Writing study: Mind Your Margin and Boundary: Are Your Distilled Datasets Truly Robust?

ICML overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICML 2026 oral writing corpus

Muquan Li, Yingyi Ma, Yihong Huang, Hang Gou, Ke Qin, Ming Li, Yuan-Fang Li, Tao He · Official ICML 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Training, objectives & optimization (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

15 physical pages

Before references / appendix

≈ 8.22 page-equivalents

Main figures / tables

6 / 4

Attached appendix figures / tables

1 / 6

Attached appendix span

≈ 4.91 page-equivalents

Before references / appendix: ≈ 54.8%References / intervening material: ≈ 12.47%Attached appendix: ≈ 32.73%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1. Introduction	1	≈ 1.37 pp.	9.13%
2. Related work	2	≈ 0.36 pp.	2.4%
3. Preliminaries	3	≈ 0.45 pp.	3%
4. Method	3	≈ 2.24 pp.	14.93%
5. Experiment	5	≈ 3.04 pp.	20.27%
6. Conclusion	8	≈ 0.22 pp.	1.47%
Impact Statement	9	≈ 0.11 pp.	0.73%
Acknowledgments	9	≈ 0.07 pp.	0.47%
References	9	≈ 1.86 pp.	12.4%
A. Algorithm	11	≈ 0.44 pp.	2.93%
B. More Experimental Settings	11	≈ 1.2 pp.	8%
C. More Experimental Results	12	≈ 2.68 pp.	17.87%
D. Limitations and Future Work	15	≈ 0.12 pp.	0.8%
E. More Clarifications of the Smallest Robust Margin.	15	≈ 0.48 pp.	3.2%

All detected figure and table locations

Main text

• Figure 1 · p. 1
• Figure 2 · p. 4
• Table 1 · p. 6
• Table 2 · p. 6
• Figure 3 · p. 7
• Figure 4 · p. 7
• Figure 5 · p. 8
• Table 3 · p. 8
• Table 4 · p. 8
• Figure 6 · p. 8

Attached appendix

• Table 5 · p. 13
• Table 6 · p. 13
• Table 7 · p. 13
• Table 8 · p. 14
• Table 9 · p. 14
• Figure 7 · p. 14
• Table 10 · p. 15

Argument and organization

1. Problem and claim

   Names two specific deficiencies—prioritization of vulnerable examples and class separation near boundaries—and assigns a distinct curriculum or loss component to each. The threat model and attack budget are part of the comparison, not generic robustness language.

2. Argument sequence

   The margin formulation precedes the perturbation score and contrastive objective. Experiments then separate dataset/attack comparisons, component contributions, coefficient sensitivity and the inner attacker cost.

3. Evidence and verification

   The four-row AAC/CRL table supplies the baseline, each single intervention and their combination. A separate attacker table reports robust accuracy and relative speed, making the efficiency trade-off distinguishable from the component effect.

Problem, claim and contribution

Names two specific deficiencies—prioritization of vulnerable examples and class separation near boundaries—and assigns a distinct curriculum or loss component to each. The threat model and attack budget are part of the comparison, not generic robustness language.

Abstract and Sections 1–4, pp. 1–4 · Main paper

Argument and section order

The margin formulation precedes the perturbation score and contrastive objective. Experiments then separate dataset/attack comparisons, component contributions, coefficient sensitivity and the inner attacker cost.

Sections 3–5, pp. 3–8 · Main paper

Figures, captions and visual explanation

Figure 2 separates original, adversarial and synthetic datasets; labeled feature and prediction paths connect to different objectives. Figure 6 groups the loss-weight sweep by images-per-class budget instead of implying one coefficient is universally optimal.

Figure 2, physical p. 4; Figure 6, physical p. 8; rasters inspected · Main paper

Tables, comparisons and evidence

The four-row AAC/CRL table supplies the baseline, each single intervention and their combination. A separate attacker table reports robust accuracy and relative speed, making the efficiency trade-off distinguishable from the component effect.

Tables 3–4, physical p. 8; raster inspected · Main paper

Appendix and reproducibility

The pseudocode and attack configurations support reproduction, while the final clarification explicitly leaves dedicated margin-statistic analysis to future work. This qualification prevents the margin rationale being mistaken for direct empirical validation.

Appendices A–B, pp. 11–12; Appendix E, p. 15 · Main paper

Clarity and writing conventions

The LS-PGD discussion says comparable or slightly better accuracy, but its Table 4 values are lower than multi-step PGD in all four displayed datasets. A careful summary should report the speed–accuracy trade-off rather than repeat the stronger wording.

Table 4 and adjacent Impact of LS-PGD paragraph, physical p. 8; raster inspected · Main paper

What to reuse—and what not to infer

Transferable lesson: Match each motivated training component to an independent control, and preserve the exact attack budget and resource trade-off in the claim.

Boundary: Robustness under listed attacks is not a certificate against all attacks; margin-based motivation and demonstrated robust-margin changes are separate claims.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-07

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-focused scan of Sections 1–6, pp. 1–8: margin motivation, objective/attack definitions, framework figure, threat-model comparisons, component and resource ablations. Impact statement and references begin p. 9.

Appendix / supplement

Structural and selected-detail scan of Appendices A–E, pp. 11–15: algorithm, attack settings, stronger-budget results, distribution shift, limitations and a qualification of margin-centric claims. No independent adversarial evaluation.

Visually inspected PDF pages

4, 8

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Published proceedings PDF, PMLR volume 306, retrieved 2026-10-07 · 15 pages