The DOI matches its DataCite record; 14 of the 14 references it cites were found in a registry or an index.
Explaining and Harnessing Adversarial Examples
Open accessAbstract
Several machine learning models, including neural networks, consistently misclassify adversarial examples---inputs formed by applying small but intentionally worst-case perturbations to examples from the dataset, such that the perturbed input results in the model outputting an incorrect answer with high confidence. Early attempts at explaining this phenomenon focused on nonlinearity and overfitting. We argue instead that the primary cause of neural networks' vulnerability to adversarial perturbation is their linear nature. This explanation is supported by new quantitative results while giving the first explanation of the most intriguing fact about them: their generalization across architectures and training sets. Moreover, this view yields a simple and fast method of generating adversarial examples. Using this approach to provide examples for adversarial training, we reduce the test set error of a maxout network on the MNIST dataset.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Moreover, adversarial training typically only improves robustness to the specific type of adversarial examples incorporated during training, potentially leaving the trained model vulnerable to other forms of adversarial noise [176, 448, 414].”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [414]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Adversarial attacks help adversaries evade FL system security detection and can generate poisoned samples to undermine the FL system accuracy (Goodfellow et al. 2014;Nair et al. 2023).”
From Survey: federated learning data security and privacy-preserving in edge-Internet of Things (2024) · cites this paper as Goodfellow et al. 2014
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Additionally, neural network-based and zero-shot detectors rely on a deep net for their detection, and they can be vulnerable to adversarial and poisoning attacks (Goodfellow et al., 2014; Sadasivan et al., 2023; Kumar et al., 2022; Wang et al., 2022).”
From Can AI-Generated Text be Reliably Detected? (2023) · cites this paper as Goodfellow et al., 2014
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Tabular data can be easily shuffled, but the perturbation of images can have unpredictable effects, with research demonstrating this type of manipulation (for example, adversarial noise) both as an attack against algorithms 65 and a regularization mechanism leading to increased robustness 66 and resilience against inversion attacks.”
From Secure, privacy-preserving and federated machine learning in medical imaging (2020) · cites this paper as [65]
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“On the other hand, it is worth noting that researchers have recently that noticed deep neural networks are vulnerable to adversarial examples, which are carefully chosen inputs that cause the network to change output without a visible change to a human (Fig. 15) [60–63].”
From Convolutional neural networks: an overview and application in radiology (2018) · cites this paper as [61]
The cited source says what the claim attributes to it.
In the citing paper
“Adversarial attacks have been widely studied against ML models [47,50] under both white-box [9, 21, 31, 55] and black-box assumptions [33, 43].”
From Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning (2021) · cites this paper as [21]
The cited source says what the claim attributes to it.
In the citing paper
“Although the impact of adversarial examples in the medical domain is unknown, these studies indicate that the way artificial networks see and predict is different from the way we do.”
From Convolutional neural networks: an overview and application in radiology (2018) · cites this paper as [61]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Hochreiter, S., & Schmidhuber, J. (1997) · Neural Computation · doi:10.1162/neco.1997.9.8.1735 · Cited by 102,318
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333
(2014) · Cited by 33,419
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Multilayer feedforward networks are universal approximators
Hornik, K., Stinchcombe, M., & White, H. (1989) · Neural Networks · doi:10.1016/0893-6080(89)90020-8 · Cited by 21,728
Multilayer feedforward networks are universal approximators
HornikK., StinchcombeM., & WhiteH. (1989) · Neural Networks · doi:10.5555/70405.70408 · Cited by 9,266
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Self-citationLarge Scale Distributed Deep Networks
Dean, J. B., Corrado, G. S., Monga, R., Chen, K., Devin, M., Mao, M., Ranzato, M., Senior, A., Tucker, P. A., Yang, K., et al. (2012) · Cited by 3,202
What is the best multi-stage architecture for object recognition?
Jarrett, K., Kavukcuoglu, K., Ranzato, M. A., & LeCun, Y. (2009) · 2009 IEEE 12th International Conference on Computer Vision · doi:10.1109/iccv.2009.5459469 · Cited by 2,153
Going Deeper with Convolutions
Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S., Anguelov, D., Erhan, D., Vanhoucke, V., & Rabinovich, A. (2014) · arXiv · doi:10.48550/arxiv.1409.4842 · Cited by 1,461
Self-citation
Research works printed but not linked: 6
- Bergstra, James, Breuleux, Olivier, Bastien, Fr´ ed´ eric, Lamblin, Pascal, Pascanu, Razvan, Desjardins, Guillaume, Turian, Joseph, Warde-Farley, David, and Bengio, Yoshua. Theano: a CPU and GPU math expression compiler. In Proceedings of the Python for Scientific Computing Conference (SciPy) , June 2010. Oral Presentation.
- Chalupka, K., Perona, P., and Eberhardt, F. Visual Causal Feature Learning. ArXiv e-prints , December 2014.
- Glorot, Xavier, Bordes, Antoine, and Bengio, Yoshua. Deep sparse rectifier neural networks. In JMLR W&CP: Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics (AISTATS 2011) , April 2011.
- Goodfellow, Ian J., Warde-Farley, David, Mirza, Mehdi, Courville, Aaron, and Bengio, Yoshua. Maxout networks. In Dasgupta, Sanjoy and McAllester, David (eds.), International Conference on Machine Learning , pp. 1319-1327, 2013c.
- Nguyen, A., Yosinski, J., and Clune, J. Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Images. ArXiv e-prints , December 2014.
- Rust, Nicole, Schwartz, Odelia, Movshon, J. Anthony, and Simoncelli, Eero. Spatiotemporal elements of macaque V1 receptive fields. Neuron , 46(6):945-956, 2005.
Cited by
Sorted by citations
Items 1,001–1,082 of 1,082
Don’t Take the Premise for Granted: Mitigating Artifacts in Natural Language Inference
Belinkov, Y., Poliak, A., Shieber, S., Van Durme, B., & Rush, A. (2019) · Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/p19-1084 · Cited by 73
Assessing Optimizer Impact on DNN Model Sensitivity to Adversarial Examples
Wang, Y., Liu, J., Mišić, J., Mišić, V. B., Lv, S., & Chang, X. (2019) · IEEE Access · doi:10.1109/access.2019.2948658 · Cited by 80
Deep Neural Network Ensembles Against Deception: Ensemble Diversity, Accuracy and Robustness
Liu, L., Wei, W., Chow, K.-H., Loper, M. L., Gürsoy, E., Truex, S., & Wu, Y. (2019) · IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) · doi:10.1109/mass.2019.00040 · Cited by 79
Revisiting Adversarially Learned Injection Attacks Against Recommender Systems
Tang, J., Wen, H., & Wang, K. (2020) · ACM Conference on Recommender Systems (RecSys) · doi:10.1145/3383313.3412243 · Cited by 82
Machine Learning Threatens 5G Security
Suomalainen, J., Juhola, A., Shahabuddin, S., Mämmelä, A., & Ahmad, I. (2020) · IEEE Access · doi:10.1109/access.2020.3031966 · Cited by 80
Uncertainty-guided Model Generalization to Unseen Domains
Qiao, F., & Peng, X. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00672 · Cited by 75
Robust and Accurate Object Detection via Adversarial Learning
Chen, X., Xie, C., Tan, M., Zhang, L., Hsieh, C., & Gong, B. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01635 · Cited by 81
Scattering Model Guided Adversarial Examples for SAR Target Recognition: Attack and Defense
Peng, B., Peng, B., Zhou, J., Xie, J., & Liu, L. (2022) · IEEE Transactions on Geoscience and Remote Sensing · doi:10.1109/tgrs.2022.3213305 · Cited by 80
Infrared Invisible Clothing: Hiding from Infrared Detectors at Multiple Angles in Real World
Zhu, X., Hu, Z., Huang, S., Li, J., & Hu, X. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01296 · Cited by 73
A Robust Semantic Text Communication System
Peng, X., Qin, Z., Tao, X., Lü, J., & Hanzo, L. (2024) · IEEE Transactions on Wireless Communications · doi:10.1109/twc.2024.3381950 · Cited by 81
Evaluating Robustness of Deep Image Super-Resolution Against Adversarial Attacks
Choi, J. H., Zhang, H., Kim, J., Hsieh, C., & Lee, J. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00039 · Cited by 73
Han, J., Zhang, Z., Cummins, N., & Schuller, B. W. (2019) · IEEE Computational Intelligence Magazine · doi:10.1109/mci.2019.2901088 · Cited by 86
A Systematic Review of Adversarial Machine Learning Attacks, Defensive Controls and Technologies
Malik, J., Muthalagu, R., & Pawar, P. M. (2024) · IEEE Access · doi:10.1109/access.2024.3423323 · Cited by 76
AI system engineering key challenges and lessons learned
Fischer, L., Ehrlinger, L., Geist, V., Ramler, R., Sobiezky, F., Zellinger, W., Brunner, D., Kumar, M., & Moser, B. (2020) · Machine Learning and Knowledge Extraction · doi:10.3390/make3010004 · Cited by 71
“This effect is both a security and a safety issue [22,42–44].”
BackgroundTrustworthy AI in the Age of Pervasive Computing and Big Data
Kumar, A., Braud, T., Tarkoma, S., & Hui, P. (2020) · 2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops) · doi:10.1109/percomworkshops48775.2020.9156127 · Cited by 68
Hard to Forget: Poisoning Attacks on Certified Machine Unlearning
Marchant, N. G., Rubinstein, B. I. P., & Alfeld, S. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20736 · Cited by 64
“We note that the signed gradient has been used as alternative to the gradient when generating adversarial examples (Goodfellow, Shlens, and Szegedy, 2015; Madry et al., 2018).”
Property Inference from Poisoning
Mahloujifar, S., Ghosh, E., & Chase, M. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833623 · Cited by 67
Secure and robust machine learning for healthcare: A survey
Qayyum, A., Qadir, J., Bilal, M., & Al-Fuqaha, A. (2021) · IEEE Reviews in Biomedical Engineering · doi:10.1109/rbme.2020.3013489 · Cited by 59
AI-GAN: Attack-Inspired Generation of Adversarial Examples
Bai, T., Zhao, J., Zhu, J., Han, S., Chen, J., Li, B., & Kot, A. (2021) · 2021 IEEE International Conference on Image Processing (ICIP) · doi:10.1109/icip42928.2021.9506278 · Cited by 58
Machine learning in NextG networks via generative adversarial networks
Ayanoglu, E., Davaslioglu, K., & Sagduyu, Y. E. (2022) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2022.3153004 · Cited by 55
Sebastian, G. (2023) · doi:10.2139/ssrn.4454761 · Cited by 56
Wasserstein Introspective Neural Networks
Lee, K., Xu, W., Fan, F., & Tu, Z. (2018) · 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2018.00390 · Cited by 56
Grey-box Adversarial Attack And Defence For Sentiment Classification
Xu, Y., Zhong, X., Jimeno Yepes, A., & Lau, J. H. (2021) · Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies · doi:10.18653/v1/2021.naacl-main.321 · Cited by 54
SpoC: Spoofing Camera Fingerprints
Cozzolino, D., Thies, J., Rossler, A., Niesner, M., & Verdoliva, L. (2021) · 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw53098.2021.00110 · Cited by 54
Don't trust your eyes: image manipulation in the age of DeepFakes
Langguth, J., Pogorelov, K., Brenner, S., Filkuková, P., & Schroeder, D. T. (2021) · Frontiers in Communication · doi:10.3389/fcomm.2021.632317 · Cited by 51
FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments
Chernikova, A., & Oprea, A. (2022) · ACM Transactions on Privacy and Security · doi:10.1145/3544746 · Cited by 52
A survey on hardware security of DNN models and accelerators
Mittal, S., Gupta, H., & Srivastava, S. (2021) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2021.102163 · Cited by 47
Challenges and efforts in managing AI trustworthiness risks: a state of knowledge
Polemi, N., Praça, I., Kioskli, K., & Bécue, A. (2024) · Frontiers in Big Data · doi:10.3389/fdata.2024.1381163 · Cited by 46
Exploring Adversarial Attacks in Federated Learning for Medical Imaging
Darzi, E., Dubost, F., Sijtsema, N. M., & van Ooijen, P. M. A. (2024) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2024.3423457 · Cited by 45
Minimalistic Attacks: How Little It Takes to Fool Deep Reinforcement Learning Policies
Qu, X., Sun, Z., Ong, Y.-S., Gupta, A., & Wei, P. (2021) · IEEE Transactions on Cognitive and Developmental Systems · doi:10.1109/tcds.2020.2974509 · Cited by 40
Authorship Attribution in the Era of LLMs: Problems, Methodologies, and Challenges
Huang, B., Chen, C., & Shu, K. (2025) · ACM SIGKDD Explorations Newsletter · doi:10.1145/3715073.3715076 · Cited by 42
“Neural network-based detectors are vulnerable to adversarial and poisoning attacks (Goodfellow et al., 2015, Pu et al., 2023a, Wang et al., 2022).”
Challenges in bridging the gap between protein structure prediction and functional interpretation
Varadi, M., Tsenkov, M., & Velankar, S. (2025) · Proteins: Structure, Function, and Bioinformatics · doi:10.1002/prot.26614 · Cited by 36
Feng, T., & Narayanan, S. (2023) · 2023 11th International Conference on Affective Computing and Intelligent Interaction (ACII) · doi:10.1109/acii59096.2023.10388152 · Cited by 34
Two Sides of the Same Coin: White-box and Black-box Attacks for Transfer Learning
Zhang, Y., Song, Y., Liang, J., Bai, K., & Yang, Q. (2020) · Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3394486.3403349 · Cited by 29
Hybrid deep learning model using SPCAGAN augmentation for insider threat analysis
R.G., G., Sajjanhar, A., & Xiang, Y. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.123533 · Cited by 28
Kang, J., Thompson, R. F., Aneja, S., Lehman, C., Trister, A., Zou, J., Obcemea, C., & El Naqa, I. (2021) · Practical Radiation Oncology · doi:10.1016/j.prro.2020.06.001 · Cited by 30
Model poisoning attacks against distributed machine learning systems
Tomsett, R., Chan, K. S., & Chakraborty, S. (2019) · Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications · doi:10.1117/12.2520275 · Cited by 27
Encryption Inspired Adversarial Defense For Visual Classification
Maung, M., Pyone, A., & Kiya, H. (2020) · 2020 IEEE International Conference on Image Processing (ICIP) · doi:10.1109/icip40778.2020.9190904 · Cited by 26
Wang, X., Delgado, H., Tak, H., Jung, J.-W., Shim, H.-J., Todisco, M., Kukanov, I., Liu, X., Sahidullah, M., Kinnunen, T., et al. (2026) · Computer Speech & Language · doi:10.1016/j.csl.2025.101825 · Cited by 30
“Readers who are already familiar with ASVspoof databases and associated generative technologies can choose to skip this material and move directly to Section 3.2 which provides a description of the attacks used in creating the training, development, and evaluation sets.”
InfluentialMa, L., & Liang, L. (2022) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2022.105345 · Cited by 26
Disruptive Innovations and Disruptive Assurance: Assuring Machine Learning and Autonomy
Bloomfield, R., Khlaaf, H., Ryan Conmy, P., & Fletcher, G. (2019) · Computer · doi:10.1109/mc.2019.2914775 · Cited by 23
SpinDrop: Dropout-Based Bayesian Binary Neural Networks With Spintronic Implementation
Ahmed, S. T., Danouchi, K., Münch, C., Prenat, G., Anghel, L., & Tahoori, M. B. (2023) · IEEE Journal on Emerging and Selected Topics in Circuits and Systems · doi:10.1109/jetcas.2023.3242146 · Cited by 25
CUDA: Convolution-Based Unlearnable Datasets
Sadasivan, V. S., Soltanolkotabi, M., & Feizi, S. (2023) · 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52729.2023.00376 · Cited by 24
Robust Vision-Based Cheat Detection in Competitive Gaming
Jonnalagadda, A., Frosio, I., Schneider, S., McGuire, M., & Kim, J. (2021) · Proceedings of the ACM on Computer Graphics and Interactive Techniques · doi:10.1145/3451259 · Cited by 23
DFGC 2021: A DeepFake Game Competition
Peng, B., Fan, H., Wang, W., Dong, J., Li, Y., Lyu, S., Li, Q., Sun, Z., Chen, H., Chen, B., et al. (2021) · 2021 IEEE International Joint Conference on Biometrics (IJCB) · doi:10.1109/ijcb52358.2021.9484387 · Cited by 23
Kumar, S. S., Cummings, M. L., & Stimpson, A. (2024) · 2024 IEEE 4th International Conference on Human-Machine Systems (ICHMS) · doi:10.1109/ichms59971.2024.10555871 · Cited by 21
Open-world continual learning: Unifying novelty detection and continual learning
Kim, G., Xiao, C., Konishi, T., Ke, Z., & Liu, B. (2025) · Artificial Intelligence · doi:10.1016/j.artint.2024.104237 · Cited by 19
Data Augmented Flatness-aware Gradient Projection for Continual Learning
Yang, E., Shen, L., Wang, Z., Liu, S., Guo, G., & Wang, X. (2023) · 2023 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00518 · Cited by 18
Complex-valued neural networks for voice anti-spoofing
Müller, N. M., Sperl, P., & Böttinger, K. (2023) · INTERSPEECH 2023 · doi:10.21437/interspeech.2023-901 · Cited by 17
Is Multi-Modal Necessarily Better? Robustness Evaluation of Multi-Modal Fake News Detection
Chen, J., Jia, C., Zheng, H., Chen, R., & Fu, C. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3249290 · Cited by 17
Investigating Vulnerability to Adversarial Examples on Multimodal Data Fusion in Deep Learning
Yu, Y., Lee, H. J., Kim, B. C., Kim, J. U., & Ro, Y. M. (2020) · arXiv · doi:10.48550/arxiv.2005.10987 · Cited by 15
DDoD: Dual Denial of Decision Attacks on Human-AI Teams
Tag, B., van Berkel, N., Verma, S., Zhao, B. Z. H., Berkovsky, S., Kaafar, D., Kostakos, V., & Ohrimenko, O. (2023) · IEEE Pervasive Computing · doi:10.1109/mprv.2022.3218773 · Cited by 15
Mitigating Adversarial Attacks in Federated Learning with Trusted Execution Environments
Queyrut, S., Schiavoni, V., & Felber, P. (2023) · 2023 IEEE 43rd International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs57875.2023.00069 · Cited by 18
Rationale Discovery and Explainable AI
Steging, C., Renooij, S., & Verheij, B. (2021) · Frontiers in Artificial Intelligence and Applications · doi:10.3233/faia210341 · Cited by 14
Prabhudesai, S., Wang, N. C., Ahluwalia, V., Huan, X., Bapuraj, J. R., Banovic, N., & Rao, A. (2021) · Frontiers in Neuroscience · doi:10.3389/fnins.2021.740353 · Cited by 13
Barriers to Artificial Intelligence Adoption in Healthcare Management: A Systematic Review
Assadullah, M. M. (2019) · SSRN Electronic Journal · doi:10.2139/ssrn.3530598 · Cited by 13
Exploring the Robustness of In-Context Learning with Noisy Labels
Cheng, C., Yu, X., Wen, H., Sun, J., Yue, G., Zhang, Y., & Wei, Z. (2025) · ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) · doi:10.1109/icassp49660.2025.10889281 · Cited by 11
DEEPFAKER: A Unified Evaluation Platform for Facial Deepfake and Detection Models
Wang, L., Meng, X., Li, D., Zhang, X., Ji, S., & Guo, S. (2024) · ACM Transactions on Privacy and Security · doi:10.1145/3634914 · Cited by 11
A Synergetic Attack against Neural Network Classifiers combining Backdoor and Adversarial Examples
Liu, G., Khalil, I., Khreishah, A., & Phan, N. (2021) · 2021 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata52589.2021.9671964 · Cited by 11
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13
Interpretable AI/ML for High-stakes Tasks with Human-in-the-loop: Critical Review and Future Trends
Kovalerchuk, B. (2024) · doi:10.21203/rs.3.rs-3989807/v1 · Cited by 9
Sometimes We Want Ungrammatical Translations
Parthasarathi, P., Sinha, K., Pineau, J., & Williams, A. (2021) · Findings of the Association for Computational Linguistics: EMNLP 2021 · doi:10.18653/v1/2021.findings-emnlp.275 · Cited by 9
Visual information processing through the interplay between fine and coarse signal pathways
Zou, X., Ji, Z., Zhang, T., Huang, T., & Wu, S. (2023) · Neural Networks · doi:10.1016/j.neunet.2023.07.048 · Cited by 9
Detecting Scene-Plausible Perceptible Backdoors in Trained DNNs Without Access to the Training Set
Xiang, Z., Miller, D. J., Wang, H., & Kesidis, G. (2021) · Neural Computation · doi:10.1162/neco_a_01376 · Cited by 8
Robustness of generative AI detection: adversarial attacks on black-box neural text detectors
Fishchuk, V., & Braun, D. (2024) · International Journal of Speech Technology · doi:10.1007/s10772-024-10144-2 · Cited by 7
Mitigating Black-Box Adversarial Attacks via Output Noise Perturbation
Aithal, M. B., & Li, X. (2022) · IEEE Access · doi:10.1109/access.2022.3146198 · Cited by 7
Jain, S., Cretu, A.-M., & de Montjoye, Y.-A. (2021) · arXiv · doi:10.48550/arxiv.2106.09820 · Cited by 21
Revisiting Flatness-Aware Optimization in Continual Learning With Orthogonal Gradient Projection
Yang, E., Shen, L., Wang, Z., Liu, S., Guo, G., Wang, X., & Tao, D. (2025) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2025.3539019 · Cited by 5
Boundary-aware Dual Biaffine Model for Sequential Sentence Classification in Biomedical Documents.
Duan, J., Guo, H., Jiang, H., Guo, F., & Wang, J. (2024) · IEEE/ACM Transactions on Computational Biology and Bioinformatics · doi:10.1109/tcbb.2024.3376566 · Cited by 2
The Illusion of Readiness in Health AI
Gu, Y., Fu, J., Liu, X., Valanarasu, J. M. J., Codella, N. C., Tan, R., Liu, Q., Jin, Y., Zhang, S., Wang, J., et al. (2025) · arXiv · doi:10.48550/arxiv.2509.18234 · Cited by 1
Dissecting Adversarial Robustness of Multimodal LM Agents
Wu, C. H., Shah, R., Koh, J. Y., Salakhutdinov, R., Fried, D., & Raghunathan, A. (2024) · arXiv · doi:10.48550/arxiv.2406.12814 · Cited by 1
Demonstration Attack against In-Context Learning for Code Intelligence
Ge, Y., Sun, W., Lou, Y., Fang, C., Zhang, Y., Li, Y., Zhang, X., Liu, Y., Zhao, Z., & Chen, Z. (2024) · arXiv · doi:10.48550/arxiv.2410.02841
“Since the foundational work by Goodfellow et al. [15], the vulnerability of neural networks to such attacks has been extensively researched.”
BackgroundInvestigating the Impact of Environmental Factors on Autonomous Vehicle Sensors
Csikor, D., Hollósi, J., & Szauter, F. (2025) · SMTS 2025 · doi:10.3390/engproc2025113015
Beyond Statistical Learning: Exact Learning Is Essential for General Intelligence
György, A., Lattimore, T., Lazić, N., & Szepesvári, C. (2025) · arXiv · doi:10.48550/arxiv.2506.23908
Jiang, N., Sun, B., Kim, N., Sim, T., & Han, J. (2026) · 2026 IEEE Symposium on Security and Privacy Workshops (SPW) · doi:10.1109/spw72489.2026.00029
Supervised Contrastive Learning
Khosla, P., Teterwak, P., Wang, C., Sarna, A., Tian, Y., Isola, P., Maschinot, A., Liu, C., & Krishnan, D. (2020) · arXiv · doi:10.48550/arxiv.2004.11362 · Cited by 3,569
A Closer Look at Memorization in Deep Networks
Arpit, D., Jastrzębski, S., Ballas, N., Krueger, D., Bengio, E., Kanwal, M. S., Maharaj, T., Fischer, A., Courville, A., Bengio, Y., et al. (2017) · arXiv · doi:10.48550/arxiv.1706.05394 · Cited by 1,307
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061
Qualitatively characterizing neural network optimization problems
Goodfellow, I. J., Vinyals, O., & Saxe, A. M. (2014) · arXiv · doi:10.48550/arxiv.1412.6544 · Cited by 341
Self-citationFeature relevance quantification in explainable AI: A causal problem
Janzing, D., Minorics, L., & Blöbaum, P. (2019) · arXiv · doi:10.48550/arxiv.1910.13413 · Cited by 207
Reward learning from human preferences and demonstrations in Atari
Ibarz, B., Leike, J., Pohlen, T., Irving, G., Legg, S., & Amodei, D. (2018) · arXiv · doi:10.48550/arxiv.1811.06521 · Cited by 117
Universal and Transferable Adversarial Attacks on Aligned Language Models
Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., & Fredrikson, M. (2023) · arXiv · doi:10.48550/arxiv.2307.15043 · Cited by 197
Metadata
- Authors
- Goodfellow, I. J., Shlens, J., & Szegedy, C.
- Affiliations
- Google (United States) (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2014
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1412.6572
- OpenAlex
- W1945616565
- Cited by
- 10,381
- References
- 14
- Citations by year
- 2026: 66 · 2025: 843 · 2024: 1806 · 2023: 1966 · 2022: 1649 · 2021: 1599 · 2020: 1112 · 2019: 767 · 2018: 383 · 2017: 124 · 2016: 43 · 2015: 15 · 2014: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- International Conference on Learning Representations
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- adversarial examples, adversarial perturbations, neural network vulnerabilities, linearization, adversarial training, MNIST, robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
