Neural Information Processing Systems http://nips.cc/

Results are aggregated across 20 different trained neural networks.

Neural Information Processing Systems http://nips.cc/

Our focus in this work is on perturbation attacks, where we aim to provide learners that remain robust even when the test data points are perturbed. A distribution shift refers to the phenomenon where the training distribution differs from the test distribution which often leads to a degradation in the learner's performance. Let H be any hypothesis class. Let H be any hypothesis class. Note that the supremum exists here since a union of open sets is also open.

Our focus in this work is on perturbation attacks, where we aim to provide learners that remain robust even when the test data points are perturbed. A distribution shift refers to the phenomenon where the training distribution differs from the test distribution which often leads to a degradation in the learner's performance. Let H be any hypothesis class. Let H be any hypothesis class. Note that the supremum exists here since a union of open sets is also open.

The memory cost of volumetric-based methods will grow cubically as the volume size increases, so a coarse-to-fine strategy is necessary for saving memory. Specifically, the coarse-to-fine strategy distinguishes surface voxels from non-surface voxels, and only potential surface voxels are considered in the succeeding procedure. However, the non-surface voxels have various features, and in particular, the voxels on the inner side of the surface are quite different from those on the outer side since there exists an intrinsic gap between them. Therefore, grouping inner-surface and outer-surface voxels into the same class will force the classifier to spend its capacity to bridge the gap. By contrast, it is relatively easy for the classifier to distinguish inner-surface and outer-surface voxels due to the intrinsic gap.

By tuning the two temperatures, we create loss functions that are non-convex already in the single layer case.

Neural Information Processing Systems http://nips.cc/

As we state at the beginning of Sec. 2, Theorems 1 and 3 hold for any activation function, including We will clarify this point in the camera-ready version. Figure 1: Histogram of correctly and incorrectly classified pictures shows that trained neural networks are far more likely to misclassify points closer to a classification boundary for both the training and test sets. Results are aggregated across 20 different trained neural networks. We will move the MNIST results to the main paper swapping them with the detailed proofs and modify Sec. We will add in the camera-ready version a discussion on the convergence rate to the Gaussian probability distribution.