Pith. sign in

REVIEW 4 major objections 5 minor 40 references

Towards more transferable adversarial attack in black-box manner

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a time-dependent classifier's score, evaluated on a single noised adversarial image, is enough to produce black-box transferable attacks that beat diffusion-based DiffPGD and run an order of magnitude faster.

desk verdict A cheap transfer attack using a time-dependent classifier's score is worth testing, but the paper's key claim about the score being the source of transferability is not yet supported. read the letter →

arxiv 2505.18097 v1 pith:PKWXLRHI submitted 2025-05-23 cs.LG cs.CV

Chun Tong Lei , Zhongliang Guo , Hon Chung Lee , Minh Quoc Duong , Chun Pong Lau This is my paper
classification cs.LGcs.CV
keywords transferableadversarialattackblack-boxscore-basedtime-dependentclassifierpurificationdiffusionmodelprojectedgradientdescentsuccessrate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the expensive diffusion model in the DiffPGD attack is not actually needed for transferable black-box attacks. Its proposed ScorePGD and U-ScorePGD attacks instead use only the score of a time-dependent classifier from classifier-guided diffusion, namely the gradient of the log-probability of a class on a noised adversarial image, as the attack signal. On ImageNet, U-ScorePGD is reported to reach 89.9%, 85.6%, 87.6%, and 81.8% attack success on ResNet101, ResNet18, WRN50, and WRN101, beating PGD and DiffPGD on unprotected classifiers, while ScorePGD wins against diffusion-purified classifiers. The whole method runs in about 2 seconds per 256x256 image instead of about 23 seconds for DiffPGD. The practical payoff would be that high transferability can be obtained at a fraction of the compute, making large-scale robustness evaluation far more accessible.

What carries the argument

The central object is the time-dependent classifier $f_\phi(x_t,t)$, a classifier trained on images noised to the diffusion timestep $t$, originally used to guide diffusion sampling. Its score $\nabla_{x_t} \log f_\phi(x_t,t)$ is used here as the attack signal: perturbing the image to minimize $\log f_\phi(x_t^{\mathrm{adv}},t)$ makes the guidance of the reverse diffusion point to a wrong class, so both the classifier and the purification process fail on the perturbed image. The forward noising rule $x_t^{\mathrm{adv}}=\sqrt{\alpha_t}x^{\mathrm{adv}}+\sigma_t\epsilon$ supplies the noisy sample at each PGD iteration, and this score-loss replaces the full denoising chain that DiffPGD must backpropagate through.

What would settle it

Run ScorePGD exactly as described but replace the time-dependent classifier with a plain ImageNet classifier whose input is noised by the same forward rule, keeping $t$ and all hyperparameters fixed; if transfer attack success stays at the reported levels, the special time-dependent classifier is not doing the work, and if it collapses, the special training of $f_\phi$ is confirmed as the source.

Watch

Extended reading notes

Core claim

The paper's central claim is that minimizing the score-loss $L_s = \log f_\phi(x_t^{\mathrm{adv}}, t)$ — where $f_\phi$ is a time-dependent classifier and $x_t^{\mathrm{adv}}$ is the adversarial image noised by the forward diffusion process — redirects the guidance of a classifier-guided diffusion model toward the wrong class, and that this alone makes adversarial perturbations transfer across architectures and survive diffusion-based purification. U-ScorePGD adds the ordinary classification loss $L_c(f_\theta(x_{\mathrm{adv}}), y)$ of a surrogate model, maximizing $L_t = L_c - L_s$ in a single PGD update, while ScorePGD drops $L_c$ entirely and only minimizes $L_s$. The authors report that U-ScorePGD outperforms both PGD and DiffPGD in black-box transfer to unprotected classifiers, while ScorePGD consistently gives the best attack success against classifiers protected by diffusion purification. They take this as evidence that the inductive bias of the noising process, not the full diffusion machinery, is the active ingredient in transferable adversarial attacks.

Load-bearing premise

The whole method rests on the assumption that a single classifier's score at one noisy version of the image captures the same distributional information that full diffusion purification uses, and that this information is what makes perturbations transfer.

Editorial extensions

If this is right

  • If the central claim holds, diffusion-based purification is not required to generate transferable attacks; a single time-dependent classifier score can carry the same inductive bias.
  • Attackers and robustness evaluators can run black-box transfer attacks at roughly a tenth of the compute and VRAM of DiffPGD, making large-scale evaluation on limited hardware practical.
  • The method extends beyond ImageNet classification: the paper shows it degrades object detectors (FastRCNN on MS COCO) and vision transformers, so the score-loss is not tied to one architecture family.
  • Because ScorePGD contains no surrogate classifier at all, it offers a way to attack purified classifiers that does not depend on which white-box surrogate the attacker happens to choose.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: If the paper is right, the same score-loss could be ported to other generative guidance mechanisms, not just diffusion, whenever a trained conditional score is available.
  • Editorial inference: The reported dependence on the timestep $t=20$, chosen by trial and error on the exact victim architectures, leaves open that part of the transfer gain comes from tuning, so a randomized-t or per-image-t variant would test how much of the mechanism is really the noised distribution knowledge.
  • Editorial inference: A direct stress test would replace the pre-trained time-dependent classifier with a standard classifier plus input noising; comparable transferability would show that the noise schedule, not the special training of $f_\phi$, is what matters.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes two transfer-based black-box attacks, ScorePGD and U-ScorePGD, built around the score of a time-dependent classifier from classifier-guided diffusion models. ScorePGD minimizes the log-probability assigned by that classifier to the true label on a single randomly noised copy of the current adversarial image; U-ScorePGD combines this score loss with the usual white-box surrogate loss. Experiments on an ImageNet subset report that U-ScorePGD outperforms PGD and DiffPGD on unprotected ResNet/WRN victims, that ScorePGD achieves the best transfer success against diffusion-purification-protected classifiers, and that both variants run roughly an order of magnitude faster than DiffPGD. Additional experiments cover ℓ2 bounds, ViT/Swin-B victims, and MS COCO object detection.

Significance. If the empirical results hold, the paper makes a useful practical contribution: it suggests that a single time-dependent classifier score can replace the full diffusion purification process in DiffPGD, yielding both higher transferability and much lower runtime. The method is simple, the ablation over timesteps is reported, and the runtime improvement is substantial and concrete. However, the central mechanistic claim is not isolated from confounds, the comparison omits standard transfer-attack baselines, and the key timestep is selected on the exact victim architectures used in evaluation. The significance is therefore conditional on additional experiments.

major comments (4)
  1. [§4.2, Eq. (9), Algorithm 1] The proposed score term is never isolated from two known transferability enhancers: the ImageNet classifier f_phi and the random noising of the input at a fixed timestep. The method is compared only with PGD (no score term, no noising) and DiffPGD (full diffusion process), so the reported gains could in principle come from the surrogate classifier or from the noise augmentation alone. Please add a control in which f_phi is replaced by a standard ImageNet classifier evaluated on the same x_t^adv = sqrt(alpha_t) x_adv + sigma_t epsilon with all other settings unchanged. If that control matches U-ScorePGD/ScorePGD, the paper's claim that the time-dependent score is the critical factor would be unsupported.
  2. [Appendix A.3 and A.4, Tables 5–8] The diffusion timestep t=20 is selected by evaluating the exact victim architectures (ResNet101, ResNet18, WRN50, WRN101) and the exact diffusion purification defense used in the main experiments. This makes the headline comparisons in Tables 1 and 2 selection-biased: the reported ASRs are the result of tuning a hyperparameter on the test victims, not a fixed a-priori configuration. The authors even note in Appendix B that t is chosen by trial and error. Please select t on a validation split disjoint from the reported victims, or report results aggregated over the t range with standard errors, or clearly flag that the reported numbers are post-selection.
  3. [§5.2 and §5.3, Tables 1–2] The evaluation compares only with PGD and DiffPGD. Since the paper claims 'more transferable adversarial attacks in a black-box manner,' standard transfer-attack baselines such as MI-FGSM, DI-TI, or an ensemble/self-ensemble baseline should be included under identical settings. Without these baselines, the relative standing of the proposed methods in the broader transfer-attack literature is unclear. In addition, all reported ASRs are single-seed point estimates with no error bars; because the algorithm involves random epsilon sampling and a fixed seed (3407), the reported margins need variance estimates or at least multiple seeds to be credible.
  4. [§5.4, Table 4] The runtime and VRAM claims are not documented at a level that allows reproduction. The table reports only approximate wall-clock times; it omits the DiffPGD configuration (number of DDIM steps, batch size, gradient checkpointing, etc.), and the VRAM numbers in Figure 1 do not appear in any table or experimental protocol. Please specify the exact hardware and DiffPGD configuration used, and report measured VRAM alongside runtime.
minor comments (5)
  1. [Algorithms 1 and 2] The for-loop variable t shadows the predefined diffusion timestep t in both algorithms. As written, 'xt_adv = sqrt(alpha_t) x_adv + sigma_t epsilon' uses the loop counter rather than the required timestep; rename the loop variable to i or similar.
  2. [Eq. (9), Algorithm 1] The notation 'log f_phi(xt_adv, t)' is ambiguous: f_phi outputs class probabilities, so the loss should specify the component corresponding to the true label y, as in Eq. (8).
  3. [§5.1 and Table 2] The terms 'full knowledge setting' and 'light gray' in Table 2 and Figure 1 are not clearly defined in the captions; please add a legend that explains which method has access to the purification model.
  4. [Appendix A.7] Using an ImageNet-256 time-dependent classifier for 512x512 MS COCO object detection is a resolution and domain mismatch; please discuss or validate this choice, for example by comparing with a classifier trained at the target resolution if one is available.
  5. [Appendix A.5 and §5.1] There are several typos: 'pertubration' in A.5, 'preform' in A.3/A.4, and 'Worth IQA scores' in §5.1 should be 'worse IQA scores.'

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack is an empirical method using an external time-dependent classifier, and transferability is measured on held-out victim models. The only flagged issue is test-set selection of the diffusion timestep t, which is an evaluation-bias concern rather than a derivational circularity.

full rationale

The derivation chain is not circular. The score loss L_s = log f_phi(x_t^adv, t) (Eq. 9) is defined directly from the externally pretrained time-dependent classifier of Dhariwal and Nichol [12]; no victim model or purification defense is used to define f_phi. The PGD updates in Eqs. 10 and 14 are standard optimization of that loss, and the reported attack success rates are measured on held-out architectures (ResNet101/18, WRN50/101, ViT, Swin) and against a diffusion-based purification defense configured as in DiffPGD's published settings. These are empirical outcomes, not consequences of the definition of the loss. The paper's claim that a time-dependent classifier 'inherently utilizes the same noising process' is a stated property of classifier-guided diffusion, not an input-output equivalence, and no load-bearing uniqueness theorem is imported. The self-citations in the paper ([2], [25]) are not load-bearing: [25] is cited alongside the external DiffPure paper [11], and removing it would not change the argument. The one caveat is that t = 20 is selected by ablating on the exact victim architectures and the exact defense (Appendix A.3-A.4; Limitation B: 'We are now choosing t for the time-dependent classifier by trial and error'). This is test-set selection bias and can inflate the headline numbers, so the comparison against DiffPGD is not fully independent. It is not, however, a circular derivation: Tables 5-8 show that t = 40 and t = 60 also outperform PGD in nearly all black-box columns and often match or exceed DiffPGD, so the central transferability claim does not reduce to the chosen t. Overall, no equation in the paper is equivalent to its own input by construction, and no fitted parameter is renamed as a prediction in the strict sense. Score 1 reflects only the selection-bias caveat, not circularity.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the reliability of an external pretrained time-dependent classifier and on the assumption that its score on one noisy sample supplies the same distributional guidance as full diffusion backprop. The only fitted selector in the method is the diffusion timestep t, tuned on the evaluation set. No new physical or mathematical entities are introduced.

free parameters (3)
  • Diffusion timestep t for the time-dependent classifier = 20
    Selected by trial and error from ablations on the exact victim models used in the main tables (Appendix A.3, A.4 and Limitation B); main results use t=20.
  • PGD iterations n and step size eta = n=10, eta=2/255 for gamma=16/255, eta=1/255 for gamma=8/255
    Standard PGD attack settings stated in Appendix A.2; conventional rather than fitted to data.
  • Relative weight between L_c and L_s in U-ScorePGD = 1 (simple subtraction in Eq. 13)
    The two losses are combined with equal weight; no weighting is tuned, and the limitation section notes that this can cause local maxima.
assumptions (5)
  • domain assumption The time-dependent classifier f_phi approximates the true posterior p_phi(y|x_t) well enough that minimizing its log-score redirects diffusion guidance (Eq. 4-5).
    Borrowed from classifier-guided diffusion [12]; the paper relies on this for L_s to be meaningful.
  • ad hoc to paper A single randomly noised sample x_t^adv gives a useful gradient signal for crafting transferable perturbations (Eq. 9, Algorithm 1).
    This is the paper's core hypothesis; the high-variance estimator is not analyzed theoretically.
  • domain assumption Transferability measured on ResNet, WRN, ViT and Swin models is representative of black-box attack effectiveness more broadly.
    Used to generalize from five architectures to 'diverse model architectures'.
  • domain assumption The ImageNet subset from [29] and the purification defense from [10] are adequate and comparably configured across methods.
    No subset size or defense hyperparameters are given; the paper defers to DiffPGD's setting.
  • ad hoc to paper A time-dependent classifier pretrained on ImageNet at 256x256 remains useful for 512x512 images and MS COCO object detection.
    Applies in Appendix A.7 where a 512x512 ImageNet classifier is used on COCO.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards more transferable adversarial attack in black-box manner." pith.science (2026). https://pith.science/paper/PKWXLRHI

@misc{pith2026250518097,
  author       = {Pith},
  title        = {Pith review of: Towards more transferable adversarial attack in black-box manner},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PKWXLRHI}},
  note         = {Machine review of arXiv:2505.18097}
}
read the original abstract

Adversarial attacks have become a well-explored domain, frequently serving as evaluation baselines for model robustness. Among these, black-box attacks based on transferability have received significant attention due to their practical applicability in real-world scenarios. Traditional black-box methods have generally focused on improving the optimization framework (e.g., utilizing momentum in MI-FGSM) to enhance transferability, rather than examining the dependency on surrogate white-box model architectures. Recent state-of-the-art approach DiffPGD has demonstrated enhanced transferability by employing diffusion-based adversarial purification models for adaptive attacks. The inductive bias of diffusion-based adversarial purification aligns naturally with the adversarial attack process, where both involving noise addition, reducing dependency on surrogate white-box model selection. However, the denoising process of diffusion models incurs substantial computational costs through chain rule derivation, manifested in excessive VRAM consumption and extended runtime. This progression prompts us to question whether introducing diffusion models is necessary. We hypothesize that a model sharing similar inductive bias to diffusion-based adversarial purification, combined with an appropriate loss function, could achieve comparable or superior transferability while dramatically reducing computational overhead. In this paper, we propose a novel loss function coupled with a unique surrogate model to validate our hypothesis. Our approach leverages the score of the time-dependent classifier from classifier-guided diffusion models, effectively incorporating natural data distribution knowledge into the adversarial optimization process. Experimental results demonstrate significantly improved transferability across diverse model architectures while maintaining robustness against diffusion-based defenses.

Figures

Figures reproduced from arXiv: 2505.18097 by the authors.

Figure 1
Figure 1. The above part shows that our method uses less runtime and VRAM compared to the current [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The illustration of our method. The fϕ(xt, t) is a classifier trained on noised image, with the noise scale up by timestep t. We calculate the cross entropy loss Lc, which is optional, and the log-likelihood of the ground truth label simultaneously. The variant with calculating Lc is U-ScorePGD, the variant without that is ScorePGD. Then we are trying to iteratively maximizing the cross entropy and minimizing the lo… view at source ↗
Figure 3
Figure 3. The illustration of the ScorePGD’s objective. Our method aims to change the guidance [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Visualization of the experiment ℓ2-based adversarial attack with setting in A.5. (a) Original Image. (b) Adversarial image of DiffPGD. (c) Perturbation of DiffPGD. (d) Adversarial image of U-ScorePGD (Ours). (e) Perturabtion of U-ScorePGD (Ours). We scale up the pertur…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

40 extracted references · 21 canonical work pages

  1. [1]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014

    work page 2014

  2. [2]

    A grey-box attack against latent diffusion model-based image editing by posterior collapse

    Zhongliang Guo, Chun Tong Lei, Lei Fang, Shuai Zhao, Yifei Qian, Jingyu Lin, Zeyu Wang, Cunjian Chen, Ognjen Arandjelovi ´c, and Chun Pong Lau. A grey-box attack against latent diffusion model-based image editing by posterior collapse. arXiv preprint arXiv:2408.10901, 2024

    arXiv 2024

  3. [3]

    A survey of recent backdoor attacks and defenses in large language models

    Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, Xiaoyu Xu, Xiaobao Wu, Jie Fu, Feng Yichao, Fengjun Pan, and Anh Tuan Luu. A survey of recent backdoor attacks and defenses in large language models. Transactions on Machine Learning Research, 2025. Survey Certification

    work page 2025

  4. [4]

    A white-box false positive adversarial attack method on contrastive loss based offline handwritten signature verification models

    Zhongliang Guo, Weiye Li, Yifei Qian, Ognjen Arandjelovic, and Lei Fang. A white-box false positive adversarial attack method on contrastive loss based offline handwritten signature verification models. In International Conference on Artificial Intelligence and Statistics, pages 901–909, 2024

    work page 2024

  5. [5]

    Threats and defenses in the federated learning life cycle: A comprehensive survey and challenges

    Yanli Li, Zhongliang Guo, Nan Yang, Huaming Chen, Dong Yuan, and Weiping Ding. Threats and defenses in the federated learning life cycle: A comprehensive survey and challenges. IEEE Transactions on Neural Networks and Learning Systems, pages 1–21, 2025

    work page 2025

  6. [6]

    Weak-to-strong backdoor attack for large language models

    Shuai Zhao, Leilei Gan, Zhongliang Guo, Xiaobao Wu, Luwei Xiao, Xiaoyu Xu, Cong-Duy Nguyen, and Luu Anh Tuan. Weak-to-strong backdoor attack for large language models. arXiv preprint arXiv:2409.17946, 2024

    arXiv 2024

  7. [7]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Ji Bo. Boosting adversarial attacks with momentum. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9185–9193, 2018

    work page 2018

  8. [8]

    Artwork protection against neural style transfer using locally adaptive adversarial color attack

    Zhongliang Guo, Junhao Dong, Yifei Qian, Kaixuan Wang, Weiye Li, Ziheng Guo, Yuheng Wang, Yanli Li, Ognjen Arandjelovi´c, and Lei Fang. Artwork protection against neural style transfer using locally adaptive adversarial color attack. In ECAI 2024, pages 1414–1421. IOS Press, 2024

    work page 2024

Show all 40 references
  1. [9]

    Meta-attack: Class-agnostic and model-agnostic physical adversarial attack

    Weiwei Feng, Baoyuan Wu, Tianzhu Zhang, Yong Zhang, and Yongdong Zhang. Meta-attack: Class-agnostic and model-agnostic physical adversarial attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 7787–7796, October 2021

    2021

  2. [10]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability.Advances in Neural Information Processing Systems, 36:2894–2921, 2023

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability.Advances in Neural Information Processing Systems, 36:2894–2921, 2023

    2023

  3. [11]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anand- kumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, pages 16805–16827, 2022

    2022

  4. [12]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans on image synthesis. arXiv preprint arXiv:2105.05233, 2021

    2021 arXiv

  5. [13]

    Explaining and harnessing adversar- ial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In International Conference on Learning Representations (ICLR), 2015

    2015

  6. [14]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

    2018

  7. [15]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

    Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248, 2017

    2017 arXiv

  8. [16]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pages 15–26,...

    2017

  9. [17]

    Transferability in machine learning: From phenomena to black-box attacks using adversarial samples

    Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: From phenomena to black-box attacks using adversarial samples. arxiv 2016. arXiv preprint arXiv:1605.07277, 2016

    2016 arXiv

  10. [18]

    Rethinking model ensemble in transfer-based adversarial attacks

    Huanran Chen, Yichi Zhang, Yinpeng Dong, Xiao Yang, Hang Su, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks. In International Conference on Learning Representations (ICLR), 2024

    2024

  11. [19]

    Understanding model ensemble in transferable adversarial attack

    Wei Yao, Zeliang Zhang, Huayi Tang, and Yong Liu. Understanding model ensemble in transferable adversarial attack. arXiv preprint arXiv:2410.06851, 2025

    2025 arXiv

  12. [20]

    Diffusion models for imperceptible and transferable adversarial attack

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    2024

  13. [21]

    Deep unsuper- vised learning using nonequilibrium thermodynamics

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. In International conference on machine learning, pages 2256–2265. pmlr, 2015

    2015

  14. [22]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840–6851, 2020

    2020

  15. [23]

    Classifier-free diffusion guidance

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598, 2022

    2022 arXiv

  16. [24]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10674–10685. IEEE, 2022

    2022

  17. [25]

    Instant ad- versarial purification with adversarial consistency distillation

    Chun Tong Lei, Hon Ming Yam, Zhongliang Guo, Yifei Qian, and Chun Pong Lau. Instant ad- versarial purification with adversarial consistency distillation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2025

    2025

  18. [26]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021

    2021

  19. [27]

    Variational diffusion models

    Diederik Kingma, Tim Salimans, Ben Poole, and Jonathan Ho. Variational diffusion models. Advances in neural information processing systems, 34:21696–21707, 2021

    2021

  20. [28]

    Score-based generative modeling through stochastic differential equations

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021

    2021

  21. [29]

    Nesterov accelerated gradient and scale invariance for adversarial attacks

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908.06281, 2019

    1908 arXiv

  22. [30]

    Imagenet: A large- scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255. IEEE, 2009

    2009

  23. [31]

    Deep residual learning for im- age recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016

    2016

  24. [32]

    Wide residual networks

    Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference 2016. British Machine Vision Association, 2016

    2016

  25. [33]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4):600– 612, 2004

    2004

  26. [34]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018

    2018

  27. [35]

    Pytorch: An imperative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in Neural Information Processing Systems, 32, 2019

    2019

  28. [36]

    David Picard. Torch. manual_seed (3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision. arXiv preprint arXiv:2109.08203, 2021. 11

    2021 arXiv

  29. [37]

    Very deep convolutional networks for large-scale image recognition

    K Simonyan and A Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations, 2015

    2015

  30. [38]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings...

    2014

  31. [39]

    Bench- marking detection transfer learning with vision transformers

    Yanghao Li, Saining Xie, Xinlei Chen, Piotr Dollar, Kaiming He, and Ross Girshick. Bench- marking detection transfer learning with vision transformers. arXiv preprint arXiv:2111.11429, 2021

    2021 arXiv

  32. [40]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in neural information processing systems, 28, 2015. 12 A Appendix A.1 Notation In this section, we provide the detailed description o...

    2015

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.