{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2017:KZG3KZYNJL4WELWEUIYJYDU4LJ","short_pith_number":"pith:KZG3KZYN","schema_version":"1.0","canonical_sha256":"564db5670d4af9622ec4a2309c0e9c5a4928e1de69d2ab12e5b525c3cc1354a3","source":{"kind":"arxiv","id":"1705.07204","version":5},"attestation_state":"computed","paper":{"title":"Ensemble Adversarial Training: Attacks and Defenses","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","cs.LG"],"primary_cat":"stat.ML","authors_text":"Alexey Kurakin, Dan Boneh, Florian Tram\\`er, Ian Goodfellow, Nicolas Papernot, Patrick McDaniel","submitted_at":"2017-05-19T21:56:43Z","abstract_excerpt":"Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model's loss. We show that this form of adversarial training converges to a degenerate global minimum, wherein small curvature artifacts near the data points obfuscate a linear approximation of the loss. The model thus learns to generate weak perturbations, rather than defend against s"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"1705.07204","kind":"arxiv","version":5},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"stat.ML","submitted_at":"2017-05-19T21:56:43Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"3846decdb2d345772880338ceba9c846778f0da459403ef3d4d68a8f971852b0","abstract_canon_sha256":"37da43319fe10183fad2b0bdd8c42ea5c2430fe0636c3b47ea86dc1baa65ffe5"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T00:58:00.101356Z","signature_b64":"jce8LIE7cOW0UN1S//XAwx4BCBiFW8QZpxgruYKl+qt4TEz2tr3VxOemAy7viz995bNihRWH8PLZBKWZ7Q+UCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"564db5670d4af9622ec4a2309c0e9c5a4928e1de69d2ab12e5b525c3cc1354a3","last_reissued_at":"2026-07-05T00:58:00.100910Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T00:58:00.100910Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Ensemble Adversarial Training: Attacks and Defenses","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","cs.LG"],"primary_cat":"stat.ML","authors_text":"Alexey Kurakin, Dan Boneh, Florian Tram\\`er, Ian Goodfellow, Nicolas Papernot, Patrick McDaniel","submitted_at":"2017-05-19T21:56:43Z","abstract_excerpt":"Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model's loss. We show that this form of adversarial training converges to a degenerate global minimum, wherein small curvature artifacts near the data points obfuscate a linear approximation of the loss. The model thus learns to generate weak perturbations, rather than defend against s"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1705.07204","kind":"arxiv","version":5},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1705.07204/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"1705.07204","created_at":"2026-07-05T00:58:00.100964+00:00"},{"alias_kind":"arxiv_version","alias_value":"1705.07204v5","created_at":"2026-07-05T00:58:00.100964+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1705.07204","created_at":"2026-07-05T00:58:00.100964+00:00"},{"alias_kind":"pith_short_12","alias_value":"KZG3KZYNJL4W","created_at":"2026-07-05T00:58:00.100964+00:00"},{"alias_kind":"pith_short_16","alias_value":"KZG3KZYNJL4WELWE","created_at":"2026-07-05T00:58:00.100964+00:00"},{"alias_kind":"pith_short_8","alias_value":"KZG3KZYN","created_at":"2026-07-05T00:58:00.100964+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":15,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2606.04767","citing_title":"Measuring Model Robustness via Fisher Information: Spectral Bounds, Theoretical Guarantees, and Practical Algorithms","ref_index":77,"is_internal_anchor":false},{"citing_arxiv_id":"1907.00374","citing_title":"Fooling a Real Car with Adversarial Traffic Signs","ref_index":36,"is_internal_anchor":false},{"citing_arxiv_id":"2406.09250","citing_title":"MirrorCheck: Efficient Adversarial Defense for Vision-Language Models","ref_index":87,"is_internal_anchor":false},{"citing_arxiv_id":"1907.05274","citing_title":"Affine Disentangled GAN for Interpretable and Robust AV Perception","ref_index":29,"is_internal_anchor":false},{"citing_arxiv_id":"2410.03000","citing_title":"Towards Generalized Certified Robustness with Multi-Norm Training","ref_index":44,"is_internal_anchor":false},{"citing_arxiv_id":"2512.13647","citing_title":"REVERB-FL: Server-Side Adversarial and Reserve-Enhanced Federated Learning for Robust Audio Classification","ref_index":33,"is_internal_anchor":false},{"citing_arxiv_id":"2605.15416","citing_title":"Margin-Adaptive Confidence Ranking for Reliable LLM Judgement","ref_index":64,"is_internal_anchor":false},{"citing_arxiv_id":"2511.21893","citing_title":"Breaking the Illusion: Consensus-Based Generative Mitigation of Adversarial Illusions in Multi-Modal Embeddings","ref_index":27,"is_internal_anchor":false},{"citing_arxiv_id":"2109.13916","citing_title":"Unsolved Problems in ML Safety","ref_index":191,"is_internal_anchor":false},{"citing_arxiv_id":"2605.10582","citing_title":"Guaranteed Jailbreaking Defense via Disrupt-and-Rectify Smoothing","ref_index":49,"is_internal_anchor":false},{"citing_arxiv_id":"2605.08910","citing_title":"Enhancing Adversarial Robustness in Network Intrusion Detection: A Layer-wise Adaptive Regularization Approach","ref_index":22,"is_internal_anchor":false},{"citing_arxiv_id":"2604.23362","citing_title":"UniAda: Universal Adaptive Multi-objective Adversarial Attack for End-to-End Autonomous Driving Systems","ref_index":18,"is_internal_anchor":false},{"citing_arxiv_id":"2604.08827","citing_title":"Quantum Patches: Enhancing Robustness of Quantum Machine Learning Models","ref_index":20,"is_internal_anchor":false},{"citing_arxiv_id":"2604.06954","citing_title":"Compression as an Adversarial Amplifier Through Decision Space Reduction","ref_index":41,"is_internal_anchor":false},{"citing_arxiv_id":"2604.23593","citing_title":"When AI reviews science: Can we trust the referee?","ref_index":82,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ","json":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ.json","graph_json":"https://pith.science/api/pith-number/KZG3KZYNJL4WELWEUIYJYDU4LJ/graph.json","events_json":"https://pith.science/api/pith-number/KZG3KZYNJL4WELWEUIYJYDU4LJ/events.json","paper":"https://pith.science/paper/KZG3KZYN"},"agent_actions":{"view_html":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ","download_json":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ.json","view_paper":"https://pith.science/paper/KZG3KZYN","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=1705.07204&json=true","fetch_graph":"https://pith.science/api/pith-number/KZG3KZYNJL4WELWEUIYJYDU4LJ/graph.json","fetch_events":"https://pith.science/api/pith-number/KZG3KZYNJL4WELWEUIYJYDU4LJ/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ/action/timestamp_anchor","attest_storage":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ/action/storage_attestation","attest_author":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ/action/author_attestation","sign_citation":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ/action/citation_signature","submit_replication":"https://pith.science/pith/KZG3KZYNJL4WELWEUIYJYDU4LJ/action/replication_record"}},"created_at":"2026-07-05T00:58:00.100964+00:00","updated_at":"2026-07-05T00:58:00.100964+00:00"}