Pith. sign in

REVIEW 6 major objections 5 minor 40 references

Prediction Inconsistency Helps Achieve Generalizable Detection of Adversarial Examples

T0 review · 6 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that adversarial examples can be reliably detected by measuring the prediction inconsistency between a protected model and a sufficiently different auxiliary model, and it proposes PID, a black-box detector that achieves…

desk verdict A simple, well-evaluated detector whose headline numbers are conditional on a non-adaptive adversary; worth reviewing but needs a more honest threat model. read the letter →

arxiv 2506.03765 v1 pith:HSVMBIWL submitted 2025-06-04 cs.CR

Sicong Han , Chenhao Lin , Zhengyu Zhao , Xiyuan Wang , Xinlei He , Qian Li , Cong Wang , Qian Wang
show 1 more author
Chao Shen
This is my paper
classification cs.CR
keywords adversarialexampledetectionpredictioninconsistencyblack-boxauxiliarymodeltrainingvisiontransformertransferabilityAUCevaluation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that adversarial examples are detectable without any internal access to the protected model: a second model that differs in architecture or training strategy will tend to give low confidence to the label the protected model predicts for an adversarial input, while both models agree on normal inputs. On that basis the authors construct Prediction Inconsistency Detector (PID), which scores each test sample by the auxiliary model's confidence in the protected model's predicted label. PID works with both naturally and adversarially trained protected models, which matters because most existing detectors degrade sharply when the protected model is adversarially trained. If true, this gives a lightweight, model-agnostic detection layer that can be dropped onto an existing classifier using only its outputs.

What carries the argument

The central object is the prediction-inconsistency score $I_{pred} = 1 - g_y(x)$, built from the hard label of the primal model and the soft confidence of the auxiliary model on that label. The load-bearing mechanism is non-transferability: an adversarial example that crosses the primal model's decision boundary tends to stay on the wrong side of a sufficiently different auxiliary model's boundary, so the auxiliary model's confidence in the primal's predicted label collapses for adversarial inputs and stays high for normal ones. The paper also tests three alternative discrepancy metrics (confidence difference, top-$n$ $\ell^1$ difference, and full-vector $\ell^1$ difference) and finds the single-label metric the most robust, especially when the primal model is adversarially trained and becomes less overconfident.

What would settle it

Generate adversarial examples with a targeted attack that optimizes against both the primal model and the ViT-L/16 auxiliary model simultaneously (as in the paper's adaptive attack, Equation 5) across all CIFAR-10 classes and check whether PID's AUC falls to the 58.13% reported for the naturally trained primal model or drops further; if a class-agnostic joint attack drives detection to chance even with an adversarially trained primal model, the transferability premise fails.

Watch

Extended reading notes

Core claim

PID detects adversarial examples by computing $I_{pred} = 1 - g_y(x)$, where $y$ is the label predicted by the primal model $f$ and $g_y(x)$ is the confidence assigned to that same label by an auxiliary model $g$ that differs from $f$ in training strategy or architecture. Normal examples receive high confidence from both models, so $I_{pred}$ stays near 0; adversarial examples crafted against $f$ typically do not transfer to $g$, so $g$ assigns low confidence to $f$'s (wrong) label and $I_{pred}$ rises. The paper reports average AUC scores of 99.29% and 99.30% on CIFAR-10 and 98.31% and 96.81% on ImageNet for naturally and adversarially trained primal models respectively, beating four baselines across three white-box, three black-box, and one mixed attack. The same inconsistency signal also works when the auxiliary model is an adversarially trained CNN or a CLIP model, with a ViT-L/16 as the default choice.

Load-bearing premise

The method assumes that adversarial examples crafted to fool the protected model will not also fool a sufficiently different auxiliary model, so the auxiliary model assigns low confidence to the protected model's predicted (wrong) label while normal examples receive high confidence from both models.

Editorial extensions

If this is right

  • PID extends to adversarially trained primal models without retraining, closing a gap where existing detectors' AUC drops below 80%.
  • Because it needs only the outputs of the protected model, PID can be deployed as a black-box layer over models whose internals are unavailable.
  • The same score works across white-box, black-box, and mixed attacks with perturbation sizes from 1/255 to 8/255, suggesting the inconsistency signal is attack-agnostic.
  • The choice of auxiliary model is flexible: adversarially trained CNNs, ViTs, and CLIP all yield average AUC above 92% on CIFAR-10, so deployment can pick whichever auxiliary is available.
  • Pairing PID with an adversarially trained primal model substantially resists the adaptive attack (AUC 87.19% vs 58.13% for natural training), indicating detection and adversarial training are complementary.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The method's reliance on non-transferability suggests it will be strongest against attacks that exploit a single model's geometry; attacks optimized for cross-architecture transferability, or ensembles of architectures, would target the Achilles' heel directly.
  • The same one-minus-auxiliary-confidence score could transfer to non-image domains (text, audio, tabular) wherever two differently trained classifiers exist, provided the transferability gap persists.
  • The paper's demonstration of the phenomenon is limited to the 'Airplane' class in Figure 2; a natural testable extension is whether the confidence gap holds uniformly across all classes and for auxiliary models that are themselves adversarially trained against the same attacks.
  • Because the auxiliary model's clean accuracy bounds the false-positive rate, selecting an auxiliary with high clean accuracy (as the paper notes for ViT-L/16) may matter more than architectural distance alone.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes Prediction Inconsistency Detector (PID), a black-box adversarial-example detector that flags a test sample by measuring the prediction inconsistency between a primal model f and an auxiliary model g, using mainly the metric I_pred = 1 - g_y(x), where y is the label predicted by f. The central observation is that adversarial examples crafted against f tend to receive low confidence from a sufficiently different auxiliary model, whereas normal examples receive high confidence from both. The authors report average AUC scores of 99.29% and 99.30% on CIFAR-10 and 98.31% and 96.81% on ImageNet for naturally and adversarially trained primal models, respectively, across white-box, black-box, and mixed attacks, with comparisons to FS, DiffPure, SID, and EPS-AD. The paper also reports an adaptive attack, in which an attacker optimizes a perturbation against both models jointly, that reduces PID's AUC to 58.13% on naturally trained CIFAR-10 and 79.28% on naturally trained ImageNet.

Significance. If the reported non-adaptive results hold, PID is an attractive detector: it is lightweight, has no fitted detector parameters, is applicable to both naturally and adversarially trained primal models, and is evaluated against a broader set of black-box attacks than many prior detection papers. The ablation studies on alternative metrics and auxiliary models are a useful addition. The main significance of the work depends, however, on the threat model: the adaptive-attack results in Section 4.3 show that the core transferability premise can be defeated by an attacker who knows the auxiliary model, and several evaluation choices (correctly-classified-only normal examples, auxiliary-model selection on the test distribution, single-run AUCs) make the reported averages optimistic. The paper is a solid empirical study of a simple and interesting signal, but its 'generalizable detection' claim needs explicit scope restrictions and a more careful evaluation protocol.

major comments (6)
  1. [§4.3, Table 4] The adaptive attack in Eq. (5) reduces PID's AUC from 98.54% to 58.13% on naturally trained CIFAR-10 and from 98.54% to 79.28% on naturally trained ImageNet. Because ViT-L/16 is a fixed, publicly available auxiliary model, this is a plausible threat model rather than an exotic one, and it directly attacks the transferability premise on which Metric 1 (Eq. (1)) relies. The abstract's 'generalizable detection' claim should therefore be restricted to non-adaptive adversaries or explicitly qualified as not covering attackers who know the auxiliary model; the statement in §4.3 that the adaptive scenario is 'idealized' does not resolve this, because a knowledgeable adversary is the standard worst-case assumption in security evaluations.
  2. [§4.1, Tables 2, 3, and 7] The evaluation protocol does not state whether AUC is computed on all attacked images or only on successful adversarial examples. Table 7 reports many low attack success rates (e.g., PGD-1/255 ASR 4.92% and VNI-FGSM ASR 3.48% on adversarially trained CIFAR-10; PGD-1/255 ASR 10.50% on adversarially trained ImageNet). If failed attacks are included among the AEs, the detector is being asked to flag any perturbed image rather than a fooling example, and the comparison with baselines may not be apples-to-apples. Please specify the inclusion criterion and, if unsuccessful perturbations are included, report the detection numbers separately for successful and unsuccessful attacks.
  3. [§3.1 and §4.2] The default auxiliary model ViT-L/16 is selected because it shows the largest prediction inconsistency in Figure 2, which is constructed from the CIFAR-10 test set, and the main evaluation in Table 2 is then performed on the same CIFAR-10 test set. This is test-set-based model selection and can inflate the reported average AUCs. The auxiliary model should be chosen on a validation split or a separate dataset, or the choice should be justified a priori from published robustness results.
  4. [§4.1, Tables 2 and 3] All AUC scores appear to come from a single evaluation run; no error bars, confidence intervals, or multiple seeds are reported. This matters because several margins over baselines are small (e.g., PID vs. DiffPure on ImageNet NAT AA-1/255 in Table 3 is 98.74% vs. 97.70%), and the headline CIFAR-10 averages 99.29% and 99.30% differ by only 0.01 percentage point. Please report means and standard deviations over at least three independent runs, or explicitly state that a single run was used and interpret differences accordingly.
  5. [§3.1, Figure 2] The motivation for the transferability premise is demonstrated only for one class ('Airplane') under one attack (PGD-8/255). Since PID is applied to all classes and seven attack types, at least an aggregate or per-class distribution of I_pred for NEs and AEs is needed to show that the phenomenon is not specific to one visual category. Figure 2 also shows that the naturally trained ResNet34 auxiliary model does not exhibit the inconsistency, so the conditions under which the premise holds deserve a more systematic characterization.
  6. [§4.1] The evaluation excludes naturally misclassified normal examples because only images correctly classified by the primal model are selected for attack and used in the normal-example pool. A detector that flags low-confidence samples will look better when the hardest normal inputs are removed from the test distribution. Please report performance on the full test set, or at least report the false-positive behavior on misclassified normal examples separately.
minor comments (5)
  1. [§3.2, Eq. (1)] The notation y = argmax_i f_i(x) defines a hard label, but f_i(x) is not explicitly defined as the i-th softmax output before Eq. (1); define the full softmax vector first.
  2. [§4.1] The sentence 'we use the whole test set of CIFAR-10, where images that can be correctly classified by primal models are selected and attacked' is ambiguous; clarify whether 'whole test set' refers to the pool before filtering.
  3. [Appendix A.5] The baselines' parameters were 'adjusted to obtain their best performance'; please state the tuning protocol (e.g., validation-based grid search) so that the comparison is reproducible and not perceived as favorable parameter selection.
  4. [Tables 2 and 3] SID* and EPS-AD* are shaded as not directly comparable, but the main text still uses them to support statements about white-box detection; consider moving the white-box variants to an appendix or separating those claims from the main comparison.
  5. [References] Reference [19] contains the typo 'Computer Cision'; it should read 'Computer Vision'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PID's prediction-inconsistency signal is empirically defined and independently benchmarked; reported AUCs are measured rather than fitted.

full rationale

The central metric, I_pred = 1 - g_y(x) (Eq. 1), is a definition of a score and not an assertion that AEs must score high; the separation between AEs and NEs is an empirical property tested against seven attack types in Tables 2 and 3. PID has no trainable parameters and its AUC values are direct measurements, not quantities derived from the detector's own construction. The choice of ViT-L/16 as the default auxiliary model is informed by the one-class, one-attack illustration in Figure 2 on CIFAR-10, which is a mild dataset-informed model-selection caveat, but it is not a circular reduction: the reported evaluation covers all classes, ten attack configurations, and two datasets, and the selection criterion does not algebraically determine those AUCs. The paper's adaptive attack (Section 4.3, Table 4) and the appended limitation (A.1) explicitly report a performance drop to 58.13% AUC on naturally trained CIFAR-10, which is a robustness and scope limitation, not evidence that the detection score reduces to its own input. No load-bearing self-citations or imported uniqueness theorems appear; references such as [10] and [8] are prior work used for metric inspiration rather than as proof of PID's effectiveness. Overall, the derivation chain is self-contained and empirically falsifiable, so no circularity is found.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical entities, forces, or conserved quantities. The detector has no trained parameters and no fitted constants in the reported metric. The main burden falls on empirical assumptions about model disagreement and transferability, plus standard deep learning assumptions about dataset alignment and attack success.

assumptions (3)
  • domain assumption AEs that fool the primal model are not reliably transferred to an auxiliary model with different architecture or training strategy, so the auxiliary model assigns low confidence to the primal's predicted label for AEs.
    Core premise of PID; empirically shown for one class in Figure 2, assumed to generalize to all classes and attacks. The adaptive attack in Section 4.3 tests this premise directly.
  • domain assumption Normal examples correctly classified by the primal model are also classified with high confidence on the same label by the auxiliary model.
    Needed for low I_pred on NEs; depends on the auxiliary model having high clean accuracy on the same data distribution. The paper uses ViT-L/16 with 98.35% CIFAR-10 accuracy to satisfy this.
  • domain assumption The auxiliary model is trained on the same dataset as the primal model, or fine-tuned on it as in the CIFAR-10 ViT-L/16.
    Ensures the label space and image distribution match. The method may not work if the auxiliary model is from a different domain, though CLIP results in the ablation suggest some flexibility.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Prediction Inconsistency Helps Achieve Generalizable Detection of Adversarial Examples." pith.science (2026). https://pith.science/paper/HSVMBIWL

@misc{pith2026250603765,
  author       = {Pith},
  title        = {Pith review of: Prediction Inconsistency Helps Achieve Generalizable Detection of Adversarial Examples},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HSVMBIWL}},
  note         = {Machine review of arXiv:2506.03765}
}
abstract

Adversarial detection protects models from adversarial attacks by refusing suspicious test samples. However, current detection methods often suffer from weak generalization: their effectiveness tends to degrade significantly when applied to adversarially trained models rather than naturally trained ones, and they generally struggle to achieve consistent effectiveness across both white-box and black-box attack settings. In this work, we observe that an auxiliary model, differing from the primary model in training strategy or model architecture, tends to assign low confidence to the primary model's predictions on adversarial examples (AEs), while preserving high confidence on normal examples (NEs). Based on this discovery, we propose Prediction Inconsistency Detector (PID), a lightweight and generalizable detection framework to distinguish AEs from NEs by capturing the prediction inconsistency between the primal and auxiliary models. PID is compatible with both naturally and adversarially trained primal models and outperforms four detection methods across 3 white-box, 3 black-box, and 1 mixed adversarial attacks. Specifically, PID achieves average AUC scores of 99.29\% and 99.30\% on CIFAR-10 when the primal model is naturally and adversarially trained, respectively, and 98.31% and 96.81% on ImageNet under the same conditions, outperforming existing SOTAs by 4.70%$\sim$25.46%.

Figures

Figures reproduced from arXiv: 2506.03765 by the authors.

Figure 1
Figure 1. Adversarial examples against one (pri￾mal) model may not be adversarial against another (auxiliary) model. Such prediction inconsistency can be used to detect adversarial examples. To mitigate the existing limitations, this paper proposes a black-box detection method exploit￾ing the prediction inconsistency of models on AEs. We observe a clear discrepancy in pre￾diction results from the primary and auxiliary models … view at source ↗
Figure 2
Figure 2. Confidence score distribution for “Airplane” label across primal and auxiliary models on (a) NEs classified by the naturally trained VGG19, (b) AEs classified by the naturally trained VGG19, (c) NEs classified by the adversarially trained VGG19, (d) AEs classified by the adversarially trained VGG19, respectively. 3 Method 3.1 Motivation It is pointed out in [10] that, AEs are sensitive to the fluctuation of the high… view at source ↗
Figure 3
Figure 3. Overview of the proposed Prediction Inconsistency Detector (PID) for detecting AEs. The test sample are fed into primal and auxiliary models, respectively, to obtain the prediction in￾consistency Ipred by using the designed metrics. If Ipred exceeds a threshold value, the test sample is judged to be adversarial. Metrics for Quantifying Prediction Inconsis￾tency. The process of PID is illustrated in [PITH_FULL_IMAGE… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

40 extracted references · 27 canonical work pages

  1. [1]

    Explaining and harnessing adver- sarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. InProceedings of the International Conference on Learning Representations, 2015

    work page 2015

  2. [2]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. IEEE, 2017

    work page 2017

  3. [3]

    Understanding adversarial attacks on deep learning based medical image analysis systems

    Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 110:107332, 2021

    work page 2021

  4. [4]

    Bakary Badjie, José Cecílio, and Antonio Casimiro. Adversarial attacks and countermeasures on image classification-based deep learning models in autonomous driving systems: A systematic review.ACM Computing Surveys, 57(1):1–52, 2024

    work page 2024

  5. [5]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. InProceedings of the International Conference on Learning Representations, 2018

    2018

  6. [6]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. InInternational Conference on Learning Representations, 2020

    work page 2020

  7. [7]

    A comprehensive study on robustness of image classification models: Benchmarking and rethinking.International Journal of Computer Vision, pages 1–23, 2024

    Chang Liu, Yinpeng Dong, Wenzhao Xiang, Xiao Yang, Hang Su, Jun Zhu, Yuefeng Chen, Yuan He, Hui Xue, and Shibao Zheng. A comprehensive study on robustness of image classification models: Benchmarking and rethinking.International Journal of Computer Vision, pages 1–23, 2024

    work page 2024

  8. [8]

    Feature squeezing: Detecting adversarial examples in deep neural networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. InProceedings of the 25th Network and Distributed System Security Symposium (NDSS), 2018

    work page 2018

Show all 40 references
  1. [9]

    Detecting adversarial data by probing multiple perturbations using expected perturbation score

    Shuhai Zhang, Feng Liu, Jiahao Yang, Yifan Yang, Changsheng Li, Bo Han, and Mingkui Tan. Detecting adversarial data by probing multiple perturbations using expected perturbation score. InInternational Conference on Machine Learning, pages 41429–41451. PMLR, 2023

    2023

  2. [10]

    Detecting adversarial examples from sensitivity inconsistency of spatial-transform domain

    Jinyu Tian, Jiantao Zhou, Yuanman Li, and Jia Duan. Detecting adversarial examples from sensitivity inconsistency of spatial-transform domain. InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 9877–9885, 2021

    2021

  3. [11]

    Characterizing adversarial subspaces using local intrinsic dimensionality

    Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. InInternational Conference on Learning Representations, 2018

    2018

  4. [12]

    Detecting adversarial faces using only real face self-perturbations

    Qian Wang, Yongqin Xian, Hefei Ling, Jinyuan Zhang, Xiaorui Lin, Ping Li, Jiazhong Chen, and Ning Yu. Detecting adversarial faces using only real face self-perturbations. InProceedings of the Thirty-Second International Joint Conference on Artificial Intelligence, pages 1488–1...

    2023

  5. [13]

    Detecting adversarial examples through image transformation

    Shixin Tian, Guolei Yang, and Ying Cai. Detecting adversarial examples through image transformation. InProceedings of the AAAI conference on artificial intelligence, volume 32, 2018. 10

    2018

  6. [14]

    Adver- sarial example detection for dnn models: A review and experimental comparison.Artificial Intelligence Review, pages 1–60, 2022

    Ahmed Aldahdooh, Wassim Hamidouche, Sid Ahmed Fezza, and Olivier Déforges. Adver- sarial example detection for dnn models: A review and experimental comparison.Artificial Intelligence Review, pages 1–60, 2022

    2022

  7. [15]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. InInternational Conference on Machine Learning, pages 2206–2216. PMLR, 2020

    2020

  8. [16]

    Minimally distorted adversarial examples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. InInternational Conference on Machine Learning, pages 2196–2205. PMLR, 2020

    2020

  9. [17]

    Square at- tack: a query-efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: a query-efficient black-box adversarial attack via random search. InEuropean Conference on Computer Vision, pages 484–501. Springer, 2020

    2020

  10. [18]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. InInterna- tional Conference on Learning Representations, 2015

    2015

  11. [19]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. InProceedings of the IEEE Conference on Computer Cision and Pattern Recognition, pages 2574–2582, 2016

    2016

  12. [20]

    Triangle attack: A query-efficient decision-based adversarial attack

    Xiaosen Wang, Zeliang Zhang, Kangheng Tong, Dihong Gong, Kun He, Zhifeng Li, and Wei Liu. Triangle attack: A query-efficient decision-based adversarial attack. InEuropean Conference on Computer Vision, pages 156–174. Springer, 2022

    2022

  13. [21]

    Enhancing the transferability of adversarial attacks through variance tuning

    Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1924–1933, 2021

    1924

  14. [22]

    Nesterov accelerated gradient and scale invariance for adversarial attacks

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. InInternational Conference on Learning Representations, 2019

    2019

  15. [23]

    Score-based generative modeling through stochastic differential equations

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021

    2021

  16. [24]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. InInternational Conf...

    2021

  17. [25]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational conference on machine learning, pag...

    2021

  18. [26]

    Improving fast adversarial training with prior-guided knowledge.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    Xiaojun Jia, Yong Zhang, Xingxing Wei, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Improving fast adversarial training with prior-guided knowledge.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    2024

  19. [27]

    On the robustness of vision trans- formers to adversarial examples

    Kaleel Mahmood, Rigel Mahmood, and Marten Van Dijk. On the robustness of vision trans- formers to adversarial examples. InProceedings of the IEEE/CVF international conference on computer vision, pages 7838–7847, 2021

    2021

  20. [28]

    Foundation models defining a new era in vision: a survey and outlook.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    Muhammad Awais, Muzammal Naseer, Salman Khan, Rao Muhammad Anwer, Hisham Cholakkal, Mubarak Shah, Ming-Hsuan Yang, and Fahad Shahbaz Khan. Foundation models defining a new era in vision: a survey and outlook.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  21. [29]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 11

    2009

  22. [30]

    Imagenet: A large- scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255. Ieee, 2009

    2009

  23. [31]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. InInternational Conference on Learning Representations, 2015

    2015

  24. [32]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  25. [33]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anand- kumar. Diffusion models for adversarial purification. InInternational Conference on Machine Learning, pages 16805–16827. PMLR, 2022

    2022

  26. [34]

    Denoising diffusion probabilistic models.Advances in Neural Information Processing Systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models.Advances in Neural Information Processing Systems, 33:6840–6851, 2020

    2020

  27. [35]

    Robust models are less over-confident.Advances in Neural Information Processing Systems, 35:39059–39075, 2022

    Julia Grabinski, Paul Gavrikov, Janis Keuper, and Margret Keuper. Robust models are less over-confident.Advances in Neural Information Processing Systems, 35:39059–39075, 2022

    2022

  28. [36]

    Evad- ing adversarial example detection defenses with orthogonal projected gradient descent

    Oliver Bryniarski, Nabeel Hingun, Pedro Pachuca, Vincent Wang, and Nicholas Carlini. Evad- ing adversarial example detection defenses with orthogonal projected gradient descent. In International Conference on Learning Representations, 2021

    2021

  29. [37]

    A convnet for the 2020s

    Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11976–11986, 2022

    2022

  30. [38]

    Torchattacks: A pytorch repository for adversarial attacks.arXiv preprint arXiv:2010.01950, 2020

    Hoki Kim. Torchattacks: A pytorch repository for adversarial attacks.arXiv preprint arXiv:2010.01950, 2020

    2010 arXiv

  31. [39]

    Benchmarking adversarial robustness on image classification

    Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. Benchmarking adversarial robustness on image classification. Inproceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 321–331, 2020

    2020

  32. [40]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems, 34:8780–8794, 2021. 12 A Appendix A.1 Limitations We observe a prediction inconsistency between primal and auxiliary models on AEs, which i...

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.