Pith. sign in

REVIEW 5 major objections 7 minor 54 references

BEARD: Benchmarking the Adversarial Robustness for Dataset Distillation

T0 review · 5 major / 7 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Training on distilled datasets makes models harder to fool by adversarial attacks, the BEARD benchmark finds, at the cost of attack speed and some clean accuracy.

desk verdict Useful benchmark concept, but the numbers that carry the main robustness claim are internally inconsistent as printed; a revision could make this a solid community resource. read the letter →

arxiv 2411.09265 v1 pith:WF6HV5EY submitted 2024-11-14 cs.CV

Zheng Zhou , Wenquan Feng , Shuchang Lyu , Guangliang Cheng , Xiaowei Huang , Qi Zhao This is my paper · ORCID
classification cs.CV
keywords datasetdistillationadversarialrobustnessbenchmarkratioattackefficiencyattacksimagesperclasstraining
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BEARD is a standardized benchmark asking whether models trained on distilled, synthetic datasets are more resistant to adversarial attacks than models trained on the full dataset. Across three datasets (CIFAR-10, CIFAR-100, TinyImageNet), six distillation methods, and five attack families, the paper claims the answer is yes on the robustness side: distilled-data models post a higher Multi-Adversary Robustness Ratio under both targeted and untargeted attacks, although attacks that do succeed take less time against them, as captured by a lower Multi-Adversary Attack Efficiency Ratio. The paper also reports that the robustness advantage shrinks as the number of images per class grows, and that adversarial training lifts full-size models more than distilled ones. If these results hold, dataset distillation is not only a way to save compute but a security-relevant design choice for the resulting model.

What carries the argument

The load-bearing machinery is the adversarial game framework, formalized as attacker and defender functions, together with three derived metrics. Robustness Ratio is $RR = 100\,\left(1 - \bar{ASR}/\max ASR\right)$, where $\bar{ASR}$ averages the attack success rate over models and attacks; Attack Efficiency Ratio is $AE = 100\,\left(\bar{AST}/\max AST\right)$, where $AST$ is the time to a successful attack; and the Comprehensive Robustness-Efficiency Index blends them as $CREI = \alpha\,RR + (1-\alpha)\,AE$. Single- and multi-adversary variants ($RRS/RRM$, $AES/AEM$) adapt the same formulas. These metrics convert the game's win conditions, low attack success rate and high attack success time, into comparable numbers that let the paper rank distillation methods on a leaderboard.

What would settle it

Re-run the BEARD evaluation on CIFAR-10 with a single fixed training configuration (one optimizer, one batch size), reporting RRM separately for targeted and untargeted attacks: if the two columns match exactly, or if distilled models no longer beat the full-size baseline, the paper's central robustness claim fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that dataset distillation confers an adversarial-robustness advantage: models trained on synthetic sets produced by DD methods obtain higher Multi-Adversary Robustness Ratio (RRM) than models trained on the full-size dataset, under both targeted and untargeted attacks, across CIFAR-10, CIFAR-100, and TinyImageNet. This advantage is strongest at the smallest compression setting (IPC-1) and tapers off as the number of images per class increases. The authors interpret the accompanying lower Multi-Adversary Attack Efficiency Ratio (AEM) as part of the same trade-off: the distilled models are harder to fool, but the attacks that do succeed take less time. They further claim that adversarial training produces larger CREI gains for full-size datasets than for distilled ones, and that the robustness comes partly at the expense of clean-data accuracy, consistent with distillation exposing models to a mix of robust and non-robust features.

Load-bearing premise

The ranking of distillation methods rests on Tables 1-4 all being produced under one consistent training-and-attack protocol, but the paper's appendix describes two different training setups and its main table shows identical robustness numbers for targeted and untargeted attacks, so that uniformity is not yet demonstrated.

Editorial extensions

If this is right

  • Practitioners can treat distilled datasets as a robustness-enhancing choice: at IPC-1 the gains are largest, with distribution-matching methods (DSA, DM, BACON) posting the highest RRM values.
  • The robustness benefit declines as images per class increase, so the compression level should be part of any security analysis of a distilled model.
  • Adversarial training remains worthwhile for distilled models, but it pays off most on full-size datasets, so combining extreme compression with AT may waste part of the robustness budget.
  • The CREI metric gives a single ranking number that balances robustness and attack efficiency, which the BEARD leaderboard applies uniformly across IPC settings, datasets, and attack types.
  • Robustness gains come with a cost in clean-data accuracy, so downstream users should weigh the accuracy drop against the security gain when choosing a distillation method.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the robustness advantage survives a cleanly separated re-run, the most direct testable extension is to check the paper's feature-level explanation directly: distillation should leave models with fewer non-robust features, which representation analyses could verify.
  • The result that adversarial training boosts full-size models more than distilled ones suggests the two defenses are partly redundant; a practical corollary the authors do not draw is that a fixed robustness budget spent on AT may be better allocated as the dataset grows toward full size.
  • Because the advantage is strongest at IPC-1, the findings point to a regime rule the authors only imply: extreme compression is where distillation's robustness benefit is most worth harvesting, and future distillation methods could be explicitly optimized for CREI rather than clean accuracy alone.
  • The identical RRM entries for targeted and untargeted attacks in Table 1 suggest the reported robustness metric may be insensitive to attack goal; if a rerun with separated attack runs contradicts the paper's ranking, the headline ordering of methods could shift.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper introduces BEARD, a benchmark for evaluating the adversarial robustness of dataset distillation (DD) methods. It proposes three metrics — Robustness Ratio (RR), Attack Efficiency Ratio (AE), and Comprehensive Robustness-Efficiency Index (CREI) — within an adversarial game framework, and reports experiments comparing six DD methods (DC, DSA, DM, MTT, IDM, BACON) on CIFAR-10, CIFAR-100, and TinyImageNet under targeted and untargeted attacks, across multiple IPC settings and with and without adversarial training. The central empirical claim is stated in Section 5.1: models trained on synthetic datasets generated by DD methods exhibit higher Multi-Adversary Robustness Ratio (RRM) under both targeted and untargeted attacks, and lower Multi-Adversary Attack Efficiency Ratio (AEM), compared to full-data models.

Significance. If its empirical results were reliable, BEARD would be a useful community resource: standardized robustness metrics for DD methods, a leaderboard, and an extensible code base would help researchers compare distillation algorithms under adversarial threat models. The adversarial-game framing and the separation of attack effectiveness from attack efficiency are reasonable design choices. However, the paper's contribution is primarily empirical, and the internal inconsistencies in the reported tables and training protocols undermine the credibility of all quantitative claims. The paper does not ship machine-checked proofs or a reproducible artifact that would let readers verify the results independently; the unspecified CREI weighting and the absence of variance estimates further limit the scientific value in its current form.

major comments (5)
  1. [Table 1; Section 5.1] The RRM values under 'Targ. Att.' and 'Untarg. Att.' are identical for every method and every dataset (e.g., CIFAR-10 DM has RRM 46.01 in both columns). Targeted and untargeted attacks are distinct threat models with different success rates, so exact equality across all entries is implausible and indicates that the two columns were copied rather than produced by separate attack runs. This directly contradicts the central claim in Section 5.1 that DD methods exhibit higher RRM under both targeted and untargeted attacks, and it is also contradicted by the paper's own prose in Section B.1, which describes different robustness behavior for the two attack types.
  2. [Appendix A.1.1 vs. Appendix A.3] The model training protocol is described inconsistently. Appendix A.1.1 states that models are trained with the Adam optimizer (learning rate 1e-4, batch size 128), while Appendix A.3 states that the same model training phase uses SGD (learning rate 0.01, momentum 0.9, weight decay 5e-4, batch size 256). Since all RRM, AEM, and CREI values are computed on models from this model pool, the reported results cannot be reproduced without knowing which protocol was actually used, and any comparison across methods is ambiguous.
  3. [Definition 8, Eq. (9)] CREI is defined as alpha * RR + (1 - alpha) * AE, but the value of alpha is never specified anywhere in the manuscript, including in the appendix where CREI values are reported in Tables 1-4. Without alpha, the CREI scores cannot be independently recomputed or compared across tables, which is a load-bearing omission for the paper's headline metric.
  4. [Section 5.2; Table 3] The key observation 'Increasing the IPC decreases adversarial robustness' is supported for targeted attacks in Table 2, but Table 3 (untargeted attacks) shows non-monotonic or increasing CREI with IPC for several methods (e.g., CIFAR-10 BACON: 25.79, 27.09, 28.48; CIFAR-100 MTT: 17.91, 19.97, 20.54). As written, the claim overgeneralizes and is contradicted by the data in the same appendix; the text should either restrict the claim to targeted attacks or account for the non-monotonic cases.
  5. [Appendix A.1.1; Tables 1-4] The paper states that the model with the highest validation accuracy on the original test set is selected, which uses the test set for model selection and biases the subsequent robustness evaluation. Additionally, the paper says results are averaged over 5 runs, but no standard deviations or error bars are reported anywhere. For a benchmark whose contribution is comparative ranking, the lack of variance estimates makes it impossible to assess whether small differences in the tables (e.g., DM 46.01 vs. DSA 45.22 in Table 1) are meaningful.
minor comments (7)
  1. [References [46] and [47]] The reference list appears to have the titles for [46] and [47] swapped: [46] is cited for DM but listed as 'Dataset condensation with differentiable siamese augmentation' (which is actually DSA), while [47] is cited for DSA but listed as 'Dataset condensation with distribution matching' (which is actually DM). This will mislead readers who try to reproduce the methods.
  2. [Section 4.2] The paper says the leaderboard integrates 'six adversarial attack strategies' but lists only five named attacks (FGSM, PGD, C&W, DeepFool, AutoAttack). Please clarify whether a sixth attack is used and name it, or correct the count.
  3. [Abstract / Section 6] The code is referenced only as 'BEARD' with no URL or permanent identifier. A stable link (e.g., a DOI or an archived repository) is needed for reproducibility.
  4. [Tables 2 and 3] Missing entries for IDM and BACON on TinyImageNet are marked with '/' but no explanation is given. State whether these runs were infeasible, omitted, or unavailable.
  5. [Definition 5, Remark 1] The thresholds gamma and beta in Definition 5 are declared conceptual and never assigned values, and they do not appear in the computed metrics. This is acceptable, but the text should state explicitly that gamma and beta are not used in the evaluation to avoid implying that the inequalities are ever checked.
  6. [Section 5.1] The sentence 'with RRM values increasing as dataset size expands' is unclear because Figure 4 has no dataset-size axis; it plots methods. Please rephrase to describe what Figure 4 actually shows.
  7. [Table 4 vs. Table 1] The 'w/o AT' rows in Table 4 are identical to the CREI entries in Table 1. Confirm that this is intended and note it in the text, or explain the duplication.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: RR, AE, and CREI are openly defined functions of attack success rate/time, and the benchmark conclusions are empirical measurements rather than reductions to the metric definitions.

full rationale

BEARD is an empirical benchmark; its central claims (higher RRM, lower AEM for distilled models; IPC and adversarial-training trends) are read off attack-success-rate and attack-time measurements reported in Tables 1-4, not derived from the metric definitions. Definitions 6-8 give RR, AE, and CREI as explicit functions of ASR and AST, with the max-normalization declared in Remark 2; 'higher RRM' is therefore a statement about measured ASR values, not an identity forced by the formula. Definition 8's coefficient alpha is never assigned a value, which is a completeness/reproducibility defect but not circularity, since CREI is not fed back into RR or AE and no target result is assumed by it. The self-citations to BACON [52] supply code, architecture, and released synthetic datasets, but BACON's robustness is independently evaluated via Torchattacks and is not imported as a conclusion; hence the citations are not load-bearing in the circularity sense. The suspicious features noted by a skeptical reader (Table 1 showing identical RRM under targeted and untargeted attacks; Appendix A.1.1 Adam/lr=1e-4/batch=128 versus Appendix A.3 SGD/lr=0.01/batch=256) are internal-consistency and reproducibility problems, not reductions of a claimed result to its inputs, which is the only basis on which a circularity flag may be raised under the hard rules.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the benchmark protocol and on the meaningfulness of two new metrics. The ledger lists the hand-set choices and domain assumptions behind those metrics. No new physical entities are introduced.

free parameters (2)
  • CREI weighting alpha
    Definition 8 defines CREI = alpha * RR + (1 - alpha) * AE, but no value for alpha is reported anywhere. All CREI tables and leaderboard rankings depend on this unspecified choice.
  • Perturbation budget epsilon = 8/255 for most attacks
    Chosen by hand as a uniform attack budget except for DeepFool and C&W; the relative robustness of methods can change with epsilon, so this is a hand-set benchmark parameter.
assumptions (4)
  • domain assumption Attack success rate is defined only on inputs the model classifies correctly before attack.
    The ASR formula in Definition 3 conditions on m(x) = y. This can favor models with low clean accuracy, which misclassify many inputs before any attack is applied.
  • domain assumption Attack success time is a meaningful robustness axis and is comparable across models and attacks.
    AST in Definition 4 depends on hardware, implementation, solver iterations, and batching; the paper folds it into CREI as if it were a stable property of the distilled dataset.
  • domain assumption Synthetic distilled datasets released by the original authors are appropriate substitutes for re-running each distillation method under identical conditions.
    Section 4.1.1 and Appendix A.1.1 say the dataset pool is sourced from existing open-source distilled datasets, so versions, augmentation defaults, and distillation code changes are not controlled.
  • ad hoc to paper The adversarial game framework with conceptual thresholds gamma and beta can ground the metrics even though the thresholds are never assigned values.
    Definitions 5 and Remark 1 introduce gamma and beta as victory conditions, then state they are conceptual and not assigned values. The link between the game and RR/AE/CREI is asserted rather than derived.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BEARD: Benchmarking the Adversarial Robustness for Dataset Distillation." pith.science (2026). https://pith.science/paper/WF6HV5EY

@misc{pith2026241109265,
  author       = {Pith},
  title        = {Pith review of: BEARD: Benchmarking the Adversarial Robustness for Dataset Distillation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WF6HV5EY}},
  note         = {Machine review of arXiv:2411.09265}
}
read the original abstract

Dataset Distillation (DD) is an emerging technique that compresses large-scale datasets into significantly smaller synthesized datasets while preserving high test performance and enabling the efficient training of large models. However, current research primarily focuses on enhancing evaluation accuracy under limited compression ratios, often overlooking critical security concerns such as adversarial robustness. A key challenge in evaluating this robustness lies in the complex interactions between distillation methods, model architectures, and adversarial attack strategies, which complicate standardized assessments. To address this, we introduce BEARD, an open and unified benchmark designed to systematically assess the adversarial robustness of DD methods, including DM, IDM, and BACON. BEARD encompasses a variety of adversarial attacks (e.g., FGSM, PGD, C&W) on distilled datasets like CIFAR-10/100 and TinyImageNet. Utilizing an adversarial game framework, it introduces three key metrics: Robustness Ratio (RR), Attack Efficiency Ratio (AE), and Comprehensive Robustness-Efficiency Index (CREI). Our analysis includes unified benchmarks, various Images Per Class (IPC) settings, and the effects of adversarial training. Results are available on the BEARD Leaderboard, along with a library providing model and dataset pools to support reproducible research. Access the code at BEARD.

Figures

Figures reproduced from arXiv: 2411.09265 by the authors.

Figure 1
Figure 1. Illustration of evaluating adversarial robustness for dataset distillation: The process is divided into three stages: 1) Distillation [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of BEARD: We first obtain a distilled dataset pool from the source dataset using various dataset distillation methods, such as DC [48], DSA [47], DM [46], IDM [49], BACON [52], among others. Next, we train neural networks on these diverse distilled datasets to generate a collection of pretrained models, forming our model pool. Finally, we evaluate the adversarial robustness of the models in the model po… view at source ↗
Figure 3
Figure 3. The top three entries on our CIFAR-10 leaderboard, with unified IPC settings, are available at [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Performance of various dataset distillation methods under targeted and untargeted adversarial attacks on CIFAR-10, CIFAR [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: CREI trends under targeted and untargeted attacks across three datasets: CIFAR-10, CIFAR-100, and TinyImageNet. The x [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Illustration of CREI trends on CIFAR-10 under targeted and untargeted attacks with (w/) or without (w/o) Adversarial Training [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 44 canonical work pages

  1. [1]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Se- curity and Privacy (S&P) , pages 39–57, 2017. 2, 5, 6, 11, 12

    work page 2017

  2. [2]

    Dataset distillation by matching training trajectories

    George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu. Dataset distillation by matching training trajectories. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 4750–4759, 2022. 1, 2, 5, 11

    work page 2022

  3. [3]

    A comprehensive study on dataset distillation: Performance, privacy, robustness and fairness

    Zongxiong Chen, Jiahui Geng, Derui Zhu, Herbert Woisetschlaeger, Qing Li, Sonja Schimmler, Ruben Mayer, and Chunming Rong. A comprehensive study on dataset distillation: Performance, privacy, robustness and fairness. arXiv preprint arXiv:2305.03355, 2023. 1, 3

    arXiv 2023

  4. [4]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Ma- chine Learning (ICML), pages 2206–2216, 2020. 2, 5, 6, 11, 12 7 CIFAR-10 (Targeted Attack) 0 20 40 60 (a) Full-size DC DSA MTT DM IDMBACON RRM AEM CREI CIFAR-10 (Untargeted Attack) 0 20 4...

    work page 2020

  5. [5]

    Dc- bench: Dataset condensation benchmark

    Justin Cui, Ruochen Wang, Si Si, and Cho-Jui Hsieh. Dc- bench: Dataset condensation benchmark. In Advances in Neural Information Processing Systems (NeurIPS) , pages 810–822, 2022. 2, 5, 12

    work page 2022

  6. [6]

    Scaling up dataset distillation to imagenet-1k with constant memory

    Justin Cui, Ruochen Wang, Si Si, and Cho-Jui Hsieh. Scaling up dataset distillation to imagenet-1k with constant memory. In International Conference on Machine Learning (ICML) , pages 6565–6590, 2023. 1

    work page 2023

  7. [7]

    Multirobustbench: Benchmarking robustness against multiple attacks

    Sihui Dai, Saeed Mahloujifar, Chong Xiang, Vikash Se- hwag, Pin-Yu Chen, and Prateek Mittal. Multirobustbench: Benchmarking robustness against multiple attacks. In In- ternational Conference on Machine Learning (ICML), pages 8 CREI on CIFAR-10 (Targeted Attack) 0 20 40 60 (a) Full-size DC DSA MTT DM IDMBACON CREI (w/o AT) CREI (w/ AT) CREI Improvement (AT...

    work page 2023

  8. [8]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 248–255, 2009. 2, 5, 11

    work page 2009

Show all 54 references
  1. [9]

    Minimizing the accumulated trajectory er- ror to improve dataset distillation

    Jiawei Du, Yidi Jiang, Vincent YF Tan, Joey Tianyi Zhou, and Haizhou Li. Minimizing the accumulated trajectory er- ror to improve dataset distillation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 3749–3758, 2023. 1

    2023

  2. [10]

    Adversarially robust distillation

    Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Gold- stein. Adversarially robust distillation. In Association for the Advancement of Artificial Intelligence (AAAI) , number 04, pages 3996–4003, 2020. 3

    2020

  3. [11]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Interna- tional Conference on Learning Representations ICLR, 2015. 1

    2015

  4. [12]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Interna- tional Conference on Learning Representations ICLR, 2015. 2, 5, 6, 11, 12

    2015

  5. [13]

    Towards lossless dataset distillation via difficulty-aligned trajectory matching

    Ziyao Guo, Kai Wang, George Cazenavette, HUI LI, Kaipeng Zhang, and Yang You. Towards lossless dataset distillation via difficulty-aligned trajectory matching. In In- ternational Conference on Learning Representations (ICLR),

  6. [14]

    Multisize dataset condensation

    Yang He, Lingao Xiao, Joey Tianyi Zhou, and Ivor Tsang. Multisize dataset condensation. In International Conference on Learning Representations (ICLR), 2024. 3

    2024

  7. [15]

    Nat- uralistic physical adversarial patch for object detectors

    Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun- Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. Nat- uralistic physical adversarial patch for object detectors. In IEEE/CVF International Conference on Computer Vision (ICCV), pages 7848–7857, 2021. 1

    2021

  8. [16]

    Adver- sarial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adver- sarial examples are not bugs, they are features. Advances in Neural Information Processing Systems (NeurIPS), 32, 2019. 3, 15

    2019

  9. [17]

    Torchattacks: A pytorch repository for adversar- ial attacks

    Hoki Kim. Torchattacks: A pytorch repository for adversar- ial attacks. arXiv preprint arXiv:2010.01950, 2020. 5, 11

    2010 arXiv

  10. [18]

    Segment any- thing

    Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer White- head, Alexander C Berg, Wan-Yen Lo, et al. Segment any- thing. In IEEE/CVF International Conference on Computer Vision (ICCV), pages 4015–4026, 2023. 1

    2023

  11. [19]

    Learning multiple layers of features from tiny images

    A Krizhevsky. Learning multiple layers of features from tiny images. Master’s thesis, University of Tront, 2009. 2, 5, 11

    2009

  12. [20]

    Imagenet classification with deep convolutional neural net- works

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural net- works. In Advances in Neural Information Processing Sys- tems (NeurIPS), pages 1106–1114, 2012. 1

    2012

  13. [21]

    Gradient-based learning applied to document recog- nition

    Yann LeCun, L ´eon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recog- nition. Proceedings of the IEEE , 86(11):2278–2324, 1998. 5

    1998

  14. [22]

    Deep learning

    Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. Nature, 521(7553):436–444, 2015. 1

    2015

  15. [23]

    Efficient dataset distillation using random feature ap- proximation

    Noel Loo, Ramin Hasani, Alexander Amini, and Daniela Rus. Efficient dataset distillation using random feature ap- proximation. In Advances in Neural Information Processing Systems (NeurIPS), pages 13877–13891, 2022. 1

    2022

  16. [24]

    Towards trustworthy dataset distillation

    Shijie Ma, Fei Zhu, Zhen Cheng, and Xu-Yao Zhang. Towards trustworthy dataset distillation. arXiv preprint arXiv:2307.09165, 2023. 1, 3

    2023 arXiv

  17. [25]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. In International Conference on Learning Representations ICLR, 2018. 1 9

    2018

  18. [26]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Con- ference on Learning Representations ICLR, 2018. 2, 5, 6, 11, 12

    2018

  19. [27]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2574–2582, 2016. 2, 5, 6, 11, 12

    2016

  20. [28]

    Dataset meta-learning from kernel ridge-regression

    Timothy Nguyen, Zhourong Chen, and Jaehoon Lee. Dataset meta-learning from kernel ridge-regression. arXiv preprint arXiv:2011.00050, 2020. 1

    2011 arXiv

  21. [29]

    Dataset distillation with infinitely wide convolutional networks

    Timothy Nguyen, Roman Novak, Lechao Xiao, and Jaehoon Lee. Dataset distillation with infinitely wide convolutional networks. In Advances in Neural Information Processing Systems (NeurIPS), pages 5186–5198, 2021. 1

    2021

  22. [30]

    Learn- ing transferable visual models from natural language super- vision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learn- ing transferable visual models from natural language super- vision. In International Conference on Machine Learning...

    2021

  23. [31]

    Empirical analysis of the hessian of over-parametrized neural networks

    Levent Sagun, Utku Evci, V Ugur Guney, Yann Dauphin, and Leon Bottou. Empirical analysis of the hessian of over-parametrized neural networks. arXiv preprint arXiv:1706.04454, 2017. 12

    2017 arXiv

  24. [32]

    On the diver- sity and realism of distilled dataset: An efficient dataset dis- tillation paradigm

    Peng Sun, Bei Shi, Daiwei Yu, and Tao Lin. On the diver- sity and realism of distilled dataset: An efficient dataset dis- tillation paradigm. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 9390–9399,

  25. [33]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations ICLR, 2014. 1

    2014

  26. [34]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszko- reit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems (NeurIPS), 30, 2017. 1

    2017

  27. [35]

    Cafe: Learning to condense dataset by aligning features

    Kai Wang, Bo Zhao, Xiangyu Peng, Zheng Zhu, Shuo Yang, Shuo Wang, Guan Huang, Hakan Bilen, Xinchao Wang, and Yang You. Cafe: Learning to condense dataset by aligning features. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12196–12205, 2022. 1

    2022

  28. [36]

    Dataset distillation

    Tongzhou Wang, Jun-Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation. arXiv preprint arXiv:1811.10959, 2018. 1, 2

    2018 arXiv

  29. [37]

    Stop-and-go: Exploring backdoor at- tacks on deep reinforcement learning-based traffic conges- tion control systems

    Yue Wang, Esha Sarkar, Wenqing Li, Michail Maniatakos, and Saif Eddin Jabari. Stop-and-go: Exploring backdoor at- tacks on deep reinforcement learning-based traffic conges- tion control systems. IEEE Transactions on Information Forensics and Security (TIFS), 16:4772–4787, 2021. 1

    2021

  30. [38]

    Adversarial sticker: A stealthy attack method in the physical world

    Xingxing Wei, Ying Guo, and Jie Yu. Adversarial sticker: A stealthy attack method in the physical world. IEEE Transac- tions on Pattern Analysis and Machine Intelligence (TPAMI), 45(3):2711–2725, 2022. 1

    2022

  31. [39]

    Simul- taneously optimizing perturbations and positions for black- box adversarial patch attacks

    Xingxing Wei, Ying Guo, Jie Yu, and Bo Zhang. Simul- taneously optimizing perturbations and positions for black- box adversarial patch attacks. IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), 2022. 1

    2022

  32. [40]

    Towards robust dataset learning

    Yihan Wu, Xinda Li, Florian Kerschbaum, Heng Huang, and Hongyang Zhang. Towards robust dataset learning. arXiv preprint arXiv:2211.10752, 2022. 3

    2022 arXiv

  33. [41]

    Dd-robustbench: An adversarial ro- bustness benchmark for dataset distillation

    Yifan Wu, Jiawei Du, Ping Liu, Yuewei Lin, Wenqing Cheng, and Wei Xu. Dd-robustbench: An adversarial ro- bustness benchmark for dataset distillation. arXiv preprint arXiv:2403.13322, 2024. 1, 3

    2024 arXiv

  34. [42]

    Fashion- mnist: a novel image dataset for benchmarking machine learning algorithms

    Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion- mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017. 5

    2017 arXiv

  35. [43]

    Towards adversarially robust dataset distillation by curvature regularization

    Eric Xue, Yijiang Li, Haoyang Liu, Yifan Shen, and Haohan Wang. Towards adversarially robust dataset distillation by curvature regularization. arXiv preprint arXiv:2403.10045,

    arXiv

  36. [44]

    Squeeze, recover and relabel: Dataset condensation at imagenet scale from a new perspective

    Zeyuan Yin, Eric Xing, and Zhiqiang Shen. Squeeze, recover and relabel: Dataset condensation at imagenet scale from a new perspective. Advances in Neural Information Process- ing Systems (NeurIPS), 36, 2024. 3

    2024

  37. [45]

    Deep reinforcement learning-driven reconfig- urable intelligent surface-assisted radio surveillance with a fixed-wing uav

    Xin Yuan, Shuyan Hu, Wei Ni, Xin Wang, and Abbas Jamalipour. Deep reinforcement learning-driven reconfig- urable intelligent surface-assisted radio surveillance with a fixed-wing uav. IEEE Transactions on Information Foren- sics and Security (TIFS), 2023. 1

    2023

  38. [46]

    Dataset condensation with differ- entiable siamese augmentation

    Bo Zhao and Hakan Bilen. Dataset condensation with differ- entiable siamese augmentation. In International Conference on Machine Learning (ICML), pages 12674–12685, 2021. 1, 2, 5, 6, 11

    2021

  39. [47]

    Dataset condensation with dis- tribution matching

    Bo Zhao and Hakan Bilen. Dataset condensation with dis- tribution matching. In IEEE/CVF Winter Conference on Ap- plications of Computer Vision (WACV) , pages 6514–6523,

  40. [48]

    Dataset condensation with gradient matching

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensation with gradient matching. arXiv preprint arXiv:2006.05929, 2020. 1, 2, 5, 6, 11

    2006 arXiv

  41. [49]

    Improved distribution matching for dataset condensation

    Ganlong Zhao, Guanbin Li, Yipeng Qin, and Yizhou Yu. Improved distribution matching for dataset condensation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7856–7865, 2023. 1, 2, 5, 6, 11

    2023

  42. [50]

    Dataset distillation using neural feature regression

    Yongchao Zhou, Ehsan Nezhadarya, and Jimmy Ba. Dataset distillation using neural feature regression. In Advances in Neural Information Processing Systems (NeurIPS), pages 9813–9827, 2022. 1

    2022

  43. [51]

    Adversarial exam- ples are closely relevant to neural network models - a pre- liminary experiment explore

    Zheng Zhou, Ju Liu, and Yanyang Han. Adversarial exam- ples are closely relevant to neural network models - a pre- liminary experiment explore. In Advances in Swarm Intel- ligence, pages 155–166, Cham, 2022. Springer International Publishing. 1

    2022

  44. [52]

    Bacon: Bayesian optimal condensation framework for dataset distil- lation

    Zheng Zhou, Hongbo Zhao, Guangliang Cheng, Xiangtai Li, Shuchang Lyu, Wenquan Feng, and Qi Zhao. Bacon: Bayesian optimal condensation framework for dataset distil- lation. arXiv preprint arXiv:2406.01112 , 2024. 1, 2, 5, 6, 11, 12 10

    2024 arXiv

  45. [53]

    Mvpatch: More vivid patch for adversarial camouflaged attacks on object detectors in the physical world

    Zheng Zhou, Hongbo Zhao, Ju Liu, Qiaosheng Zhang, Li- wei Geng, Shuchang Lyu, and Wenquan Feng. Mvpatch: More vivid patch for adversarial camouflaged attacks on object detectors in the physical world. arXiv preprint arXiv:2312.17431, 2024. 1 Supplementary Material BEARD: Bench...

    2024 arXiv

  46. [256]

    Additionally, we provide a configuration JSON file to facilitate the conve- nient setup and management of experimental parameters

    All experiments, including both the generation of syn- thetic datasets and the training of models, are conducted us- ing NVIDIA RTX 2080 Ti GPU clusters. Additionally, we provide a configuration JSON file to facilitate the conve- nient setup and management of experimental para...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.