Pith. sign in

REVIEW 3 major objections 3 minor 109 references

When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning

T0 review · 3 major / 3 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that adding a conformal prediction stage to multimodal backdoor detection turns a heuristic similarity cutoff into a statistically controlled test, with average FPR below 6 percent at full recall.

desk verdict A solid empirical backdoor-detection paper whose headline statistical guarantee is weaker than claimed—the authors half-admit it in a remark, but the proof and the reported FPR are not actually connected. read the letter →

arxiv 2608.04052 v1 pith:XTXCRYJR submitted 2026-08-04 cs.CR cs.CVcs.LG

Yiming Chen , Kemou Li , Haiwei Wu , Jiantao Zhou This is my paper · ORCID
classification cs.CRcs.CVcs.LG
keywords backdoordetectionmultimodalcontrastivelearningconformalpredictiondatapoisoningCLIPnonconformityscorecoarse-to-fineadaptiveattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoor attacks on multimodal contrastive learning hide triggered images paired with target-class captions inside pre-training data; after training, any image with the trigger is misclassified as the target class. Existing defenses score image–caption pairs by semantic similarity and cut at a fixed threshold, but the score distributions of benign and poisoned pairs overlap, so the cutoff carries no statistical guarantee. This paper proposes CASCADE, a two-stage detector: a coarse stage partitions the dataset into high-confidence benign, high-confidence poisoned, and ambiguous subsets using a cross-modality consistency score, and a fine stage applies conformal prediction with a textual nonconformity score to decide the ambiguous pairs. The paper's claim is that this both detects poisoned pairs accurately—on CC3M the average false-positive rate is 5.79% at 100% true-positive rate and average AUROC is 0.9867 across nine attacks—and provides a principled bound: under exchangeability, the probability of misclassifying a poisoned pair as benign is at most the chosen level $\epsilon$.

What carries the argument

The load-bearing object is the textual nonconformity score $A(t;S) = 1 - \frac{1}{|S|}\sum_{t' \in S} \cos(t_e, t'_e)$, which measures how far a candidate caption's embedding sits from the cluster of high-confidence poisoned captions. The coarse stage's cross-modality consistency score $\Delta_\kappa = |\kappa_{\mathrm{gen}} - \kappa_{\mathrm{orig}}|$, built from an image-conditioned caption embedding, supplies the initial split into $D_b$, $D_p$, and $D_u$ via a Gaussian mixture model. The conformal p-value $p = (1 + \sum_{i=1}^q \mathbf{1}(\alpha_i \ge \alpha_{q+1}))/(q+1)$ converts these nonconformity scores into a decision whose false-negative rate is controlled by Theorem 1.

What would settle it

Compute the empirical distribution of conformal p-values from Eq. (12) on truly poisoned pairs when the reference set is built by the paper's top-q selection; under the null hypothesis that the pair is poisoned, Theorem 1 requires this distribution to be uniform on $\{1/(q+1), \ldots, 1\}$. If it is not, the claimed level-$\epsilon$ bound does not hold for the actual construction.

Watch

Extended reading notes

Core claim

The central claim is that backdoor detection in multimodal contrastive learning can be made both more accurate and statistically principled by replacing a global similarity cutoff with a coarse-to-fine conformal test. In the coarse stage, an off-the-shelf image captioning model maps each image embedding into text space, and CASCADE computes the cross-modality consistency score $\Delta_\kappa = |\kappa_{\mathrm{gen}} - \kappa_{\mathrm{orig}}|$; poisoned pairs show large discrepancies because their captions do not describe the image. After a Gaussian mixture model partitions the data into $D_b$, $D_p$, and $D_u$, the fine stage computes for each ambiguous pair a nonconformity score equal to one minus the average cosine similarity between its caption embedding and the caption embeddings in the high-confidence poisoned reference set. That score is converted into a conformal p-value, and the pair is declared benign when $p \le \epsilon$. Theorem 1 states that under exchangeability of the test pair with the reference set, $\Pr[p \le \epsilon \mid H_0] \le \epsilon$, so the chance of a poisoned pair slipping through is controlled; experiments on CC3M report 5.79% average FPR at 100% TPR and 0.9867 average AUROC over nine attacks.

Load-bearing premise

The statistical guarantee assumes the reference set of suspected poisoned pairs behaves like a random sample from the poisoned distribution, but it is actually the q most extreme pairs selected by the first stage.

Editorial extensions

If this is right

  • If CASCADE is correct, a defender can filter poisoned pairs before CLIP pre-training and retrain on the remaining benign subset, cutting average attack success rate from 80.37% to 0.12% on ImageNet-1K while keeping clean accuracy within 1.5 points of clean training.
  • The conformal p-value gives a user-set error bar: choose $\epsilon$ and the probability of letting a poisoned pair through as benign is bounded by $\epsilon$, under the paper's exchangeability assumption.
  • The detector remains usable against adaptive attacks that optimize triggers for semantic consistency and diversify poisoned captions, with AUROC still above 0.93 and FPR at 100% TPR below 11.4%.
  • The method generalizes across poison rates, target classes, CLIP architectures, and pre-training datasets in the reported experiments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own adaptive-attack results show the hardest case is diversified poisoned captions, so a natural stress test is per-sample unique poisoned captions; the textual clustering signal should be expected to degrade further.
  • The exchangeability assumption is the fragile step: $D_p$ is the top-$q$ set by consistency, a selected-extremes set rather than an i.i.d. draw, so a stronger variant would draw the conformal reference set uniformly from the identified poisoned region or use weighted conformal methods that tolerate contaminated references.
  • The same two-stage signal—image-conditioned text prediction plus textual conformity—could be repurposed to audit other web-scale multimodal data problems, such as mismatched alt-text or noisy image–caption pairs, since it does not require knowing the trigger.
  • Because Stage I depends on an external image captioning mapping, an attacker who can also optimize against that mapping may close the gap; the paper does not test that combined threat.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper proposes CASCADE, a two-stage conformal backdoor detection method for multimodal contrastive learning. Stage I fits a Gaussian mixture model to a cross-modality consistency score and partitions the training data into a high-confidence poisoned set Dp, a high-confidence benign set Db, and an unidentified set Du. Stage II constructs a poisoned reference set from Dp, defines a textual nonconformity score based on cosine similarity in the CLIP text-embedding space, and converts it into a conformal p-value. The central theoretical claim is Theorem 1 (Appendix C): under an exchangeability assumption, the probability of misclassifying a poisoned pair as benign is bounded by the significance level. Empirically, the paper reports an average FPR of 5.79% at 100% TPR and an average AUROC of 0.9867 across nine backdoor attacks on CC3M, together with ablations, adaptive-attack evaluations, stress tests, and additional datasets.

Significance. If the conformal guarantee were valid, the paper would provide a practically appealing and statistically principled filter for poisoned image-caption pairs. The empirical evaluation is broad and valuable: nine attacks, multiple datasets and CLIP variants, adaptive attacks, stress tests at high poison rates, reference-set purity checks, and fault-tolerance analysis. The two-stage design and the use of an external captioning model to define the coarse consistency score are also interesting and could be reusable beyond the specific setting. The main weakness is that the advertised distribution-free guarantee is not actually established by the construction, because the reference set and test candidates are selected rather than i.i.d. draws; the empirical robustness results are reassuring but do not repair the theoretical claim.

major comments (3)
  1. [Appendix C, Eqs. (9) and (12)] Theorem 1's type-I error guarantee does not follow from the actual pipeline. Under Assumption 1, the test pair and the reference samples in Dp are required to be exchangeable i.i.d. draws from the poisoned distribution. However, Eq. (9) constructs Dp as the top-q pairs by the coarse consistency score, so Dp is a set of selected extremes, and the test candidate is a member of Du = D \ (Db ∪ Dp), meaning it is conditioned on not being selected into either high-confidence set. Both selection events break the exchangeability that is needed for the uniform p-value in Eq. (12). The Remark in Appendix C explicitly calls Assumption 1 an "idealized condition" and describes Dp as only an "approximate realization" of it. The high empirical purity in Table 12 and the fault-tolerance results in Table 13 show robustness to contamination, but they do not restore the distribution-free guarantee claimed in the abstract and in Section 4.2.
  2. [Theorem 1, Eq. (12), Table 1] The theorem certifies a different quantity from the headline empirical result. Theorem 1 controls Pr[p(x,t) ≤ ε | H0], which is the probability that a poisoned pair is misclassified as benign. The headline "5.79% FPR@100%TPR" in Table 1 is the empirical fraction of benign pairs flagged as poisoned when all poisoned pairs are detected; it is an ROC operating point and is not bounded by Theorem 1. The manuscript should state this distinction explicitly and should not present Theorem 1 as certifying the reported FPR values.
  3. [Section 5.5, Figure 5, Table 1] The main hyperparameters K=3, γ=0.8, and q=100 are selected by ablations on the same CC3M benchmark that is used for the headline results in Table 1, and the manuscript does not report error bars or repeated-seed statistics. This makes it difficult to assess whether the average FPR and AUROC numbers reflect a tuned operating point or stable performance. The authors should either report variance across multiple runs or perform hyperparameter selection on a separate validation split and report test-set results on held-out data.
minor comments (3)
  1. [Section 4, paragraph after Eq. (5)] There is a typo: the phrase "robust learning (Li et al. 2024a, 2025a)..StageII" contains a double period before "StageII" and should be corrected.
  2. [Appendix C, proof of Theorem 1] The proof states that the p-value is exactly uniformly distributed, but Eq. (12) uses a non-strict inequality (α_i ≥ α_{q+1}); ties in the nonconformity scores can make the stated equality in distribution inexact. The bound Pr[p ≤ ε] ≤ ε remains conservative under tie-breaking conventions, but the proof should state the tie assumption or the conservative nature of the result.
  3. [Appendix G, Limitations] The limitations listed (dynamic attacks, continual learning, inference-stage detection, multilingual pairs) are useful and appropriately candid, but the abstract and introduction present CASCADE in fairly general terms; one sentence in the conclusion or abstract acknowledging these boundary conditions would help calibrate the reader's expectations.

Circularity Check

1 steps flagged · score 6.0 of 10

Theorem 1's error-control guarantee is assumed, not derived: Dp is the top-q tail by Eq. (9), so Assumption 1's i.i.d. exchangeability is contradicted by construction and is conceded as 'idealized'.

  1. other [Section 4.1 Eq. (9), Section 4.2 Eq. (10)-(12), Appendix C Assumption 1, Remark, Theorem 1]
    "we take q pairs with the largest consistency values: Dp = Top-q({∆κ(x_i,t_i)}^N_{i=1}). ... D_u = D̃ \(D_b ∪ D_p). ... Assumption 1 (Exchangeability). Assume that (x, t) and the samples in D_p are drawn i.i.d. from the poisoned distribution. ... although the top-q selection procedure does not strictly produce i.i.d. samples from the poisoned distribution, the resulting reference set can be regarded as an approximate realization of this idealized setting."

    The theorem's validity is not a consequence of the algorithm; it is an imported assumption that the construction contradicts. Eq. (9) defines Dp as the q most extreme Δκ samples, and the candidate is explicitly drawn from D_u = D̃ \(D_b ∪ D_p), so the reference and test are not exchangeable draws from one poison distribution: one is a selected tail, the other is conditioned on exclusion from that tail. The paper's own Remark concedes that the top-q selection 'does not strictly produce i.i.d. samples' and labels Assumption 1 'an idealized condition.' Theorem 1 therefore reduces to assuming that Dp is a representative poison sample—the very property the detector is supposed to establish—rather than proving it.

full rationale

The empirical detection pipeline is not circular in the classic sense: Stage II's textual NCS (Eq. 11) uses a different signal (text-space clustering) than Stage I's cross-modality consistency (Eq. 4), and it labels samples outside the seed set Dp, so its detections are not merely a re-statement of the coarse-stage input. No load-bearing self-citation or fitted-parameter-renamed-as-prediction appears; the method is benchmarked against external defenses and generalizes across attacks, datasets, and mapping networks. However, the central advertised 'provable confidence bounds' rest entirely on Assumption 1, which is not satisfied by construction because Dp is the top-q selected tail and the test candidate is from the complement. The paper explicitly calls the assumption idealized, so Theorem 1 does not follow from the method; it is an assumed guarantee. Because the abstract and introduction lead with 'provable confidence bounds' and the theorem is the theoretical core, this is a central circularity/validity gap that is only partially mitigated by the empirical purity and fault-tolerance studies.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The detection pipeline rests on a set of modeling assumptions and hand-tuned hyperparameters. The exchangeability assumption is the most fragile and is explicitly acknowledged by the authors as idealized. The GMM and CLIPCap mapping assumptions are standard tools but are not independently verified in this setting. No new physical or conceptual entities are introduced.

free parameters (5)
  • K (number of GMM components) = 3
    Selected by ablation on CC3M (Fig. 5a); controls how consistency scores are partitioned into benign, poisoned, and unidentified subsets.
  • gamma (benign confidence threshold) = 0.8
    Selected by ablation on CC3M (Fig. 5b); controls the purity and coverage of the high-confidence benign subset D_b.
  • q (poisoned reference set size) = 100
    Selected by ablation on CC3M (Fig. 5c); determines how many top-consistency pairs form the poisoned reference set T_ref for conformal scoring.
  • epsilon (conformal significance level) = 0.05 (default, implied)
    Chosen by the user; controls the threshold on conformal p-values and the claimed type-I error bound in Theorem 1.
  • GMM component parameters = estimated by EM on the training set
    Mixing weights, means, and variances are fit to the same dataset being partitioned, so the subset boundaries adapt to the data rather than being externally fixed.
assumptions (4)
  • ad hoc to paper Assumption 1 (Exchangeability): under H0, test pair and reference samples in Dp are i.i.d. from the poisoned distribution.
    Required for Theorem 1's p-value uniformity; top-q selection makes it an approximation, and the paper calls it an idealized condition (Appx. C).
  • domain assumption The consistency scores Delta_kappa follow a K-component Gaussian mixture with a low-mean benign component.
    Stage I's benign subset is defined as the lowest-mean GMM component (Section 4.1); no justification is given that the real score distribution is Gaussian.
  • domain assumption CLIPCap's mapping G places image embeddings in the CLIP text-embedding space so generated text embeddings are comparable to caption embeddings.
    The cross-modality consistency score relies on this comparability (Section 4.1, Eq. 2); the paper tests several G choices but does not analyze failure modes of the mapping.
  • domain assumption Poisoned captions for a target class cluster tightly in text-embedding space.
    Stage II's textual nonconformity score assumes poisoned captions form a compact reference cluster (Section 4.2, Fig. 2c); adaptive paraphrasing tests this but does not guarantee it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning." pith.science (2026). https://pith.science/paper/XTXCRYJR

@misc{pith2026260804052,
  author       = {Pith},
  title        = {Pith review of: When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XTXCRYJR}},
  note         = {Machine review of arXiv:2608.04052}
}
read the original abstract

Backdoor attacks in multimodal contrastive learning (MCL) have garnered growing attention in recent years, as many downstream tasks critically depend on pre-trained MCL models. Existing detection-based defenses predominantly rely on the CLIPScore metric, under the assumption that poisoned pairs exhibit lower semantic similarity between the image and the caption. However, we identify two critical flaws remaining in existing methods: (1) the substantial overlap between CLIPScore distributions of benign and poisoned pairs undermines the reliability of this metric, and (2) fixed-threshold detection cannot provide statistical guarantees for ambiguous samples within overlapping regions. To overcome these limitations, we propose integrating conformal prediction (CP), a statistical framework that quantifies uncertainty through nonconformity scores (NCSs), to establish provable confidence bounds for detecting poisoned image-caption pairs. Building on CP, we introduce CASCADE, a novel two-stage Coarse-to-Fine Conformal Backdoor Detection framework. The coarse-grained stage uses cross-modality consistency to identify high-confidence benign and poisoned pairs. In the fine-grained stage, a reference set is constructed from high-confidence poisoned pairs, and instance-level NCSs based on text-space similarity are computed for each sample in the unidentified subset. These NCSs measure conformity to the poisoning distribution and enable precise identification of latent poisoned pairs within the unidentified subset. Extensive experiments on the large-scale CC3M dataset demonstrate that CASCADE achieves an average FPR of 5.79% at 100% TPR and an average AUROC of 0.9867 across diverse attacks, while remaining effective against adaptive attacks.

Figures

Figures reproduced from arXiv: 2608.04052 by the authors.

Figure 1
Figure 1. Backdoor attack scenario in MCL. fine-tuning pre-trained MCL encoders. Without loss of gen￾erality, we focus on CLIP models, while our method can be readily extended to other MCL architectures. MCL leverages large-scale image–caption datasets to en￾hance semantic understanding; however, this reliance de facto introduces critical security vulnerabilities (Chen et al. 2023). Carlini et al. (2024) shows that large-scal… view at source ↗
Figure 2
Figure 2. Comparison between CLIPScore and the proposed NCS. (a) CLIPScore distributions of benign and poisoned pairs (normalized to [0, 1]), showing substantial overlap. (b) Normalized NCS distributions of benign and poisoned pairs, where a simple threshold separates the two groups. (c) Confusion matrix of text embedding correlation scores for poisoned and benign pairs, indicating that poisoned pairs exhibit markedly stronge… view at source ↗
Figure 3
Figure 3. Overview of CASCADE. Stage I performs coarse-grained detection by using cross-modality consistency to partition the dataset into a high-confidence poisoned subset Dp, a high-confidence benign subset Db, and an unidentified subset Du. Stage II refines Du via conformal prediction using Dp as the poisoned reference set. 3 Problem Statement Threat Model. Consider a clean image–caption dataset, de￾noted by D = {(xi , ti)… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Computation of cross-modality consistency. ambiguous remainder Du, analogous to clean/noisy sample separation in robust learning (Li et al. 2024a, 2025a).. Stage II (fine-grained detection) in §4.2 focuses on Du and employs CP to determine whether each sample conforms …
Figure 5
Figure 5. Figure 5: Sensitivity of CASCADE to (a) the number of Gaussian components K, (b) the confidence threshold γ, and (c) the size of the poisoned reference subset q [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Illustration of GMM-based subset partitioning process. (a) Distribution of consistency values. (b) A GMM is fitted to the consistency distribution, with each Gaussian component outlined by a dotted line. (c) The components with the minimum and maximum means (µ) are hig…
Figure 8
Figure 8. Figure 8: Time consumption comparison of CASCADE and existing defense methods. F.6 Time Consumption We report the runtime of CASCADE and existing defenses in [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 9
Figure 9. Figure 9: Visualization examples of the visual-guided [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

109 extracted references · 67 canonical work pages

  1. [1]

    Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervision , author =

  2. [2]

    Poisoning and Backdooring Contrastive Learning , author=

  3. [3]

    Data Poisoning Attacks Against Multimodal Encoders , author =

  4. [4]

    Carlini, Nicholas and Jagielski, Matthew and Choquette-Choo, Christopher A and Paleka, Daniel and others , booktitle = SP, title =

  5. [5]

    Siyuan Liang and Mingli Zhu and Aishan Liu and Baoyuan Wu and others , title =

  6. [6]

    Bansal, Hritik and Singhi, Nishad and Yang, Yu and Yin, Fan and others , title =

  7. [7]

    arXiv:2403.16257 , year=

    Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearning , author=. arXiv:2403.16257 , year=

    arXiv

  8. [8]

    Yuan Xun and Siyuan Liang and Xiaojun Jia and Xinwei Liu and others , title =

Show all 109 references
  1. [9]

    Yang, Wenhan and Gao, Jingdong and Mirzasoleiman, Baharan , booktitle = NEURIPS, title =

  2. [10]

    Detecting Backdoor Samples in Contrastive Language Image Pretraining , author=

  3. [11]

    Pre-trained trojan attacks for visual recognition , author=

  4. [12]

    Does Few-shot Learning Suffer from Backdoor Attacks? , author=

  5. [13]

    Poisoned forgery face: Towards backdoor attacks on face forgery detection , author=

  6. [14]

    Liang, Jiawei and Liang, Siyuan and Liu, Aishan and Cao, Xiaochun , journal=IJCV, year=

  7. [15]

    Detecting backdoors in pre-trained encoders , author=

  8. [16]

    Gu, Tianyu and Liu, Kang and Dolan-Gavitt, Brendan and Garg, Siddharth , journal=

  9. [17]

    arXiv:1712.05526 , year=

    Targeted backdoor attacks on deep learning systems using data poisoning , author=. arXiv:1712.05526 , year=

    arXiv

  10. [18]

    A new backdoor attack in

    Barni, Mauro and Kallas, Kassem and Tondi, Benedetta , booktitle=ICIP, year=. A new backdoor attack in

  11. [19]

    Invisible backdoor attack with sample-specific triggers , author=

  12. [20]

    2025 , volume=

    Li, Fengpeng and Li, Kemou and Wu, Haiwei and Tian, Jinyu and others , journal=TIFS, title=. 2025 , volume=

    2025

  13. [21]

    2024 , volume=

    Wu, Haiwei and Zhou, Jiantao and Zhang, Xinyu and Tian, Jinyu and others , journal=TIFS, title=. 2024 , volume=

    2024

  14. [22]

    2025 , volume=

    Wu, Haiwei and Chen, Yiming and Zhou, Jiantao and Li, Yuanman , journal=TDSC, title=. 2025 , volume=

    2025

  15. [23]

    Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning , author=

  16. [24]

    A Simple Framework for Contrastive Learning of Visual Representations , author =

  17. [25]

    Trojaning attack on neural networks , author=

  18. [26]

    InverTune: A Backdoor Defense Method for Multimodal Contrastive Learning via Backdoor-Adversarial Correlation Analysis , author=

  19. [27]

    Li, Yige and Lyu, Xixiang and Koren, Nodens and Lyu, Lingjuan and others , booktitle = NEURIPS, title =

  20. [28]

    Dempster, A. P. and Laird, N. M. and Rubin, D. B. , title =. 1977 , pages =

    1977

  21. [29]

    Bermano , journal=

    Ron Mokady and Amir Hertz and Amit H. Bermano , journal=

  22. [30]

    Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and others , booktitle = NIPS, title =

  23. [31]

    Learning Transferable Visual Models From Natural Language Supervision , author =

  24. [32]

    Kim, Gwanghyun and Kwon, Taesung and Ye, Jong Chul , title =

  25. [33]

    arXiv:2204.06125 , year=

    Hierarchical text-conditional image generation with clip latents , author=. arXiv:2204.06125 , year=

    arXiv

  26. [34]

    arXiv:2409.19526 , year=

    Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threats , author=. arXiv:2409.19526 , year=

    arXiv

  27. [35]

    Test-Time Multimodal Backdoor Detection by Contrastive Prompting , author=

  28. [36]

    Clark, Kevin and Jaini, Priyank , booktitle = NEURIPS, title =

  29. [37]

    Nichol, Alexander Quinn and Dhariwal, Prafulla and Ramesh, Aditya and Shyam, Pranav and others , booktitle = ICML, year =

  30. [38]

    Avrahami, Omri and Lischinski, Dani and Fried, Ohad , title =

  31. [39]

    Wang, Zhizhong and Zhao, Lei and Xing, Wei , title =

  32. [40]

    Ye, Fulong and Liu, Guang and Wu, Xinya and Wu, Ledell , year=

  33. [41]

    Liu, Haotian and Li, Chunyuan and Wu, Qingyang and Lee, Yong Jae , booktitle = NEURIPS, title =

  34. [42]

    Zhang, Hang and Li, Xin and Bing, Lidong , booktitle = EMNLP, year =. Video-

  35. [43]

    Video-ChatGPT: Towards Detailed Video Understanding via Large Vision and Language Models , author=

  36. [44]

    Tuan Anh Nguyen and Anh Tuan Tran , booktitle=ICLR, year=

  37. [45]

    Decoupled Weight Decay Regularization , author=

  38. [46]

    Davis, Jesse and Goadrich, Mark , title =

  39. [47]

    Microsoft

    Chen, Xinlei and Fang, Hao and Lin, Tsung-Yi and Vedantam, Ramakrishna and others , journal=. Microsoft

  40. [48]

    Wang, Zihan and Pang, Guansong and Miao, Wenjun and Zheng, Jin and others , booktitle = AAAI, year =

  41. [49]

    Philipp Allgeuer and Kyra Ahrens and Stefan Wermter , title =

  42. [50]

    Abbasi, Reza and Nazari, Ali and Sefid, Aminreza and Banayeeanzade, Mohammadali and others , title =

  43. [51]

    When and why Vision-Language Models behave like Bags-of-Words, and what to do about it? , author=

  44. [52]

    Deep residual learning for image recognition , author=

  45. [53]

    arXiv:2003.04297 , year=

    Improved Baselines with Momentum Contrastive Learning , author=. arXiv:2003.04297 , year=

    2003 arXiv

  46. [54]

    2014 , pages=

    From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions , author =. 2014 , pages=

    2014

  47. [55]

    Li, Junnan and Li, Dongxu and Xiong, Caiming and Hoi, Steven , booktitle = ICML, year =

  48. [56]

    Rashtchian, Cyrus and Young, Peter and Hodosh, Micah and Hockenmaier, Julia , title =

  49. [57]

    Zhai, Xiaohua and Mustafa, Basil and Kolesnikov, Alexander and Beyer, Lucas , title =

  50. [58]

    SLIP : Self-supervision Meets Language-Image Pre-training

    Mu, Norman and Kirillov, Alexander and Wagner, David and Xie, Saining. SLIP : Self-supervision Meets Language-Image Pre-training. 2022

    2022

  51. [59]

    Supervision Exists Everywhere: A Data Efficient Contrastive Language-Image Pre-training Paradigm , author=

  52. [60]

    arXiv:1912.02771 , year=

    Label-Consistent Backdoor Attacks , author=. arXiv:1912.02771 , year=

    1912 arXiv

  53. [61]

    2005 , publisher=

    Algorithmic learning in a random world , author=. 2005 , publisher=

    2005

  54. [62]

    2014 , publisher=

    Conformal prediction for reliable machine learning: Theory, adaptations and applications , author=. 2014 , publisher=

    2014

  55. [63]

    Prediction with confidence based on a random forest classifier , author=

  56. [64]

    Real-time out-of-distribution detection in learning-enabled cyber-physical systems , author=

  57. [65]

    arXiv:1803.04765 , year=

    Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning , author=. arXiv:1803.04765 , year=

    arXiv

  58. [66]

    Li, Junnan and Li, Dongxu and Savarese, Silvio and Hoi, Steven , title =

  59. [67]

    Alayrac, Jean-Baptiste and Donahue, Jeff and Luc, Pauline and Miech, Antoine and others , title =

  60. [68]

    Driess, Danny and Xia, Fei and Sajjadi, Mehdi S. M. and Lynch, Corey and others , title =

  61. [69]

    Zhen Xiang and Zidi Xiong and Bo Li , booktitle=NEURIPS, year=

  62. [70]

    Liang, Ziyi and Sesia, Matteo and Sun, Wenguang , title =

  63. [71]

    Kaur, Ramneet and Jha, Susmit and Roy, Anirban and Park, Sangdon and others , year =

  64. [72]

    Testing exchangeability on-line , author=

  65. [73]

    Sequential conformal anomaly detection in trajectories based on

    Laxhammar, Rikard and Falkman, G. Sequential conformal anomaly detection in trajectories based on

  66. [74]

    2024 , volume=

    Zhang, Jiale and Zhu, Chengcheng and Sun, Xiaobing and Ge, Chunpeng and others , journal=TIFS, title=. 2024 , volume=

    2024

  67. [75]

    2024 , volume=

    Sun, Wenli and Jiang, Xinyang and Dou, Shuguang and Li, Dongsheng and others , journal=TIFS, title=. 2024 , volume=

    2024

  68. [76]

    2024 , volume=

    Chen, Chen and Hong, Haibo and Xiang, Tao and Xie, Mande , journal=TIFS, title=. 2024 , volume=

    2024

  69. [77]

    2024 , volume=

    Vice, Jordan and Akhtar, Naveed and Hartley, Richard and Mian, Ajmal , journal=TIFS, title=. 2024 , volume=

    2024

  70. [78]

    2024 , volume=

    Gao, Yinghua and Li, Yiming and Gong, Xueluan and Li, Zhifeng and others , journal=TIFS, title=. 2024 , volume=

    2024

  71. [79]

    2024 , volume=

    Guo, Wei and Tondi, Benedetta and Barni, Mauro , journal=TIFS, title=. 2024 , volume=

    2024

  72. [80]

    Wenhan Yang and Jingdong Gao and Baharan Mirzasoleiman , title =

  73. [81]

    Krishna, Ranjay and Zhu, Yuke and Groth, Oliver and Johnson, Justin and others , journal=IJCV, volume=. Visual

  74. [82]

    Ramos, Rita and Martins, Bruno and Elliott, Desmond and Kementchedjhieva, Yova , title =

  75. [83]

    Oscar: Object-Semantics Aligned Pre-training for Vision-Language Tasks. 2020

    2020

  76. [84]

    Dormant Backdoor: Weaponizing Model Finetuning for Feasible Backdoor Attacks Against Pretrained Models , author =

  77. [85]

    Barraco, Manuele and Stefanini, Matteo and Cornia, Marcella and Cascianelli, Silvia and others , booktitle=ICPR, year=

  78. [86]

    Rikard Laxhammar and Gran Falkman , title =

  79. [87]

    Robust Conformal Outlier Detection under Contaminated Reference Data , author=

  80. [88]

    Fengpeng Li and Kemou Li and Haiwei Wu and Jinyu Tian and others , title =

  81. [89]

    2009 , institution=

    Alex Krizhevsky , title =. 2009 , institution=

    2009

  82. [90]

    Food-101 -- M ining Discriminative Components with Random Forests

    Bossard, Lukas and Guillaumin, Matthieu and Van Gool, Luc. Food-101 -- M ining Discriminative Components with Random Forests. 2014

    2014

  83. [91]

    Parkhi and Andrea Vedaldi and Andrew Zisserman and C

    Omkar M. Parkhi and Andrea Vedaldi and Andrew Zisserman and C. V. Jawahar , title =

  84. [92]

    Krause, Jonathan and Stark, Michael and Deng, Jia and Fei-Fei, Li , booktitle=ICCVW, title=

  85. [93]

    Learning Generative Visual Models from Few Training Examples: An Incremental

    Li Fei. Learning Generative Visual Models from Few Training Examples: An Incremental

  86. [94]

    Olga Russakovsky and Jia Deng and Hao Su and Jonathan Krause and others , title =

  87. [95]

    2000 , publisher=

    Finite mixture models , author=. 2000 , publisher=

    2000

  88. [96]

    OpenAI Blog , volume=

    Language models are unsupervised multitask learners , author=. OpenAI Blog , volume=

  89. [97]

    2025 , publisher=

    Li, KunChang and He, Yinan and Wang, Yi and Li, Yizhuo and others , journal=. 2025 , publisher=

    2025

  90. [98]

    Editprint: General Digital Image Forensics via Editing Fingerprint with Self-Augmentation Training , author=

  91. [99]

    Fengpeng Li and Kemou Li and Qizhou Wang and Bo Han and others , booktitle=ICLR, year=

  92. [100]

    Fengpeng Li and Kemou Li and Qizhou Wang and Bo Han and others , title =

  93. [101]

    Regroup Median Loss for Combating Label Noise , author=

  94. [102]

    Zhilin Tu and Kemou Li and Fengpeng Li and Jianwei Fei and others , journal=

  95. [103]

    Wong, Kahim and Zhou, Jicheng and Li, Kemou and Si, Yain-Whar and others , journal=TMM, pages=

  96. [104]

    Li, Kemou and Wang, Qizhou and Wang, Yue and Li, Fengpeng and others , booktitle=ICLR, year=

  97. [105]

    Wong, Kahim and Li, Kemou and Chen, Yiming and Wu, Haiwei and others , journal=

  98. [106]

    Wong, Kahim and Li, Kemou and Wu, Haiwei and Zhou, Jiantao , journal=

  99. [107]

    Gushchin, Aleksandr and others , booktitle=

  100. [108]

    Progressive Poisoned Data Isolation for Training-Time Backdoor Defense , author=

  101. [109]

    Effective Ambiguity Attack Against Passport-Based

    Chen, Yiming and Tian, Jinyu and Chen, Xiangyu and Zhou, Jiantao , booktitle=CVPR, year=. Effective Ambiguity Attack Against Passport-Based

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.