Pith. sign in

REVIEW 3 major objections 4 minor 40 references

Salient Information Preserving Adversarial Training Improves Clean and Robust Accuracy

T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Salient Information Preserving Adversarial Training lifts clean accuracy while keeping robustness.

desk verdict SIP-AT is a simple, well-tested trick that shifts the robustness-accuracy trade-off toward low-epsilon robustness, but the abstract oversells high-epsilon performance; worth refereeing with revisions. read the letter →

arxiv 2501.09086 v1 pith:V2EKLWLF submitted 2025-01-15 cs.CV

Timothy Redgrave , Adam Czajka This is my paper · ORCID
classification cs.CV
keywords adversarialtrainingrobustness-accuracytrade-offsaliencemapsnon-robustfeaturescleanaccuracyAutoAttackfine-grainedclassificationhumandetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that the robustness-accuracy trade-off of adversarial training can be reduced by refusing to perturb the image regions an annotator deems salient. Its method, SIP-AT, generates adversarial examples as usual but multiplies the perturbation by the complement of a salience mask, so meaningful pixels stay unchanged during training. The models then keep learning predictive non-robust features that ordinary adversarial training erases, gaining clean accuracy while retaining robustness against AutoAttack across several epsilon budgets. The claim is tested on CIFAR-10, CIFAR-100, and CUB-200-2011 with both human and automatic salience maps.

What carries the argument

The load-bearing object is the salience-preserving perturbation set $\Delta'(x)$ and its practical proxy, a binary mask $M(x)$ built as the minimal top-$k$ set of pixels whose gradient magnitudes sum to at least half the total gradient magnitude. The adversarial perturbation $\delta$ computed by PGD is masked to $\delta' = \delta \cdot (1-M(x))$, so salient pixels are frozen during training. The theoretical framing imports the useful/robust feature taxonomy: a feature is useful if correlated with the label, robust if it stays useful under perturbations in $\Delta$, and salient-or-robust if it stays useful under the restricted set $\Delta'$. The key identity is $F_{\mathrm{robust}}\subseteq F_{\mathrm{sal\text{-}robust}}\subseteq F_{\mathrm{useful}}$, which is what enlarges the set of learnable features.

What would settle it

Train SIP-AT on CIFAR-10 with a mask that protects a randomly chosen set of pixels of the same size as the gradient mask; if clean accuracy rises as much as with the true salience mask, the claim that semantically meaningful features are being preserved is false, while if random masks do not reproduce the gain, the salience link is load-bearing.

Watch

Extended reading notes

Core claim

On the paper's own terms, SIP-AT establishes that imposing the constraint $\Delta'(x)=\{\delta \in \Delta(x) : M(x)_{c,h,w}=1 \Rightarrow \delta_{c,h,w}=0\}$ on adversarial training lets a model learn from the enlarged feature set $F_{\mathrm{sal\text{-}robust}}\setminus F_{\mathrm{robust}}$: useful non-robust features that survive salient-region protection. In practice every PGD step perturbs only non-salient pixels during training, while evaluation still attacks all pixels. Across architectures and datasets, SIP-AT reports higher clean accuracy than standard adversarial training, TRADES, FAT, and PART baselines, and comparable or better low-epsilon robust accuracy; the clean gain is largest on CIFAR-10, for example 82.34 percent clean accuracy with a ResNet18 versus 74.39 for standard adversarial training, and fine-grained CUB-200-2011 benefits most when synthetic salience is used.

Load-bearing premise

The method assumes that a binary top-k gradient mask captures the same salient features a human annotator would protect, and that freezing exactly those pixels preserves the predictive non-robust features that drive the clean-accuracy gain.

Editorial extensions

If this is right

  • If SIP-AT holds, adversarially trained image classifiers can be noticeably more accurate on clean inputs without giving up robustness to small perturbations, which are exactly the attacks humans most often fail to notice.
  • The method reduces to a single masking step inside standard PGD adversarial training, so it can be added to existing pipelines with negligible extra cost once salience maps are available.
  • Because evaluation attacks all pixels, the reported robustness is not an artifact of test-time masking; the defense is in the training procedure itself.
  • Fine-grained classification responds differently to human versus synthetic masks: human masks protect object-only regions and yield more robust models, while synthetic masks that include correlated background yield higher clean accuracy.
  • The human survey implies that low-epsilon robustness matters most in human-in-the-loop deployment, since perturbations at $\epsilon=4/255$ and $8/255$ are detected at semi-consistent or high rates while $\epsilon=1/255$ and $2/255$ perturbations are almost always missed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: a direct test of whether salience itself matters is to replace the salience mask with a random mask of equal coverage; if the clean-accuracy gain persists, the benefit would come from a reduced perturbation budget rather than from protecting semantically meaningful pixels.
  • Editorial inference: because SIP-AT enlarges the learnable feature set rather than reweighting the loss, it may combine additively with loss-based trade-off methods such as TRADES-style regularization, though this combination is not tested in the paper.
  • Editorial inference: the method transfers naturally to domains where local salience can be annotated, such as medical imaging, where protecting diagnostically meaningful regions during adversarial training could preserve clinically useful non-robust features.
  • Editorial inference: the human detection results suggest a testable design principle for deployment: optimize primarily for robustness at $\epsilon\le 2/255$ because higher-epsilon attacks are perceptible and therefore less dangerous in practice.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes Salient Information Preserving Adversarial Training (SIP-AT), a method that restricts adversarial perturbations during training to non-salient image regions, with the goal of retaining useful non-robust features and thereby improving clean accuracy without sacrificing robustness. The authors formalize a feature-level notion of salience following Ilyas et al., introduce a practical pixel-level mask based on top-k gradient magnitudes, and evaluate on CIFAR-10, CIFAR-100, and CUB-200-2011 with ResNet and WideResNet architectures. They report that SIP-AT improves clean accuracy relative to standard adversarial training and other baselines, while maintaining robustness at low perturbation budgets, and complement this with a human survey on detection of adversarial perturbations.

Significance. If the central claims held, SIP-AT would be a valuable, low-cost addition to adversarial training: it requires no additional training-time computation beyond a precomputed salience mask, and the reported clean-accuracy gains on multiple datasets are nontrivial. The paper is also careful in its evaluation: five repeats per condition, AutoAttack for robustness, and evaluation at four epsilon levels are all strengths. However, the significance is undercut by the fact that the high-epsilon robustness claims are not supported by the data on two of three datasets, and by the disconnect between the feature-level theory and the pixel-level implementation. The method still appears promising for low-epsilon robustness, but the paper needs substantial qualification and revision before it can be accepted.

major comments (3)
  1. [Abstract and §5.1] The abstract claims SIP-AT maintains robustness 'at multiple epsilon levels' and relieves the robustness-accuracy trade-off 'without sacrificing overall robustness,' and §5.1 claims 'comparable or improved levels of robust accuracy at higher epsilons.' These claims are contradicted by Tables 2 and 3 at ε=8/255. On CIFAR-100 (ResNet18 and WRN-34), SIP-S achieves 11.79% and 13.00% versus Madry's 14.76% and 17.23%; on CUB (ResNet50 and DenseNet121), SIP-S achieves 1.64% and 1.69% versus Madry's 4.59% and 5.68%. This is a substantial robustness drop on two of three datasets. The abstract and discussion must be revised to state that the robustness benefit is concentrated at low epsilon values, and the 'without sacrificing overall robustness' phrasing should be removed or explicitly qualified.
  2. [§3.1 and §3.2] The theoretical framework defines feature-level salience ST(x, f) and the restricted perturbation set Δ1 in Eq. (4), but the practical method in Eqs. (7)–(9) uses a pixel-level binary mask M(x) derived from the top-k gradient magnitude and restricts perturbations by zeroing masked elements. There is no formal or empirical bridge showing that zeroing perturbation on the pixel-level mask preserves the feature-level salience condition ST(x, y, f) = 1 → ST(x+δ, y, f) = 1. Consequently, the theoretical claim that models trained with the restricted set learn features in F_sal_robust \ F_robust does not apply to the actual training procedure. The paper should either provide a proof that the pixel mask approximates the feature-level condition, or reframe the theory as a motivation and add experiments that directly test whether masked perturbations preserve the salience of the features identified by T.
  3. [§5.1, Tables 2 and 3] The discussion in §5.1 is internally inconsistent: it first states that SIP-AT models 'maintain comparable or improved levels of robust accuracy at higher epsilons' and then immediately notes that 'performance degrades more rapidly at higher epsilons.' The data show that, at ε=8/255, SIP-S is worse than Madry on CIFAR-100 and CUB, and even SIP-H is only marginally better on CUB (ResNet50: 5.04% vs 4.59%; DenseNet121: 6.70% vs 5.68%). The narrative that SIP-AT relieves the trade-off is not accurate across the tested epsilon range; the trade-off has been shifted toward low-epsilon robustness. The authors should report and interpret this trade-off honestly, and should avoid claiming that robustness is maintained 'at multiple epsilon levels' without specifying which epsilons and which datasets.
minor comments (4)
  1. [§3.2, Eq. (7)] The notation ∇pT pxqq is ambiguous; it should be ∇ₓT(x) to indicate the gradient with respect to the input, and 'Top-k' should be formally defined (e.g., the set of coordinates with the k largest absolute gradient values, with ties broken deterministically).
  2. [§5.2] The human survey is interesting but its connection to the central claims of SIP-AT is not stated explicitly. The paper should clarify whether the survey is intended to motivate the focus on low-epsilon robustness, or to validate the threat model, and how it informs the method's design.
  3. [Figure 5] The y-axis label 'Images Labeled Perturbed (%)' is unclear; it should be 'Percentage of images correctly labeled as perturbed' or similar, and the caption should state whether the plot shows mean detection rate across participants and images.
  4. [§4.3] The paper does not report the computational overhead of SIP-AT relative to standard adversarial training; a brief statement that the only added cost is the precomputed salience mask and an element-wise multiplication would help readers assess practicality.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SIP-AT's empirical claims are evaluated by held-out clean accuracy and full-image AutoAttack, independent of the training-time salience mask.

full rationale

The derivation chain is self-contained. The theoretical set inclusion in Section 3.1 (F_robust subset of F_sal_robust subset of F_useful) is a direct consequence of the definitions of robust and salient-preserved features, and it is not used to fabricate an empirical result; it only justifies why restricting training perturbations may allow access to additional useful features. The practical salience map in Eq. (7)-(8) is a free, parameter-free heuristic (top-k gradient pixels accounting for half of gradient magnitude) rather than a parameter fitted to the headline numbers. Clean accuracy is measured on unperturbed held-out test data, and robust accuracy is measured with AutoAttack on full images with the adversary free to perturb all pixels, as Section 4.4 explicitly states: "adversaries are free to perturb any/all elements within the images during evaluation." Thus the robustness numbers cannot be forced by the training-time masking. The only self-citation, reference [20], supports a general observation about defenses being circumvented and is not load-bearing for the central claims. The paper's own results at epsilon = 8/255 on CIFAR-100 and CUB show lower robustness than Madry, which may contradict some abstract claims, but that is a correctness or evidence concern, not circularity.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the untested assumption that pixel-level gradient masks correspond to the feature-level salience of the theory. The only free parameter is the top-k threshold in Eq. (8). No new physical or algorithmic entities are introduced beyond the SIP-AT training objective.

free parameters (1)
  • Salience top-k gradient threshold = 0.5 (fraction of cumulative gradient magnitude)
    Eq. (8). Chosen by hand, with no sensitivity analysis. It determines which pixels are protected and directly controls how much of the image is perturbable during SIP-AT training.
assumptions (5)
  • ad hoc to paper Feature-level salience, as defined in Eq. (3)-(5), can be operationalized by binary pixel-level salience maps.
    Section 3.2. The paper jumps from ST(x,f) to M(x) with values on pixels; no argument shows pixel masking preserves the feature-level property.
  • ad hoc to paper The top-k gradient mask covering 50 percent of cumulative gradient magnitude identifies the meaningful regions.
    Section 4.3 and Eq. (7)-(8). The 0.5 threshold is arbitrary; the authors note the method was chosen for simplicity, not validated.
  • domain assumption Adversarially trained models yield salience maps that are suitable for guiding SIP-AT.
    Section 4.3, citing Tsipras et al. and Etmann et al. The synthetic salience maps are generated by a separate adversarially trained WRN-34 or DenseNet-121, not by the model being trained.
  • ad hoc to paper Optimizing the minimax objective in Eq. (6) will cause the model to learn the additional useful non-robust features shown by set inclusion.
    Section 3.1, after Eq. (5). The derivation only shows such features exist in F_sal_robust; it does not prove that SGD finds them. The empirical results are the only evidence.
  • domain assumption Human segmentation masks in CUB-200-2011 are a valid salience signal for bird species classification.
    Section 4.1 and Fig. 4. The paper treats background pixels as non-salient, but background cues can be predictive for species; the paper asserts they are not.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Salient Information Preserving Adversarial Training Improves Clean and Robust Accuracy." pith.science (2026). https://pith.science/paper/V2EKLWLF

@misc{pith2026250109086,
  author       = {Pith},
  title        = {Pith review of: Salient Information Preserving Adversarial Training Improves Clean and Robust Accuracy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V2EKLWLF}},
  note         = {Machine review of arXiv:2501.09086}
}
read the original abstract

In this work we introduce Salient Information Preserving Adversarial Training (SIP-AT), an intuitive method for relieving the robustness-accuracy trade-off incurred by traditional adversarial training. SIP-AT uses salient image regions to guide the adversarial training process in such a way that fragile features deemed meaningful by an annotator remain unperturbed during training, allowing models to learn highly predictive non-robust features without sacrificing overall robustness. This technique is compatible with both human-based and automatically generated salience estimates, allowing SIP-AT to be used as a part of human-driven model development without forcing SIP-AT to be reliant upon additional human data. We perform experiments across multiple datasets and architectures and demonstrate that SIP-AT is able to boost the clean accuracy of models while maintaining a high degree of robustness against attacks at multiple epsilon levels. We complement our central experiments with an observational study measuring the rate at which human subjects successfully identify perturbed images. This study helps build a more intuitive understanding of adversarial attack strength and demonstrates the heightened importance of low-epsilon robustness. Our results demonstrate the efficacy of SIP-AT and provide valuable insight into the risks posed by adversarial samples of various strengths.

Figures

Figures reproduced from arXiv: 2501.09086 by the authors.

Figure 1
Figure 1. An illustration of Salient Information Preserving Adversarial Training (SIP-AT). Input images [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Examples of synthetically generated salience maps following equation ( [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Example of a question shown to survey participants. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Examples comparing synthetic salience maps (middle [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 32 canonical work pages

  1. [1]

    Square attack: a query-efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flam- marion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. InComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIII , pages 484–501. Springer, 2020. 2, 5

    work page 2020

  2. [2]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Confer- ence on Machine Learning , pages 274–283. PMLR, 2018. 2 8

    work page 2018

  3. [3]

    Are transformers more robust than cnns? Advances in Neural Information Processing Systems, 34:26831–26843, 2021

    Yutong Bai, Jieru Mei, Alan L Yuille, and Cihang Xie. Are transformers more robust than cnns? Advances in Neural Information Processing Systems, 34:26831–26843, 2021. 2

    work page 2021

  4. [4]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 2

    work page 2017

  5. [5]

    Minimally distorted adversarial examples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In International Conference on Machine Learning , pages 2196–2205. PMLR, 2020. 5

    work page 2020

  6. [6]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on ma- chine learning, pages 2206–2216. PMLR, 2020. 2, 5

    work page 2020

  7. [7]

    On the connection between adversarial ro- bustness and saliency map interpretability

    Christian Etmann, Sebastian Lunz, Peter Maass, and Car- ola Schoenlieb. On the connection between adversarial ro- bustness and saliency map interpretability. In International Conference on Machine Learning, pages 1823–1832. PMLR,

    work page

  8. [8]

    Cub-200-2011 segmentations, 2022

    Ryan Farrell. Cub-200-2011 segmentations, 2022. 4

    work page 2011

Show all 40 references
  1. [9]

    Adversarial spheres

    Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S Schoen- holz, Maithra Raghu, Martin Wattenberg, and Ian Goodfel- low. Adversarial spheres. arXiv preprint arXiv:1801.02774,

    arXiv

  2. [10]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1

    2014 arXiv

  3. [11]

    Delving deep into rectifiers: Surpassing human-level per- formance on imagenet classification

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level per- formance on imagenet classification. In Proceedings of the IEEE International Conference on Computer Vision , pages 1026–1034, 2015. 1

    2015

  4. [12]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on Computer Vision and Pattern Recognition, pages 770–778, 2016. 5

    2016

  5. [13]

    Adversarial example defenses: ensembles of weak defenses are not strong

    Warren He, James Wei, Xinyun Chen, Nicholas Carlini, and Dawn Song. Adversarial example defenses: ensembles of weak defenses are not strong. In Proceedings of the 11th USENIX Conference on Offensive Technologies , pages 15– 15, 2017. 2

    2017

  6. [14]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4700–4708, 2017. 5

    2017

  7. [15]

    Adversar- ial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversar- ial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019. 2, 3

    2019

  8. [16]

    Deep imitation learning for au- tonomous vehicles based on convolutional neural networks

    Parham M Kebria, Abbas Khosravi, Syed Moshfeq Salaken, and Saeid Nahavandi. Deep imitation learning for au- tonomous vehicles based on convolutional neural networks. IEEE/CAA Journal of Automatica Sinica, 7(1):82–95, 2019. 1

    2019

  9. [17]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 4

    2009

  10. [18]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. 2, 3, 4

    2018

  11. [19]

    International evaluation of an ai system for breast cancer screening

    Scott Mayer McKinney, Marcin Sieniek, Varun Godbole, Jonathan Godwin, Natasha Antropova, Hutan Ashrafian, Trevor Back, Mary Chesus, Greg S Corrado, Ara Darzi, et al. International evaluation of an ai system for breast cancer screening. Nature, 577(7788):89–94, 2020. 1

    2020

  12. [20]

    Generating adversar- ial samples in mini-batches may be detrimental to adversar- ial robustness

    Timothy Redgrave and Colton Crum. Generating adversar- ial samples in mini-batches may be detrimental to adversar- ial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Work- shops, pages 2377–2383, 2023. 2

    2023

  13. [21]

    Overfitting in ad- versarially robust deep learning

    Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in ad- versarially robust deep learning. InInternational Conference on Machine Learning, pages 8093–8104. PMLR, 2020. 2

    2020

  14. [22]

    Adversarial training for free! Advances in Neural Information Processing Systems , 32, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems , 32, 2019. 2

    2019

  15. [23]

    Learning important features through propagating activation differences

    Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Learning important features through propagating activation differences. In International conference on machine learn- ing, pages 3145–3153. PMlR, 2017. 4

    2017

  16. [24]

    Deep inside convolutional networks: Visualising image classification models and saliency maps

    Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034, 2013

    2013 arXiv

  17. [25]

    Striving for simplicity: The all convolutional net

    Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin Riedmiller. Striving for simplicity: The all convolutional net. arXiv preprint arXiv:1412.6806, 2014. 4

    2014 arXiv

  18. [26]

    Disentan- gling adversarial robustness and generalization

    David Stutz, Matthias Hein, and Bernt Schiele. Disentan- gling adversarial robustness and generalization. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6976–6987, 2019. 2

    2019

  19. [27]

    Is robustness the cost of accuracy?– a comprehensive study on the robustness of 18 deep image classification models

    Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin-Yu Chen, and Yupeng Gao. Is robustness the cost of accuracy?– a comprehensive study on the robustness of 18 deep image classification models. In Proceedings of the European con- ference on computer vision (ECCV) , pages 631–648...

    2018

  20. [28]

    Axiomatic attribution for deep networks

    Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. InInternational conference on machine learning, pages 3319–3328. PMLR, 2017. 4

    2017

  21. [29]

    In- triguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. In- triguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014, 2014. 1

    2014

  22. [30]

    Adversarial training and robustness for multiple perturbations

    Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations. Advances in neural information processing systems, 32, 2019. 2

    2019

  23. [31]

    Robustness may 9 be at odds with accuracy

    Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may 9 be at odds with accuracy. In International Conference on Learning Representations, 2019. 2, 5

    2019

  24. [32]

    The Caltech-UCSD Birds-200- 2011 dataset, 2011

    Catherine Wah, Steve Branson, Peter Welinder, Pietro Per- ona, and Serge Belongie. The Caltech-UCSD Birds-200- 2011 dataset, 2011. 4

    2011

  25. [33]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations. 2

  26. [34]

    On the algorith- mic stability of adversarial training

    Yue Xing, Qifan Song, and Guang Cheng. On the algorith- mic stability of adversarial training. Advances in neural in- formation processing systems, 34:26523–26535, 2021. 2

    2021

  27. [35]

    Wide residual networks

    Sergey Zagoruyko. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016. 5

    2016 arXiv

  28. [36]

    You only propagate once: Accelerat- ing adversarial training via maximal principle

    Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. You only propagate once: Accelerat- ing adversarial training via maximal principle. Advances in Neural Information Processing Systems, 32, 2019. 2

    2019

  29. [37]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Lau- rent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR,

  30. [38]

    Attacks which do not kill training make adversarial learning stronger

    Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pages 11278– 11287. PMLR, 2020. 2, 5

    2020

  31. [39]

    Improving accuracy-robustness trade- off via pixel reweighted adversarial training

    Jiacheng Zhang, Feng Liu, Dawei Zhou, Jingfeng Zhang, and Tongliang Liu. Improving accuracy-robustness trade- off via pixel reweighted adversarial training. In Forty-first International Conference on Machine Learning, 2024. 2, 5

    2024

  32. [40]

    Understanding the robustness in vision transformers

    Daquan Zhou, Zhiding Yu, Enze Xie, Chaowei Xiao, An- imashree Anandkumar, Jiashi Feng, and Jose M Alvarez. Understanding the robustness in vision transformers. In In- ternational Conference on Machine Learning, pages 27378– 27394. PMLR, 2022. 2 10

    2022

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.