, Claudius Glaeser, Fabian Timm, Werner Wiesbeck, and Klaus Dietmayer. Deep multi-modal object detection and semantic segmentation for autonomous driving: Datasets, methods, and challenges. IEEE Transactions on Intelligent Transportation Systems, 22(3):1341–1360, 2020

    work page 2020

  4. [4]

    Using chatgpt for human–computer interaction research: a primer

    Wilbert Tabone and Joost De Winter. Using chatgpt for human–computer interaction research: a primer. Royal Society Open Science, 10(9):231053, 2023

    work page 2023

  5. [5]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014

    work page 2014

  6. [6]

    Explaining and harnessing adversarial examples

    Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015

    work page 2015

  7. [7]

    At- tacking vision-based perception in end-to-end autonomous driving models.Journal of Systems Architecture, 110:101766, 2020

    Adith Boloor, Karthik Garimella, Xin He, Christopher Gill, Yevgeniy V orobeychik, and Xuan Zhang. At- tacking vision-based perception in end-to-end autonomous driving models.Journal of Systems Architecture, 110:101766, 2020

    work page 2020

  8. [8]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016

    2016

Show all 51 references
  1. [9]

    Carlini and D

    N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In2017 IEEE Symposium on Security and Privacy (SP), pages 39–57, 2017

    2017

  2. [10]

    To- wards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

    2018

  3. [11]

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li. Boosting adversarial attacks with momentum. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9185–9193, 2018

    2018

  4. [12]

    Generating adversarial examples with adversarial networks

    Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. In IJCAI, 2018

    2018

  5. [13]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020

    2020

  6. [14]

    Adversarial training for free! In Advances in Neural Information Processing Systems, volume 32, pages 3358–3369, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, volume 32, pages 3358–3369, 2019

    2019

  7. [15]

    Are labels required for improving adversarial robustness? In Advances in Neural Information Processing Systems, volume 32, 2019

    Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In Advances in Neural Information Processing Systems, volume 32, 2019

    2019

  8. [16]

    Theoreti- cally principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoreti- cally principled trade-off between robustness and accuracy. In ICML, 2019

    2019

  9. [17]

    Boosting adversarial training with hypersphere embedding

    Tianyu Pang, Xiao Yang, Yinpeng Dong, Kun Xu, Hang Su, and Jun Zhu. Boosting adversarial training with hypersphere embedding. In NeurIPS, 2020

    2020

  10. [18]

    Improving adver- sarial robustness requires revisiting misclassified examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adver- sarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2020

    2020

  11. [19]

    Adversarial weight perturbation helps robust generalization

    Dongxian Wu, Shu tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In NeurIPS, 2020. 10

    2020

  12. [20]

    Does network width really help adversarial robustness? arXiv 2010.01279, 2020

    Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Does network width really help adversarial robustness? arXiv 2010.01279, 2020

    2010 arXiv

  13. [21]

    Lafeat: Piercing through adversarial defenses with latent features

    Yunrui Yu, Xitong Gao, and Cheng-Zhong Xu. Lafeat: Piercing through adversarial defenses with latent features. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 5735–5745, 2021

    2021

  14. [22]

    Mora: Improving ensemble robustness evaluation with model reweighing attack

    Xitong Gao, Cheng-Zhong Xu, et al. Mora: Improving ensemble robustness evaluation with model reweighing attack. Advances in Neural Information Processing Systems, 35:26955–26965, 2022

    2022

  15. [23]

    Lafit: Efficient and reliable evaluation of adversarial defenses with latent features

    Yunrui Yu, Xitong Gao, and Cheng-Zhong Xu. Lafit: Efficient and reliable evaluation of adversarial defenses with latent features. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(1):354– 369, 2023

    2023

  16. [24]

    Composite adversarial attacks

    Xiaofeng Mao, Yuefeng Chen, Shuhui Wang, Hang Su, Yuan He, and Hui Xue. Composite adversarial attacks. Association for the Advancement of Artificial Intelligence (AAAI), 2021

    2021

  17. [25]

    Gradient masking causes clever to overestimate adversarial perturbation size

    Ian Goodfellow. Gradient masking causes clever to overestimate adversarial perturbation size. arXiv preprint arXiv:1804.07870, 2018

    2018 arXiv

  18. [26]

    Improving adversarial robustness of ensembles with diversity training

    Sanjay Kariyappa and Moinuddin K Qureshi. Improving adversarial robustness of ensembles with diversity training. arXiv preprint arXiv:1901.09981, 2019

    1901 arXiv

  19. [27]

    Improving adversarial robustness via promoting ensemble diversity

    Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In International Conference on Machine Learning, pages 4970–4979. PMLR, 2019

    2019

  20. [28]

    DVERGE: diversifying vulnerabilities for enhanced robust generation of ensembles

    Huanrui Yang, Jingyang Zhang, Hongliang Dong, Nathan Inkawhich, Andrew Gardner, Andrew Touchet, Wesley Wilkes, Heath Berry, and Hai Li. DVERGE: diversifying vulnerabilities for enhanced robust generation of ensembles. arXiv preprint arXiv:2009.14720, 2020

    2009 arXiv

  21. [29]

    Efficient loss function by minimizing the detrimental effect of floating- point errors on gradient-based attacks

    Yunrui Yu and Cheng-Zhong Xu. Efficient loss function by minimizing the detrimental effect of floating- point errors on gradient-based attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4056–4066, 2023

    2023

  22. [30]

    Adversarial examples in the physical world.Technical Report, Google Inc., 2017

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world.Technical Report, Google Inc., 2017. Available at: https://arxiv.org/abs/1607.02533

    2017 arXiv

  23. [31]

    Minimally distorted adversarial examples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML, 2020

    2020

  24. [32]

    Gradient-based learning applied to document recognition

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998

    1998

  25. [33]

    Convolutional deep belief networks on cifar-10

    Alex Krizhevsky, Geoff Hinton, et al. Convolutional deep belief networks on cifar-10. Unpublished manuscript, 40(7):1–9, 2010

    2010

  26. [34]

    Robustbench: a standardized adversarial robustness benchmark

    Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670, 2020

    2010 arXiv

  27. [35]

    Guided adversarial attack for evaluating and enhancing adversarial defenses

    Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Guided adversarial attack for evaluating and enhancing adversarial defenses. Advances in Neural Information Processing Systems, 33:20297–20308, 2020

    2020

  28. [36]

    Uncovering the limits of adversarial training against norm-bounded adversarial examples

    Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020

    2010 arXiv

  29. [37]

    Mma training: Direct input space margin maximization through adversarial training

    Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. In International Conference on Learning Representations, 2020

    2020

  30. [38]

    Zico Kolter

    Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020

    2020

  31. [39]

    Data augmentation can improve robustness

    Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Andrei Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Data augmentation can improve robustness. In A. Beygelzimer, Y . Dauphin, P. Liang, and J. Wortman Vaughan, editors,Advances in Neural Information Processing Systems, 2021

    2021

  32. [40]

    Do wider neural networks really help adversarial robustness? In Thirty-Fifth Conference on Neural Information Processing Systems, 2021

    Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Do wider neural networks really help adversarial robustness? In Thirty-Fifth Conference on Neural Information Processing Systems, 2021. 11

    2021

  33. [41]

    Unlabeled data improves adversarial robustness

    Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In Advances in Neural Information Processing Systems, volume 32, pages 11192–11203, 2019

    2019

  34. [42]

    Hydra: Pruning adversarially robust neural networks

    Vikash Sehwag, Shiqi Wang, Prateek Mittal, and Suman Jana. Hydra: Pruning adversarially robust neural networks. arXiv preprint arXiv:2002.10509, 2020

    2002 arXiv

  35. [43]

    Using pre-training can improve model robustness and uncertainty

    Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In International Conference on Machine Learning, pages 2712–2721. PMLR, 2019

    2019

  36. [44]

    Zico Kolter

    Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In ICML, 2020

    2020

  37. [45]

    Self-adaptive training: beyond empirical risk minimiza- tion

    Lang Huang, Chao Zhang, and Hongyang Zhang. Self-adaptive training: beyond empirical risk minimiza- tion. In NeurIPS, 2020

    2020

  38. [46]

    Controlling neural level sets

    Matan Atzmon, Niv Haim, Lior Yariv, Ofer Israelov, Haggai Maron, and Yaron Lipman. Controlling neural level sets. In Advances in Neural Information Processing Systems, pages 2032–2041, 2019

    2019

  39. [47]

    You only propagate once: Accelerating adversarial training via maximal principle

    Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. You only propagate once: Accelerating adversarial training via maximal principle. In Advances in Neural Information Processing Systems, volume 32, pages 227–238, 2019

    2019

  40. [48]

    Improving adversarial robustness through progressive hardening

    Chawin Sitawarin, Supriyo Chakraborty, and David Wagner. Improving adversarial robustness through progressive hardening. arXiv 2003.09347, 2020

    2003 arXiv

  41. [49]

    Robustness (python library), 2019

    Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library), 2019. Available at: https://github.com/MadryLab/robustness

    2019

  42. [50]

    Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533– 3545, 2020

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533– 3545, 2020

    2020

  43. [51]

    Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses

    Jérôme Rony, Luiz G Hafemann, Luiz S Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger. Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogniti...

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.