Pith. sign in

REVIEW 4 major objections 4 minor 40 references

Robust Convolution Neural ODEs via Contractivity-promoting regularization

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Contractivity-promoting regularization makes convolutional neural ODEs robust to noise and attacks.

desk verdict Solid empirical paper with a clean new regularizer; the theory-mechanism link is unverified, but the results are strong enough to warrant peer review. read the letter →

arxiv 2508.11432 v1 pith:SHSNC476 submitted 2025-08-15 cs.LG cs.CVcs.SYeess.SY

Muhammad Zakwan , Liang Xu , Giancarlo Ferrari-Trecate This is my paper · ORCID
classification cs.LGcs.CVcs.SYeess.SY
keywords NeuralODEcontractiontheoryadversarialrobustnessregularizationconvolutionalNODEGeršgorintheoremMNISTFashion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that convolutional neural ODEs can be made substantially more robust to input noise and adversarial attacks by training them with a regularization term derived from contraction theory. Contractive dynamics guarantee that perturbed trajectories converge to each other exponentially fast, which limits how much a small input perturbation can change the output. The authors prove a sufficient condition on the weight matrices of NODEs with slope-restricted activations (Theorem 1) that guarantees contractivity, and translate it into a simple filter-based regularizer for convolutional layers. In experiments on MNIST and FashionMNIST, the regularized models improve average test accuracy by up to 34% under Gaussian noise and up to 30% under FGSM/PGD attacks, with no loss of clean accuracy.

What carries the argument

The load-bearing object is the row-wise diagonal-dominance condition (8), $-\rho - 2\kappa W_{ii} - \bar{\kappa}\sum_{j\neq i}(|W_{ij}| + |W_{ji}|) > 0$. It is a sufficient condition, derived via the Ger\v{s}gorin disk theorem, for the NODE (7) to be contractive. The work it does: it converts a global, state-dependent Jacobian inequality (5) into a simple constraint that depends only on the weights (or convolution filters), so contractivity can be promoted by adding the penalty (11) or its convolutional version (14) to the training loss.

What would settle it

Check whether trained CNODEs actually satisfy condition (8) or the Jacobian inequality (5) on the sampled states. If a large fraction of trained models violate these conditions yet still show the reported robustness gains, the improvement is not explained by the proven contractivity condition.

Watch

Extended reading notes

Core claim

The central claim is that robustness of convolutional NODEs can be promoted by regularizing the network weights rather than computing and penalizing the Jacobian at every state. Theorem 1 states that if the activation slopes lie in $[\kappa, \bar{\kappa}]$ and the weights satisfy $-\rho - 2\kappa W_{ii} - \bar{\kappa}\sum_{j\neq i}(|W_{ij}|+|W_{ji}|) > 0$ for every row $i$, then the NODE $\dot{x} = \sigma(W_t x + b)$ is contractive with rate $\rho$. The proof uses the Ger\v{s}gorin disk theorem on the Hermitian part of the Jacobian. Using Lemma 1, which relates the weight-matrix entries of a convolution to the convolution filters, the condition becomes a per-filter penalty $\psi(C^i_j, \rho,

Load-bearing premise

The proof guarantees contractivity for the continuous-time ODE under condition (8), but training uses a soft penalty on discretized weights; the paper assumes this penalty makes the trained networks actually contractive enough, and that the non-contractive encoder and decoder layers do not undo the robustness.

Editorial extensions

If this is right

  • If true, robustness for NODE-based classifiers can be bought with a cheap weight penalty, without adversarial training or Jacobian computations.
  • Contractive NODEs remain accurate on clean data while reducing sensitivity to perturbation strength, as the reported standard deviations are the same or lower than vanilla NODEs in almost all experiments.
  • The sufficient condition can be used to parameterize contractive NODEs by construction (Remark 3), not just as a soft penalty.
  • The regularizer generalizes across convolution filter sizes (3×3, 5×5, 7×7) and is insensitive to the contraction rate $\rho$ and penalty weight $\gamma$ per the appendix studies.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: Because condition (8) is sufficient but not necessary, the robustness gains in the experiments may be obtainable with even weaker penalties, or conversely, the training-time $\rho$ may be conservative compared with the actual contraction of trained networks.
  • Inference: The same filter-based penalty could plausibly extend to other continuous-depth architectures (e.g., Hamiltonian NODEs or implicit networks) whose dynamics can be written with slope-restricted activations, though the paper only treats the NODE form (7).
  • Inference: The transferability result suggests contractivity regularization does not rely on gradient masking, so it may compose with adversarial training; the paper does not test this combination, but it is a natural next experiment.
  • Inference: A direct verification of condition (8) or the Jacobian inequality (5) on trained CNODE weights would close the gap between the continuous-time theorem and the discrete-time model actually used; the paper does not report such measurements.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes to improve the robustness of convolutional Neural ODEs (NODEs) by promoting contractivity through weight regularization. For the NODE class \dot{x} = \sigma(W_t x_t + b_t), Theorem 1 gives a Gershgorin-based sufficient condition (8) on W_t for contractivity. The authors then derive a filter-based regularizer (14) using Lemma 1, avoiding explicit Jacobian computation. They evaluate vanilla NODEs and regularized CNODEs on MNIST and FashionMNIST under Gaussian noise, salt-and-pepper noise, FGSM, and PGD attacks, reporting up to 34% and 30% accuracy improvements, with 10 seeds, hyperparameter sensitivity studies, and a transferability check.

Significance. If the theoretical bridge were sound, this would be a valuable, computationally cheap method for improving NODE robustness with a contraction-theoretic justification. The empirical study is extensive: multiple noise types and strengths, 10 seeds, ablations over \rho, \gamma, and convolution filter sizes, and a transferability study. Theorem 1 itself is correct given its assumptions. However, the connection between the proven sufficient condition and the implemented regularizer is flawed as written, and the trained networks are never verified to be contractive, so the central mechanism is not established by the current manuscript.

major comments (4)
  1. [III-A, Eqs. (8) and (11)] Condition (8) is equivalent to \rho + 2\kappa W_{ii} + \bar\kappa \sum_{j\ne i}(|W_{ij}|+|W_{ji}|) < 0. The regularizer in (11) uses \phi = \rho + 2(\kappa+\bar\kappa)W_{ii} + \bar\kappa \sum_{j=1}^n (|W_{ij}|+|W_{ji}|). If the sum includes j=i, the extra term 2\bar\kappa|W_{ii}| (when W_{ii}<0) makes \phi smaller than the left-hand side of (8), so \phi can be negative even when (8) is violated; if the sum is intended to run over j\ne i, the coefficient of W_{ii} is wrong. Either way, the positive-part penalty is not a faithful proxy for the sufficient condition. The same issue propagates to (14). This needs to be corrected and the derivation stated explicitly.
  2. [IV and Appendices V-B to V-E] The paper never reports whether the trained CNODEs actually satisfy (8) or the Jacobian condition (5). Since \gamma=1 is a soft penalty, the regularizer does not enforce contractivity. Without this verification, the observed robustness gains cannot be attributed to the contraction mechanism; they could be caused by generic weight shrinkage. I request a post-training evaluation of \phi (or of the symmetric Jacobian's minimum eigenvalue) on the trained models, ideally per layer and across seeds.
  3. [II-A] The contractivity bound (4) applies to the NODE state x_t as a function of the initial condition x_0. The full classifier is x_0 = h_\alpha(z), y = g_\beta(x_T). The paper explicitly omits h_\alpha and g_\beta, yet the attacks in Section IV are applied to the raw image z. Without Lipschitz bounds on h_\alpha and g_\beta, contractivity of the NODE alone does not yield an input-to-output robustness guarantee. This limitation should be stated and addressed, for example by reporting or constraining the Lipschitz constants of the pre- and post-processing layers.
  4. [II-A, Eq. (2)] Theorem 1 is for the continuous-time ODE (7). Training and inference use the Forward Euler discretization (2) with h=0.01. Contractivity of the continuous flow does not automatically transfer to the discretized map for a given step size. The paper should either prove a discrete-time counterpart or verify contractivity of the trained discrete network, for example by checking the Jacobian of one Euler step. This is especially important because all robustness experiments are performed on the discrete network.
minor comments (4)
  1. [III, Eq. (6)] The notation \lambda_{\min}(\Gamma(x)|_{x_i^k,k}) is unclear and not formally defined. Please clarify how the sampled states and time indices enter the Jacobian evaluation.
  2. [Remark 5 and IV] Omitting the factor P\times H in (14) and absorbing it into \gamma changes the effective regularization strength. For reproducibility, please report the effective product \gamma/(P\times H) or the actual value used.
  3. [Appendix V-A] The activation \sigma(x)=0.1x+0.9\log(1+e^x) is called 'smooth leaky ReLU'; the derivative range is stated correctly. Minor terminology: 'shorthand notion' should be 'shorthand notation', and the sentence following (14) is a fragment.
  4. [Table III] The table and accompanying text would be clearer if the rows were labeled 'white-box on CNODE' and 'transfer from vanilla NODE' in the caption itself, rather than only in the prose.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the contractivity regularizer is derived from a proven sufficient condition and the robustness gains are measured on corrupted test images rather than read back from the regularization term.

full rationale

The paper's derivation chain is: Theorem 1 proves that condition (8) (a Gershgorin sufficient condition on W_t) makes the continuous-time NODE (7) contractive; the regularizers (11) and (14) are then constructed by penalizing violations of exactly that condition (with the convolution bound from Lemma 1), and the reported 34%/30% improvements are test-set accuracies under noise and attacks for CNODE vs vanilla NODE. Nothing in this chain defines robustness as the regularizer, and no fitted parameter is renamed as a prediction: gamma and rho are selected by grid search, but the paper shows insensitivity across rho and gamma and the gains persist for different filter sizes, so the comparison is not forced by construction. The self-citations ([14], [26], [29]) are related-work or illustrative and are not load-bearing: the key theorem is proved in the paper, and the clean-accuracy claim is independently supported by the paper's own experiments. The paper explicitly says the regularizer only promotes contractivity locally (Section III) and does not verify that trained CNODEs satisfy (8); this is an evidence gap about whether contractivity is the operative mechanism, not a circular reduction. The robustness gains could partly stem from generic weight shrinkage, but the regularizer is derived from the sufficient condition rather than fitted to the test data. No step reduces, by the paper's own equations, to its inputs.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard contraction theory plus one prior lemma about convolution matrices. The main unstated input is that regularizing discrete-time weights with a continuous-time condition produces the intended contractivity; this is plausible but not verified on trained models.

free parameters (2)
  • contraction rate rho = 2
    Selected by grid search on MNIST (values 0.1, 2, 5, 7, 10, 12, 15); sensitivity analysis in Appendix V-B shows accuracy is insensitive. Used for all experiments.
  • regularization weight gamma = 1
    Selected by grid search on MNIST (values 0.1, 1, 5, 10, 20, 30, 40, 50); sensitivity analysis in Appendix V-C shows accuracy is insensitive.
assumptions (5)
  • standard math The Jacobian inequality (5) is equivalent to contractivity of (1) with rate rho (from [16]).
    Invoked in Section II-B to justify regularizer (6).
  • standard math Gershgorin disk theorem: a strictly diagonally dominant matrix is positive definite.
    Used in the proof of Theorem 1, Section III-A.
  • domain assumption Lemma 1 from [36] relating convolution filter elements to the weight matrix W.
    Used in Section III-B to derive the filter regularizer (14).
  • domain assumption The continuous-time contractivity sufficient condition applies to the forward-Euler discretized weights W_k during training.
    Assumed in Sections III-A/B; the paper does not prove that discretization preserves contractivity or that the soft penalty makes the trained model contractive.
  • domain assumption Activation slopes lie in [kappa, kappa_bar] with kappa > 0.
    Theorem 1 requires this; experiments use smooth leaky ReLU with slopes in [0.1, 1].

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Convolution Neural ODEs via Contractivity-promoting regularization." pith.science (2026). https://pith.science/paper/SHSNC476

@misc{pith2026250811432,
  author       = {Pith},
  title        = {Pith review of: Robust Convolution Neural ODEs via Contractivity-promoting regularization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SHSNC476}},
  note         = {Machine review of arXiv:2508.11432}
}
read the original abstract

Neural networks can be fragile to input noise and adversarial attacks. In this work, we consider Convolutional Neural Ordinary Differential Equations (NODEs), a family of continuous-depth neural networks represented by dynamical systems, and propose to use contraction theory to improve their robustness. For a contractive dynamical system two trajectories starting from different initial conditions converge to each other exponentially fast. Contractive Convolutional NODEs can enjoy increased robustness as slight perturbations of the features do not cause a significant change in the output. Contractivity can be induced during training by using a regularization term involving the Jacobian of the system dynamics. To reduce the computational burden, we show that it can also be promoted using carefully selected weight regularization terms for a class of NODEs with slope-restricted activation functions. The performance of the proposed regularizers is illustrated through benchmark image classification tasks on MNIST and FashionMNIST datasets, where images are corrupted by different kinds of noise and attacks.

Figures

Figures reproduced from arXiv: 2508.11432 by the authors.

Figure 1
Figure 1. Classification accuracy on the clean test dataset with respect to [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 3
Figure 3. Classification accuracy on test dataset perturbed by FGSM attacks [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 6
Figure 6. Classification accuracy on test dataset perturbed FGSM attacks [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Classification accuracy on test dataset perturbed by Gaussian noise [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 34 canonical work pages

  1. [1]

    Adversarial attacks and defenses in images, graphs and text: A review,

    H. Xu, Y . Ma, H.-C. Liu, D. Deb, H. Liu, J.-L. Tang, and A. K. Jain, “Adversarial attacks and defenses in images, graphs and text: A review,”International Journal of Automation and Computing , vol. 17, no. 2, pp. 151–178, 2020

    work page 2020

  2. [2]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfel- low, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  3. [3]

    Adversarial learning target- ing deep neural network classification: A comprehensive review of defenses against attacks,

    D. J. Miller, Z. Xiang, and G. Kesidis, “Adversarial learning target- ing deep neural network classification: A comprehensive review of defenses against attacks,” Proceedings of the IEEE , vol. 108, no. 3, pp. 402–433, 2020

    work page 2020

  4. [4]

    Explaining and harness- ing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    arXiv 2014

  5. [5]

    Feature purification: How adversarial training performs robust deep learning,

    Z. Allen-Zhu and Y . Li, “Feature purification: How adversarial training performs robust deep learning,” in IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS) , pp. 977–988, IEEE, 2022

    work page 2022

  6. [6]

    Distillation as a defense to adversarial perturbations against deep neural networks,

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in IEEE symposium on security and privacy (SP) , pp. 582–597, IEEE, 2016

    work page 2016

  7. [7]

    Training robust neural networks using Lipschitz bounds,

    P. Pauli, A. Koch, J. Berberich, P. Kohler, and F. Allg ¨ower, “Training robust neural networks using Lipschitz bounds,” IEEE Control Systems Letters, vol. 6, pp. 121–126, 2021

    2021

  8. [8]

    Robust- ness against adversarial attacks in neural networks using incremental dissipativity,

    B. Aquino, A. Rahnama, P. Seiler, L. Lin, and V . Gupta, “Robust- ness against adversarial attacks in neural networks using incremental dissipativity,” IEEE Control Systems Letters , vol. 6, pp. 2341–2346, 2022. TABLE I CLASSIFICATION ACCURACY OVER NOISY AND ADVERSARIAL TEST IMAGES (MEAN ± STANDARD DEVIATION ). No Noise Gaussian Salt&Pepper FGSM PGD MNIST...

    work page 2022

Show all 40 references
  1. [9]

    Stable architectures for deep neural networks,

    E. Haber and L. Ruthotto, “Stable architectures for deep neural networks,” Inverse Problems, vol. 34, no. 1, p. 014004, 2017

    2017

  2. [10]

    Neural ordinary differential equations,

    R. T. Chen, Y . Rubanova, J. Bettencourt, and D. K. Duvenaud, “Neural ordinary differential equations,” in Advances in neural information processing systems, vol. 31, 2018

    2018

  3. [11]

    Latent ordinary differential equations for irregularly-sampled time series,

    Y . Rubanova, R. T. Chen, and D. K. Duvenaud, “Latent ordinary differential equations for irregularly-sampled time series,” in Advances in neural information processing systems , vol. 32, 2019

    2019

  4. [12]

    Hamiltonian neural networks,

    S. Greydanus, M. Dzamba, and J. Yosinski, “Hamiltonian neural networks,” in Advances in Neural Information Processing Systems , vol. 32, 2019

    2019

  5. [13]

    Safety verification and robustness analysis of neural networks via quadratic constraints and semidefinite programming,

    M. Fazlyab, M. Morari, and G. J. Pappas, “Safety verification and robustness analysis of neural networks via quadratic constraints and semidefinite programming,” IEEE Transactions on Automatic Control, vol. 67, no. 1, pp. 1–15, 2022

    2022

  6. [14]

    Hamil- tonian deep neural networks guaranteeing non-vanishing gradients by design,

    C. L. Galimberti, L. Furieri, L. Xu, and G. Ferrari-Trecate, “Hamil- tonian deep neural networks guaranteeing non-vanishing gradients by design,” arXiv preprint arXiv:2105.13205 , 2021

    2021 arXiv

  7. [15]

    On contraction analysis for non- linear systems,

    W. Lohmiller and J.-J. E. Slotine, “On contraction analysis for non- linear systems,” Automatica, vol. 34, no. 6, pp. 683–696, 1998

    1998

  8. [16]

    Contraction theory for nonlinear stability analysis and learning-based control: A tutorial overview,

    H. Tsukamoto, S.-J. Chung, and J.-J. E. Slotine, “Contraction theory for nonlinear stability analysis and learning-based control: A tutorial overview,” Annual Reviews in Control , vol. 52, pp. 135–169, 2021

    2021

  9. [17]

    Towards robust neural networks via close-loop control,

    Z. Chen, Q. Li, and Z. Zhang, “Towards robust neural networks via close-loop control,” arXiv preprint arXiv:2102.01862 , 2021

    2021 arXiv

  10. [18]

    On robustness of neural ordinary differential equations,

    Y . Hanshu, D. Jiawei, T. Vincent, and F. Jiashi, “On robustness of neural ordinary differential equations,” in International Conference on Learning Representations, 2019

    2019

  11. [19]

    Stable neural ode with Lyapunov-stable equilibrium points for defending against adversarial attacks,

    Q. Kang, Y . Song, Q. Ding, and W. P. Tay, “Stable neural ode with Lyapunov-stable equilibrium points for defending against adversarial attacks,” in Advances in Neural Information Processing Systems , vol. 34, 2021

    2021

  12. [20]

    LyaNet: A Lyapunov framework for training neural ODEs,

    I. D. J. Rodriguez, A. Ames, and Y . Yue, “LyaNet: A Lyapunov framework for training neural ODEs,” in International Conference on Machine Learning, pp. 18687–18703, PMLR, 2022

    2022

  13. [21]

    Stable neural flows,

    S. Massaroli, M. Poli, M. Bin, J. Park, A. Yamashita, and H. Asama, “Stable neural flows,” arXiv preprint arXiv:2003.08063 , 2020

    2003 arXiv

  14. [22]

    Robust implicit networks via non-Euclidean contractions,

    S. Jafarpour, A. Davydov, A. Proskurnikov, and F. Bullo, “Robust implicit networks via non-Euclidean contractions,” in Advances in Neural Information Processing Systems , vol. 34, 2021

    2021

  15. [23]

    Contracting implicit recurrent neural networks: Stable models with improved trainability,

    M. Revay and I. Manchester, “Contracting implicit recurrent neural networks: Stable models with improved trainability,” in Learning for Dynamics and Control , pp. 393–403, PMLR, 2020

    2020

  16. [24]

    Robustness certificates for implicit neural networks: A mixed mono- tone contractive approach,

    S. Jafarpour, M. Abate, A. Davydov, F. Bullo, and S. Coogan, “Robustness certificates for implicit neural networks: A mixed mono- tone contractive approach,” in Learning for Dynamics and Control Conference, pp. 917–930, PMLR, 2022

    2022

  17. [25]

    Contraction analysis of Hopfield neural networks with Hebbian learning,

    V . Centorrino, F. Bullo, and G. Russo, “Contraction analysis of Hopfield neural networks with Hebbian learning,” arXiv preprint arXiv:2204.05382, 2022

    2022 arXiv

  18. [26]

    Robust classification using contractive Hamiltonian neural ODEs,

    M. Zakwan, L. Xu, and G. Ferrari Trecate, “Robust classification using contractive Hamiltonian neural ODEs,” IEEE Control Systems Letters, vol. 7, pp. 145–150, 2022

    2022

  19. [27]

    Learning stabilizable nonlinear dynamics with contraction-based regularization,

    S. Singh, S. M. Richards, V . Sindhwani, J.-J. E. Slotine, and M. Pavone, “Learning stabilizable nonlinear dynamics with contraction-based regularization,” The International Journal of Robotics Research, vol. 40, no. 10-11, pp. 1123–1150, 2021

    2021

  20. [28]

    Recurrent equilibrium networks: Unconstrained learning of stable and robust dynamical models,

    M. Revay, R. Wang, and I. R. Manchester, “Recurrent equilibrium networks: Unconstrained learning of stable and robust dynamical models,” in 60th IEEE Conference on Decision and Control (CDC) , pp. 2282–2287, IEEE, 2021

    2021

  21. [29]

    Neural exponential stabilization of control-affine nonlinear systems,

    M. Zakwan, L. Xu, and G. Ferrari-Trecate, “Neural exponential stabilization of control-affine nonlinear systems,” arXiv preprint arXiv:2403.17793, 2024

    2024 arXiv

  22. [30]

    Automatic differen- tiation in pytorch,

    A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, and A. Lerer, “Automatic differen- tiation in pytorch,” NIPS 2017 Autodiff Workshop , 2017

    2017

  23. [31]

    Bullo, Contraction Theory for Dynamical Systems

    F. Bullo, Contraction Theory for Dynamical Systems . Kindle Direct Publishing, 1.2 ed., 2024

    2024

  24. [32]

    Convergent systems vs. incremental stability,

    B. S. R ¨uffer, N. Van De Wouw, and M. Mueller, “Convergent systems vs. incremental stability,” Systems & Control Letters , vol. 62, no. 3, pp. 277–285, 2013

    2013

  25. [33]

    Ro- bustness may be at odds with accuracy,

    D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry, “Ro- bustness may be at odds with accuracy,” in International Conference on Learning Representations , 2019

    2019

  26. [34]

    R. A. Horn and C. R. Johnson, Matrix Analysis. New York: Cambridge University Press, 1985

    1985

  27. [35]

    Goodfellow, Y

    I. Goodfellow, Y . Bengio, and A. Courville, Deep learning . Cam- bridge, Massachusetts: MIT press, 2016

    2016

  28. [36]

    Nais-net: Stable deep networks from non-autonomous differential equations,

    M. Ciccone, M. Gallieri, J. Masci, C. Osendorfer, and F. Gomez, “Nais-net: Stable deep networks from non-autonomous differential equations,” in Advances in Neural Information Processing Systems , vol. 31, 2018

    2018

  29. [37]

    Towards the first ad- versarially robust neural network model on MNIST,

    L. Schott, J. Rauber, M. Bethge, and W. Brendel, “Towards the first ad- versarially robust neural network model on MNIST,” in International Conference on Learning Representations , 2019

    2019

  30. [38]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  31. [39]

    Adversarial robustness of stabilized neural ode might be from obfuscated gradients,

    Y . Huang, Y . Yu, H. Zhang, Y . Ma, and Y . Yao, “Adversarial robustness of stabilized neural ode might be from obfuscated gradients,” in Mathematical and Scientific Machine Learning , pp. 497–515, PMLR, 2022. APPENDIX A. Experimental details The NODE structure is described a...

    2022

  32. [40]

    The weight γ for the regularization term (14) is set to 1

    For the regularizer (14), we use ρ = 2. The weight γ for the regularization term (14) is set to 1. B. Contraction Rate VS Classification Accuracy In this appendix, we analyze how the contraction rate affects the classification accuracy. For this purpose, we use the MNIST datas...

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.