Investigating Decision Boundaries of Trained Neural Networks

Dianne P O'Leary; Roozbeh Yousefzadeh

REVIEW 3 major objections 5 minor 23 references

Investigating Decision Boundaries of Trained Neural Networks

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read For a trained neural network with nonlinear activations, exact points on decision boundaries can be computed by solving a nonconvex optimization problem, and these flip points show that Taylor-based distances and loss-based adversarial…

desk verdict Useful empirical check on boundary-distance approximations, but the 'exact/closest' claims outrun what the nonconvex numerics can certify. read the letter →

arxiv 1908.02802 v1 pith:ISLKM426 submitted 2019-08-07 cs.LG stat.ML

Roozbeh Yousefzadeh , Dianne P O'Leary This is my paper · ORCID

classification cs.LGstat.ML MSC 68T0790C26

keywords decisionboundariesflippointsadversarialexamplesnonconvexoptimizationneuralnetworkinterpretabilityLipschitzcontinuityTaylorapproximationrobustness

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that exact points on the decision boundaries of trained neural networks, called flip points, can be computed by solving a nonconvex optimization problem, even though earlier work treated this as intractable. It demonstrates on a 12-layer network trained on ship and plane images that these flip points give distances and directions to the decision boundary that are far more reliable than first-order Taylor approximations, which can underestimate distance by large factors. It also shows that common adversarial-example searches that minimize loss under a distance constraint can miss the closest adversarial change or become infeasible, whereas the closest flip point directly reveals the model's weakest vulnerability. The broader point is that interpretation, generalization, and robustness studies should verify their simplifying assumptions about decision boundaries rather than rely on linear or derivative-based approximations.

What carries the argument

The central object is the flip point: a point on the decision boundary where the model's top-two softmax outputs are equal. The carrying machinery is the optimization problem $\min_z \|z-x\|_2$ subject to $f_i(z)=f_j(z)$ and $f_i(z)\ge f_k(z)$ for all other classes, where $f$ is the softmax output vector and $x$ is the original input. A good starting point for the optimization is the data point itself, and the authors cross-check solutions with several nonlinear optimization algorithms. A second piece of machinery is Lipschitz continuity of the network output, which tells them how finely to discretize straight paths between images so that boundary crossings and the shape of decision regions can be observed reliably.

What would settle it

Take a small trained network whose decision boundary can be computed analytically, or enumerate all boundary points on a fine grid in a low-dimensional input space, then run the paper's optimization routine and check whether it returns the true closest boundary point. If it returns a flip point that is farther than a grid-found boundary point, then the reported distances, directions, and vulnerability claims are not guaranteed for that case.

Watch

Extended reading notes

Core claim

The paper's central claim is that for a trained network with nonlinear activations, one can compute exact points on its decision boundaries by minimizing the distance from a given input to a boundary point subject to the conditions that the softmax outputs of the two competing classes are equal and no other class has a higher output. Applied to a 12-layer feedforward network using erf activations and 200 wavelet coefficients, the resulting flip points yield actual boundary distances and directions. These exact quantities reveal that first-order Taylor distance estimates systematically underestimate the true distance, sometimes by a factor of 20 or more, and that the Taylor direction can point far from the closest boundary point. The closest flip point also provides a more direct measure of adversarial vulnerability than minimizing an adversarial loss under a fixed distance constraint, which may find a point much farther away or have no feasible solution. The authors explicitly note in Section 2 that their optimization problem is nonconvex and that they cannot guarantee finding the global minimizer, although consistency across several solvers and the fact that their points are closer than Taylor estimates support the computed results.

Load-bearing premise

The whole study rests on the assumption that the optimization solver truly finds the closest flip point, and the authors state in Section 2 that they cannot prove this because the problem is nonconvex.

Editorial extensions

If this is right

Distance-to-boundary estimates based on first-order Taylor expansions can be checked against flip points; in the authors' tests they understate the true distance by factors from about 2 to more than 20.
Adversarial-example searches that minimize loss under a distance constraint can be replaced or supplemented by searching for the closest flip point, which yields a closer adversarial change and reveals the weakest vulnerability.
The decision region for a class can be studied directly: in their model the ship region is connected and star-shaped, so hyperplane or locally linear approximations to the boundary are inadequate.
Computing flip points costs about the same as common adversarial-attack methods, making direct boundary investigation a practical tool rather than a theoretical one.
A single distance constraint tuned for one image does not transfer across a dataset, because distances to the closest flip point vary widely between images.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the global-minimizer assumption holds, true flip-point distances could replace Taylor-based margin estimates in generalization-gap prediction, potentially yielding tighter and more reliable margin distributions than current approximations.
The same optimization could be turned into a training procedure: the authors note that adding flip points as training data improves accuracy, but they do not design or test a systematic boundary-moving training algorithm.
The observed near-linear growth of the angle between the Taylor direction and the closest flip point as distance increases suggests a predictable degradation of local linearity; testing this relationship on other architectures would show whether it is a general geometric law or an artifact of this model.
Because the paper says its method has been implemented for multiple classes and discrete features, a natural extension is to check whether the distance, direction, and vulnerability conclusions persist beyond the binary continuous-input setting studied here.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Worth your time if you care about interpretability or adversarial robustness. The new content here is the systematic comparison: first-order Taylor distance estimates are off by factors of 2 to 20, the Taylor direction can point outside the feasible image domain, and loss-minimization adversarial methods can miss much closer boundary points or become infeasible. Those findings are concrete and well illustrated. The flip-point method itself comes from their earlier paper, but the comparisons and the geometric observations are new.

The paper does several things right. It states plainly in Section 2 that the optimization is nonconvex and that they cannot guarantee global optimality, and they hedge by testing multiple solvers. The Lipschitz-based argument for choosing discretization along paths is sensible. The empirical plots are readable and the critique of distance-constrained adversarial attacks is fair, with a nice example where the constraint makes the problem infeasible yet a much closer flip point exists.

Now the soft spots, in proportion. The biggest one is the gap between the abstract's 'exact points' / 'closest flip point' language and what is actually computed. The authors admit that in fewer than 5% of images the interior-point solvers find closer flip points. That means their reported distances are sometimes upper bounds, and every downstream quantity — the underestimation factors, angle distributions, and the 'weakest vulnerability' adversarial examples — is computed relative to possibly suboptimal points. This does not destroy the paper's comparative claims, because the Taylor approximation underestimates by such large factors that a small optimality gap would not change the qualitative conclusion, but it does undermine the word 'exact' and the strength of the vulnerability claim. An optimality certificate, even for a subset of cases, would have helped.

Second, the star-shaped conclusion does not follow. They show that lines between many pairs of ships stay in the ship region, which indicates connectedness or line-connectedness, but star-shapedness requires a common point from which every other point is visible. They did not test that. The language in Section 6 overreaches.

Third, the claim that the observations would still hold for pixel-based networks is unsupported. The experiments use 200 wavelet coefficients, not pixels, and the authors themselves note that the reduced feature space makes global optimization more likely. Extrapolating to pixel input is an assertion, not a result.

No code or data is shipped, which is a real drawback for a methods paper. Still, the core empirical comparisons are valuable and the authors are honest about the main theoretical limitation. I'd bring this to a reading group and would send it to review, with the expectation that the authors tighten the 'exact' language, fix the star-shaped claim, and ideally release code. This is a solid, useful paper that needs moderate revision, not a desk reject.

Referee Report

3 major / 5 minor

Summary. The paper proposes computing 'flip points'—points on the decision boundaries of trained neural networks—by solving a nonconvex optimization problem that minimizes the distance from a given input to a point where the softmax outputs of two classes are equal. The authors use these flip points to compare against first-order Taylor approximations of boundary distance (Section 5), to study the geometry and connectivity of decision regions along straight lines (Sections 4 and 6), and to produce adversarial examples that they argue reveal the 'weakest vulnerability' of a model (Section 7). All experiments use a 12-layer fully connected network with erf activations trained on 200 Daubechies-1 wavelet coefficients of ship/plane images from CIFAR-10, achieving 84.05% test accuracy.

Significance. If the computed flip points are indeed the closest points on decision boundaries, the paper offers a practical tool for interpreting trained networks, auditing approximation methods, and generating minimal adversarial perturbations. The empirical comparisons with Taylor-series distance estimates (Figures 5–8) and with loss-minimization adversarial attacks (Figures 9–12) are valuable and clearly demonstrate that common approximations can be misleading. The paper is also honest in stating the nonconvexity of its optimization problem. However, the central quantitative claims depend on unverified global optimality, the star-shapedness conclusion is not supported by the presented evidence, and the asserted generalization to pixel-based networks is without experimental support. These issues currently limit the contribution to a useful methodology demonstration rather than a fully established set of geometric and robustness conclusions.

major comments (3)

[Section 2] The paper's central claim is that it computes 'exact points' on decision boundaries and 'closest' flip points, but the optimization problem is nonconvex and the authors explicitly state that they 'cannot be sure that optimization algorithms will find the global minimizer.' They also report that in fewer than 5% of images, interior-point algorithms found closer flip points than their preferred solution. This means the reported distances are only upper bounds on the true distance in general, and all downstream quantitative results—the underestimation factors in Figures 5–6, the angle distributions in Figure 8, and the 'weakest vulnerability' comparisons in Figures 9–12—are computed relative to possibly suboptimal flip points. The text should either provide optimality certificates (e.g., interval bounds, branch-and-bound, or verified local optimality with a gap estimate) or systematically qualify 'closest' as 'locally closest among computed solutions' and discuss how the <5% gap affects the conclusions.
[Section 6] The claim that the 'ship' region is star-shaped does not follow from the evidence presented. The authors show that for 89% of pairs of correctly classified ships, the straight line segment between them stays in the ship class, and that there exist paths (using multiple lines) connecting every pair. Star-shapedness requires the existence of a single center point that sees every other point in the region via a straight line; pairwise line connectivity is a weaker property that implies path-connectedness but not star-shapedness. The statement 'This indicates that the ship region is star-shaped' should be revised to a claim supported by the data, such as 'the region is path-connected' or 'most pairs are line-connected,' or new evidence for a common center should be provided.
[Section 7] The sentence 'These observations would still hold for networks trained on the pixels rather than wavelet coefficients' is an unsupported generalization. All experiments in the paper use a 200-dimensional wavelet-coefficient feature space, and the geometry of decision boundaries in that space may differ from the geometry in the original pixel space. Since the adversarial-robustness conclusions in this section are intended to apply broadly, the authors should either provide comparable experiments on pixel-based networks or remove this claim and restrict the conclusions to the feature representation actually tested.

minor comments (5)

[Abstract and Section 1] The terms 'exact points' and 'closest flip point' are used throughout the abstract and introduction without qualification, despite the nonconvexity caveat in Section 2. Consider consistently using 'computed flip point' or 'locally closest flip point' so that the presentation matches the technical caveats.
[Section 3] The statement that using a smaller number of wavelet coefficients 'makes us more likely to find the global solution of our non-convex optimization problem' is presented without supporting evidence. It would be helpful to frame this as a heuristic rationale or provide diagnostic results on smaller problems.
[Section 5, Figure 6] There is a typo in the caption: 'siginiﬁcantly' should be 'significantly.'
[Section 7] The discussion of the distance-constrained loss-minimization problem is imprecise: the problem with a distance constraint of 0.5 is always feasible (the original image is feasible), but it may have no solution that changes the label. The text should clarify that the issue is the absence of an adversarial example within the ball, not infeasibility of the optimization problem itself.
[Section 4.2] The sentence 'This means that we choose the distance between the discretization points small enough such that the output of network can be considered to change linearly between any consecutive points' is a heuristic interpretation of Lipschitz continuity; a Lipschitz bound controls the magnitude of change, not the linearity of the function between points. Consider rewording to avoid overstating what the bound provides.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: flip points are computed numerical solutions; the conceded nonconvexity is a correctness caveat, not a circular reduction.

full rationale

The paper's core objects are flip points, defined in Section 2 as minimizers of distance subject to softmax-equality constraints. All subsequent measurements—distances, ratios to Taylor estimates, angles, connectedness, and adversarial examples—are read off from these computed points. No target quantity appears in the objective or constraints, and no parameter is fitted to a subset of the data and then renamed a prediction. The only self-citation is [Yousefzadeh and O'Leary, 2019] for the flip-point optimization formulation; that is provenance for a method restated in the present paper, and the numerical results here are independent checks on those computed points, so the citation is not load-bearing. Flagged limitation: Section 2 explicitly concedes 'our optimization problem is nonconvex, so we cannot be sure that optimization algorithms will find the global minimizer' and notes that in fewer than 5% of images the interior point algorithms find closer flip points. This weakens the word 'exact' and means reported distances may be upper bounds on the true distances, but it is a verification/correctness gap, not an equivalence of conclusions to inputs. No uniqueness theorem is imported, no ansatz is hidden in a citation, and no known empirical result is merely renamed.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No free parameters or invented entities; the model's weights and activation scale are trained, not fit to the target results. The analysis depends on the assumption that the nonconvex solvers reach global optima, and that the 200 wavelet coefficients preserve decision-relevant structure.

assumptions (3)

domain assumption The nonconvex optimization problem is solved to global optimality (or near-global in practice), so computed flip points are the closest boundary points.
Section 2 admits 'we cannot be sure that optimization algorithms will find the global minimizer'; the paper relies on agreement among solvers in >95% of cases, but this is not proven.
domain assumption The 200 wavelet coefficients chosen by pivoted QR preserve the decision-relevant structure of images.
Section 3 uses these coefficients as inputs; the model reaches 84% test accuracy, but the analysis of boundaries is only in this reduced space.
standard math The network output is Lipschitz continuous and its constants can be bounded using layer matrices and activation scales.
Section 4.1, composition of Lipschitz functions; used to justify path discretization, though no explicit bound is computed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Investigating Decision Boundaries of Trained Neural Networks." pith.science (2026). https://pith.science/paper/ISLKM426

@misc{pith2026190802802,
  author       = {Pith},
  title        = {Pith review of: Investigating Decision Boundaries of Trained Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ISLKM426}},
  note         = {Machine review of arXiv:1908.02802}
}

read the original abstract

Deep learning models have been the subject of study from various perspectives, for example, their training process, interpretation, generalization error, robustness to adversarial attacks, etc. A trained model is defined by its decision boundaries, and therefore, many of the studies about deep learning models speculate about the decision boundaries, and sometimes make simplifying assumptions about them. So far, finding exact points on the decision boundaries of trained deep models has been considered an intractable problem. Here, we compute exact points on the decision boundaries of these models and provide mathematical tools to investigate the surfaces that define the decision boundaries. Through numerical results, we confirm that some of the speculations about the decision boundaries are accurate, some of the computational methods can be improved, and some of the simplifying assumptions may be unreliable, for models with nonlinear activation functions. We advocate for verification of simplifying assumptions and approximation methods, wherever they are used. Finally, we demonstrate that the computational practices used for finding adversarial examples can be improved and computing the closest point on the decision boundary reveals the weakest vulnerability of a model against adversarial attack.

Figures

Figures reproduced from arXiv: 1908.02802 by the authors.

**Figure 2.** Model output along the line connecting two images. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Model output along the line connecting an image with its closest flip point. Images for the [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (9 more)

**Figure 4.** Figure 4: Model output along the line connecting two flip points. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: Using the first-order Taylor expansion for estimating the minimum distance to decision [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 6.** Figure 6: β is the distance to the closest flip point divided by the distance predicted by the Taylor approximation. Since these ratios are far from 1, the approximation is not a reliable measure. Unfortunately, the Taylor direction itself is not so reliable. We look at the angl…

**Figure 7.** Figure 7: Finding the flip point along the direction indicated by the first-order Taylor expansion often [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

**Figure 8.** Figure 8: Angle between direction of first-order Taylor approximation and direction to closest flip [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]

**Figure 9.** Figure 9: Finding the closest flip point reveals the least changes that would lead to an adversarial [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]

**Figure 10.** Figure 10: Minimizing the loss function subject to a distance constraint may find adversarial examples [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]

**Figure 11.** Figure 11: Minimizing the loss function subject to a tight distance constraint may not have a feasible [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]

**Figure 12.** Figure 12: Distance to the closest flip point has large variation among images in the training set, [PITH_FULL_IMAGE:figures/full_fig_p009_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 19 canonical work pages

[1]

Large margin deep networks for classification

Gamaleldin Elsayed, Dilip Krishnan, Hossein Mobahi, Kevin Regan, and Samy Bengio. Large margin deep networks for classification. In Advances in Neural Information Processing Systems (NeurIPS 2018), pages 842--852, 2018

work page 2018
[2]

The robustness of deep networks: A geometrical perspective

Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. The robustness of deep networks: A geometrical perspective. IEEE Signal Processing Magazine, 34 0 (6): 0 50--62, 2017

work page 2017
[3]

Empirical study of the topology and geometry of deep networks

Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard, and Stefano Soatto. Empirical study of the topology and geometry of deep networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 3762--3770, 2018

work page 2018
[4]

Matrix Computations

Gene H Golub and Charles F Van Loan. Matrix Computations. JHU Press, Baltimore, 4th edition, 2012

work page 2012
[5]

Explaining and harnessing adversarial examples

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

arXiv 2014
[6]

Formal guarantees on the robustness of a classifier against adversarial manipulation

Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. In Advances in Neural Information Processing Systems (NeurIPS 2017), pages 2266--2276, 2017

work page 2017
[7]

Adversarial examples are not bugs, they are features

Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175, 2019

arXiv 1905
[8]

With friends like these, who needs adversaries? In Advances in Neural Information Processing Systems (NeurIPS 2018), pages 10749--10759, 2018

Saumya Jetley, Nicholas Lord, and Philip Torr. With friends like these, who needs adversaries? In Advances in Neural Information Processing Systems (NeurIPS 2018), pages 10749--10759, 2018

work page 2018

Show all 23 references

[9]

Predicting the generalization gap in deep networks with margin distributions

Yiding Jiang, Dilip Krishnan, Hossein Mobahi, and Samy Bengio. Predicting the generalization gap in deep networks with margin distributions. In International Conference on Learning Representations (ICLR 2019), 2019

2019
[10]

Steven G. Johnson. The NLopt nonlinear-optimization package, http://ab-initio.mit.edu/nlopt, 2014

2014
[11]

An introduction to computing with neural nets

Richard P Lippmann. An introduction to computing with neural nets. Artificial Neural Networks: Theoretical Concepts, 4 0 (2): 0 4--22, 1987

1987
[12]

Margin maximization for robust classification using deep learning

Alexander Matyasko and Lap-Pui Chau. Margin maximization for robust classification using deep learning. In International Joint Conference on Neural Networks, pages 300--307. IEEE, 2017

2017
[13]

Deepfool: a simple and accurate method to fool deep neural networks

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574--2582, 2016

2016
[14]

Exploring generalization in deep learning

Behnam Neyshabur, Srinadh Bhojanapalli, David McAllester, and Nati Srebro. Exploring generalization in deep learning. In Advances in Neural Information Processing Systems (NeurIPS 2017), pages 5947--5956, 2017

2017
[15]

Why should I trust you?: Explaining the predictions of any classifier

Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Why should I trust you?: Explaining the predictions of any classifier. In International Conference on Knowledge Discovery and Data Mining, pages 1135--1144. ACM, 2016

2016
[16]

A simple explanation for the existence of adversarial examples with small Hamming distance

Adi Shamir, Itay Safran, Eyal Ronen, and Orr Dunkelman. A simple explanation for the existence of adversarial examples with small Hamming distance. arXiv preprint arXiv:1901.10861, 2019

1901 arXiv
[17]

Actionable recourse in linear classification

Alexander Spangher, Berk Ustun, and Yang Liu. Actionable recourse in linear classification. In Proceedings of the 5th Workshop on Fairness, Accountability and Transparency in Machine Learning, 2018

2018
[18]

A boundary tilting persepective on the phenomenon of adversarial examples

Thomas Tanay and Lewis Griffin. A boundary tilting persepective on the phenomenon of adversarial examples. arXiv preprint arXiv:1608.07690, 2016

2016 arXiv
[19]

Robustness may be at odds with accuracy

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Representations (ICLR 2019), 2019

2019
[20]

A tutorial on spectral clustering

Ulrike Von Luxburg. A tutorial on spectral clustering. Statistics and Computing, 17 0 (4): 0 395--416, 2007

2007
[21]

On the implementation of an interior-point filter line-search algorithm for large-scale nonlinear programming

Andreas W \"a chter and Lorenz T Biegler. On the implementation of an interior-point filter line-search algorithm for large-scale nonlinear programming. Mathematical Programming, 106 0 (1): 0 25--57, 2006

2006
[22]

Counterfactual explanations without opening the black box: Automated decisions and the GDPR

Sandra Wachter, Brent Mittelstadt, and Chris Russell. Counterfactual explanations without opening the black box: Automated decisions and the GDPR . Harvard Journal of Law & Technology, 31 0 (2), 2018

2018
[23]

Interpreting neural networks using flip points

Roozbeh Yousefzadeh and Dianne P O'Leary. Interpreting neural networks using flip points. arXiv preprint arXiv:1903.08789, 2019

1903 arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Large margin deep networks for classification

Gamaleldin Elsayed, Dilip Krishnan, Hossein Mobahi, Kevin Regan, and Samy Bengio. Large margin deep networks for classification. In Advances in Neural Information Processing Systems (NeurIPS 2018), pages 842--852, 2018

work page 2018

[2] [2]

The robustness of deep networks: A geometrical perspective

Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. The robustness of deep networks: A geometrical perspective. IEEE Signal Processing Magazine, 34 0 (6): 0 50--62, 2017

work page 2017

[3] [3]

Empirical study of the topology and geometry of deep networks

Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard, and Stefano Soatto. Empirical study of the topology and geometry of deep networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 3762--3770, 2018

work page 2018

[4] [4]

Matrix Computations

Gene H Golub and Charles F Van Loan. Matrix Computations. JHU Press, Baltimore, 4th edition, 2012

work page 2012

[5] [5]

Explaining and harnessing adversarial examples

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

arXiv 2014

[6] [6]

Formal guarantees on the robustness of a classifier against adversarial manipulation

Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. In Advances in Neural Information Processing Systems (NeurIPS 2017), pages 2266--2276, 2017

work page 2017

[7] [7]

Adversarial examples are not bugs, they are features

Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175, 2019

arXiv 1905

[8] [8]

With friends like these, who needs adversaries? In Advances in Neural Information Processing Systems (NeurIPS 2018), pages 10749--10759, 2018

Saumya Jetley, Nicholas Lord, and Philip Torr. With friends like these, who needs adversaries? In Advances in Neural Information Processing Systems (NeurIPS 2018), pages 10749--10759, 2018

work page 2018