The first half of the framework, Sharpness-Adaptive Label Smoothing, builds on a technique that practitioners have used for years. Label smoothing softens the hard one-hot targets of standard classification, replacing a certain answer with a distribution that leaves some probability mass on incorrect classes. This discourages the network from becoming overconfident and pushes it toward flatter minima, which earlier work by Hochreiter and Schmidhuber and later large-batch studies linked to better generalization. The catch is that the smoothing strength is usually a fixed hyperparameter, tuned by trial and error, even though the need for regularization changes dramatically over the course of training. SLAW makes that strength dynamic. It computes a first-order proxy of local sharpness, an inexpensive estimate of how steeply the loss rises around the current parameters, and uses it to modulate the smoothing applied at each step.

The intuition behind this adaptive scheme is geometric. Early in training, when gradients are large and the optimizer is traversing high-curvature regions of the loss landscape, the network benefits from strong regularization that discourages it from diving into narrow valleys. As training stabilizes and the parameters approach flatter basins, aggressive smoothing becomes counterproductive, blurring the decision boundaries the model needs to fit the data. SALS therefore applies heavier smoothing in steep, high-curvature areas and gradually relaxes it as the landscape flattens. Because the sharpness estimate relies only on first-order information rather than the full Hessian, which would be computationally prohibitive for modern architectures, the method keeps the overhead low enough for routine use. The authors report that this component improves not only generalization accuracy but also predictive calibration, addressing the well-documented tendency of modern networks to be confidently wrong.

The second component, Loss-Adaptive Reweighting, addresses the label-noise problem from a different angle. Deep networks have a well-known and troubling habit: given enough epochs, they memorize even blatantly wrong labels, because the capacity of these models is sufficient to fit arbitrary noise. Memorization typically shows up late in training, when the loss on corrupted samples that the network has already fit collapses toward zero while the loss on genuinely hard, clean examples remains elevated. LAW exploits this statistical signature. Within each mini-batch, it standardizes the per-sample loss values and flags samples whose losses are anomalous relative to their batch peers, then down-weights their contribution to the parameter update. Corrupted labels, which the model fits quickly and confidently, thus lose influence before they can drag the shared weights in the wrong direction.

What distinguishes LAW from the crowded field of noise-robust training methods is what it does not require. Many existing approaches, such as co-teaching, loss correction, and joint methods like DivideMix, depend on estimates of the noise rate or assumptions about the structure of the noise, for example that it is symmetric and flips labels uniformly across classes. In practice, real-world annotation errors are rarely so well-behaved, and misestimating the noise rate can be as damaging as ignoring it. LAW involves no prior knowledge of noise characteristics and no noise estimation rate at all. It simply reacts to the empirical distribution of losses in each batch, making it applicable to datasets whose corruption level is unknown or heterogeneous, which is the norm rather than the exception in web-scraped and crowd-annotated data.

The experimental evaluation covers three standard benchmarks: MNIST, CIFAR-10 and CIFAR-100. On clean data, SLAW matches conventional training algorithms, an important sanity check showing that the added machinery does not sacrifice baseline performance. The more striking results appear under synthetic label corruption. At moderate noise levels, with twenty percent of labels flipped symmetrically, SLAW nearly eliminates the catastrophic overfitting that typically afflicts late training, when standard models begin absorbing the corrupted labels and their test accuracy degrades. At extreme noise of forty percent, a regime in which the baseline models usually collapse entirely, SLAW continues to learn stably and retains meaningful generalization, a result the authors present as evidence that the framework can function where most pipelines fail outright.

Ablation studies disentangle the contributions of the two components and reveal a clean division of labor. SALS, the sharpness-adaptive smoothing, is the primary driver of improved generalization and calibration on clean and moderately noisy data, consistent with the landscape-flattening role of label smoothing identified in earlier analyses by Müller, Kornblith and Hinton. LAW, by contrast, is the main engine of robustness to label noise, doing the heavy lifting when corrupted samples threaten to poison the updates. The synergy matters because the two failure modes interact: noisy labels tend to push optimizers toward sharp minima, since memorizing outliers often requires fitting narrow spikes in the loss surface, so a method that addresses only one vulnerability leaves the other exposed.

The work sits at the intersection of several research threads that have matured over the past decade. Sharpness-aware minimization, introduced by Foret and colleagues, explicitly optimizes for flat minima by perturbing weights to worst-case nearby points before taking a gradient step, and adaptive variants such as ASAM refined the idea. Sample reweighting has its own lineage, from MentorNet’s learned curricula to meta-learned example weighting by Ren and co-workers and recent dynamic loss-based reweighting for large language model pretraining. SLAW’s contribution is less a single new primitive than a demonstration that these ideas can be fused cheaply and adaptively, with the sharpness signal controlling regularization strength and the loss statistics controlling sample influence, without the two mechanisms interfering with each other.

For practitioners, the appeal lies in the framework’s economy of assumptions. Real datasets are messy: medical registries contain transcription errors, web labels reflect the biases of their annotators, and crowdsourced annotations disagree in ways no symmetric noise model captures. A training method that neither assumes a known noise rate nor demands expensive second-order curvature computations fits the constraints of applied machine learning, where the authors argue such techniques are most needed. The code has been released on GitHub, lowering the barrier to independent replication, and the benchmarks, while standard, are the same ones on which the field’s noisy-label methods are conventionally compared.

The broader significance may lie in what SLAW implies about the relationship between optimization geometry and data quality. The results support a view in which these are not separate concerns to be handled by separate tools, but coupled aspects of a single training dynamic: the shape of the loss landscape determines how eagerly a network memorizes bad examples, and the composition of the data determines which minima the optimizer can reach. A framework that senses both, adjusting its regularization as the terrain flattens and its trust in each sample as the loss statistics shift, offers a template for the kind of self-correcting training that reliable, real-world deep learning systems will likely require as models are deployed on data that is, as the authors put it, imperfect, noisy, or of low quality.

Subject of Research: A sharpness- and loss-adaptive weighting framework for robust deep learning under label noise

Article Title: Slaw: sharpness- and loss-adaptive weighting for robust deep learning

Article References: Slaw: sharpness- and loss-adaptive weighting for robust deep learning. (n.d.). https://doi.org/10.1007/s41060-026-01272-w

Image Credits: AI Generated

DOI: 10.1007/s41060-026-01272-w

Keywords: deep learning, label noise, loss landscape, sharp minima, label smoothing, sample reweighting, generalization, calibration, robustness, sharpness-aware minimization, neural networks, CIFAR-10

The problem the study set out to address is subtle but consequential. Quantum-inspired optimizers occupy an ambiguous middle ground between genuine quantum algorithms and ordinary classical methods. Some, like the quantum natural gradient, are quantum-native in origin but must be approximated classically for neural networks. Others, like quantum-behaved particle swarm optimization, are classical metaheuristics that borrow quantum-mechanical metaphors such as tunneling and superposition. Still others, like simultaneous perturbation stochastic approximation, known as SPSA, and COBYLA, are purely classical algorithms that became associated with quantum computing because they happen to work well for tuning small variational quantum circuits. Because the label spans methods with such different origins, comparisons reported in the literature have often blurred the line between implementing an algorithm and simply relabeling a hyperparameter configuration.

To untangle this, the benchmark introduced a structural taxonomy that assigns every tested configuration to one of three classes: direct implementations of published update rules, documented classical analogs, and hyperparameter controls. The direct implementations included a faithful SPSA that estimates gradients from just two loss evaluations per step without any backpropagation, and a direct adaptation of the quantum-behaved particle swarm update rule to stochastic minibatch training. The classical analog of the quantum natural gradient was implemented as a diagonal second-moment preconditioner, an approximation related to natural gradient descent. The hyperparameter controls preserved the configurations from the study’s earlier version that had carried quantum-inspired labels but were, in fact, classical optimizers with modified settings. This separation allowed the study to ask, with explicit controls rather than labels, whether observed performance differences originate in the algorithm or in the accompanying hyperparameter choices.

The results were unambiguous. On CIFAR-10 with a ResNet18 architecture, where the original version of the study had reported an SPSA result that was by construction a learning-rate-scaled Adam, the revised benchmark found that Adam itself scores about 59 accuracy points above genuine SPSA. On the tabular benchmark, the hyperparameter control trains alongside the classical baselines while the direct algorithms sit roughly 10 to 24 points below. The quantum-behaved particle swarm adaptation remained at or near chance level on every completed LSTM and small convolutional experiment, while consuming 18 to 74 times Adam’s measured wall-clock cost on those tasks. SPSA collapsed to non-finite loss or stagnated at chance on several configurations, and its best computer vision result, about 60.9 percent on Fashion-MNIST with ResNet18, fell far short of the gradient-based arms, all of which exceeded 90 percent on that task.

Perhaps the most illuminating result came from a seed-paired factorial experiment on RoBERTa, a large transformer language model. The original study had reported that its quantum natural gradient-inspired configuration outperformed AdamW, a widely used adaptive optimizer, on language classification tasks. But that configuration had changed two things at once: it halved the learning rate and raised the weight decay. The new 2×2 factorial over learning rate and weight decay, run across three language datasets with five seeds per cell, identified the smaller learning rate as the dominant observed component of the previously reported advantage, contributing roughly half an accuracy point at the dataset level, while the weight-decay effect was small and inconsistent in sign. With only three datasets, the uncertainty intervals spanned zero, meaning the design could not establish a precise population-wide effect, but the direction was clear: the quantum label itself contributed nothing detectable beyond the hyperparameters it happened to carry.

The configured natural gradient analog fared no better. Compared against a learning-rate-matched AdamW arm under identical training protocols, it showed no detectable advantage, with a pooled descriptive difference of about 0.3 accuracy points and a statistical significance value of 0.23, while costing 6 to 7 percent more wall-clock time per run. On ResNet18, its trained endpoints actually exhibited larger dominant-curvature estimates than the Adam family’s, contradicting the intuition that natural-gradient-style preconditioning should find flatter minima. Loss-landscape probes and Hessian curvature measurements at trained endpoints revealed geometry that was qualitatively ordinary, with no curvature signature unique to any quantum-inspired arm.

The statistical protocol underlying these conclusions was deliberately conservative. Every headline comparison used five random seeds with seed-paired t-tests, Holm correction for multiple comparisons within stated families, and explicitly stated detection limits quantifying what differences the design could resolve. Where results were aggregated across three datasets, the study employed modified Hartung-Knapp random-effects inference and an exact sign-flip test, treating the dataset rather than the individual seed as the unit of replication. The full analysis ledger contained 84 inferential quantities, of which 45 were significant uncorrected, 39 survived false-discovery-rate control, and 18 survived a single global Holm correction. The revised campaign comprised 413 training runs, all executed in a single unified codebase on identical hardware, with every result table regenerated programmatically from archived per-run artifacts.

The study is careful about scope. Its negative results apply to neural-network training at parameter counts from roughly ten thousand to over one hundred million, under fixed epoch budgets that mirror practitioner constraints. SPSA remains genuinely valuable in its native regime of low-dimensional, gradient-inaccessible problems such as variational quantum circuits with tens of parameters, where its two-evaluation-per-step cost structure is a real advantage. The authors also acknowledge that a more heavily tuned SPSA could perform better than the configuration tested, and that alternative stochastic-objective designs for particle swarm methods remain unexplored. But at the scales where cost binds, an optimizer whose tuning is itself unaffordable cannot serve as a practical alternative, regardless of its theoretical tuned-optimum performance.

The practical implications are direct. For practitioners, the recommendation is to default to well-tuned Adam or AdamW and to tune the learning rate early, since that single hyperparameter dominated the observed differences in the factorial analysis. For the research community, the study offers both a warning and a tool: benchmarks that fail to separate direct algorithms from classical analogs and hyperparameter controls risk attributing ordinary configuration effects to quantum inspiration, and any future claim of quantum-inspired benefit can now be tested against the auditing taxonomy, factorial protocol, and measurement-backed landscape analysis this benchmark provides. Until such a claim passes those controls, the study concludes, classical adaptive methods remain the correct default for training neural networks, and the quantum-inspired label, however evocative, buys nothing detectable at the scales where modern machine learning actually operates.

Subject of Research: Empirical benchmarking of quantum-inspired versus classical optimization algorithms for machine learning

Article Title: A cross-domain empirical benchmark of quantum-inspired and classical optimization algorithms for machine learning

Article References: Yilmaz, G. (2026). A cross-domain empirical benchmark of quantum-inspired and classical optimization algorithms for machine learning. Quantum Machine Intelligence, 8(2), Article 103. https://doi.org/10.1007/s42484-026-00444-y

Image Credits: AI Generated

DOI: 10.1007/s42484-026-00444-y

Keywords: quantum-inspired optimization, machine learning, neural network training, SPSA, quantum-behaved particle swarm optimization, quantum natural gradient, Adam optimizer, benchmarking, hyperparameters, deep learning, statistical testing, loss landscape

The technique belongs to a family of attacks known as transfer-based adversarial attacks. In such attacks, an adversary cannot peer inside the target recommendation system, which operates as a black box guarded by commercial secrecy. Instead, the attacker builds a surrogate model that mimics the target’s behavior, trains the surrogate on publicly available data, and then injects carefully constructed fake user profiles designed to manipulate the surrogate’s recommendations. The hope is that these poisoned profiles will transfer: that when injected into the real, unknown target system, they will produce the same distortion, promoting a chosen item or burying a competitor. This scenario, often called a shilling attack, has been studied since the early days of collaborative filtering, but deep learning has dramatically raised the stakes, because modern neural recommenders are both more powerful and, in some respects, more susceptible to carefully aimed perturbations.

The core insight behind RecGP comes from an unexpected corner of deep learning theory: the geometry of the loss landscape. When an adversarial example is optimized on a surrogate model, it typically settles into a region where the loss surface is sharp—a narrow spike surrounded by steep gradients. Such solutions perform superbly on the surrogate but generalize poorly, because they are exquisitely sensitive to small changes in model parameters. Two recommendation systems, even trained on the same data, will have slightly different internal weights, and an adversarial example perched on a sharp peak will lose its effectiveness under that variation. Flat regions of the loss landscape, by contrast, exhibit small gradients and gentle slopes, meaning the adversarial example’s effect is stable even when parameters shift between the surrogate and the unknown target. The same flatness principle underlies sharpness-aware minimization, a technique developed to improve model generalization in entirely benign contexts, and the authors adapt it here for offensive purposes.

RecGP operationalizes this insight by adding a gradient penalty to the optimization process that generates fake users. As the attacker searches for adversarial perturbations, the penalty regularizes the magnitude of the gradients, steering the search away from sharp peaks and toward flat basins of the loss surface. In effect, the method asks not merely, ‘Which fake user fools this surrogate most effectively?’ but rather, ‘Which fake user fools this surrogate in a way that is robust to the inevitable differences between models?’ The authors frame this as a recommendation-specific reformulation, because recommendation data differs fundamentally from the continuous image data where flatness-aware attacks were first explored. A fake user profile in a recommender is not a subtly shifted photograph; it is a discrete collection of interactions, and the attack must respect the semantic structure of that discrete space.

That discrete structure creates a computational challenge, which the team addressed with a second contribution: RecGP-RS, or Recommender Systems Gradient Penalty with Resource-efficient Sampling. Computing true second-order gradient information—needed to assess the flatness of the landscape—is expensive, particularly over the large interaction spaces typical of real-world recommender systems. RecGP-RS sidesteps the cost through semantic-aware neighborhood sampling, which selects representative neighbors of each perturbation in the discrete interaction space while preserving semantic consistency, ensuring that sampled neighbors correspond to plausible user behaviors rather than arbitrary noise. Around these sampled neighbors, the method approximates second-order gradients using first-order interpolation, capturing the essential curvature information at a fraction of the computational price. The result, according to the paper, is a variant that retains 98 percent of the attack efficacy of the full method while reducing GPU memory consumption by 42 percent—a substantial saving that matters when attacks must be staged against large-scale production-like systems.

The empirical evaluation spanned two widely used benchmark datasets: MovieLens-1M, a canonical collection of roughly one million movie ratings maintained by the GroupLens research group, and Gowalla, a location-based social network dataset distributed through the Stanford Network Analysis Project. Across eight target recommendation models, RecGP achieved an average attack success rate improvement of approximately eight percent over existing baseline attack methods on the Gowalla dataset. The target models examined in the broader literature on which this work builds include the standard architectures of the field: neural collaborative filtering, Bayesian personalized ranking, collaborative denoising autoencoders, and matrix factorization approaches, among others. The breadth of improvement across diverse architectures is the transferability claim’s real substance—an attack that only worked against one model family would be of limited concern, but a method that reliably degrades many different recommenders suggests a structural weakness in how these systems learn from behavioral data.

The practical implications are sobering. Recommendation systems are not merely convenience features; they are revenue engines. A seller who can promote products through injected fake users can distort marketplace competition, and a malicious actor who can suppress content can shape public opinion. Earlier generations of shilling attacks required large volumes of hand-crafted fake profiles and were relatively easy to detect because they followed stereotyped patterns. Learning-based attacks such as the one developed here generate profiles optimized by gradient descent, which can be subtler and harder to flag. The flatness technique makes them more portable across the heterogeneous collection of models that platforms actually deploy, meaning a profile set crafted once could plausibly threaten several services rather than one. The study also notes that RecGP builds on earlier transferability work by the same group, including methods based on Nesterov momentum and multi-model integration and fine-tuning, indicating a sustained research trajectory into how adversarial examples move between recommender architectures.

From a defensive standpoint, the research is valuable precisely because it illuminates the mechanism of failure. If sharp loss regions are what make adversarial examples brittle and flat regions what make them dangerous, then defenders have a concrete signal to target. Detection systems could look for interactions that sit suspiciously in flat regions of the platform’s own loss surface, or training procedures could incorporate flatness-aware objectives that make recommendation models inherently less sensitive to small numbers of poisoned profiles. The work also joins a broader conversation about loss landscape geometry in machine learning security, echoing findings from computer vision where flat local maxima have been linked to improved adversarial transferability, and from theoretical studies of the embedding principle of loss landscapes in deep neural networks. The transferability problem, once considered a vision-specific curiosity, now demonstrably spans the recommender domain.

The research team, based at Anhui University’s Key Laboratory of Intelligent Computing and Signal Processing and its Artificial Intelligence Institute, with a collaborator at Tsinghua University, was supported by the National Natural Science Foundation of China and provincial research programs, and used Anhui University’s high-performance computing platform. Caihong Wu and Hai Chen contributed equally to the work, with Fulan Qian serving as corresponding author. As recommendation systems grow more embedded in commerce, media, and information ecosystems, studies of this kind serve a dual purpose: they hand attackers a sharper tool, but they also hand defenders a clearer map of where the walls are thin. The eight percent gain in attack success reported on Gowalla is not merely a benchmark increment; it is a quantified measure of how much behavioral data alone can be trusted, and a reminder that robustness against adversarial manipulation must be designed into recommendation systems from the ground up rather than bolted on after the fact.

Subject of Research: Gradient-penalized transferable adversarial attacks on recommendation systems

Article Title: Recgp: gradient penalization for transferable adversarial attacks in recommendation systems

Article References: Wu, C., Chen, H., Song, S., Yan, Y., Zhao, S., & Qian, F. (2026). Recgp: gradient penalization for transferable adversarial attacks in recommendation systems. Data Mining and Knowledge Discovery, 40(5), Article 88. https://doi.org/10.1007/s10618-026-01253-4

Image Credits: AI Generated

DOI: 10.1007/s10618-026-01253-4

Keywords: recommendation systems, adversarial examples, gradient penalty, loss landscape, transferability, shilling attacks, collaborative filtering, data poisoning, black-box attack, MovieLens, Gowalla, machine learning security