Library

DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain

To protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample's frequency spectrum -- typically containing crucial semantic information -- more than those in the amplitude, resulting in the model's erroneous categorization of AEs. We find that, by mixing the amplitude of training samples' frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As a result, the model's robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized Adversarial Amplitude Generator (AAG) to achieve a better tradeoff between improving the model's robustness and retaining phase patterns. Based on this generator, together with an efficient AE production procedure, we design a new Dual Adversarial Training (DAT) strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks.

cs.LGcs.CVAdversarial Robustness in Machine LearningFire Detection and Safety SystemsComputer Science
View graphSource

Paper

References (64)

01Decoupled Kullback-Leibler Divergence LossJiequan Cui, Zhuotao Tian, Zhisheng Zhong et al.2023 · Neural Information Processing Systems · 108 citations In Library
02Rethinking Model Ensemble in Transfer-based Adversarial AttacksHuanran Chen, Yichi Zhang, Yinpeng Dong et al.2023 · International Conference on Learning Representations · 125 citations In Library
03Domain Generalisation via Domain Adaptation: An Adversarial Fourier Amplitude ApproachMinyoung Kim, Da Li, Timothy M. Hospedales2023 · International Conference on Learning Representations · 16 citations In Library
04Better Diffusion Models Further Improve Adversarial TrainingZekai Wang, Tianyu Pang, Chao Du et al.2023 · International Conference on Machine Learning · 318 citations In Library
05Data Augmentation Alone Can Improve Adversarial TrainingLin Li, Michael W. Spratling2023 · International Conference on Learning Representations · 69 citations In Library
06Efficient and Effective Augmentation Strategy for Adversarial TrainingSravanti Addepalli, Samyak Jain, R. Venkatesh Babu2022 · Neural Information Processing Systems · 75 citations In Library
07Scaling Adversarial Training to Large Perturbation BoundsSravanti Addepalli, Samyak Jain, Gaurang Sriramanan et al.2022 · European Conference on Computer Vision · 28 citations In Library
08Saliency Guided Adversarial Training for Learning Generalizable Features with Applications to Medical Imaging Classification SystemXin Li, Yao Qiang, Chengyin Li et al.2022 · arXiv.org · 4 citations In Library
09Elucidating the Design Space of Diffusion-Based Generative ModelsTero Karras, M. Aittala, Timo Aila et al.2022 · Neural Information Processing Systems · 3.7k citations In Library
10Squeeze Training for Adversarial RobustnessQizhang Li, Yiwen Guo, W. Zuo et al.2022 · International Conference on Learning Representations · 19 citations In Library
11LAS-AT: Adversarial Training with Learnable Attack StrategyXiaojun Jia, Yong Zhang, Baoyuan Wu et al.2022 · Computer Vision and Pattern Recognition · 193 citations In Library
12Robustness and Accuracy Could Be Reconcilable by (Proper) DefinitionTianyu Pang, Min Lin, Xiao Yang et al.2022 · International Conference on Machine Learning · 177 citations In Library

Scroll for more · 38 remaining

Similar papers

Enhancing robust generalization through appropriate adversarial example attack intensityXiaoguo Ding, Liangjian Zhang, Qiqi Bao et al.2025 · Neurocomputing · 3 citations In Library
Improve Adversarial Robustness via Probabilistic Distributions Decoupled Network While Guaranteeing Clean PerformanceZeping Ye, Zhigang Zeng, Bingrong Xu2023 In Library
A Spectral Perspective towards Understanding and Improving Adversarial RobustnessBinxiao Huang, Rui Lin, Chaofan Tao et al.2023 · arXiv (Cornell University) · 1 citation In Library
Robustness and Generalization via Generative Adversarial TrainingOmid Poursaeed, Tianxing Jiang, Harry Yang et al.2021 · arXiv (Cornell University) · 37 citations In Library
Robustness and Generalization via Generative Adversarial TrainingOmid Poursaeed, Tianxing Jiang, Harry Yang et al.2021 · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) In Library
AT‐AER: Adversarial Training With Adaptive Example ReuseMeng Hu, Yanting Guo, Ran Wang et al.2026 · CAAI Transactions on Intelligence Technology In Library
Adaptive Perturbation-Driven Adversarial TrainingShuai Li, Xiaoguang Ma, Shancheng Jiang et al.2024 In Library
Progressive Diversified Augmentation for General Robustness of DNNs: A Unified ApproachHang Yu, Aishan Liu, Gengchao Li et al.2021 · IEEE Transactions on Image Processing In Library
Boosting Adversarial Training with Hardness-Guided Attack StrategyShiyuan He, Jiwei Wei, Chaoning Zhang et al.2024 · IEEE Transactions on Multimedia · 10 citations In Library
Towards Alternative Techniques for Improving Adversarial Robustness: Analysis of Adversarial Training at a Spectrum of PerturbationsKaustubh Sridhar, Souradeep Dutta, Ramneet Kaur et al.2022 · arXiv (Cornell University) · 4 citations In Library

Peer review

Accept (poster)NeurIPS 2024 · via OpenReview
Reviewer FTsi6/10 · confidence 3/52024-06-25

Summary

Motivated by observation on the difference influence of amplitude and phase of adversarial examples, this paper propose a framework to generate better adversarial examples for adversarial training. Experiments verify the effectiveness of the proposed approach.

Strengths

1. The motivation in Figure is clear and solid. 2. The experimental improvements are clear and consistent.

Weaknesses

1. The proposed framework contain many modules, making it complex and difficult to implement. 2. Some descriptions are unclear and some details are missed. See questions for details.

Questions

1. In Figure 1, the authors claim that “The adversarial perturbation severely damages phase pattern and the frequency spectrum, while amplitude patterns are rarely impacted.” However, this comparison is not clear. It seems the amplitude patterns still changes a lot in Figure 1. Both the patterns and spectrum change. Could you provide more proof on this observation (e.g., results on more images and more datasets)? 2. In Line 88, the features induced from the amplitude and phase patterns of x are denoted as $h_a(\mathbf{x})$ and $h_p(\mathbf{x})$ respectively. 
Does it indicate an assumption that some parts of the learned $h$ correspond to the amplitude features? Do we need carefully design the network to explicitly accomplish this? It also makes the theoretical analysis in Sec. 3.4 difficult to understand. 3. As the proposed framework contains multiple modules and optimization steps, it is surprising that the additional time consumptions are small. Could you please kindly provide more explanation on this? Do we need any relatively complex optimization tricks? Furthermore, what is the memory cost during training and could you please present the corresponding comparison with the baseline methods? 4. It seems the mix-up operation is important in the whole framework. The adversarial amplitude and original amplitude are mixed by linear combination and the proportion is sampled from a uniform distribution. How do you make such a design? Have you ever tried other possible methods?

Rating

6

Confidence

3

Soundness

3

Presentation

2

Contribution

3

Limitations

The authors discuss the limitations of this work in Sec. F.9 and say that the verification may be insufficient. No limitation of the proposed method itself is discussed.

Reviewer FTsi2024-08-10

The rebuttal mostly addresses my concerns. Therefore, I decide to increase the score.

Authorsrebuttal2024-08-10

Dear Reviewer， We greatly appreciate your responses and score improvements. Also, the final version of the paper will be revised based on your comments.

Reviewer KucH5/10 · confidence 5/52024-07-13

Summary

The paper introduces Dual Adversarial Training (DAT). This method enhances deep neural network resilience against adversarial attacks by employing generative amplitude mix-up in the frequency domain, focusing the model on phase patterns less impacted by such perturbations, and presenting an optimized adversarial amplitude generator for balancing robustness improvements with phase pattern retention. Experiments validate DAT's effectiveness against diverse adversarial attacks.

Strengths

1. The paper is well-organized and easy to follow. 2. The experimental results show the effectiveness of the proposed method.

Weaknesses

1. In the experiment, only decision space attacks are used to test the defense capability. Compared with decision space attack, feature space attack can better destroy the semantic information of benign images and obtain more powerful adversarial samples. It is recommended that some feature space attacks be added to further demonstrate the effectiveness of the proposed method, like [a] and [b]. [a] StyLess: Boosting the Transferability of Adversarial Examples, CVPR 2023 [b] Enhancing the Self-Universality for Transferable Targeted Attacks, CVPR 2023 2. The types of models used in the experiment are not rich enough. Line 258 of this paper states that "ResNet-18, WideResNet-34-10 (WRN-34-10), and WideResNet-28-10 (WRN-28-10) are used as the backbones". Line 269 says "Table 1 displays the results on CIFAR-10, CIFAR-100, and tiny-ImageNet using ResNet-18". These models are all based on ResNet architecture and have high structural similarities. To show that the method proposed in this paper is generalizable, the proposed method should be able to achieve good results on different surrogate and target models. Therefore, it is recommended to add more surrogate and target models, such as Inception_v3, ViT, etc. 3. This paper uses CIFAR-10, CIFAR-100, and Tiny ImageNet for experiments, but does not use ImageNet. However, ImageNet is the most widely used dataset in the CV field. The authors should provide additional experimental results on ImageNet for this paper's method.

Questions

1. Can the authors provide some results against feature space attacks? 2. Can the authors provide some results on other models and datasets, like ImageNet and ViTs?

Rating

5

Confidence

5

Soundness

3

Presentation

3

Contribution

3

Limitations

The authors have discussed the limitations of the method proposed in this paper. It is suggested that the authors provide some results on other models and datasets, like ImageNet and ViTs.

Authorsrebuttal2024-08-13

Follow-up on Submission1111 Rebuttal Response

Dear Reviewer, We hope you are doing well. We sincerely appreciate the detailed feedback and the time you have devoted to reviewing our submission. In our recent rebuttal, we carefully address your concerns and provide detailed responses: - **Additional Experiments on Feature Space Attacks**: We conduct experiments on several **feature space attacks**, specifically including methods like **SMTDI/SMTDSI [a] and DCS/DLS [b]** as you suggested, to demonstrate the robustness of our approach against more challenging adversarial attacks. These results show that our method performs better than previous SOTA techniques in most scenarios, despite being originally designed for pixel space attacks. - **Incorporating Diverse Backbones**: We expand our experiments to include **additional backbones such as Inception_v3 and ViT-S**, demonstrating that our method generalizes well across different network architectures. The results confirm that our approach maintains its effectiveness and robustness across these diverse models. - **Extensive Experiments on ImageNet-1K**: We also provide **extensive results on the ImageNet-1K dataset**, a critical benchmark in the CV field. Given the time constraints, we combine our method with fast adversarial training techniques like FGSM-PGK and FGSM-PGI, achieving significant improvements in robustness compared to the baseline methods. These comprehensive experiments are conducted with great care to address your concerns about the scope and applicability of our approach, and to demonstrate its generalization and robustness across different models and datasets. With the rebuttal discussion period closing tomorrow, ***Aug 13, 11:59 PM AoE***, we would deeply appreciate your input if there are any further questions or points that you feel need clarification. If our rebuttal has satisfactorily addressed your concerns, we humbly request that you consider reflecting this positively in your rating score. Thank you very much for your continued support and thoughtful consideration. Best regards, Submission1111 Authors

Authorsrebuttal2024-08-13

Follow-up on Submission1111 Rebuttal - Request for Timely Feedback

Dear Reviewer, We hope this message finds you well. We apologize for reaching out again, but with the rebuttal discussion period **ending in less than 24 hours** on ***Aug 13, 11:59 PM AoE***, we kindly request your timely feedback on our rebuttal. To briefly restate our previous points in our rebuttal: - We conduct additional experiments on **feature space attacks**, including the SMTDI/SMTDSI [a] and DCS/DLS [b] methods that you suggested. These experiments demonstrate the robustness of our approach against more challenging adversarial attacks. - We expand our experiments to incorporate **diverse backbones**, such as Inception_v3 and ViT-S, showing that our method generalizes well across different network architectures. - We provide **extensive results on the ImageNet-1K dataset**, which is a critical benchmark in the CV field. Our results show significant improvements in robustness compared to baseline methods. These comprehensive efforts are made with great care to thoroughly address your concerns and demonstrate the generalization and robustness of our approach across different models and datasets. If our rebuttal has satisfactorily addressed your concerns, we humbly request that you consider reflecting this positively in your rating score. We would be deeply grateful for your timely input. Thank you very much for your continued support and thoughtful consideration. Best regards, Submission1111 Authors

Authorsrebuttal2024-08-14

Re: Official Comment by Reviewer KucH

Dear Reviewer, We are truly grateful for your continued time and effort in further discussing our submission. Below is our detailed response to the two questions you raised. --- > ***"For W1. could you please explain why you use a different dataset and a different threat model (a black-box setting) than those of Table 1 in the main paper?"*** + **Dataset:** The training dataset used in [a] and [b] is ImageNet-1k. We understand your concern and would like to clarify that existing adversarial training methods with multiple iteration steps for AE generation do not report results on ImageNet-1K, since AT with a 10-step AE generation on ImageNet-1K requires **approximately one week**. Additionally, these feature space attacks need to be performed on real-world dataset, e.g. ImageNet. Given these considerations, we choose ImageNette, a widely used subset of ImageNet-1K in adversarial training [c], for the experiments in **W1**. + **Backbones:** In [a] and [b], multiple backbones are adopted, including ResNet-50 and DenseNet-121. To better demonstrate the robust generalization of our method against feature space attacks, we select ViT-S, which **you mentioned in W2**, for experiments in **W1**. It is important to note that baselines in **W1** do not provide experimental results and settings with so many backbones, meaning we need significant time to explore these methods' settings across different backbones. Furthermore, given the rebuttal's **6000 characters** limit, it is challenging to present results for so many backbones. Consequently, to balance these factors and provide a clear comparison, combining the considerations of both **W1** and **W2**, we select **ResNet-50, DenseNet-121, and ViT-S** for **W1**. --- > ***"For W3, could you please explain why you use different attacks than those of Table 1 (FGSM, PGD-20, PGD-100, C&W, and AA) in the main paper?"*** The adversarial attacks we evaluate in **W3** follow [h]. To ensure a fair and consistent comparison on ImageNet-1K, we use these specific adversarial attacks to provide the results in **W3**. --- We sincerely hope these clarifications address your concerns. If there are any further questions or if you require additional explanations, we are more than happy to provide them. We also hope that if our responses sufficiently address your concerns, you might consider reflecting this positively in your review score.

Reviewer 8ttu6/10 · confidence 4/52024-07-13

Summary

This paper investigates a novel approach to improving adversarial training by performing data augmentation in the frequency domain. The authors propose a unique pipeline that jointly optimizes a classification network and a generator network. The generator is used to create adversarial noise, which is added to the amplitude component of the input to encourage the model to more accurately capture phase patterns. The authors conduct a comprehensive evaluation of their approach across multiple datasets and architectures, demonstrating its competitive performance.

Strengths

Comprehensive experiments on several datasets with different architectures. A novel approach that improves adversarial training by performing data augmentation using a generator network in the frequency domain.

Weaknesses

In Table 1 and Table 2, the authors have only compared their approach with a few weak baselines. Since the proposed approach is based on data augmentation, the authors should consider comparing it with other data augmentation-based approaches, such as DAJAT[1] and [47]. Although DAJAT’s results are presented in Table 3, the table does not show the clean accuracy of the models, making it difficult to assess the accuracy-robustness tradeoff. In fact, DAJAT’s clean accuracy is significantly higher than that of the proposed approach. For instance, DAJAT’s clean accuracies on CIFAR-10 and CIFAR-100 (with ResNet-18) are 86.67% and 66.96%, respectively, while the proposed approach’s are 84.17% and 63.28%. [37]’s clean accuracy and AA robust accuracy with WRN-34-10 are 86.18% and 58.09%, respectively, while the proposed approach’s with WRN-34-10 are 86.78% and 56.46%. The proposed pipeline is complicated, with a multi-part loss function and a requirement for joint optimization with a generator network. This complexity may necessitate extensive hyperparameter tuning to achieve satisfactory performance, making it a much more complex error-prone solution compared to data augmentation approaches such as [1] and [47].

Questions

No questions

Rating

6

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

Yes

Authorsrebuttal2024-08-13

Re: Type of augmentations

Dear Reviewer, Thank you very much for your prompt response and for your continued engagement with our submission. We appreciate the opportunity to clarify our approach, and below we provide detailed responses to the two points you raised. --- > ***"DAJAT applies 2 and 3 data augmentations"*** Regarding your question on DAJAT [1], the natural accuracy that you referenced is achieved by generating 2 or 3 augmented data samples for each benign sample using the **AutoAugment** strategy. These benign and augmented samples, along with their corresponding adversarial examples, are then utilized in the training process. --- > ***"we extend our DAT to include 2 and 3 augmentations"*** In our Dual Adversarial Training (DAT) approach, the recombined data with mixed amplitude spectra serve as augmented samples for each benign sample. **To ensure a fair comparison with DAJAT [1], we employ the adversarial amplitude generator to produce 3 distinct adversarial amplitude spectra. These spectra are subsequently mixed with the amplitude spectrum of the benign sample. By combining the phase spectrum of the benign sample with each of these mixed amplitude spectra, we generate 3 recombined data samples.** These are considered as 3 augmentations of the original benign sample. For a more detailed explanation of the augmentation process, including formulas, please refer to the subsequent comment titled **(Continued) Re: Type of augmentations**. --- Using these recombined data, we conduct the experiments detailed in **Table A.1**, providing a comparison with DAJAT using 2 and 3 augmentations. Our results indicate that our DAT method offers a superior accuracy-robustness trade-off under identical experimental conditions. We hope this explanation clarifies your concerns. We greatly appreciate your valuable feedback and look forward to any further questions or comments you may have. ---

Reviewer 8ttu2024-08-13

Thank the authors for the clarifications which have addressed my concerns. I have adjusted my rating accordingly.

Authorsrebuttal2024-08-13

(Continued) Re: Type of augmentations

To provide a clearer understanding of the statements "DAJAT [1] applies 2 and 3 data augmentations" and "we extend our DAT to include 2 and 3 augmentations", we offer a detailed explanation using a benign sample $(\mathbf{x},y)\in\mathcal{D}$ as an example. --- ### **For adversarial training with model $f$ using DAJAT [1], augmented data is generated as follows:** + **2 augmentations (#Aug. 2)**: + Generate augmented data via AutoAugment: $\mathbf{x}_1$=$\mathrm{AutoAugment}(\mathbf{x}), \quad \mathbf{x}_2$=$\mathrm{AutoAugment}(\mathbf{x})$. + Generate adversarial examples for $\mathbf{x}$, $\mathbf{x}_1$, and $\mathbf{x}_2$ as $\mathbf{x}^{\prime}$, $\mathbf{x}_1^{\prime}$, and $\mathbf{x}_2^{\prime}$, respectively. DAJAT then uses $\mathbf{x}$, $\mathbf{x}_1$, $\mathbf{x}_2$, $\mathbf{x}^{\prime}$, $\mathbf{x}_1^{\prime}$, and $\mathbf{x}_2^{\prime}$ for training. + **Similarly, DAJAT with 3 augmentations (#Aug. 3) follows the same procedure.** --- ### **For our DAT with IDFT $\mathcal{F}^{-1}(\cdot)$, model $f$, and adversarial amplitude generator $G$, recombined data (which can be regarded as augmented data) is generated as follows:** + **2 recombined data (#Aug. 2)**: + Generate adversarial amplitude: $\mathcal{A_1}(\mathbf{x})=G (f(\mathbf{x}), \mathbf{z}_1), \quad \mathrm{where}\ \mathbf{z}_1 \sim \mathcal{N}(0,1)$, $\mathcal{A_2}(\mathbf{x})=G (f(\mathbf{x}), \mathbf{z}_2), \quad \mathrm{where}\ \mathbf{z}_2 \sim \mathcal{N}(0,1)$. + Obtain recombined data: $\hat{\mathbf{x}}_1=\mathcal{F}^{-1}(\lambda_1 \cdot \mathcal{A_1}(\mathbf{x})+(1-\lambda_1)\cdot \mathcal{A}(\mathbf{x}),\mathcal{P}(\mathbf{x})), \quad \mathrm{where}\ \lambda_1\sim \mathrm{Uniform}(0,1)$, $\hat{\mathbf{x}}_2=\mathcal{F}^{-1}(\lambda_2 \cdot {\mathcal{A_2}}(\mathbf{x})+(1-\lambda_2)\cdot \mathcal{A}(\mathbf{x}),\mathcal{P}(\mathbf{x})), \quad \mathrm{where}\ \lambda_2\sim \mathrm{Uniform}(0,1)$. + Generate adversarial examples **with the same settings as DAJAT** for $\mathbf{x}$, $\hat{\mathbf{x}}_1$, and $\hat{\mathbf{x}}_2$ as $\mathbf{x}^{\prime}$, $\hat{\mathbf{x}}_1^{\prime}$, and $\hat{\mathbf{x}}_2^{\prime}$, respectively. Our DAT then uses $\mathbf{x}$, $\mathbf{x}_1$, $\mathbf{x}_2$, $\mathbf{x}^{\prime}$, $\mathbf{x}_1^{\prime}$, and $\mathbf{x}_2^{\prime}$ for training, **following the settings of DAJAT**. + **Similarly, DAT with 3 recombined data (#Aug. 3) follows the same strategy.** --- We hope this explanation provides greater clarity on the augmentations used in our approach. If there are any further questions or points that require clarification, we would be most grateful for your feedback. If our rebuttal has satisfactorily addressed your concerns, we humbly request that you consider reflecting this positively in your rating score. Thank you once again for your time, thoughtful consideration, and continued support. ---

Authorsrebuttal2024-08-13

Dear Reviewer, We are truly grateful for your prompt response and for adjusting your rating. Your thoughtful feedback has been invaluable in refining our work, and we sincerely appreciate the time and effort you have dedicated to our submission. We will incorporate your suggested experiments and further clarifications in the final version. Thank you once again for your support.

Authorsrebuttal2024-08-13

Follow-up on Submission1111 Rebuttal Response

Dear Reviewer, I hope this message finds you well. We sincerely appreciate the time and effort you invest in reviewing our submission. In our recent rebuttal, we carefully address your feedback and provide detailed responses to your concerns: - **Expanded Comparison with Data Augmentation-Based Approaches**: We conduct additional experiments to ensure a **fair comparison** with more data augmentation-based methods, specifically including **DAJAT and Rebuffi et al. [47]**. We provide an in-depth analysis demonstrating that our approach not only **enhances robustness** but also achieves **comparable or better natural accuracy** under similar conditions. - **Comprehensive Analysis of Accuracy-Robustness Trade-off**: We offer a detailed examination of both **natural and robust accuracy**, showing how our method **balances these two metrics effectively**. For instance, our method **outperforms DAJAT in robustness** while maintaining **competitive natural accuracy**, as outlined in our comparison tables. - **Clarification on Pipeline Complexity**: We clarify concerns regarding the **complexity of our pipeline**, explaining that while our method involves multiple components, it is designed to require **fewer hyperparameters and simpler optimization steps** than comparable methods. We also demonstrate that our approach is **more efficient** in terms of **training time and computational cost**, particularly when compared to methods like **[47]**, which require longer iteration steps for adversarial example generation. As the rebuttal discussion period ends tomorrow, ***Aug 13, 11:59 PM AoE***, we would be truly grateful if you could let us know if there are any remaining questions or concerns regarding our submission. If our responses have satisfactorily addressed your concerns, we kindly hope you might consider reflecting this in your review score by raising it. Thank you once again for your thoughtful feedback and for considering our request. Best regards, Submission1111 Authors

Reviewer 8ttu2024-08-13

Type of augmentations

Thank the authors for the additional experiments. Could the authors clarify what do they mean by "DAJAT applies 2 and 3 data augmentations"? Additionally, in the statement "we extend our DAT to include 2 and 3 augmentations", what are the specific types of augmentations used?

Authorsrebuttal2024-08-13

Request for Timely Reviewer Feedback Before Deadline

Dear Area Chairs and Reviewers, We sincerely appreciate the time and effort you and the reviewers dedicate to evaluating our submission. We are encouraged that **all reviewers view our work positively**. Following ***Reviewer FTsi***'s feedback, we clarify key technical aspects and conduct additional experiments, which are well received and **result in a score increase**. However, although ***Reviewer 8ttu*** has responded to our rebuttal, we are still awaiting a response to our latest comment, and ***Reviewer KucH*** has not yet responded to our rebuttal. In response to ***Reviewer 8ttu***'s question regarding the **type of augmentations**, we offer further explanations with a detailed description of the augmentation approach used in DAJAT [1] and our DAT in **Re: Type of augmentations**, and a specific example in **(Continued) Re: Type of augmentations**. For ***Reviewer KucH***, we expand our experiments to include **feature space attacks**, add **additional backbones like Inception_v3 and ViT-S**, and provide results on the **ImageNet-1K dataset**. These comprehensive experiments demonstrate the generalization and robustness of our method across different models and datasets, providing a thorough response to the reviewer's concerns about the scope and applicability of our approach. As the rebuttal discussion period ends in **less than 24 hours**, ***Aug 13, 11:59 PM AoE***, we are concerned that we may not have sufficient time to address any potential additional feedback that may arise. We would be deeply grateful if you could kindly remind ***Reviewers 8ttu*** and ***KucH*** to review our responses at their earliest convenience. Your assistance in this matter would be greatly appreciated. Thank you once again for your continued support and consideration. Best regards, Submission1111 Authors

Authorsrebuttal2024-08-14

Follow-up on Submission1111 Rebuttal - Urgent Request for Feedback

Dear Reviewer, We are truly sorry to trouble you again, but with **less than 8 hours** left before the rebuttal discussion period ends at ***11:59 PM AoE today***, we are writing with a humble and heartfelt request for your feedback on our rebuttal. We have put our utmost effort into addressing your invaluable comments and suggestions. We would be deeply grateful if you could take a few moments to review our responses and share any further thoughts. If our responses are satisfactory, we would be sincerely thankful if you might consider reflecting this in your review score. We greatly value your guidance, and we are genuinely appreciative of your time and consideration. Thank you so much for your continued support. Best regards, Submission1111 Authors

Reviewer KucH2024-08-14

Thank you for your responses! For W1. could you please explain why you use a different dataset and a different threat model (a black-box setting) than those of Table 1 in the main paper? For W3, could you please explain why you use different attacks than those of Table 1 (FGSM, PGD-20, PGD-100, C\&W, and AA) in the main paper?

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC