Pith. sign in

REVIEW 4 major objections 5 minor 30 references

The paper argues that masked autoencoders develop class-separable latent geometry during label-free pretraining, and that this geometry is why fine-tuned MAE stays accurate under blur and occlusion.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Masked Autoencoders build class-separable representations across depth and keep their embeddings directionally stable under blur and occlusion, which tracks their robust classification.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection Worth a serious referee, but only after the authors disclose the subspace rank k and add baselines; the central class-separation trend is plausible but currently rests on unreported knobs. the 4 major comments →

arxiv 2602.03531 v2 pith:Q66E7FYP submitted 2026-02-03 cs.LG cs.CV

Robust Representation Learning in Masked Autoencoders

Anika Shrivastava , Renu Rameshan , Samar Agnihotri This is my paper
classification cs.LG cs.CV
keywords Masked Autoencodersrepresentation learningself-supervised learningrobustnesssubspace analysisprincipal anglesattention mechanismsVision Transformer
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks why Masked Autoencoders, trained without labels to reconstruct missing image patches, classify so well and remain accurate when images are degraded. It argues that the MAE encoder progressively builds class-aware structure during pretraining: token embeddings for different classes become increasingly separable with depth, and their class-specific subspaces rotate apart. After fine-tuning, MAE keeps stable accuracy under Gaussian blur and attention-guided occlusion because its latent representations stay directionally aligned and its attention heads preserve their active features, until perturbations become extreme. The paper offers two quantitative sensitivity indicators that connect representation stability to classification robustness, giving a mechanistic explanation for a behavior previously observed only empirically.

Core claim

On the paper's own terms: a pretrained MAE encoder organizes its latent space by class even though it never saw labels. Class clusters appear in CLS, mean-patch, and raw patch token embeddings around the seventh through ninth layers and grow stronger in deeper layers. SVD-based class subspaces diverge progressively with depth, and MAE attention is global from the first layer, unlike standard Vision Transformers. After fine-tuning, top-1 accuracy stays above 80 percent under heavy blur and above 60 percent even when 90 percent of the most attended patches are occluded. The two proposed indicators—cosine alignment between clean and perturbed mean-patch embeddings, and per-head retention of com

What carries the argument

The central objects are class-specific subspaces built by SVD of patch-token matrices for each class at each encoder layer; principal angles between pairs of subspaces quantify how far classes rotate apart with depth. The robustness analysis rests on two indicators: cosine similarity between clean and perturbed mean-patch embeddings, and a common-feature count that tracks how many of the top-k active dimensions per attention head survive perturbation. Together they map accuracy changes to representation-level changes, and attention-distance measurements across layers explain why global context is available from the start.

Load-bearing premise

The main load-bearing assumption is that the unstated rank k used for the SVD class subspaces, together with the 10 ImageNet classes and 50 images per class, is representative of MAE's behavior across all classes; if the divergence trend depends strongly on k or on the selected classes, the central geometric claim would not generalize.

What would settle it

Repeat the principal-angle analysis at several values of k (for example, 1, 10, 50, 100, and 200) on the same 10 classes; if the layer-wise increase in the smallest principal angle is not monotonic or disappears for some k, the claim that class subspaces progressively diverge is an artifact of the chosen k. A second decisive test: run the same subspace analysis on all 1000 ImageNet classes or on a larger per-class sample; if the trend flattens, the 10-class result does not reflect global MAE structure.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Fine-tuned MAE keeps top-1 accuracy above 80 percent under the strongest Gaussian blur tested, even as PSNR drops from 28 to 20 dB, implying the mean-patch embedding retains class information when local detail is destroyed.
  • Attention-guided occlusion of the 50 percent most-attended patches leaves accuracy high, and even 90 percent occlusion retains 60.8 percent accuracy, implying the model does not depend on any single attended patch.
  • ImageNet-C results extend the robustness claim beyond blur and occlusion: weather, digital corruption, defocus blur, and motion blur show stable accuracy until high severity, with noise-based corruptions declining more steeply.
  • Correctly classified images have high cosine similarity between clean and perturbed embeddings (about 0.915) while misclassified images have much lower similarity (about 0.289), so directional alignment is a representation-level correlate of correctness.
  • The layer at which class clusters emerge (layers 7-9) is where MAE's latent space first becomes class-aware, providing a natural depth marker for future transfer or probing.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The subspace-divergence measure could be run on other masked-image models to test whether class-separable geometry is unique to MAE or a general property of masked reconstruction; the paper does not make that comparison.
  • If directional alignment is a reliable proxy for correctness, the same cosine-similarity indicator could serve as a test-time uncertainty signal: when a perturbed embedding rotates away from the clean direction, confidence should be discounted.
  • The pronounced collapse at roughly 60 percent occlusion, visible in both accuracy and feature retention, suggests a capacity limit of the learned representation that could be compared across models or training recipes.
  • Because MAE attends globally from early layers, attention-rollout-based occlusion may be inherently less damaging for MAE than for a standard ViT; the paper's attention-distance result implies this, though it does not directly compare the two under identical occlusion.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper analyzes a pretrained MAE ViT-B/16 on ImageNet and claims that (i) the pretrained encoder progressively builds class-separable structure across depth, visible in CLS, mean-patch, and raw patch token embeddings; (ii) class-specific subspaces rotate apart with depth; (iii) after fine-tuning, MAE remains accurate under Gaussian blur and attention-guided occlusion, with supporting ImageNet-C results; and (iv) two proposed indicators—directional alignment and head-wise active-feature retention—quantify representation robustness and track classification performance. The evidence includes t-SNE visualizations, attention-distance measurements, principal-angle box plots, accuracy tables, cosine-similarity tables, and feature-retention heatmaps.

Significance. If substantiated, this would be a useful empirical contribution to MAE interpretability, especially the layer-wise subspace geometry and the attention-guided occlusion protocol. The paper uses a standard public architecture, evaluates on a broad corruption set (ImageNet-C), and introduces two simple, interpretable robustness indicators. However, the central geometric claim and the quantitative robustness results are currently under-specified: the analysis depends on unreported rank/feature-count hyperparameters, the robustness comparison lacks any baseline model, and the accuracy numbers have no error bars. These gaps are fixable but need to be addressed before the paper can support its conclusions.

major comments (4)
  1. [III-A3, III-B2, IV-A2, Figs. 4, 6–8] The subspace rank k is never reported. Section III-A3 says class subspaces retain 'the top-k singular vectors' and calls the restriction 'more for convenience of analysis,' but no k is given for Figure 4. This is load-bearing because principal angles between k-dimensional subspaces of R^768 are highly sensitive to k: for 2k > 768 generic subspaces intersect, forcing the smallest principal angle theta_1 to 0, while for very small k the angles are noisy. The observed increasing trend could be an artifact of one favorable k. Please report k and provide a k-sweep (e.g., k = 1, 2, 4, 8, 16, 32, 64) showing that Figure 4's trend is stable. The same problem affects the feature-retention analysis: in Section III-B2, 'top-k active features' is only illustrated with k=10, and the actual k used for Figures 6–8 is not stated, making those heatmaps non-reproducible. A sensitivity analysis for the 60%
  2. [Introduction, IV-B, V] The paper repeatedly contrasts MAE with 'ViTs' and concludes that MAE maintains robust classification performance, but no supervised ViT or other SSL baseline is evaluated under the same perturbations. Tables I–II and Figure 5 report absolute accuracies for a single fine-tuned MAE on ten ImageNet classes. Without a supervised ViT-B/16 (or another SSL method) trained and evaluated under the identical blur/occlusion/ImageNet-C protocol, the comparative claim 'robust compared to ViTs' is unsupported. The authors should either add such baselines or explicitly weaken the claims to state that MAE retains high absolute accuracy under these degradations.
  3. [IV-B, Tables I–II, Fig. 5] No error bars, confidence intervals, repetition counts, or seeds are reported for the accuracy numbers. The evaluation appears to use 10 classes with 50 images each (approximately 500 images), so adjacent accuracy values such as 87.6% vs. 87.4% in Table I are within binomial sampling error. The claim that accuracy 'remains stable' across a wide perturbation range needs support from bootstrap confidence intervals or multiple evaluation runs; otherwise the observed stability may be an artifact of a small sample.
  4. [IV-B] The classifier used to produce the accuracy results is under-specified. The text says predictions are made 'based on mean patch embedding \bar z^{(l)}' but does not state which layer l is used, how the classifier is trained, what head architecture is used, or whether the fine-tuned MAE model is taken from the original MAE repository with its default classification head. Without these details, Tables I–II and Figure 5 cannot be reproduced, and the claimed link between representational robustness and classification accuracy cannot be independently checked.
minor comments (5)
  1. [III-A3, IV-A1, IV-A2] The class subsets and image sampling are not fully specified: Section IV-A1 uses 90 images from three ImageNet-1K classes, while Section IV-A2 uses ten classes with 50 images per class, but the class identities and random seed are not reported. Please provide them for reproducibility.
  2. [III-B2, IV-C] Directional robustness, as defined by Eq. (1), is essentially a statement that perturbed embeddings remain in the same direction as clean embeddings. Calling this 'robustness' is partly a restatement of the metric. The paper should soften this framing and rely more on the classification-accuracy link, which is currently only anecdotal (the correct-vs-misclassified cosine comparison in Section IV-C has no sample sizes or statistical test).
  3. [Throughout] There are several typos and infelicities: 'prinicpal angles' (III-A3), 'covenience' (III-A3), 'perturbated' (V), and 'Imagenet-1K' should be 'ImageNet-1K' for consistency. Please also clarify in Section III-A1 whether the stated masking ratio (0.75, N_v=49) applies to pretraining only or also to inference/perturbation experiments.
  4. [IV-A1, Fig. 3] The attention-distance figure for standard ViT is reproduced or adapted from [9]. Please confirm that permission/reproduction guidelines are followed and clearly state how attention distances are computed for MAE when 'no masking' is used, since the pretrained MAE was trained with 75% masking.
  5. [General] No code or model checkpoints are provided. Given the number of unstated hyperparameters (k, top-k, thresholds, seeds), releasing evaluation code would substantially improve reproducibility.

Circularity Check

0 steps flagged

No significant circularity: robustness metrics are operational measurements, and the central claims are anchored by independent accuracy evaluations; the unstated rank k is a reproducibility issue, not a circular reduction.

full rationale

The paper is an empirical characterization rather than a derivation that fits parameters and then predicts them. The robustness indicators are explicitly operationalized: the authors state, 'We use robustness in the sense that the representation does not change much even when the input is perturbed.' Directional alignment is defined as cosine similarity in Eq. (1), and feature retention is defined via common-feature counts and intersection cardinality; these are direct measurements of representation stability. Calling these measurements 'robustness' is a naming choice, not a circular derivation, because the paper also validates robustness with independent accuracy measurements on the same perturbations (Tables I-II, Figure 5) and on ImageNet-C (Table II). Similarly, the class-subspace separation claim in Figure 4 is computed from SVD principal angles of MAE embeddings and is not derived from or fitted to the reported cosine-similarity or feature-retention results. No fitted parameter is renamed as a prediction, and no load-bearing self-citation appears in the reference list. The main methodological weakness is the unreported rank k in Section III-A3, where the paper says 'Restricting the analysis to the leading k directions is more for covenience of analysis,' and no k is given for Figures 4 or 6-8; this is a reproducibility defect, not a circularity. Under the required standard of exhibiting a specific reduction of a prediction to its inputs, no circular step can be identified.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The central claims rest on two hand-chosen analysis knobs (subspace rank k and active-feature selection), a small hand-picked dataset subset, and the assumption that attention rollout and mean-patch embeddings faithfully represent model behavior. No new physical or architectural entities are introduced.

free parameters (4)
  • subspace rank k = not reported
    Section III-A3: class subspaces are built from top-k singular vectors; k is never specified, yet the principal-angle separation results depend on it.
  • top-k active features = not reported (example k=10)
    Section III-B2: common features are defined as the top-k active features per head; the actual k used in experiments is not stated.
  • common-feature threshold = 60%
    Section III-B2: a feature is considered common within a class if active in at least 60% of images; this hand-chosen threshold controls the feature-retention counts.
  • class/image subset sizes = 10 classes, 50 images each; 90 images for t-SNE
    Section IV-A: all geometric and robustness claims are computed on a small, hand-picked ImageNet subset, which is assumed to represent global MAE behavior.
axioms (5)
  • standard math Top-k SVD principal angles capture meaningful class separation in embedding space.
    Section III-A3: the paper assumes the leading singular directions define the class subspace and that the smallest principal angle is a valid separation measure.
  • domain assumption The selected 10 ImageNet classes and 50 images per class are representative of MAE's global representational behavior.
    Section IV-A: no evidence is provided that the subset reflects the full ImageNet distribution.
  • domain assumption Mean patch embedding is an effective representation for classification.
    Section III-A2: the paper relies on mean patch embeddings for robustness evaluation, citing [4], but does not verify this for the fine-tuned model.
  • domain assumption Attention rollout accurately identifies the patches most important to the model's prediction.
    Section III-B1: attention-guided occlusion uses rollout scores from [24] as ground-truth importance; this is an approximate interpretation of attention.
  • ad hoc to paper The 60% common-feature threshold and top-k active-feature definition capture meaningful head-level behavior.
    Section III-B2: these thresholds are chosen for the analysis without derivation or sensitivity study, yet they drive the feature-retention indicator.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Representation Learning in Masked Autoencoders." pith.science (2026). https://pith.science/paper/Q66E7FYP

@misc{pith2026260203531,
  author       = {Pith},
  title        = {Pith review of: Robust Representation Learning in Masked Autoencoders},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Q66E7FYP}},
  note         = {Machine review of arXiv:2602.03531}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Masked Autoencoders (MAEs) achieve impressive performance in image classification tasks, yet the internal representations they learn remain less understood. This work started as an attempt to understand the strong downstream classification performance of MAE. In this process we discover that representations learned with the pretraining and fine-tuning, are quite robust -- demonstrating a good classification performance in the presence of degradations, such as blur and occlusions. Through layer-wise analysis of token embeddings, we show that pretrained MAE progressively constructs its latent space in a class-aware manner across network depth: embeddings from different classes lie in subspaces that become increasingly separable. We further observe that MAE exhibits early and persistent global attention across encoder layers, in contrast to standard Vision Transformers (ViTs). To quantify feature robustness, we introduce two sensitivity indicators: directional alignment between clean and perturbed embeddings, and head-wise retention of active features under degradations. These studies help establish the robust classification performance of MAEs.

Figures

Figures reproduced from arXiv: 2602.03531 by Anika Shrivastava, Renu Rameshan, Samar Agnihotri.

Figure 1
Figure 1. Figure 1: t-SNE visualizations of token embeddings across encoder layers: (a) CLS tokens and (b) mean patch tokens. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: t-SNE visualization of patch tokens across encoder layers. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Each dot shows the mean attention distance across images for one head in [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Layer-wise distribution of principal angles [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Occlusion level vs Accuracy plot on ImageNet-1K dataset. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Heatmap of common feature counts under Gaussian blur. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Heatmap of common feature counts under attention-guided occlusion perturbations. [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Average drop from C pl,hq clean for (a) Gaussian blur and (b) attention-guided occlusion perturbations. highest severity level. This behavior is further supported by our evaluation on ImageNet-C, which reveals robust performance across a broad set of algorithmically generated degradations. To better understand this robustness, we examine representation robustness from two complementary viewpoints. Under mo… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

30 extracted references · 12 linked inside Pith

  1. [1]

    K. He, H. Fan, Y . Wu, S. Xie, and R. Girshick: Momentum contrast for unsupervised visual representation learning. In: Proc. of CVPR, pp. 9729–9738, (2020a)

  2. [2]

    Baevski, W

    A. Baevski, W. N. Hsu, Q. Xu, A. Babu, J. Gu, and M. Auli: Data2vec: A general framework for self-supervised learning in speech, vision and language. In: Proc. of ICML pp. 1298-1312. PMLR, (2022)

    2022

  3. [3]

    M. Tan, R. Pang, and Q. V . Le: Efficientdet: Scalable and efficient object detection. In: Proc. of CVPR, pp. 10781–10790, (2020)

    2020

  4. [4]

    K. He, X. Chen, S. Xie, Y . Li, P. Doll ´ar, and R. Girshick: Masked autoencoders are scalable vision learners. In: arXiv preprint: 2111.06377, (2021)

    Pith/arXiv arXiv 2021

  5. [5]

    P. Gao, T. Ma, H. Li, Z. Lin, J. Dai, and Y . Qiao: ConvMAE: Masked convolution meets masked autoencoders. In: arXiv preprint: 2205.03892, (2022)

    Pith/arXiv arXiv 2022

  6. [6]

    H. Bao, L. Dong, S. Piao, and F. Wei: BEit: BERT pre-training of image transformers. In: Proc. of ICLR, (2022)

    2022

  7. [7]

    Z. Xie, Z. Zhang, Y . Cao, Y . Lin, J. Bao, Z. Yao, Q. Dai, and H. Hu: SimMIM: A simple framework for masked image modeling. In: Proc. of CVPR, (2022)

    2022

  8. [8]

    Devlin, M.-W

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova: Bert: Pre-training of deep bidirectional transformers for language understanding. In: Proc. of NAACL, vol. 1, pp. 4171–4186, (2019)

    2019

  9. [9]

    Dosovitskiy, L

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby: An image is worth 16x16 words: Transformers for image recognition at scale. In: arXiv preprint:2010.11929, (2020)

    Pith/arXiv arXiv 2010

  10. [10]

    L. Fu, L. Lian, R. Wang, B. Shi, X. Wang, A. Yala, T. Darrell, A. A. Efros, and K. Goldberg: Rethinking patch dependence for masked autoencoders. In: arXiv preprint: 2401.14391, (2024)

    Pith/arXiv arXiv 2024

  11. [11]

    J. Liu, X. Huang, J. Zheng, Y . Liu, and H. Li: MixMIM: Mixed and masked image modeling for efficient visual representation learning. In: arXiv preprint:2205.13137, (2022)

    Pith/arXiv arXiv 2022

  12. [12]

    G. Li, H. Zheng, D. Liu, C. Wang, B. Su, and C. Zheng: SemMAE: Semantic-guided masking for learning masked autoencoders. In: Proc. of NeuRIPS, 35:14290–14302, (2022)

    2022

  13. [13]

    S. Cao, P. Xu, and D. A. Clifton: How to understand masked autoencoders. In: arXiv preprint:2202.03670, (2022)

    Pith/arXiv arXiv 2022

  14. [14]

    L. Kong, M. Q. Ma, G. Chen, E. P. Xing, Y . Chi, L.-P. Morency, and K. Zhang: Understanding masked autoencoders via hierarchical latent variable models. In: Proc. of CVPR, pp. 7918-7928, (2023)

    2023

  15. [15]

    Zhang, Y

    Q. Zhang, Y . Wang, and Y . Wang: How mask matters: Towards theoretical understandings of masked autoencoders. In: NeuRIPS, 35:27127–27139, (2022)

    2022

  16. [16]

    Vincent, H

    P. Vincent, H. Larochelle, I. Lajoie, Y . Bengio, and P.-A. Manzagol: Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion. Journal of machine learning research, vol. 11, no. 12, (2010)

    2010

  17. [17]

    Ramesh, M

    A. Ramesh, M. Pavlov, G. Goh, S. Gray, C. V oss, A. Radford, M. Chen, and I. Sutskever: Zero-shot text-to-image generation. In: ICML, pages 8821–8831. PMLR, (2021)

    2021

  18. [18]

    X. Chen, M. Ding, X. Wang, Y . Xin, S. Mo, Y . Wang, S. Han, P. Luo, G. Zeng, and J. Wang: Context autoencoder for self-supervised representation learning. IJCV , vol. 132(1), pp. 208-223, (2024)

    2024

  19. [19]

    J. Zhou, C. Wei, H. Wang, W. Shen, C. Xie, A. Yuille, and T. Kong: iBot: Image bert pre-training with online tokenizer. In: arXiv preprint: 2111.07832, (2021)

    Pith/arXiv arXiv 2021

  20. [20]

    Kong and X

    X. Kong and X. Zhang: Understanding masked image modeling via learning occlusion invariant feature. In: Proc. of CVPR, pp. 6241–6251, (2023)

    2023

  21. [21]

    X. Yue, L. Bai, M. Wei, J. Pang, X. Liu, L. Zhou, and W. Ouyang: Understanding masked autoencoders from a local contrastive perspective. In: arXiv preprint:2310.01994, (2023)

    Pith/arXiv arXiv 2023

  22. [22]

    van der Maaten and G

    L. van der Maaten and G. Hinton: Visualizing data using t-sne. Journal of Machine Learning Research, vol. 9, no. 11, pp. 2579–2605, (2008)

    2008

  23. [23]

    Zhu and A

    P. Zhu and A. V . Knyazev: Angles between subspaces and their tangents. In: arXiv preprint:1209.0523, (2012)

    Pith/arXiv arXiv 2012

  24. [24]

    Abnar and W

    S. Abnar and W. Zuidema: Quantifying attention flow in transformers. In: arXiv preprint:2005.00928, (2020)

    Pith/arXiv arXiv 2005

  25. [25]

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei: ImageNet: A large-scale hierarchical image database. In: Proc. of CVPR, Miami, FL, USA, March (2009)

    2009

  26. [26]

    B. Heo, S. Yun, D. Han, S. Chun, J. Choe, and S. J. Oh: Rethinking spatial dimensions of vision transformers. In: Proc. of ICCV , pp. 11936–11945, (2021)

    2021

  27. [27]

    Kirillov, E

    A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y . Lo, P. Doll ´ar, and R. Girshick: Segment anything dataset, arXiv:2304.02643, (2023)

    Pith/arXiv arXiv 2023

  28. [28]

    Hendrycks and T

    D. Hendrycks and T. Dietterich: Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint:1903.12261, (2019)

    Pith/arXiv arXiv 1903

  29. [29]

    Hendrycks, S

    D. Hendrycks, S. Basart, N. Mu, S. Kadavath, F. Wang, E. Dorundo, R. Desai, T. Zhu, S. Parajuli, M. Guo, D. Song, J. Steinhardt, and J. Gilmer: The many faces of robustness: A critical analysis of out-of-distribution generalization. In: Proc. of the IEEE/CVF ICCV , pp. 8340-8349, (2021)

    2021

  30. [30]

    Hendrycks, K

    D. Hendrycks, K. Zhao, S. Basart, J. Steinhardt, and D. Song: Natural adversarial examples. In: Proc. of the IEEE/CVF CVPR, pp. 15262-15271, (2021)

    2021

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.