Pith. sign in

REVIEW 3 minor 723 cited by

Explaining and Harnessing Adversarial Examples

T0 review · 0 major / 3 minor · reviewed 2026-05-11 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Neural networks are vulnerable to adversarial examples mainly because they behave linearly in their inputs.

desk verdict This paper explains adversarial examples as a consequence of linearity in neural nets and introduces the fast gradient sign method to generate them, with MNIST results showing both the attack and a simple defense. read the letter →

arxiv 1412.6572 v3 pith:I6F6HXEC submitted 2014-12-20 stat.ML cs.LG

Ian J. Goodfellow , Jonathon Shlens , Christian Szegedy This is my paper · ORCID
classification stat.MLcs.LG
keywords adversarialexamplesneuralnetworkstraininglinearbehaviorgradientsignmethodMNIST
checked against Cost.FunctionalEquationFoundation.DAlembert.Inevitability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the main reason neural networks can be fooled by tiny, carefully chosen changes to inputs is their linear response to those inputs rather than any deep nonlinearity or overfitting. This linear view accounts for why the same perturbed examples often fool many different networks and training regimes. It also supplies a fast way to create such examples by following the sign of the input gradient. When those examples are fed back into training, the network's error rate on clean test data drops.

What carries the argument

A first-order linear approximation of the network's output with respect to the input, used to select the direction of perturbation that most increases the loss.

What would settle it

A neural network whose output is demonstrably highly nonlinear for small perturbations yet still produces adversarial examples at rates matching current models, or a linear model that resists them.

Watch

Extended reading notes

Core claim

The primary cause of neural networks' vulnerability to adversarial perturbation is their linear nature. This linearity explains why adversarial examples generalize across architectures and training sets, and it directly yields a simple, fast method of generating adversarial examples via a first-order approximation that can be used for adversarial training to lower test-set error.

Load-bearing premise

The network's output changes sufficiently linearly with small input changes that a first-order approximation accurately predicts the effect of a perturbation.

Editorial extensions

If this is right

  • Adversarial examples generated this way transfer across different network architectures and training sets.
  • Including the generated examples in training reduces test error on the original clean dataset.
  • The same linear approximation explains why the perturbations remain effective even when the network is retrained on different data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If linearity is the root cause, then techniques that enforce stronger local linearity constraints could reduce vulnerability without changing the overall architecture.
  • The approach may extend to other models that exhibit locally linear decision boundaries, such as certain kernel methods or decision trees with linear splits.
  • Defensive training using these examples could be combined with architectural changes that increase curvature to test whether the two strategies are additive.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 3 minor

Summary. The paper claims that the vulnerability of neural networks to adversarial examples is primarily due to their linear nature in the input space rather than nonlinearity or overfitting. It supports this via a first-order Taylor approximation motivating the fast gradient sign method for efficient adversarial example generation, shows that such examples transfer across architectures and training sets, and demonstrates that adversarial training reduces test-set error for maxout networks on MNIST.

Significance. If the linearity hypothesis holds in the small-perturbation regime, the work supplies a parsimonious account of cross-model generalization of adversarial examples and yields a computationally cheap attack method plus a practical robustness technique. The MNIST quantitative results are consistent with the claims and the approach has proven influential for subsequent robustness research.

minor comments (3)
  1. [Introduction] Introduction: the reference to 'early attempts' focused on nonlinearity and overfitting would be strengthened by naming the specific prior works being critiqued.
  2. [Fast gradient sign method] Derivation of the fast gradient sign method: a short remark on the range of perturbation magnitudes for which the first-order approximation remains accurate would improve clarity without altering the central argument.
  3. [Experiments] Experiments section: figure captions should explicitly list the value of epsilon used in each panel to facilitate exact reproduction of the reported error rates.

Simulated Author's Rebuttal

0 responses · 0 unresolved

We thank the referee for the positive assessment of the manuscript, the recognition of its significance in providing a parsimonious explanation for the cross-model generalization of adversarial examples, and the recommendation to accept.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity in the derivation chain

full rationale

The paper's core argument derives the fast gradient sign method from the first-order Taylor approximation of the network output (f(x + ε) ≈ f(x) + ε · ∇_x f(x)), which is an explicit linearization assumption stated upfront rather than fitted or self-defined. This yields the sign(∇_x J) perturbation without reducing to any input parameter by construction. The claim that linearity is the primary cause is then supported by independent experimental outcomes on MNIST maxout networks (attack success, cross-architecture transfer, and adversarial training gains), none of which loop back to redefine the approximation or rely on self-citations for uniqueness. No enumerated circularity pattern applies; the derivation remains self-contained against external benchmarks.

Assumptions & free parameters 1 free parameters · 1 assumptions · 0 invented entities

The central claim rests on the assumption that neural networks behave linearly for small perturbations; epsilon is a free parameter controlling perturbation magnitude.

free parameters (1)
  • epsilon
    Perturbation magnitude chosen to control attack strength while keeping changes small.
assumptions (1)
  • domain assumption Neural network decision functions are approximately linear in input space near data points.
    Invoked to justify the first-order Taylor expansion used to derive the adversarial perturbation direction.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Explaining and Harnessing Adversarial Examples." pith.science (2026). https://pith.science/paper/I6F6HXEC

@misc{pith202614126572,
  author       = {Pith},
  title        = {Pith review of: Explaining and Harnessing Adversarial Examples},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I6F6HXEC}},
  note         = {Machine review of arXiv:1412.6572}
}
read the original abstract

Several machine learning models, including neural networks, consistently misclassify adversarial examples---inputs formed by applying small but intentionally worst-case perturbations to examples from the dataset, such that the perturbed input results in the model outputting an incorrect answer with high confidence. Early attempts at explaining this phenomenon focused on nonlinearity and overfitting. We argue instead that the primary cause of neural networks' vulnerability to adversarial perturbation is their linear nature. This explanation is supported by new quantitative results while giving the first explanation of the most intriguing fact about them: their generalization across architectures and training sets. Moreover, this view yields a simple and fast method of generating adversarial examples. Using this approach to provide examples for adversarial training, we reduce the test set error of a maxout network on the MNIST dataset.

Discussion (0). Continue with ORCID to comment.

Forward citations

Showing 60 of 723 Pith papers that cite this

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. OpenAlex reports about 8,153 citations worldwide. See all 723 Pith citations

  1. Bagging Robustly Learns VC Classes with Linear Sample Complexity

    stat.ML 2026-08 conditional novelty 8.0 of 10

    Bagging robust ERMs achieves robust risk O(d/n) for VC classes with VC dimension d, and Ω(d*) RERM calls are necessary where d* is the dual VC dimension.

  2. Adversarially Robust Approximate Furthest Neighbor

    cs.DS 2026-05 unverdicted novelty 8.0 of 10

    First adversarially robust data structure for c-approximate furthest neighbor search with query time matching the best known oblivious results for many parameter regimes.

  3. REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinations

    cs.CL 2026-05 unverdicted novelty 8.0 of 10

    REALISTA optimizes continuous combinations of valid editing directions in latent space to produce realistic adversarial prompts that elicit hallucinations more effectively than prior methods, including on large reason...

  4. Online Learning-to-Defer with Varying Experts

    stat.ML 2026-05 unverdicted novelty 8.0 of 10

    Presents the first online learning-to-defer algorithm with regret bounds O((n + n_e) T^{2/3}) generally and O((n + n_e) sqrt(T)) under low noise for multiclass classification with varying experts.

  5. On the Generation and Mitigation of Harmful Geometry in Image-to-3D Models

    cs.CR 2026-05 conditional novelty 8.0 of 10

    Image-to-3D models successfully generate harmful geometries in most cases with under 0.3% caught by commercial filters; existing safeguards are weak but a stacked defense cuts harmful outputs to under 1% at 11% false-...

  6. Local LMO: Constrained Gradient Optimization via a Local Linear Minimization Oracle

    math.OC 2026-05 unverdicted novelty 8.0 of 10

    Local LMO is a new projection-free method that achieves the convergence rates of projected gradient descent for constrained optimization by using local linear minimization oracles over small balls.

  7. Uncovering and Understanding FPR Manipulation Attack in Industrial IoT Networks

    cs.CR 2026-01 unverdicted novelty 8.0 of 10

    FPR manipulation attack perturbs benign MQTT packets to flip labels to attacks in NIDS with 80-100% success, increasing SOC delays without gradient-based methods.

  8. GPUHammer: Rowhammer Attacks on GPU Memories are Practical

    cs.CR 2025-07 conditional novelty 8.0 of 10

    First successful Rowhammer attack on discrete GPU GDDR6 memory (NVIDIA A6000), with 8 bit-flips and a single-bit-flip ML accuracy degradation from 80% to below 1%.

  9. Property-Preserving Hashing for $\ell_1$-Distance Predicates: Applications to Countering Adversarial Input Attacks

    cs.CR 2025-04 unverdicted novelty 8.0 of 10

    Introduces first PPH for ℓ1-distance predicate with O(t²) runtime to force significant noise in adversarial image attacks.

  10. Breaking the Quadratic Barrier: Robust Cardinality Sketches for Adaptive Queries

    cs.DS 2025-02 conditional novelty 8.0 of 10

    A fine-grained per-key analysis lets bottom-k cardinality sketches answer many adaptive queries when each key appears in few of them, shifting the quadratic barrier from total query count to per-key participation.

  11. Robust Representation Consistency Model via Contrastive Denoising

    cs.CV 2025-01 accept novelty 8.0 of 10

    rRCM, a contrastive denoising pre-training and fine-tuning scheme, gives a single-pass robust classifier that beats diffusion-based defenses on ImageNet and CIFAR-10 while reducing inference cost by up to 85x.

  12. Universal and Transferable Adversarial Attacks on Aligned Language Models

    cs.CL 2023-07 accept novelty 8.0 of 10

    Gradient and greedy search over token suffixes produces universal, transferable adversarial prompts that elicit objectionable outputs from aligned models including black-box commercial systems.

  13. Testing Robustness Against Unforeseen Adversaries

    cs.LG 2019-08 conditional novelty 8.0 of 10

    ImageNet-UA, a six-attack benchmark with four new attacks, shows L-infinity robustness does not transfer to unforeseen distortions and that L2 training and AugMix generalize better.

  14. Dataset Distillation

    cs.LG 2018-11 unverdicted novelty 8.0 of 10

    Dataset distillation creates a tiny synthetic training set that, when used with a fixed network initialization, produces models whose performance approximates that of models trained on the full original dataset.

  15. Safe Start: Configuring Optimization Algorithms for Decision-Making under Extreme Risks

    math.OC 2026-08 conditional novelty 7.0 of 10

    Safe-start initialization, combined with efficient gradient estimators, guarantees sub-exponential sample complexity for SGD in rare-event optimization; without it, exponential complexity can be unavoidable.

  16. ConformalShift: Targeted Event Reordering Against Adaptive ECG Monitoring

    cs.LG 2026-08 conditional novelty 7.0 of 10

    Bounded reordering of authentic preceding ECG events can suppress ventricular-class recovery in adaptive conformal monitors, at rates far above random schedules.

  17. VETO: Towards Protecting Images From Frontier AI Editing

    cs.CV 2026-07 conditional novelty 7.0 of 10

    VETO's attention-entropy cloak cuts FLUX.2 human-judged edit success to as low as 1.33%, and VetoBench adds 300 open/closed-frame examples for evaluating such protections.

  18. When cheap gradients fail: the measurement cost of attacking quantum classifiers

    quant-ph 2026-07 conditional novelty 7.0 of 10

    Unbiased gradient extraction for attacking quantum classifiers costs at least Θ(d^{5/2}) shots under norm-concentration scaling, and ~d³ for tested deep circuits, so the attacker's relative cost diverges versus classi...

  19. Tubular Neighbourhoods of Pfaffian Sets and Applications to Neural Networks

    math.AG 2026-07 conditional novelty 7.0 of 10

    Tube-volume bounds for smooth Pfaffian hypersurfaces yield condition-number tails for Pfaffian neural classifiers, with polynomial-in-width control for single-layer rational-weight sigmoids.

  20. AirflowAttack: Thermal-Airflow Adversarial Perturbations against Infrared Remote-Sensing Vision-Language Models

    cs.CV 2026-07 conditional novelty 7.0 of 10

    A single input-agnostic thermal-airflow perturbation, optimized on one surrogate CLIP model, transfers to five CLIP backbones and six VLMs, degrading scene classification by up to 38.2%.

  21. Gradient-Based Inverse Design of Free-Energy Landscapes with Diffusion Models

    physics.comp-ph 2026-07 conditional novelty 7.0 of 10

    GB-FESO backpropagates a KL-divergence loss through a frozen conditional diffusion model's sampling trajectory to optimize system parameters so the generated ensemble matches a target free-energy surface.

  22. Vision Token Manipulation Attacks on Cloud-Edge Inference of Large Vision-Language Models

    cs.CR 2026-07 conditional novelty 7.0 of 10

    Black-box man-in-the-middle attacks that alter just 10% of transmitted vision tokens reduce LVLM accuracy by up to 88.31% across six models and four benchmarks.

  23. Detecting Adversarial Evasion Attacks Against Autoencoder-Based Network Intrusion Detection Systems

    cs.CR 2026-07 unverdicted novelty 7.0 of 10

    Two detectors achieve near-perfect accuracy detecting PANDA-style adversarial attacks on autoencoder NIDS using image-space error localization and packet-feature consistency checks on IoT traffic.

  24. A Classifier-Agnostic Zero-Shot Adversarial Attack Detection via CLIP

    cs.CV 2026-06 unverdicted novelty 7.0 of 10

    A^4D is a classifier- and attack-agnostic zero-shot adversarial attack detector based on CLIP embedding shifts that claims SOTA performance.

  25. Can Machines Really See Objects in Images? A Study Based on Syntactic Distance and Visual Self-Referential Instances

    cs.CV 2026-06 unverdicted novelty 7.0 of 10

    Vision models show a phase transition where accuracy on a zero syntactic-distance global-semantics task collapses to chance beyond a critical scale and does not recover with larger models or data.

  26. The Riddle Riddle: Testing Flexible Reasoning in Large Language Models and Humans

    cs.CL 2026-06 conditional novelty 7.0 of 10

    LLMs score 84.9% on genuine riddles but 50.7% on riddle riddles requiring literal answers, opposite to humans (50.5% vs 80.5%), indicating memory retrieval over flexible strategy selection.

  27. MIRAGE: Protecting against Malicious Image Editing via False Moderation

    cs.CR 2026-06 unverdicted novelty 7.0 of 10

    MIRAGE immunizes images by crafting perturbations that align them with policy-violating concepts in open-source moderation models, triggering refusals in closed-source commercial image editors at over 88% success rate.

  28. Accelerated and Stable Convergence with Anchored Generalized Optimistic Method

    math.OC 2026-06 unverdicted novelty 7.0 of 10

    GOMA achieves optimal last-iterate O(1/k²) convergence in deterministic monotone Lipschitz VIs and O(1/√k) in stochastic unbounded-variance settings without variance reduction.

  29. Improving Adversarial Transferability on Vision-Language Pre-training Models via Surrogate-Specific Bias Correction

    cs.CV 2026-06 unverdicted novelty 7.0 of 10

    DeBias-Attack corrects surrogate-specific bias in adversarial gradients for VLP models by subtracting the projection from a reference branch optimized on weak-semantic images.

  30. Adversarial Robustness of Activation Steering in Large Language Models

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    First systematic test shows activation steering robustness drops sharply (up to 64%) under adversarial input perturbations across multiple extraction methods, models, and personas.

  31. Anti-Hyperspectral Anomaly Detection: A First Study on Stealthy Lipschitz-Forcing Perturbations Against Unknown Detectors

    eess.IV 2026-06 unverdicted novelty 7.0 of 10

    Develops the first AHAD method using ARAB regularization and Lipschitz-forcing perturbations to produce one energy-efficient signal that evades multiple unknown benchmark HAD detectors.

  32. RogueMerge: Robust and Unified Attacks against LLM Model Merging

    cs.CR 2026-06 unverdicted novelty 7.0 of 10

    RogueMerge is a unified attack method that jointly optimizes task vectors to succeed after merging, using stochastic min-max simulation for unknown merging settings and a Taylor-approximated DRO for prompt generalizat...

  33. RepoMirage: Probing Repository Context Reasoning in Code Agents with Perturbations

    cs.SE 2026-05 unverdicted novelty 7.0 of 10

    RepoMirage uses semantics-preserving perturbations on SWE-Bench to show code agents lack repository context reasoning, with performance falling sharply on extended structure tasks, and introduces RepoAnchor as a struc...

  34. When Interpretability Becomes a Liability: Adversarial Attacks on CBM Concept Layers

    cs.LG 2026-05 unverdicted novelty 7.0 of 10

    Concept-level adversarial attacks exploit CBM interpretability on the CUB dataset, but SPECTRA raises required perturbation norm from 0.46 to over 4200 while keeping accuracy loss under 2.2%.

  35. Understanding Dynamics of Adam in Zero-Sum Games: An ODE Approach

    cs.LG 2026-05 unverdicted novelty 7.0 of 10

    Derives ODE limits of Adam-DA showing that first- and second-order momentum parameters reverse their convergence roles in zero-sum games compared to minimization, validated on GAN experiments.

  36. Interaction-Breaking Adversarial Learning Framework for Robust Multi-Agent Reinforcement Learning

    cs.LG 2026-05 unverdicted novelty 7.0 of 10

    The IBAL framework builds information-theoretic attacks that break agent interactions in MARL and trains policies to stay robust under observation and action perturbations.

  37. Escaping the Linearity Trap: Manifold Detours for Black-Box Adversarial Attacks on Singing Audio Deepfake Detection

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    MARS is a transfer-based black-box attack that uses bi-level optimization on semantic and artifact anchors to escape the linearity trap and improve attack success rates on SSL-SVDD by up to 36%.

  38. AIM: Adversarial Information Masking for Faithfulness Evaluation of Saliency Maps

    cs.LG 2026-05 unverdicted novelty 7.0 of 10

    AIM is a new saliency-guided adversarial feature replacement method to evaluate faithfulness of saliency maps and reliability of masking operators on image, audio, and EEG tasks.

  39. $\alpha$-TCAV: A Unified Framework for Testing with Concept Activation Vectors

    stat.ML 2026-05 unverdicted novelty 7.0 of 10

    α-TCAV replaces TCAV's hard indicator with a tunable smooth function to create a unified probabilistic framework with lower variance and guidance for parameter choice or Bayes-optimal scoring.

  40. Quantitative Linear Logic for Neuro-Symbolic Learning and Verification

    cs.LO 2026-05 unverdicted novelty 7.0 of 10

    Quantitative Linear Logic interprets logical connectives via natural ML operations on logits to embed constraints in neural training while satisfying most linear logic laws and correlating performance with independent...

  41. A neurosymbolic Approach with Epistemic Deep Learning for Hierarchical Image Classification

    cs.CV 2026-05 unverdicted novelty 7.0 of 10

    A neurosymbolic model augments Swin Transformers with focal sets and fuzzy logic to produce calibrated hierarchical image classifications that respect logical constraints.

  42. TARO: Temporal Adversarial Rectification Optimization Using Diffusion Models as Purifiers

    cs.LG 2026-05 unverdicted novelty 7.0 of 10

    TARO builds a temporally guided score prior from high-noise and low-noise diffusion views to purify adversarial examples more robustly than uniform timestep methods.

  43. Revealing Physical-World Semantic Vulnerabilities: Universal Adversarial Patch for Infrared Vision-Language Models

    cs.CV 2026-04 unverdicted novelty 7.0 of 10

    UCGP is a universal physical adversarial patch that compromises cross-modal semantic alignment in IR-VLMs through curved-grid parameterization and representation-space disruption.

  44. Hidden Reliability Risks in Large Language Models: Systematic Identification of Precision-Induced Output Disagreements

    cs.AI 2026-04 unverdicted novelty 7.0 of 10

    PrecisionDiff is a differential testing framework that uncovers widespread precision-induced behavioral disagreements in aligned LLMs, including safety-critical jailbreak divergences across precision formats.

  45. TorchLean: Formalizing Neural Networks in Lean

    cs.MS 2026-02 conditional novelty 7.0 of 10

    A Lean 4 framework gives neural networks one machine-checked semantics shared by training, autodiff, and CROWN-style verification, demonstrated on small robustness, PINN, and controller cases.

  46. A Speculative GLRT-Backed Approach for Robust Deep Learning-Based Array Processing

    eess.SP 2025-12 unverdicted novelty 7.0 of 10

    A speculative DL classifier validated by GLRT on spatially robust second-order statistics provides adversarially resilient array processing.

  47. Adversarial Robustness in One-Stage Learning-to-Defer

    stat.ML 2025-10 unverdicted novelty 7.0 of 10

    New adversarial surrogate losses and claimed consistency guarantees for one-stage learning-to-defer in classification and regression, with experiments suggesting improved robustness.

  48. On Surjectivity of Neural Networks: Can you elicit any behavior from your model?

    cs.LG 2025-08 conditional novelty 7.0 of 10

    Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.

  49. Finding DoRI: Discovery of Retained Images in Diffusion Models

    cs.CV 2025-07 conditional novelty 7.0 of 10

    Adversarially optimized text embeddings re-trigger supposedly removed memorized images in pruned diffusion models, showing memorization is distributed rather than local.

  50. SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examples

    cs.CV 2025-07 conditional novelty 7.0 of 10

    SCOOTER supplies best-practice guidelines, open tools, and a 3K-image benchmark with 34K+ human ratings showing that six tested unrestricted attacks produce images humans can detect as fake.

  51. 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation

    cs.CV 2025-07 conditional novelty 7.0 of 10

    PGA uses 3D Gaussian Splatting to generate physical adversarial camouflage from a few images, improving multi-view attack robustness on vehicle detectors.

  52. Evaluating Robustness of Monocular Depth Estimation with Procedural Scene Perturbations

    cs.CV 2025-07 conditional novelty 7.0 of 10

    A procedural-generation benchmark (PDE) shows that depth models are surprisingly vulnerable to camera changes and occlusion, while resisting lighting changes.

  53. GViT: Representing Images as Gaussians for Visual Recognition

    cs.CV 2025-06 conditional novelty 7.0 of 10

    Images encoded as a few hundred learnable 2D Gaussians, steered by classifier gradients, support a ViT that reaches 76.9% top-1 on ImageNet-1k, close to patch-based ViTs.

  54. Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on $\mathbb{so}(d)$

    cs.LG 2025-06 conditional novelty 7.0 of 10

    Using isoperimetric inequalities on SO(d), this paper proves that random convolutional networks with odd activations or ReLU have sign-flipping adversarial examples at distance O(||x0||/sqrt(d)).

  55. Interior-Point Vanishing Problem in Semidefinite Relaxations for Neural Network Verification

    cs.LG 2025-06 conditional novelty 7.0 of 10

    Semidefinite relaxation for deep ReLU verification suffers from 'interior-point vanishing' as depth increases, and removing layer-wise bound constraints mitigates it.

  56. Tarallo: Evading Behavioral Malware Detectors in the Problem Space

    cs.CR 2025-06 conditional novelty 7.0 of 10

    Tarallo evades RNN-based behavioral malware detectors by injecting API calls selected with a new position-sensitive gradient attack, reaching up to 99% evasion in feature and problem space tests.

  57. Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometry

    cs.LG 2025-05 conditional novelty 7.0 of 10

    Diffusion models improve adversarial robustness mainly by compressing the input space, while the large gains reported earlier mostly come from evaluation randomness.

  58. Experimental robustness benchmarking of quantum neural networks on a superconducting quantum processor

    quant-ph 2025-05 conditional novelty 7.0 of 10

    Experimental runs on a superconducting quantum processor demonstrate that 20-qubit quantum neural networks are more resistant to adversarial attacks than classical networks, with adversarial training further improving...

  59. TRAIL: Transferable Robust Adversarial Images via Latent diffusion

    cs.CV 2025-05 conditional novelty 7.0 of 10

    TRAIL adapts a latent diffusion model to a target image during the attack, then uses the adapted model to generate transferable adversarial images with minimal visual change.

  60. Robust learning of halfspaces under log-concave marginals

    cs.DS 2025-05 accept novelty 7.0 of 10

    An efficient agnostic learner for halfspaces over subgaussian isotropic log-concave distributions returns a classifier with error opt+O(ε) and boundary volume O(r+ε) in time d^{~O(1/ε^2)}.

See all 723 Pith citations

Pith tools

Reviewed May 11, 2026 · model on record in the stance chip above.