equation

index.html

@@ -248,12 +248,12 @@
 <!-- Relations -->
 <section class="section">
   <div class="container is-max-desktop">
-    <h2 class="title is-3">Neighborhood Relations of Benign Examples and AEs</h2>
+    <h2 class="title is-3">Neighborhood Relations of AEs and Clean Samples</h2>
     <div class="columns is-centered">
       <div class="column container-centered">
           <img src="./static/images/relations.jpg" alt="Neighborhood Relations of Benign Examples and AEs"/>
           <p>
-            <strong>Figure 1. Neighborhood Relations of Benign Examples and AEs.</strong>
+            <strong>Figure 1. Neighborhood Relations of AEs and Clean Samples.</strong>
           </p>
       </div>
     </div>
@@ -460,6 +460,26 @@
           </div>
           </div>
       </div>
+
+      <div class="columns is-centered">
+        <div class="column">
+          <p id="label-loss">
+            Attackers can design adaptive attacks to try to bypass BEYOND when the attacker knows all the parameters of the model 
+            and the detection strategy. For an SSL model with a feature extractor $f$, a projector $h$, and a classification head $g$, 
+            the classification branch can be formulated as $\mathbb{C} = f\circ g$ and the representation branch as $\mathbb{R} = f\circ h$. 
+            To attack effectively, the adversary must deceive the target model while guaranteeing the label consistency and representation similarity of the SSL model. 
+          </p>
+          <p id="representation-loss", style="display: none">
+            where $\mathcal{S}$ represents cosine similarity, $k$ represents the number of generated neighbors, 
+            and the linear augmentation function $W(x)=W(x,p);~p\sim P$ randomly samples $p$ from the parameter distribution $P$ to generate different neighbors. 
+            Note that we guarantee the generated neighbors are fixed each time by fixing the random seed. The adaptive adversaries perform attacks on the following objective function:
+          </p>
+            
+          <p id="total-loss", style="display: none;">
+            where $\mathcal{L}_C$ indicates classifier's loss function, $y_t$ is the targeted class, and $\alpha$ refers to a hyperparameter.
+          </p>
+        </div>
+      </div>
     </div>