Pith. sign in

REVIEW 4 major objections 5 minor 36 references

Defeating Misclassification Attacks Against Transfer Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An ensemble of five pruned two-class differentiators can reject more than 90% of misclassification attacks against transfer-learned Student models while keeping accuracy loss under 10%.

desk verdict A plausible new defence against misclassification attacks on transfer learning, with a strong result against non-adaptive attackers, but the abstract overstates it: once the defence is known, non-targeted attack success jumps to 80.1%. read the letter →

arxiv 1908.11230 v4 pith:KXEZ6WSY submitted 2019-08-29 cs.LG cs.CR

Bang Wu , Shuo Wang , Xingliang Yuan , Cong Wang , Carsten Rudolph , Xiangwen Yang This is my paper · ORCID
classification cs.LGcs.CR
keywords transferlearningmisclassificationattacknetworkpruningensembledefenceadversarialexampleactivationtwo-phaseinferencedifferentiator
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that transfer-learned Student models can be defended against the strongest known misclassification attacks by attaching a small ensemble of heavily pruned two-class classifiers, called differentiators. The key move is to make each differentiator as unlike the public Teacher model as possible through activation-based pruning, so adversarial perturbations crafted on the Teacher lose their transferability. At inference, the Student model's own prediction selects only five relevant differentiators, and if any of them disagrees, the input is rejected as adversarial. On face recognition and traffic sign recognition, the authors report rejection of more than 90% of targeted and non-targeted attacks with clean-input accuracy above 90% and roughly 3% extra memory. If true, this gives transfer-learning users a practical and scalable defence that earlier dropout- or distance-based defences do not provide.

What carries the argument

The load-bearing mechanism is activation-based network pruning, applied to build each differentiator by removing filters and connections whose activations are least relevant for the two classes it distinguishes. This makes every differentiator highly distilled and deliberately dissimilar from the Teacher model, which breaks the transferability of adversarial perturbations. The two-phase inference scheme is the second piece: the Student model's preliminary prediction narrows the candidate differentiators to those involving that class, and a randomly chosen subset of five validates the input, so the defence avoids the cost of running all pairwise differentiators.

What would settle it

A white-box attacker who knows the defence algorithm, the pruning ratios for each layer, and has exact copies of the five selected differentiators should be able to repeat the non-targeted misclassification attack with a perturbation budget of 0.01 DSSIM; the paper's own Table 4 already reports 80.1% success in this setting, so a direct test is to count how many of 1,000 such adversarial images pass all five differentiators and reach misclassification.

Watch

Extended reading notes

Core claim

The central claim is that Student models in transfer learning can be made robust against both targeted and non-targeted misclassification attacks by attaching an ensemble of at most five distilled two-class differentiators. Each differentiator is a transfer-learned model that has been aggressively pruned, using activation-based pruning on only the two classes it must separate, so that its internal structure diverges sharply from the public Teacher model and from the Student model. During inference, the Student model first makes a preliminary prediction; the defence then randomly picks five differentiators that involve that predicted class, and any disagreement among them causes the input to be rejected. The paper reports that this design rejects over 90% of adversarial inputs on both a 83-class face recognition task and a 43-class traffic sign recognition task, while keeping clean-input accuracy within 10% of the original and adding only about 3% to model memory. The defence also substantially reduces the success of general attacks such as FGSM, DeepFool, and Carlini-Wagner attacks.

Load-bearing premise

The defence assumes attackers cannot reproduce the exact pruned differentiators because they do not know the per-layer pruning ratios; the paper's Table 4 shows that when attackers do know the defence and have exact Student models, non-targeted attack success rises to 80.1%, which would undercut the unqualified over-90% rejection claim.

Editorial extensions

If this is right

  • If the claim holds, transfer-learning users can defend both targeted and non-targeted misclassification attacks with only five small pruned models, requiring no retraining of the whole Student model.
  • The defence is robust across different attack layers and perturbation budgets, with false positive rates below 10% for targeted attacks and below 20% for non-targeted attacks at the optimal attack layer.
  • General adversarial attacks such as FGSM, DeepFool, and Carlini-Wagner that succeed over 90% of the time against unguarded models drop to under 10% success when the ensemble is present.
  • The memory overhead is small, about 3% beyond the original Student model, because the differentiators reuse most of the Teacher weights and only add pruning tags and new classification layers.
  • Inference remains practical: with one CPU core, the full two-phase validation costs about 2.11 seconds on the tested tasks, compared with 0.54 seconds for the Student model alone.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The security of the defence appears to rest on the secrecy of the per-layer pruning ratios: the paper's own Table 4 shows that when attackers know the defence and have exact Student models, non-targeted attack success rises to 80.1%, so a variant that keeps pruning ratios secret while making the rest of the defence public would be a natural stress test.
  • The same pruning-based diversity could plausibly defend other transfer-learning settings such as NLP or audio models, but the requirement of class-pair-specific differentiators makes the cost grow quadratically with the number of classes unless the clustering trick in Appendix B is used.
  • Appendix B's voting variant, which runs all pairwise differentiators and rejects only when unanimity fails, points to a trade-off between rejecting adversarial inputs and correctly classifying them; a hybrid that classifies some rejected inputs could be explored.
  • A testable extension would be measuring how defence rate degrades as differentiators share more of the same pruning pattern, which would quantify how much diversity the ensemble actually needs.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper proposes a defence for transfer-learning Student models against misclassification attacks (Wang et al., USENIX 2018). The defence consists of an ensemble of 'differentiators': small two-class networks obtained by transfer learning and activation-based pruning, chosen to be highly divergent from the public Teacher model. A two-phase inference first classifies with the unpruned Student model, then validates with k randomly selected differentiators that involve the predicted class; disagreement triggers rejection. Experiments on PubFig face recognition (83 classes, VGG-Face Teacher) and GTSRB traffic signs (43 classes, VGG16 Teacher) report rejection of over 90% of targeted and non-targeted attacks with k=5, accuracy around 92%, and lower memory overhead than prior defences. The paper also compares with Randomizing Input via Dropout and Injecting Neuron Distances.

Significance. If the defence behaves as claimed under the stated black-box Student threat model, it is a useful practical contribution: it is one of the first defences specifically targeting transfer-learning misclassification attacks, the mechanism (distillation via activation pruning) is directly tied to breaking attack transferability, and the two-phase ensemble construction addresses scalability. The paper also provides comparisons against prior defences, evaluates general attacks (FGSM, DeepFool, CW), and reports modest overhead. However, the headline claim is broader than what the evidence supports: the paper's own stronger-attacker experiments in Section 5/Table 4 show that the defence's advantage largely disappears when the attacker knows the defence and has exact Student models, so the significance rests on accepting the restricted threat model and on the secrecy of pruning ratios, which is not experimentally validated.

major comments (4)
  1. [Abstract and Section 4.2.1 / Table 4] The unqualified claim in the Abstract and Section 4.2.1 that the defence makes Student models 'immune to over 90% of the adversarial inputs' is contradicted by Table 4, where the known-defence/white-box row reports 80.1% non-targeted attack success, i.e., the rejection rate is below 20%. Because Section 2 explicitly excludes Student-model leakage from the threat model, the abstract should either be restricted to that model or accompanied by an adaptive evaluation; as written, the headline claim is not supported by the paper's own data.
  2. [Section 5, Table 4] The transition from 'Defence Unknown' (8.5% non-targeted success) to 'Pruning Ratios Unknown' (40.0%) shows that knowledge of the defence algorithm alone already degrades the non-targeted defence to below 60% rejection, and the 'Defence Known' row (80.1%) shows the defence collapses if the attacker can reproduce the differentiators. The paper asserts without experimental support that the pruning ratios are 'not easily inferred by querying' (Section 5); no model-extraction or query-based inference experiment is conducted. Since the secrecy of pruning ratios is the remaining load-bearing secret, this gap must be addressed or explicitly listed as a limitation.
  3. [Section 3.3.2 / Section 4.2.1 / Figure 5] Several defence hyperparameters are selected on the basis of the same attack data used for evaluation: Figure 5 is used to fix k=5, and the rejection threshold is set to 1 from the FPR/TPR trade-off in the same figure. With non-adaptive attacks this is a form of tuning on the test distribution; to support generalization, the defence should be evaluated with hyperparameters chosen on a held-out attack configuration (e.g., different perturbation budgets or attack layers) or a dedicated validation set.
  4. [Algorithm 1 / Figures 5-8] The differentiators in the second phase are chosen randomly, but Figures 5-8 report only single point estimates with no error bars or multiple trials. Because random selection is intrinsic to the algorithm, the reader cannot assess the variance of the claimed rejection rates; repeated runs should be reported (or confidence intervals given).
minor comments (5)
  1. [Abstract] The phrase 'immune over 90% the adversarial inputs' should be 'immune to over 90% of the adversarial inputs'.
  2. [Section 4.2] The metric called FPR is defined as the fraction of adversarial inputs that are rejected; this is a detection/rejection rate, not a false positive rate, and the terminology should be corrected to avoid confusion.
  3. [Table 4] The column headings 'Defence Known' and 'Pruning Ratios Unknown' are ambiguous; the surrounding text should state explicitly which attacker capabilities each column represents (e.g., exact white-box access vs. known defence algorithm with unknown ratios).
  4. [Algorithm 2] Line 8 contains a typo: 'IterationT imes' should be 'IterationTimes'.
  5. [Section 5 / Appendix B] The expression 'K(k−1)/2' in Section 5 should be 'K(K−1)/2' to match Appendix B.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defence is evaluated against an external attack, and the tuned parameters are empirical choices rather than predictions derived from the attack.

full rationale

The paper's central claim is an empirical defence-evaluation result, not a derivation. Adversarial examples are generated with the misclassification attack of Wang et al. [33], an external attack independent of the present authors; defence success rates are measured on those externally generated inputs. The threat model is explicitly black-box to the Student model, and the defence is not defined in terms of the attack-success metric. The ensemble size k=5, pruning ratios, and rejection threshold are selected from the authors' own experiments, which is parameter tuning rather than circularity: these choices are not claimed to be predicted from first principles. Section 5's known-defence variant assumes the pruning ratios are secret; that assumption is unverified and Table 4's 80.1% non-targeted success under known defence conflicts with the abstract's unqualified 'over 90%' statement, but this is a robustness/correctness limitation, not a circular reduction to the paper's inputs. No load-bearing self-citation appears; [33] is external and cited for the attack and baseline defences. Therefore no circular step can be exhibited.

Assumptions & free parameters 4 free parameters · 5 assumptions · 1 invented entities

The central claim rests on an empirical attack model (white-box Teacher, black-box Student), the assumption that pruning breaks attack transferability, and the secrecy of pruning ratios. No free parameters are derived from theory; key design choices are tuned on the evaluation datasets.

free parameters (4)
  • k (number of differentiators in the ensemble) = 5
    Chosen from Figure 5 as balancing defence rate and accuracy; not derived from theory.
  • per-layer pruning ratios = not reported
    Adjusted per layer based on pruning sensitivity; exact values are not given in the paper.
  • rejection threshold = 1
    Set to one negative vote for rejection; threshold 2 increases false positives, so 1 is the baseline.
  • pruning and retraining iterations = 5
    Figure 8 shows accuracy recovers by 5 iterations; chosen empirically on the evaluation data.
assumptions (5)
  • domain assumption White-box access to Teacher model and black-box access to Student model.
    Section 2.1, follows the attack model of Wang et al. [33].
  • domain assumption Adversarial examples transfer from Teacher to Student because shared layers preserve internal features.
    Section 2.1 and Figure 2, based on Wang et al. [33].
  • domain assumption Network pruning reduces attack transferability.
    Section 3.2, citing Liu et al. [18] and Wang et al. [33].
  • ad hoc to paper Attackers cannot infer the secret pruning ratios via queries.
    Section 5; this secrecy is load-bearing for the claimed robustness.
  • standard math Gradient-based optimization of the perturbation objective in Eq. 1 is valid.
    Appendix A, standard adversarial example generation method.
invented entities (1)
  • Distilled differentiator independent evidence
    purpose: A two-class classifier, heavily pruned via activation-based pruning, used to detect adversarial inputs by disagreeing with the Student model's prediction.
    Evaluated empirically in Section 4; it is a method component, not a postulated physical entity.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Defeating Misclassification Attacks Against Transfer Learning." pith.science (2026). https://pith.science/paper/KXEZ6WSY

@misc{pith2026190811230,
  author       = {Pith},
  title        = {Pith review of: Defeating Misclassification Attacks Against Transfer Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KXEZ6WSY}},
  note         = {Machine review of arXiv:1908.11230}
}
read the original abstract

Transfer learning is prevalent as a technique to efficiently generate new models (Student models) based on the knowledge transferred from a pre-trained model (Teacher model). However, Teacher models are often publicly available for sharing and reuse, which inevitably introduces vulnerability to trigger severe attacks against transfer learning systems. In this paper, we take a first step towards mitigating one of the most advanced misclassification attacks in transfer learning. We design a distilled differentiator via activation-based network pruning to enervate the attack transferability while retaining accuracy. We adopt an ensemble structure from variant differentiators to improve the defence robustness. To avoid the bloated ensemble size during inference, we propose a two-phase defence, in which inference from the Student model is firstly performed to narrow down the candidate differentiators to be assembled, and later only a small, fixed number of them can be chosen to validate clean or reject adversarial inputs effectively. Our comprehensive evaluations on both large and small image recognition tasks confirm that the Student models with our defence of only 5 differentiators are immune to over 90% of the adversarial inputs with an accuracy loss of less than 10%. Our comparison also demonstrates that our design outperforms prior problematic defences.

Figures

Figures reproduced from arXiv: 1908.11230 by the authors.

Figure 2
Figure 2. Misclassification Attacks in Transfer Learn [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Network Pruning outputs for the rest are also likely to be very similar even they are retrained. Such similarity will be maintained to the final prediction. As a result, the misclassification takes place since two inputs with different labels have a similar prediction. For realisation, it can be translated into an optimized problem which minimizes the distance for the internal outputs by limited perturbations. More … view at source ↗
Figure 4
Figure 4. Inference Strategy maintain the transferability to the variance of models. The adver￾sarial images can only fool parts of these models and loss their transferability to the rest of them. The overall ensemble models with difference classifiers achieve stronger robustness against these attacks. While extending the defence to non-targeted attacks, a naive approach that combines differentiators for all possible attack p… view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Performance of defence with different numbers of [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Attack Layer 0.00 0.20 0.40 0.60 0.80 1.00 0.004 0.005 0.01 0.02 0.03 False Positive Rate Perturbation Budget Targeted (original models) Non-targeted (original models) Targeted (with defence) Non-targeted (with defence) (b) Traffic Sign Recognition [PITH_FULL_IMAGE:fi…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 33 canonical work pages

  1. [1]

    Robustness to adversarial examples through an ensemble of specialists

    Mahdieh Abbasi and Christian Gagné. Robustness to adversarial examples through an ensemble of specialists. In 5th International Conference on Learning Representations, Workshop Track Proceedings, 2017

    work page 2017

  2. [2]

    Bunescu, and Gordon Stewart

    Alexander Bagnall, Razvan C. Bunescu, and Gordon Stewart. Training ensembles to detect adversarial examples. CoRR, 2017

    work page 2017

  3. [3]

    Bendale and T

    A. Bendale and T. E. Boult. Towards open set deep networks. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 1563–1572, 2016

    work page 2016

  4. [4]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019

    arXiv 1902

  5. [5]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017 , 2017

    work page 2017

  6. [6]

    J. Deng, W. Dong, R. Socher, L. Li, and and. Imagenet: A large-scale hierarchi- cal image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255, 2009

    work page 2009

  7. [7]

    Curtin, Saurabh Shintre, and Andrew B

    Reuben Feinman, Ryan R. Curtin, Saurabh Shintre, and Andrew B. Gardner. Detecting adversarial samples from artifacts. Computing Research Repository , abs/1703.00410, 2017

    arXiv 2017

  8. [8]

    Making machine learning robust against adversarial inputs

    Ian Goodfellow, Patrick McDaniel, and Nicolas Papernot. Making machine learning robust against adversarial inputs. Communications of the ACM, 61(7):56– 66, 2018

    work page 2018

Show all 36 references
  1. [9]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In 3rd International Conference on Learning Representations, Conference Track Proceedings , 2015

    2015

  2. [10]

    Google Cloud AutoML

    Google. Google Cloud AutoML. Online at https://cloud.google.com/automl/, 2019

    2019

  3. [11]

    Song Han, Jeff Pool, John Tran, and William J. Dally. Learning both weights and connections for efficient neural networks. In Proceedings of the 28th International Conference on Neural Information Processing Systems - Volume 1 , pages 1135–1143. MIT Press, 2015

    2015

  4. [12]

    Ad- versarial example defense: Ensembles of weak defenses are not strong

    Warren He, James Wei, Xinyun Chen, Nicholas Carlini, and Dawn Song. Ad- versarial example defense: Ensembles of weak defenses are not strong. In 11th USENIX Workshop on Offensive Technologies, 2017, 2017

    2017

  5. [13]

    Model-reuse attacks on deep learning systems

    Yujie Ji, Xinyang Zhang, Shouling Ji, Xiapu Luo, and Ting Wang. Model-reuse attacks on deep learning systems. In Proceedings of the 2018 ACM SIGSAC Con- ference on Computer and Communications Security , pages 349–363. ACM, 2018

    2018

  6. [14]

    Sanjay Kariyappa and Moinuddin K. Qureshi. Improving adversarial robustness of ensembles with diversity training. CoRR, 2019

    2019

  7. [15]

    Kumar, A

    N. Kumar, A. C. Berg, P. N. Belhumeur, and S. K. Nayar. Attribute and simile classifiers for face verification. In 2009 IEEE 12th International Conference on Computer Vision, pages 365–372, 2009

    2009

  8. [16]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In 5th International Conference on Learning Representations, Conference Track Proceedings, 2017

    2017

  9. [17]

    Prun- ing filters for efficient convnets

    Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf. Prun- ing filters for efficient convnets. In 5th International Conference on Learning Representations, Conference Track Proceedings , 2017

    2017

  10. [18]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses, pages 273–294. Springer International Publishing, 2018

    2018

  11. [19]

    Deep neural network ensembles against deception: Ensemble diversity, accuracy and robustness

    Ling Liu, Wenqi Wei, Ka Ho Chow, Margaret Loper, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu. Deep neural network ensembles against deception: Ensemble diversity, accuracy and robustness. In16th IEEE International Conference on Mobile Ad Hoc and Sensor Systems, MASS 2019,...

    2019

  12. [20]

    Deep- fool: A simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- fool: A simple and accurate method to fool deep neural networks. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 2574–2582, 2016

    2016

  13. [21]

    A survey on transfer learning.IEEE Transactions on Knowledge and Data Engineering (TKDE) , 22(10):1345–1359, 2010

    Sinno Jialin Pan and Qiang Yang. A survey on transfer learning.IEEE Transactions on Knowledge and Data Engineering (TKDE) , 22(10):1345–1359, 2010

    2010

  14. [22]

    O. M. Parkhi, A. Vedaldi, and A. " Zisserman. Deep face recognition. British Machine Vision Conference, 1(3):6, 2015

    2015

  15. [23]

    Pinto, Z

    N. Pinto, Z. Stone, T. Zickler, and D. Cox. Scaling up biologically-inspired computer vision: A case study in unconstrained face recognition on facebook. In Computer Vision and Pattern Recognition 2011 Workshops , pages 35–42, 2011

    2011

  16. [24]

    Polyak and L

    A. Polyak and L. Wolf. Channel-level acceleration of deep face representations. IEEE Access, 3:2163–2175, 2015

    2015

  17. [25]

    Sara Sabour, Yanshuai Cao, Fartash Faghri, and David J. Fleet. Adversarial manipulation of deep representations. In 4th International Conference on Learning Representations, Conference Track Proceedings , 2016

    2016

  18. [26]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In 3rd International Conference on Learning Representations, Conference Track Proceedings , 2015

    2015

  19. [27]

    Stallkamp, M

    J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel. The german traffic sign recognition benchmark: A multi-class classification competition. In The 2011 International Joint Conference on Neural Networks , pages 1453–1460, 2011

    2011

  20. [28]

    Stallkamp, M

    J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel. Man vs. computer: Benchmark- ing machine learning algorithms for traffic sign recognition. Neural Networks, 32:323–332, 2012

    2012

  21. [29]

    One pixel attack for fooling deep neural networks

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Trans. Evolutionary Computation , 23(5):828– 841, 2019

    2019

  22. [30]

    Rethinking the inception architecture for computer vision.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 2818–2826, 2016

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbig- niew Wojna. Rethinking the inception architecture for computer vision.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 2818–2826, 2016

    2016

  23. [31]

    Goodfellow, Dan Boneh, and Patrick D

    Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses. In 6th International Conference on Learning Representations, Conference Track Proceedings, 2018

    2018

  24. [32]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proceedings of 40th IEEE Symposium on Security and Privacy. IEEE, 2019

    2019

  25. [33]

    Bolun Wang, Yuanshun Yao, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. With great training comes great vulnerability: Practical attacks against trans- fer learning. In 27th USENIX Security Symposium , pages 1281–1297. USENIX Association, 2018

    2018

  26. [34]

    Z. Wang, E. P. Simoncelli, and A. C. Bovik. Multiscale structural similarity for image quality assessment. In The Thrity-Seventh Asilomar Conference on Signals, Systems Computers, 2003, volume 2, pages 1398–1402 Vol.2, 2003

    2003

  27. [35]

    Adadelta: an adaptive learning rate method

    Matthew D Zeiler. Adadelta: an adaptive learning rate method. arXiv preprint arXiv:1212.5701, 2012

    2012 arXiv

  28. [36]

    To compress or not to compress: Understanding the interactions between adversarial attacks and neural network compression

    Yiren Zhao, Ilia Shumailov, Robert Mullins, and Ross Anderson. To compress or not to compress: Understanding the interactions between adversarial attacks and neural network compression. In Proceedings of the 2nd SysML Conference , 2019. A MISCLASSIFICATION ATTACKS IN TRANSFER ...

    2019

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.